How Secure Scan works
Secure Scan lets users scan a document at a secured printer and send it straight to Microsoft 365 (OneDrive, SharePoint or email), a network folder or a fax. Because users sign in at the printer the same way they do to release print jobs, every scan is tied to a person, and the options they see come from the device profile the printer is assigned to.
What happens when someone scans
- The user signs in at a secured printer and selects Scan Document.
- They place the document in the feeder or on the glass and, if they need to, change the scan options.
- They choose a destination, such as Email, OneDrive, SharePoint or Network Folder, and start the scan.
- The printer shows Scan Request complete, or an error, and the document is sent to the destination.
Users only see Secure Scan on printers that are secured with a device profile that has Scan turned on. That profile is also where administrators choose the default scan options and which destinations users can pick from, so printers with different needs can use different profiles.
Where scans can go
| Destination | What happens |
|---|---|
| The scan is sent as an attachment to the signed-in user's email address, through Microsoft 365 or your SMTP server. If administrators allow it, users can change the To address, for example to send to someone else or to a fax number. | |
| OneDrive | The scan is saved to the user's own OneDrive, so only they can see it unless they share it. |
| SharePoint | The scan is saved to a SharePoint location the user has access to, which is useful for documents a team needs to share. |
| Fax | The scan is sent to a fax machine or fax service, usually through an email-to-fax gateway such as RightFax. |
| Network Folder | The scan is saved to a shared folder on your network, using the credentials you enter in the device profile. |
How Microsoft 365 access works
When users scan to OneDrive, SharePoint or Microsoft 365 email, Secure Scan connects to Microsoft 365 through the Microsoft Graph API. It uses delegated permissions, which means it acts on behalf of the user who is scanning and can reach only what that user can already access. Before this can work, two kinds of consent are needed:
- Admin consent: a Microsoft Entra ID administrator approves the HP Insights app for your whole organization. Depending on your organization's consent policy, some permissions can only be granted this way.
- User consent: the first time each user scans to a Microsoft 365 destination, they get an authorization email and must approve access to their own account before the scan can be delivered.
The order matters. An administrator should grant admin consent before anyone scans to a Microsoft 365 destination. If a user authorizes first, their authorization may not include every permission Secure Scan needs, and they'll have to authorize again once admin consent is in place. See Connect Secure Scan to Microsoft 365.
Network Folder and Fax don't go through Microsoft 365, so they don't need either kind of consent.
What happens to scanned documents
HP Insights doesn't retain copies of scanned documents. Documents are encrypted using TLS 1.2 while being transferred to their destination and are not stored at rest.
For reporting, HP Insights sends only information about the scan job to HP Insights, not the scanned document itself. This information is handled according to your organization's data privacy settings.