User Authentication Providers

User Authentication Providers define how HP Insights verifies the identity of print users. The configured provider determines how users sign in to HP Insights and how their identities are established across supported printing workflows and applications.

For an overview of how identities are authenticated and managed in HP Insights, see How Identity and Authentication Work in HP Insights.

Choosing an Authentication Provider

For new deployments, HP Insights offers two authentication providers: OpenID Connect and SAML. Active Directory and Internal are also supported, but only for organizations that were already configured with them before July 2026 — see Legacy Authentication Providers below. Many HP Insights features require either OpenID Connect or SAML. If you configure Active Directory or Internal authentication, you lose access to those features, which can be frustrating if you discover later that something you want isn't available.

Active Directory and Internal are hidden by default for new tenants because we intentionally guide you toward OpenID Connect or SAML, so you can take full advantage of everything HP Insights has to offer. It's less about restricting choice and more about steering you toward the configuration that gives you the best experience from the start.

If your organization requires Active Directory or Internal authentication, those options are still available. However, we recommend using OpenID Connect or SAML whenever possible to ensure access to the widest range of HP Insights capabilities.

Feature Availability by Authentication Provider

The tables below show which HP Insights features are available with each authentication provider, grouped by category. Certain features rely on capabilities available only through OpenID Connect integrations and are therefore unavailable when using SAML, Active Directory, or Internal authentication.

Identity & User Lifecycle

Feature	OpenID Connect	SAML	Active Directory	Internal
SCIM Provisioning	✓	✓	✗	✗
Group Mapping	✓	✓	✗	✗
Auto-Provisioning	✓	✓	✗	✗
Role Assignment	✓	✓	✗	✗

Authentication & Sign-In

Feature	OpenID Connect	SAML	Active Directory	Internal
Admin SSO	✓	✓	✗	✗
Mobile App	✓	✓	✗	✗
User Portal	✓	✓	✗	✗
QR Sign-In	✓	✓	✗	✗
Passcode Sign-In and Release	✓	✓	✗	✗

Advanced Features

Feature	OpenID Connect	SAML	Active Directory	Internal
Guest Print	✓	✓	✗	✗
Quota Management	✓	✓	✗	✗
Copy Accounting	✓	✓	✗	✗
Cloud Connector	✓	✓	✗	✗
External Card Integration	✓	✓	✗	✗
Chrome Direct Print	✓	✓	✗	✗

Authentication Provider Availability

Authentication Provider	Recommended for New Deployments	Supports Modern Identity and User Management Features
OpenID Connect	Yes	Yes
SAML	Yes	Yes
Active Directory	Legacy/Specific Scenarios	Limited
Internal	Legacy/Specific Scenarios	Limited

Note: For both OpenID Connect and SAML, users register through the HP Secure Print desktop app and receive a system-generated passcode that can be used for Secure Print authentication.

OpenID Connect

OpenID Connect (OIDC) allows users to authenticate with an external identity provider such as Microsoft Entra ID, Google, Okta, or PingFederate using Single Sign-On (SSO).

Users register through the desktop app, and the email address returned in the ID token becomes their print identity. This identity is used throughout HP Insights workflows to associate user activity and print jobs.

OpenID Connect is well suited to organizations that use a modern cloud identity provider and want to provide a seamless SSO experience.

See OpenID Connect (OIDC) and Configure OpenID Connect Authentication for more information.

SAML 2.0

SAML 2.0 allows users to authenticate with their organization's identity provider, such as Microsoft Entra ID or Okta, instead of using credentials managed by HP Insights.

HP Insights acts as the Service Provider and uses the email address provided in the SAML assertion as the user's print identity.

Authentication policies remain enforced by your identity provider. Any MFA requirements, Conditional Access policies, or other sign-in restrictions configured in your identity provider continue to be enforced when users authenticate through SAML.

See SAML in HP Insights and Configure SAML Authentication for Print Users for more information.

Legacy Authentication Providers

For more information, see Legacy Authentication.

Where the Authentication Provider Applies

The configured authentication provider is the organization's source of user identity and applies across supported HP Insights services. Although the sign-in experience may differ depending on the workflow or client, all supported services use the same configured authentication provider.

This applies across both supported print workflows:

• Secure Print
• Secure Print Direct

And across every client where users establish their identity:

• Print Scout (workstation)
• User Portal (browser)
• HP Secure Print mobile app (mobile)

Relationship to Administrator Single Sign-On (SSO)

User Authentication Providers are used to authenticate print users. Administrator authentication is configured separately through Admin SSO under Account Settings > Settings > Admin SSO.

Organizations can configure administrators to sign in using the same identity provider that is used for print users, but Admin SSO is managed independently of User Authentication Providers.

For more information, see Configure SSO for System User Login.

Claim Mapping

Claim Mapping controls how claims provided by an identity provider are mapped to the user attributes required by HP Insights.

The default mappings work for most identity providers. Claim Mapping is typically required only when an identity provider uses non-standard claim names. For example, an identity provider might send the user's email address in a claim named mail instead of email, or use upn as the primary identifier.

Claim Mapping is available for both OpenID Connect and SAML through the Advanced option. This option becomes available after a valid authentication provider configuration has been saved.

See Claim Mapping for details and examples.