Limit which printers administrators can manage
Configure Device Groups by defining which devices belong to each group, then assigning the group to administrators through the provided Print Administrator role or through SCIM group mapping. Use device attributes such as location, manufacturer, department, custom fields, or IPv4 address to set the group's scope, and verify that administrators can access only the devices they need to manage.
- Create a Device Group and define the devices it should include using one or more restrictions, such as location, manufacturer, department, custom printer field, or IPv4 address.
- Assign the role and Device Group to administrators, either directly or through group mapping.
- Verify access to confirm administrators can view and manage only the devices that match their assigned Device Groups.
Create a Device Group
Device Groups are created in Account Settings > Device Groups. They use restrictions to determine which devices belong to the group.
Open Account Settings and then select the Device Groups tab.
Select + Create.
Enter a descriptive Name for the group.
Optionally enter a Description to explain the group's purpose.
Add one or more Restrictions to define which devices are included. Available criteria shown in the interface include Printer Manufacturer, Printer Location, Department, Printer Custom 1–4, and Printer IPv4 Address. If you add more than one restriction, a printer must match all of them to be included.
Save the Device Group.
- At least one restriction is required. To create a Device Group, add at least one manufacturer, location, or attribute filter. The group cannot be saved until at least one restriction is configured.
- Printer Location values come from the locations defined in Secure Print Direct. To add or change locations, see Location-based Printing.
- Review Device Groups after making changes to the location hierarchy. If a Device Group references locations that have been removed, the location restriction is no longer applied until the Device Group is updated.
After the Device Group is saved, it becomes available for assignment to administrators with the Print Administrator role, either manually in System Users or through SCIM group mappings.
Assign a Device Group
There are two ways to assign a Device Group. Which one you use depends on whether SCIM-based Admin SSO is on:
- Admin SSO off: assign it manually on the administrator's record in System Users. See Option 1.
- Admin SSO on: assign it through Group Mapping, based on the administrator's identity provider group. See Option 2.
Both need the Print Administrator role. Device Groups can't be assigned to administrators with any other role.
Option 1: Assign Manually through System Users
Use this method when SCIM-based Admin SSO is off. When it's on, System Users is read-only, so use Option 2 instead.
Navigate to Users > System Users.
Create a new user or edit an existing user.
Set Role Name to Print Administrator. Device Groups are associated with the Print Administrator role, so the Device Access Group field only applies to users with this role.
In the Device Access Group field, select the Device Group to assign.
Save the user.
The Device Access Group field is required and defaults to Full Access, which applies no device restrictions. As a result, every system user is assigned a Device Access Group, even when device scoping is not required.
After the user is saved, the assigned Device Group determines which printers the user can view and manage. Users assigned Full Access can access all printers.
Option 2: Assign Through SCIM Group Mapping
When User and Group Sync and Admin SSO are enabled, Device Groups are assigned through Users > Group Mapping. In this configuration, group mappings determine a user's role and Device Group. When users sign in through SSO, HP Insights automatically applies the role and Device Group defined in the matching group mapping.
Device Group mapping through SCIM requires both User and Group Sync and Admin SSO to be configured under Account Settings > Settings.
- User and Group Sync provisions users and groups from your identity provider.
- Admin SSO applies the mapped role and Device Group when users sign in.
Prerequisites
Before you can configure SCIM Group Mapping, complete the following steps in order:
Configure Admin SSO
Under Account Settings > Settings > Admin SSO, complete the Admin SSO setup, including Authentication Providers, Friendly URL, User and Group Sync, and Group to Role Mapping.
Configure User and Group Sync (SCIM)
Generate a SCIM token and connect your identity provider. This option becomes available only after Admin SSO has been configured.
Create Group Mappings
Map directory groups to HP Insights roles and Device Groups.
Assign the Device Group
Go to Users > Group Mapping.
Select Create.
In the User Group field, select the user group to map.
In the User Role field, select the Print Administrator role.
In the Device Group field, select the Device Group to assign.
Select Apply.
Users in the mapped IdP group receive the assigned role and Device Group the next time they sign in through SSO.
Verify Access
After creating and assigning Device Groups, verify that administrators can view and manage only the printers included in their assigned Device Group. Confirm that users with Full Access can access the full fleet, and that SCIM-managed users receive the expected role and Device Group after signing in through SSO.