Device Group rules and limits

Keep the following rules and limitations in mind when using Device Groups.

• SCIM Admin SSO makes System Users read-only. When SCIM-based Admin SSO is enabled, you can't manually create, invite, or edit System Users in the web console. The System Users page displays synced users who can access the web console, along with their mapped role and Device Group.
• SCIM-managed assignments take precedence. For administrators managed through SCIM Admin SSO, role and Device Group assignments are controlled through Group Mapping rather than manual assignment. Changes to group membership are applied according to the applicable Group Mapping rule when the user next signs in.
• Device Groups apply only to Print Administrators. You can assign a Device Group only to a user with the Print Administrator role. To limit an administrator to a specific set of printers, assign the Print Administrator role and a Device Group.
• Multiple restrictions are combined. If a Device Group has multiple restrictions, a printer must match all restrictions to be included. For example, restrictions for both manufacturer and location include only printers from that manufacturer within the selected location.
• Device Groups don't grant permissions. The user's role determines what they can do, while the Device Group determines which printers they can view and manage.
• A Device Group with no valid restrictions doesn't filter printers. If all restrictions resolve to no valid values, no filtering is applied and the assigned administrator can see the full printer fleet.