How identity and authentication work in HP Insights

HP Insights has two separate identity contexts: one for the people who administer it, and one for the people who print. They're configured independently, and mixing them up is the most common source of confusion during setup. This page explains both, how authentication flows through the print pipeline, and what you'll need to decide before you configure anything.

Two identity contexts

The distinction matters because the two contexts serve different purposes and are configured in different places.

Context	Who it covers	What it controls	Where it's configured
System users	Admins and staff with HP Insights accounts who sign in to the web console.	Access to the management console: fleet, users, policy, reporting.	Account Settings > Single Sign-On Configuration (Legacy SSO) or Account Settings > Settings > Admin SSO — depends on your organization. See below.
Print users	Everyone who submits and releases print jobs.	Identity for print job attribution, release authentication, and policy enforcement.	Account Settings > Settings > User Authentication Providers

Setting up SSO for system users doesn't configure print user authentication, and vice versa. Both can be active at the same time, and they can use different identity providers if your organization needs that.

How print user authentication works

A print job in HP Insights goes through two distinct authentication steps. Administrators often focus on only one of these steps, but both are required to complete the printing workflow.

Step 1: Identity at the workstation

When a user submits a print job, Print Scout establishes who they are. This happens silently in the background for most authentication methods. The mechanism depends on which authentication provider is configured:

Credentials always stay with your identity provider. HP Insights receives an assertion of identity, not a password.

Step 2: Authentication at the printer

For secure release workflows, the user authenticates again when they walk up to the printer. This is what holds the job until the right person is standing there. It's separate from Step 1, and the methods available depend on how your printers are configured:

Method	How it works	What you need
Badge / proximity card	The user taps their card on a reader attached to the printer. The card is linked to their HP Insights identity during registration.	Card reader hardware on the printer.
QR code	The user opens the HP Secure Print mobile app and scans a QR code displayed on the printer screen or a label attached to the device.	Mobile app installed on the user's phone.
Passcode	A short code generated by Print Scout or the user portal. Useful as a fallback when a card is lost or unavailable.	Available for organizations using OIDC or SAML authentication.

Secure Print Direct does not include a hold-and-release step: jobs go straight to the printer when submitted. Identity is still established at the workstation, which is what links the job to a user in analytics and reporting.

Choosing an authentication provider

There's no universal right answer, but there's usually an obvious one once you know what you're working with.

If your organization uses...	Use this provider	Why
Microsoft Entra ID, Google, Okta, or another cloud IdP	OpenID Connect (OIDC)	Modern SSO with token-based authentication. MFA and conditional access policies from your IdP apply automatically.
A SAML 2.0-capable IdP and an existing SAML infrastructure	SAML	Works with any SAML 2.0-compliant identity provider. Credentials never pass through HP Insights.

System user authentication

By default, admins sign in to the HP Insights web console with credentials managed directly by HP Insights (internal accounts). Two SSO approaches exist, but they are mutually exclusive. Only one can be active for an organization at a time.

Legacy SSO

Configured under Account Settings > Single Sign-On Configuration. Supports Internal, SAML 2.0, and OpenID Connect. If your organization uses Legacy SSO, this tab is editable and the Admin SSO section is not visible.

Admin SSO

Configured under Account Settings > Settings > Admin SSO. This is the current approach. Unlike Legacy SSO, Admin SSO uses the Authentication Providers configuration: the same identity provider that authenticates print users can also be used for administrator sign-in, configured once. When Admin SSO is enabled for an organization, the Single Sign-On Configuration tab is still visible but shows "This feature is not applicable" — Legacy SSO cannot be configured.

System user accounts can be provisioned manually or via SCIM. If you use SCIM for print users, you can use the same SCIM integration to provision system users too.

User provisioning

Provisioning is how print user accounts get created and removed. There are two approaches.

Just-in-time provisioning

With OIDC and SAML, accounts are created automatically the first time a user submits a job. There's no pre-provisioning step. The user's identity comes from the authentication assertion, and HP Insights creates the account on first contact. This is how most deployments work.

SCIM sync

If you need accounts to exist before users print, or if you need deprovisioning to be immediate rather than passive, SCIM is the answer. Your identity provider pushes user records to HP Insights as they're created, modified, or deactivated. Disable someone in Entra ID and their HP Insights access is removed on the next sync. SCIM is supported for Secure Print Direct user provisioning with Entra ID, Okta, and Ping Identity. See Automatic user and group provisioning with SCIM.

What users don't have to manage

With OIDC or SAML, print users don't have a separate HP Insights password. They authenticate with whatever credentials they already use. If someone leaves and their account is disabled in your directory, their access to HP Insights is cut off at the same time. There's no second account to chase down.