Managing Business Printers on Entra-Joined PCs Without a Domain Controller

The short recommendation, and when it holds

For a UK small business running Entra-joined Windows devices, our recommendation is Universal Print with the printers pushed to users by Intune. It is Microsoft's cloud print service, it runs entirely in Azure, and Microsoft states that with Universal Print-compatible printers it needs no on-premises infrastructure. The printer list lives in one place, Intune installs the printers for people and nobody has to hunt for a UNC path.

That holds under a few conditions. If any of them fail, use the decision path further down. This article covers the choice and a sensible rollout pattern. It does not cover secure-release printing, print accounting or a full Intune build.

• Your users and the admins who manage printing hold a licence that includes Universal Print (see the cost section).
• Your PCs run Windows 11, or Windows 10 21H2 or later, which is what Microsoft lists for Intune-deployed Universal Print printers. Windows Server is not supported as a printing client.
• Your printers are Universal Print-ready, or you are willing to host a connector on one always-on Windows machine for the ones that are not.
• Your printers and PCs can reach Microsoft's Universal Print endpoints over the internet. Printing no longer depends on being on the office network.

Why the domain-era approach stops fitting

The traditional pattern was a Windows print server, a shared queue per printer and a Group Policy that mapped the queues to users. An Entra-joined PC has no domain Group Policy to receive that mapping. The print server also still holds the drivers, and Windows has been tightening how drivers get from a server onto a client. Since the August 2021 updates, Point and Print (the mechanism that copies a driver from a print server to a PC when someone connects) requires administrator rights to install or update drivers by default. Microsoft says to keep that setting on, and describes no equivalent combination of other mitigations.

None of that makes a print server impossible. It means you are keeping a server, its drivers and a driver-delivery workaround alive purely to feed cloud-managed laptops. That is the part worth questioning.

The four options compared

These are the realistic ways to give Entra-joined PCs a managed set of printers. We have kept to what Microsoft documents. Manufacturer and partner pricing varies by contract, so we have not quoted any.

• Universal Print plus an Intune policy. Central: yes, printers are registered and shared in the Universal Print portal and installed by an Intune settings catalog policy (Printer Provisioning). Drivers: none on the PC for Universal Print-ready printers. Connector-hosted printers use their driver on the connector machine instead. Cost: included entitlement on some licences, with a monthly job allowance (see below). Reliability: Microsoft-hosted service, but it has documented known issues and printers must stay reachable and shared. Infrastructure: none for Universal Print-ready printers, one Windows machine for a connector.
• Manufacturer or partner cloud print. Several printer makers ship Universal Print-ready firmware, and Microsoft's partner page also lists cloud print-management products (PaperCut, Printix, Y Soft, Xerox Workplace Cloud and others) that extend Universal Print with features such as pull printing and accounting. Treat these as add-ons to a Universal Print base or as separate subscriptions, and check each one's licensing, supported printer models and Entra-joined behaviour directly with the supplier. We have not verified any individual product's claims.
• Direct-IP printers with packaged drivers. You package the vendor driver and a script that adds the printer, and deploy it from Intune as an app. Intune's printer provisioning policy is built on the Universal Print CSP, so it does not do this for you. That means you own the packaging, the testing against every Windows update and the clean-up when a driver changes. It works, and it is the route where driver breakage bites hardest.
• A traditional print server. Central queues and a familiar admin console, but you keep a server and its drivers, your PCs need a network path to it, and driver installation on clients is subject to the Point and Print restriction above. We could not find Microsoft guidance describing seamless sign-in from a cloud-only Entra-joined PC to a domain-based print server, so test that explicitly before committing. It makes most sense when you already have a hybrid estate and other reasons to keep the server.

Licensing and cost for the Universal Print route

Both end users and the admins who manage printing need an eligible licence. For commercial tenants Microsoft lists Microsoft 365 E3, E5 and F3, Windows 10/11 Enterprise E3 and E5, Microsoft 365 Business Premium and standalone Universal Print. Other Microsoft 365 plans are not on that list, so check before assuming you are covered.

