Explanation Understanding-oriented: concepts and design decisions

Secure Print Direct Overview

Secure Print Direct is a cloud-managed print solution that delivers jobs directly to the printer when submitted, with no authentication required at the device. It replaces traditional print server infrastructure with a centrally managed platform that handles driver deployment, queue configuration, and printer discovery automatically.

Why use Secure Print Direct

Eliminate print servers — remove on-premises print servers and the IT burden of managing them. The cloud-native solution scales as your organization grows without adding hardware.
Simplify print driver management — a single IPP print driver supports most printer models regardless of manufacturer, providing a consistent experience across a multi-vendor fleet. Full OEM driver functionality is available for devices that need it.
Improve the print experience — location-based printing automatically adds and removes print queues on user workstations based on location and permissions, so users print to nearby printers with no manual setup.
Enhance security — an ISO 27001 certified platform removes print servers as an attack vector, protects data with end-to-end encryption, and supports zero trust security principles.
Print across networks — users can print from their workstation directly to HP Insights-managed printers even when the printer is on a separate or isolated network, or the user is working remotely.
Reduce Help Desk calls — the familiar direct-to-printer workflow and a consistent IPP driver across the fleet reduce user friction and support tickets.

How Secure Print Direct works

Administrators configure Secure Print Direct in the HP Insights web console. This includes selecting an authentication provider, setting up a location hierarchy that mirrors the organization's physical layout, importing or discovering printers using Device Scout, and configuring print queues for each printer. Each queue defines the driver type, finishing options (paper size, color, duplex), and install type — auto-install (Print Scout installs the queue automatically when a user signs in at a matching location) or manual-install (users add the queue themselves from the desktop app). Queue Profiles can automate queue creation across large fleets by matching printers to the right configuration based on make and model.
Print Scout is deployed to user workstations. It installs the HP Secure Print mobile app desktop app, downloads drivers and finishing options, and creates the configured print queues. For auto-install queues, this happens automatically when the user signs in at a matching location.
Users print. Users select a Secure Print Direct queue from their printer list and submit jobs as they normally would.

Where the document goesFor direct line-of-sight printing on the local network, print jobs are sent directly to the printer and do not travel through the cloud; only job metadata is collected and sent to HP Insights for analytics. For off-network printing via the cloud, the job is temporarily stored in your configured region during transit and automatically deleted after printing. See Off-Network Direct IP Printing for details.

Key capabilities

Off-network Direct IP printing through the cloud

Allows users to send print jobs to printers across disparate networks via the cloud, so users can reliably print to any HP Insights-managed direct printer even without a direct network path. More information: Off-Network Direct IP Printing through the cloud.

Print driver management

Drivers are managed centrally in the cloud. Administrators can select from the list of manufacturer drivers for Windows, upload device-specific drivers with the Driver Capture tool, use the IPP Class driver, hide irrelevant drivers, and set a default driver. More information: Print Driver Management.

Location-based printing

Print Scout detects the user's location and shows the printers available there, adding and removing queues automatically as users move. Supported on Windows and macOS only. More information: Location-based Printing.

Group-based printing

Assign groups to install specific print queues regardless of where the printers are physically located, so users in a group get the queue wherever they are. More information: Group-based Printing.

Restrict access by group

Administrators can assign a printer or a print queue to one or more groups so it is available only to users in those groups; with no group assignment, printers and queues are available to all users by default. More information: Restrict Access to a Direct Printer by Group and Restrict Access to a Print Queue by Group.

SCIM-based user and group synchronization

HP Insights supports automatic provisioning of users and groups from identity providers using the SCIM protocol. More information: SCIM-Based User and Group Synchronization.

Secure Print Direct dashboard

Offers an overview of key metrics for your Secure Print Direct setup, with guidance on actions to improve your print environment. More information: Secure Print Direct Dashboard.

Print Support App (PSA)

PSA extends the Microsoft IPP Class Driver to enable advanced print features that the default driver alone does not provide, such as tray selection, duplex, and finishing options (stapling, hole punching, booklet creation).

Windows Protected Print (WPP)

With Print Scout v8.1, Direct IP printing is supported in WPP-enabled environments using the Microsoft IPP Class Driver, for secure, driverless printing with consistent behavior across modern Windows platforms.

Windows on Arm

Direct Print in Print Scout v8.1 supports native printing on Windows on Arm platforms. Jobs are sent directly to printers using the Microsoft IPP Class Driver, for a driverless, secure, and consistent experience without additional configuration.

Reference Information-oriented: details to look up

Supported clients

Secure Print Direct supports the following clients:

Supported authentication providers

Secure Print Direct supports OpenID Connect and SAML 2.0 for Windows and macOS. Internal Authentication and Active Directory remain supported for tenants configured with them before July 2026.

Note: Chrome Direct Print does not support Internal Authentication or Active Directory authentication.

Device discovery

IT administrators use Device Scout to automatically discover Secure Print Direct-compatible printers. Device Scout detects a device's IPP capability and configuration — specifically IPP Support (whether the printer supports the IPP protocol) and the Discovered IPP URL (for example, ipp://ipaddress:631/ipp/print). Alternatively, you can manually import printers by uploading a comma-separated values (CSV) file listing the printers to add.

The Direct tab in the HP Insights web console

The web portal includes the Direct tab with the following sections:

Setup Guide — guides you through the steps required to deploy Secure Print Direct.
Dashboard — an overview of key metrics for your Secure Print Direct setup, with guidance on improvements.
Direct Printers — configure the components required for Secure Print Direct: locations, printers, and print queues.
Print Scout — details about the individual workstations where Print Scout is installed.
Invite — invite users to start using Secure Print Direct, using the provided template as a starting point.
Settings — configure the authentication provider for Secure Print Direct and cloud-based delivery.

Note: The Direct tab is available only if you have a Secure Print Direct license.

Known issues and limitations

Direct Print v2.0 cannot be used on 32-bit machines. If you have a 32-bit machine and require Direct Print, contact Support to obtain an earlier Print Scout that supports Direct Print v1.0. Note that v1.0 lacks some functionality, including print driver management and location-based printing.
Chrome Direct Print supports location-based printing but does not support automatic installation of queues.

Note: User workstations must be restarted first to recover from a spooler crash.