Enabling Entra ID (Azure AD) for PaperCut NG/MF version 21.1 or earlier

This table shows what features are available if you’re running Entra ID (Azure AD) on PaperCut version 21.1 or earlier. PaperCut 21.2 or higher has many extra features, including multi-factor authentication. For details, see Overview of synchronizing user and group details with Entra ID (Azure AD). PaperCut version 21.1 or earlier using Microsoft Graph API. PaperCut Core Synchronize users and groups to PaperCut database 1Yes (PaperCut username is the MailNickName - user)MFD/Copier swipe card authentication 1YesMFD/Copier swipe card self-association 2NoMFD/Copier username/password authenticationNoUser or Admin User Web Interface username/password authenticationNo“Sign On with Microsoft” button (Azure SSO) on Admin or User Web Interface 3YesMobile Web Client username/password authenticationNoPaperCut User Client username/password AuthenticationNo“Sign On with Microsoft” button (Azure SSO) on the PaperCut user client 3NoRelease Station swipe card authentication 1YesRelease Station username/password authenticationNoPrint Deploy Print Deploy User Client username/password authenticationNoPrint Deploy Web Admin username/password authenticationNo“Sign On with Microsoft” button (Azure SSO) on Print Deploy client 3NoMobility Print Mobility Print client username/password authenticationNoMobility Print Web Admin username/password authenticationNo“Sign On with Microsoft” button (Azure SSO) on Mobility Print client 3NoUniversal Print Universal Print ConnectorYesOther differences CostFreeUsername in PaperCutUPN (e.g. alex.test@papercut.com)Support 2FA / MFA through the PaperCut sync sourceNoAbility to sync card numbers with AzureYes4Ability to sync user aliases with AzureNo5Ability to sync users that sit within nested groups 6No 1 Swipe card authentication – use a swipe card with a card reader to log in to the device or release station. Since this only uses the card number (and optional PIN), username/password authentication is not involved. 2 Swipe card self-association – use a brand new swipe card with a card reader to log in to the device. Since PaperCut does not recognize the card number, it will ask the user to log in with their username and password, to ‘self-associate’ the new card with their user record. 3 ‘Single Sign on with Microsoft’ method of signing in – enabled on the Admin and User web interfaces under Options > User/Group Sync > Single Sign on with Microsoft > Enable the ‘Sign in with Microsoft’ button. 4 When using the standard Azure AD sync method, if you want to sync a primary card number, set the config key user-source.update-user-details-card-id to Y. On next sync, the Employee ID number from Entra ID is synced into the Primary Card Numberfield in PaperCut. There are no other configuration options available for this currently. Other alternatives for importing card numbers when using the standard Entra ID method are to use a batch-update method, auto-generation of card numbers, or an external lookup as detailed in User card and ID numbers . 5 An alternative option for the standard Entra ID method to update the user alias fields is to use the batch import and update user process - however that leads to an ongoing maintenance overhead. 6 If you want to sync a group of users (for example, Group B) that’s nested under another group (for example, Group A), when you configure the sync source settings be sure to explicitly target the nested group (Group B). If you target the higher-level group, no users will be synced. Always explicitly target sync sources.