Universal Print printer provisioning

Overview

Microsoft Intune is the supported way to deploy Universal Print printers on managed Windows devices. The Intune Settings Catalog includes a dedicated Universal Print configuration that automates printer installation on enrolled devices.

This article explains how the Intune integration works on Windows and calls out its limitations. The information may be useful when configuring policies or troubleshooting installation issues. For step-by-step instructions on creating an Intune policy, see Create a Universal Print policy in Microsoft Intune.

How Universal Print provisioning works on Windows

When you deploy a Universal Print policy from Intune, several Windows components work together to install the printer on the device:

• Microsoft Intune authors the policy in the cloud and distributes it to enrolled devices through the Mobile Device Management (MDM) channel.
• The Windows MDM client on the device receives the policy and dispatches the relevant settings to the matching Configuration Service Provider (CSP).
• The Universal Print CSP is the Windows component that performs the actual printer installation. It invokes UPPrinterInstaller.exe to add the printer to the user's device.

+---------------------------------------------------------+
| Microsoft Intune (cloud)                                |
|   - Admin authors policy in Settings Catalog            |
|   - Intune distributes the policy to enrolled devices   |
+---------------------------+-----------------------------+
                            | policy via MDM channel
                            v
+---------------------------------------------------------+
| Windows MDM client on device                            |
|   - Receives the policy                                 |
|   - Dispatches to the Universal Print CSP               |
+---------------------------+-----------------------------+
                            | CSP node operations
                            v
+---------------------------------------------------------+
| Universal Print CSP                                     |
|   - Windows component                                   |
|   - The only piece that actually installs the printer   |
+---------------------------+-----------------------------+
                            | invokes
                            v
        UPPrinterInstaller.exe -> printer installed

When a printer doesn't appear on a device, knowing this layering helps you locate the failure point: was the policy assigned in Intune, did the device sync, did the CSP receive the settings, or did the installer fail? See the Universal Print troubleshooting guide for diagnostic steps.

Windows version requirement

Universal Print CSP is available on Windows 11 and on Windows 10 with the July 2022 cumulative update (KB5015807) or later.

Multi-user shared devices

The Universal Print Intune integration is designed for the standard single-user Windows model — one user per device — and for Azure Virtual Desktop (AVD), where each user session is treated as an independent single-user device.

Non-AVD shared Windows devices (where multiple users sign in to the same physical device) are not officially supported. The integration may appear to work in some configurations, but you should expect the following issues:

• Conditional Access (CA) and Multi-Factor Authentication (MFA) failures. Users on shared devices typically sign in with passwords rather than Windows Hello for Business (WHFB). When the Universal Print CSP attempts to install printers for a signed-in user, the operation silently fails if your tenant's Conditional Access policies require MFA, because the password-based session token doesn't satisfy the MFA claim.
• Delayed or partial installation. Intune policy sync can take several hours to reach a device, so printer installation on a shared device can appear delayed or only partially complete. User switching while a sync or install is in progress may compound this and leave printers in an inconsistent state.

For deployments that require multiple users to share a Windows device, use Azure Virtual Desktop instead.

Upgrade behavior: Windows 10 to Windows 11

• Universal Print printers installed on Windows 10 are visible to all users of that device, even if the specific user account does not have permission to access the print queue.
• In Windows 11, the behavior was enhanced so Universal Print printers are installed and visible only to the user account that installed the print queue.
• When you upgrade a Windows 10 device that has existing Universal Print printers to Windows 11, those print queues remain visible to all users on the device.

Related articles

• Create a Universal Print policy in Microsoft Intune
• Universal Print CSP in Windows
• Universal Print troubleshooting guide
• Blog: Universal Print settings available in Microsoft Endpoint Manager
• Previous provisioning tool, now deprecated.