Secure Print settings

The Secure Print Settings section of Secure > Settings controls how users release jobs, where jobs are stored and how they reach printers, how jobs are encrypted, and how long they're kept. For the other sections of the page, see Web console settings.

User workflows

Choose the ways users can release their jobs.

Workflow	How users release jobs
QR Release	Users release jobs at any Secure Print printer by scanning a QR code with their mobile device.
Printer Sign In	Users sign in at the printer to release jobs, with either: Card Readers: they tap their card. Keyboard Sign In: they enter their registered email address and PIN, or their username and password.
External Hardware	Users release jobs with a card reader on an SR25 or Ethernet 241 device attached to the back of the printer. Available only with an SR25 or Ethernet 241 hardware license.

Workflow

How users release jobs

QR Release

Users release jobs at any Secure Print printer by scanning a QR code with their mobile device.

Printer Sign In

Users sign in at the printer to release jobs, with either:

Card Readers: they tap their card.
Keyboard Sign In: they enter their registered email address and PIN, or their username and password.

External Hardware

Users release jobs with a card reader on an SR25 or Ethernet 241 device attached to the back of the printer. Available only with an SR25 or Ethernet 241 hardware license.

NoteNot every printer supports every workflow. For example, a printer may support QR Release but not Printer Sign In.

Cloud Connector (HP and Ricoh only)

Turns the Cloud Connector on or off. Secure Print can secure printers through either connector:

Local Connector (Secure Print Service): a Windows service in your network, installed with Device Scout. It secures printers and lets them release secure jobs. For organizations that prefer not to use a cloud service to secure printers.
Cloud Connector: hosted in HP Insights. It runs the services behind the Secure Print app on the printer, such as signing users in, showing their jobs and receiving job accounting data. Printers secured against it with the Device Discovery and Deployment Utility (DDU) become cloud-connected, so you don't need a Local Connector or a direct network route to the printers. It works in internet-only (zero trust) networks, so you can do without print servers, print drivers and queue management.

Setting	What happens
On	You can secure printers against the Cloud Connector with the DDU.
Off	Printers can't be secured against the Cloud Connector. Use the Local Connector instead.

See Configuring Cloud-Connected Devices.

Document handling

Choose where jobs are stored and how they reach printers.

Setting	What it does
Cloud Storage	Where jobs sent from a computer through Print Scout are stored: Off (default): jobs are encrypted and stored only on the user's computer, which must be online for the user to release them. On: jobs are encrypted and stored on the user's computer and in the cloud, so users can release them when their computer isn't available. Useful for people who move around. Needs a Cloud: Backup license. Jobs submitted from a mobile device are always stored in the cloud, even when Cloud Storage is off. See Mobile Submission below.
Force delivery via print servers	Sends every job through a Print Scout in print server mode instead of the user's computer. Every job is stored in, and released from, the cloud. Use it when printers are on a different VLAN from users' computers, so the computers can't reach the printers. Needs Cloud Storage turned on, and Print Scout installed in print server mode. See Installing Print Scout in Print Server Mode.
Restrict Print Scout Release	The user's own Print Scout releases their jobs. If it isn't online, a Print Scout in print server mode downloads the job from the cloud and sends it to the printer. Jobs are never released through another user's Print Scout, which keeps each user's data on their own computer or a server you control. Needs Cloud Storage turned on, and Print Scout installed in print server mode so jobs can still be released when users' computers are offline.
Cloud Release (HP and Ricoh only)	Printers pull jobs straight from cloud storage. Also called pull print. Needs the Cloud Connector and Cloud Storage. On: Cloud Release is on in every device profile, and each device profile shows a setting to change it for that profile. See Device Profiles. Off: Cloud Release is off for all printers, and the setting is hidden from device profiles. With Cloud Release, Print Scout isn't involved in releasing jobs, so the IPP print driver may not work well. Use the HP Universal Print Driver (UPD) instead. See Cloud Release.
Mobile Submission	Lets users send jobs from their mobile device with the HP Secure Print mobile app, from the App Store or Google Play. Off by default. See Mobile Submission. Jobs sent this way are always encrypted and stored in the cloud, whatever the Cloud Storage setting. To release them with QR Release, a Print Scout must be online to get the job from the cloud and send it to the printer: the user's own, or the print server's if Force delivery via print servers is on.

ImportantDon't turn on Force delivery via print servers and Restrict Print Scout Release at the same time. They can't be used together.

Advanced encryption

Choose whether zero knowledge encryption (ZKE) is applied to job names, and see whether it's applied to job content. These settings affect jobs sent through Print Scout only.

Setting	What it does
Print Job Name	On: job names are encrypted, so they look scrambled in the User Portal and mobile app. Off: job names appear as readable text. For example, when the Cloud Connector is off, encrypted job names make it hard for users to find their jobs in the User Portal, the mobile app or on cloud-connected printers, so you might turn this off.
Print Job Content	Read-only. Shows whether job content is encrypted with ZKE on the user's computer before it's uploaded to cloud storage. Either way, jobs in cloud storage are encrypted at rest with AES-256 server-side encryption. If you use Enterprise Key Management, they're also encrypted with your own AWS KMS key before they're stored, as a separate layer. On when the Cloud Connector is off, or when it's on but Cloud Release is off. You can't turn it off. Off when Cloud Release is on.

Setting

What it does

Print Job Name

On: job names are encrypted, so they look scrambled in the User Portal and mobile app.
Off: job names appear as readable text.

For example, when the Cloud Connector is off, encrypted job names make it hard for users to find their jobs in the User Portal, the mobile app or on cloud-connected printers, so you might turn this off.

Print Job Content

Read-only. Shows whether job content is encrypted with ZKE on the user's computer before it's uploaded to cloud storage. Either way, jobs in cloud storage are encrypted at rest with AES-256 server-side encryption. If you use Enterprise Key Management, they're also encrypted with your own AWS KMS key before they're stored, as a separate layer.

On when the Cloud Connector is off, or when it's on but Cloud Release is off. You can't turn it off.
Off when Cloud Release is on.

Mobile deployment (iOS only)

Allow manual profile installation controls whether users can install the iOS configuration profile themselves.

On (default): users install the profile on their iOS devices themselves, so they can start printing even without a mobile device management (MDM) system.
Off: users can't install it themselves. Download the profile and push it to devices with an MDM system, such as Microsoft Intune, MobileIron or AirWatch. The download button appears after you select Save. See Downloading the iOS Configuration Profile for use with MDM and Deploying the iOS Configuration Profile with Microsoft Intune.

Purge jobs after

Sets how long an unreleased job is kept before it's deleted automatically. You set the time in days and hours, from 1 hour up to 7 days. The default is 2 days (48 hours), so a job that nobody releases within 2 days is deleted.

Lock the Settings page

You can lock Secure > Settings so only System Administrators can change it. You need the Site Encryption Key to lock or unlock it. If the page is locked, generating a SCIM token fails with an error naming the page. See Lock the Settings page.