Usage is measured in print jobs, not pages or printers. A job is one document regardless of pages or copies, and it counts once it is delivered to the printer. Each licence adds to a shared monthly pool for the whole tenant: Microsoft 365 E3, E5 and Business Premium add 100 jobs per licence, while F3, Windows Enterprise E3 and E5 and standalone licences add 5. Nobody is capped individually, the pool refreshes monthly, and usage is visible in the Universal Print portal's Usage and Reports page.

If you exceed the pool, users can keep printing and the IT admin of record is alerted. To stay compliant you then buy extra volume. Microsoft's page lists add-ons of 500 jobs for $25 a month and 10,000 jobs for $300 a month, billed monthly with an annual commitment. Those are US dollar figures and Microsoft notes prices can change, so get a UK quote before budgeting. A 20-person Business Premium tenant would have a pool of 2,000 jobs a month on that arithmetic, which is plenty for many offices and not enough for a busy one.

You also need Intune for the deployment policy. Most Business Premium customers already have it, but check your own plan.

Why Windows updates keep breaking printing

'A Windows update broke printing' tends to mean one of three different things, and they need different fixes.

First, a driver written for an older Windows build misbehaves after the operating system changes underneath it. Third-party print drivers are code that runs inside Windows' print machinery, so they are exposed to OS changes in a way that a standard protocol is not. Second, Windows Update or a vendor installer changes which driver a printer uses. Microsoft's published plan says that from 1 July 2026 Windows driver ranking always prefers its own IPP inbox class driver, which means a newly installed printer can end up on a different driver from the same model installed last year. That is our reading of the ranking change rather than a Microsoft statement, but it is a plausible source of PCs that behave differently from each other. Third, security hardening such as the Point and Print default described earlier changes who may install a driver.

Microsoft's timeline for third-party drivers is worth knowing. From 15 January 2026, new printer drivers for Windows 11 and Windows Server 2025 and later are no longer published to Windows Update, with existing ones updated case by case. From 1 July 2027, apart from security fixes, third-party driver updates will no longer be allowed. Existing drivers can still be installed, including through manufacturer installation packages, and Microsoft says there are no plans to disable print features of the legacy driver platform. In short, nothing is being switched off, but vendor drivers are on a slow road to maintenance mode.

Universal Print does not make you immune. Microsoft's own known-issues page documents a regression in Windows 11 KB5083769 and later that can stop Universal Print printers that were originally installed on Windows 10 from working, with a published detection and repair script. The practical lesson is to test updates on a pilot ring before the whole company gets them, whichever printing route you use.

Removing drivers from the equation with Windows protected print mode

Windows protected print mode is Windows' stricter setting that uses only the built-in Windows Ready Print (IPP class driver) stack. Microsoft says it prevents installation of third-party drivers, is designed for Mopria-certified printers (Mopria being the industry standard that lets printers speak IPP without vendor drivers) and removes the need to keep drivers up to date. It also states that Print Support Apps from manufacturers can still provide differentiating features.

This is a genuinely disruptive change, so treat it as one. When it is enabled, printers using third-party drivers are uninstalled and their drivers deleted from the driver store. Mopria-certified printers can be reinstalled and will use Windows Ready Print. Software printers such as the XPS writer and fax are removed, and Microsoft notes that some scanners may be unavailable. If it is set by policy, users cannot turn it off themselves. To roll back, remove the policy assignment, and then reinstall any affected printers. Microsoft says the original driver is restored when a printer is reinstalled with the mode off.

Check printers against the Mopria certified products list before you begin, and pilot with a small group that includes the awkward devices. We would also keep any machine that hosts a Universal Print connector out of scope unless you have tested it, since connector-hosted printers use drivers on that machine. That last point is our caution, not documented Microsoft guidance.

For Intune, Microsoft's enterprise guidance gives a custom profile (Devices, Configuration, Create, Windows 10 and later, Templates, Custom) using this OMA-URI setting. OMA-URI is the path Intune uses to reach a specific Windows configuration setting. Microsoft's Group Policy equivalent is Configure Windows protected print under Computer Configuration, Administrative Templates, Printers.

