How Device Groups limit administrator access to printers

Overview

A Device Group controls which printers an administrator can view and manage in HP Insights. Instead of giving every administrator access to all printers in the organization, Device Groups allow administrative access to be limited to a specific set of printers based on defined criteria.

Device Groups use printer attributes as membership criteria. Printers that match the specified attribute values are automatically included in the Device Group. Supported attributes include:

Printer Manufacturer
Printer Location (the locations defined in Secure Print Direct)
Department
Printer IPv4 Address
Printer Custom 1
Printer Custom 2
Printer Custom 3
Printer Custom 4

NoteConfirm which attributes are available and enforced in your tenant before relying on them. A Device Group that resolves to no valid restrictions does not filter anything, so the assigned administrator sees the full fleet rather than no printers.

When a Device Group has more than one restriction, a printer must match all of them to be included. For example, a group restricted to the HP manufacturer and the Denver location includes only HP printers in Denver.

This feature allows organizations to organize printer administration in a way that matches their operational requirements. For example, organizations can create Device Groups based on geographic regions, printer manufacturers, or other printer classifications. Administrators are then assigned to the appropriate Device Group and can manage only the printers included in that group.

Important Notes

Device Groups control administrative access only. They do not affect which printers end users can see or print to.

How Device Groups Work

HP Insights uses two layers of administrative access control:

Roles determine what an administrator is allowed to do, such as manage printers, change settings, or view reports.
Device Groups determine which printers an administrator can see and manage.

A Device Group does not grant permissions on its own. Instead, it limits the scope of the permissions granted by a role. For example, an administrator with permission to manage printers can manage only the printers that belong to their assigned Device Group. In other words, roles control permissions, while Device Groups control scope.

To restrict printer administration to a specific set of printers, an administrator needs a role that grants the required administrative permissions, and a Device Group that defines which printers are within the administrator's scope.

Print Administrators can manage printers within their assigned Device Groups. The Print Administrator role determines the administrative actions available to the user, while Device Groups determine which printers they can access and manage.

The Print Administrator role doesn't have access to global configuration areas. Device Groups provide an additional layer of access control by limiting the printers the administrator can view and manage. Together, they allow customers to delegate printer administration without providing access to global configuration or the entire printer fleet.

The Print Administrator role is a standard role, available to assign in every account from version 4.6. You don’t create it yourself, and its permissions are fixed. Administrators can't create or customize roles, so to limit someone to a Device Group, give them the Print Administrator role. For the list, see Add administrators and assign roles.

ImportantDevice Groups can be assigned only to users with the Print Administrator role, whether on the System User record or in Users > Group Mapping. Other administrators keep Full Access.

Example Scenarios

Organizations can create Device Groups using different printer attributes to match their administrative requirements.

A healthcare organization creates Florida Device Group and North Carolina Device Group using the Printer Location attribute. Regional IT teams can manage only the printers in their assigned region.
A printer fleet team is assigned to an HP Printers Device Group based on the Printer Manufacturer attribute. Team members can manage HP printers across all locations without seeing printers from other manufacturers.
A university creates Student Labs Device Group and Faculty Offices Device Group using a Printer Custom attribute. IT staff responsible for student computing environments can manage lab printers, while another team manages faculty office printers.

Device Groups help organizations implement delegated administration by limiting administrators to the printers they are responsible for managing. This reduces the risk of unintended changes to printers outside an administrator's scope and supports least-privilege access practices.

FAQ

Are Device Groups and Access Groups the same thing?

Device Groups are the customer-facing feature for limiting which printers an administrator can view and manage. Access Groups are a separate HP Insights feature with different behavior and should not be used as another name for Device Groups. Some existing customers may still see the Access Groups tab, depending on their account configuration.

Does a Device Group replace a role?

No. A role defines what actions an administrator can perform. A Device Group limits which printers those actions apply to. Most delegated administration scenarios need both.

Can a Device Group be assigned to any role?

No. Device Groups can be assigned only to users with the Print Administrator role. To limit an administrator to a Device Group, assign them the Print Administrator role.