13.61. How to enable Microsoft Entra authentication

Enable this to allow users to sign in with their Microsoft work or school account and get single sign-on (SSO) to Printix. You just need a user account in Microsoft Entra ID to configure Microsoft Entra integration.

1. On the Authentication page, select the Microsoft Entra ID tab.
2. Select Connect.
3. On the Microsoft Sign in page:
   • Enter your work or school account.
   • Enter Password.

4. Select Sign in.
5. Printix will ask you for permission to:
   • Maintain access to data you have given it access to.
   • View your basic profile.

*The permission ‘Maintain access to data you have given it access to’ (formerly presented as ‘Access your data anytime’) should only be listed in Microsoft’s Consent Page for applications that request offline_access. Printix does not request or need offline_access. This bug is reported to Microsoft. For the sign in process Printix does not request (or get) a refresh token, only an access token, which is ignored. The only token actually used for signing in, is the id_token, which contains user information (username+email) which Printix store, and then check the token signature, to verify the token is granted by Microsoft Entra ID.

6. Select Accept to grant these permissions, so Printix can configure Microsoft Entra integration.
   In Microsoft Azure, this will add the enterprise application Printix.
   • If you see the check box Consent on behalf of your organization, it is because you have the role as global admin in Microsoft Entra ID and Printix has not yet been accepted for all users. Check Consent on behalf of your organization so Printix can have access to the specified resources for all users in your organization. No one else will be prompted.

7. Select OK if the connection to Microsoft Entra ID was successful.

From now on the Sign in page will show Sign in with Microsoft.

See also:

• How to deploy Printix Client with Microsoft Endpoint Manager
• How to deploy Printix Client
• How to enable Microsoft Entra groups
• How to revoke the acceptance of Printix
• How to find out if computer support SSO
• How to add multiple directories
• How to remove sign in with email
• Troubleshooting sign in
  

How to accept Printix for all users

1. For Accept for all users, select Accept to grant permission to read users’ profiles without prompting the individual in your organization. You must have the role as global admin in Microsoft Entra ID to do this.
2. On the Microsoft Sign in page:
   • Enter your administrator account. You must have the role as global admin in Microsoft Entra ID to grant permission to read users’ profiles.
   • Enter Password.

3. Select Sign in.
4. Printix will ask you to accept permissions for your organization to:
   • Sign in and read user profile.
   • Subsequent deletion or modification of the used global admin Microsoft Entra ID account will not affect the already consented application permissions.

5. Select Accept to grant these permissions, so Printix can have access to the specified resources for all users in your organization. No one else will be prompted.
   If this is successful you will see the message: Accepted for all users.

6. Optionally, remove Sign in with email option.

How to revoke the acceptance of Printix

1. Open a new browser window and sign in to Microsoft Azure (portal.azure.com), using your work account credentials.
2. In the portal menu, select All Services.
3. In the Identity category, select Microsoft Entra ID.
4. On the left pane, select Enterprise applications.
5. Select Printix.
6. On the left pane, select Properties.
7. Select Delete.

How to find out if computer supports SSO

Open a command prompt as Administrator and run the command: dsregcmd /status

1. Select the Start icon and select in the Search box.
2. Type cmd into the search box.
3. Right-click Command Prompt in the search window and select Run as administrator.
4. Type: dsregcmd /status
5. Scroll to the SSO State section and look for:

• AzureAdPrt : TRUE

If the AzureAdPrt value is FALSE, the computer is not Microsoft Entra joined and SSO (Single Sign-on) will not work.

If a group policy blocks Printix Client from running the dsregcmd command, you can modify Windows Registry to inform Printix Client that SSO is supported.

1. Select Windows logo key + R to open Run.
2. Type: regedit, and select OK.
3. In Registry Editor browse to:
   HKEY_LOCAL_MACHINE\SOFTWARE\
   printix.net\Printix Client\
4. Add the DWORD value name ForceAzurePrt and give it the value 1 (0×00000001).

In the PrintixClient log file (PrintixClient- user . number .log) you can also search for the text:

• Azure: Token available = True

SSO (Single Sign-on) will not work if it says:

• Azure: Token available = False

How to add multiple directories

1. Select Add to add another Microsoft Entra directory.

*If there are more than one Microsoft Entra directories, then Sign in to Printix Client is no longer automatic the first time on Microsoft Entra joined Windows 10 and 11 computers. The user must select directory (acme.com or ajax.com) and then sign in, but only the first time.

Troubleshooting sign in

• Sign in page does not show: Sign in with Microsoft
• Permission denied
• Not authorized. You do not have permission to use Printix Administrator
• Microsoft Entra authentication has been disabled and is now enabled again, and I want to accept Printix for all users again
• You can’t access this application. Printix needs permission to access resources in your organization that only an admin can grant

Sign in page does not show: Sign in with Microsoft

• Microsoft Entra authentication is not enabled.
  RESOLUTION: You may have forgotten to select Save after you connected to Microsoft Entra ID. If it still does not show, then try to refresh the browser (Ctrl + F5).

Permission denied

• After you select Accept for all users and Sign in you get Permission denied.
  RESOLUTION: You must sign in with a role as global admin in Microsoft Entra ID after you select Accept for all users.

Not authorized. You do not have permission to use Printix Administrator

• The first time you Sign in with Microsoft, a new user is automatically created for you. This new user is not authorized to Sign in to Printix Administrator.
  RESOLUTION: Sign in with email to Printix Administrator, and change the role of the newly created user to System manager. From now on you can sign in with your work or school account.

Microsoft Entra authentication has been disabled and is now enabled again, and I want to accept Printix for all users again

If you disable Microsoft Entra authentication and want to withdraw the accept of Printix, then you must do this from within Microsoft Entra ID. If you have withdrawn the accept of Printix and now want to accept Printix again, then select the Accept again link.

You can’t access this application. Printix needs permission to access resources in your organization that only an admin can grant

• After attempting to Sign in with Microsoft you are told you can not access Printix.
  RESOLUTION: Follow the steps below to allow users to consent to apps accessing company data on their behalf. You must have the role as global admin in Microsoft Entra ID to make this change. Printix will read the users’ basic profile (display name and email address).

1. Sign in to portal.azure.com.
2. In the portal menu, select All Services.
3. In the Identity category, select Microsoft Entra ID.
4. On the left pane, select Enterprise applications.
5. On the left pane, select Consent and permissions.
6. Set User consent for applications to Allow user consent for apps or Allow user consent for apps from verified publishers, for selected permissions (Recommended).
7. Select Save.
   It may take up to 15 minutes before the change take effect.