OMA-URI: ./Device/Vendor/MSFT/Policy/Config/Printers/ConfigureWindowsProtectedPrint
Data type: String
Value: <enabled/>

A decision path

Work down this list and stop at the first row that fits. It is our judgement, built on the Microsoft constraints above.

• Do you already hold a Universal Print-eligible licence and run Windows 11 or recent Windows 10? If not, a licence cost enters the picture, so compare it with the cost of keeping a print server alive.
• Are your printers on Microsoft's Universal Print-ready list, or Mopria-certified and modern enough to be reached through a connector? Then Universal Print. Prefer native registration, because Microsoft says Universal Print-ready printers give the best performance and management experience compared with the connector.
• Do you need pull printing, accounting or follow-me release across many devices? Look at a partner product on top of Universal Print, and ask the supplier how it behaves on Entra-joined PCs.
• Do you have printers that need vendor driver features (certain finishing or proprietary job options) and cannot be replaced? Use packaged drivers for those devices only, keep their users in a pilot ring for updates, and expect to maintain them.
• Do you have a hybrid estate, a print server you must keep for other reasons and a reliable network path? Keeping the server is reasonable, but test Entra-joined sign-in and driver installation first.
• Are you buying new printers? Choose Mopria-certified, Universal Print-ready models and the problem mostly goes away.

Piloting Universal Print with an Intune policy

Start with one office printer and a handful of users. Intune policy delivery is not instant, so allow time for the pilot devices to check in before concluding anything has failed. These steps need Universal Print administration rights, the Policy and Profile Manager role in Intune and a Universal Print licence for the admin and pilot users.

The policy needs three values per printer from the Universal Print portal: the Cloud Device ID, the Printer Shared ID and the Printer Shared Name. In some cases the printer ID and shared ID get swapped, and the printer is then not discovered, so enter them carefully.

1. Confirm the printer is Universal Print-ready using Microsoft's printer list. If it is not, install a connector on an always-on Windows machine and register the printer through that instead.
2. Register the printer with Universal Print, following the printer maker's instructions for ready printers or the connector's registration steps.
3. In the Universal Print portal, share the printer with your pilot group. Registering creates the queue, but users cannot see it until it is shared.
4. Copy the printer's Cloud Device ID, Printer Shared ID and Printer Shared Name from the portal.
5. In the Microsoft Intune admin center, go to Devices, Manage devices, Configuration, Create, New policy. Choose Windows 10 and later as the platform and Settings catalog as the profile type.
6. Under Configuration settings, select Add settings, choose Printer Provisioning, then set Action to Install and enter the three printer values. Use Add for further printers.
7. Assign the profile to your pilot user group. If the group lacks permission to the printers, Intune warns you and grants the permission itself.
8. On a pilot PC, open Settings, then Bluetooth & devices, then Printers & scanners. The printer should appear once the policy has applied. Print a test page, then check the profile status in Intune.

Limits to plan around and how to check reliability

Microsoft documents several behaviours that surprise people, and it is better to know them before the rollout than after it. Printer defaults changed in the portal may not reach users until they remove and re-add the printer. Windows defaults to one copy regardless of the portal default. The portal's Last Seen time can be wrong for idle printers, so do not treat it as a health monitor. Some stapling and hole-punch combinations print in the wrong place, and printers on shared PCs and virtual desktops behave less cleanly on Windows 10 than on Windows 11. Several of these are marked as fixed in Windows 11, which is another reason to get off Windows 10.

If you remove or unshare a printer, or remove users' permissions, the Intune policy fails to install it, so changes to printers should be coordinated with the policy. Intune reports show whether the profile applied, failed or conflicted. Microsoft also notes error 0x8007007f usually indicates an unsupported Windows version, and the Application event log can contain Universal Print errors.

Judge success on four simple things: pilot users see only the printers they should, a test page prints, the Intune profile reports success, and the next monthly Windows update does not break any of it. Only then widen the group.