Intune deploy printers to devices (not users) — persistent mapping recipe

Joe B.

Reviewed for technical accuracy

Specialities: Microsoft Intune, Endpoint Manager, Universal Print, AD/GPO, Print Servers, Hybrid Azure AD

Deploy printers to devices with Intune — device-based assignments, persistent mappings, hybrid & cloud print

Technician

Let’s get your Intune printer deployment under control.
A lot of admins start with user-targeted mappings or legacy GPOs and end up with printers that disappear, don’t follow kiosks, or behave differently per logon.
Before we design a clean “deploy printers to devices, not users” persistent mapping recipe, tell me:
• Are your endpoints Azure AD joined, hybrid joined, or still on-prem domain joined?
• Do printers live on a print server, via Universal Print, or as direct TCP/IP queues?
• Are you targeting shared PCs, kiosks, call-center devices, or personal laptops?
With that, we’ll pick the right combo of Intune device configuration, Win32/PowerShell, and groups so printers are bound to the machine and stay there.

Customer

We’re hybrid Azure AD, using Intune for management. Printers are still on an on-prem print server. We tried user-targeted printer deployments and some Universal Print, but on shared Windows 11 PCs it’s a mess — printers don’t show for all users, mappings vanish, and sometimes users get the wrong site’s printers.

Technician

That’s a common pain with Intune-only printer strategies.
User-targeted deployments rely on each user’s sign-in, sync cycles, group membership and sometimes UPN/tenant alignment. On shared devices and kiosks this leads to:
• Printers mapping only after long delays or not at all.
• Different sets of printers per user on the same PC.
• Orphaned queues when users leave groups or the tenant.
The fix is to deploy printers to the device so that any user who signs in gets the same, consistent set of queues.
We’ll do this with a repeatable approach:
1) Use device groups (per site / role) in Intune.
2) Deploy printers using a PowerShell or Win32 app running in SYSTEM context.
3) Optionally integrate Universal Print where it makes sense.
4) Add health checks so mappings persist and auto-repair.

Customer

We’d like all users on a given kiosk or front-desk PC to always see two specific printers: one local, one secure follow-me. How do we force that via Intune without touching every user?

Technician

Step 1 — Target printers to device groups
1) In Intune, create Azure AD device groups per location or function (e.g. DEV-Print-FrontDesk-London). Add the relevant devices only.
2) Prepare a small PowerShell script that:
  • Adds your shared queue: Add-Printer -Name "LDN-FrontDesk" -ConnectionName "\\PRINTSRV01\LDN-FrontDesk"
  • Adds follow-me / pull-print queue if needed.
  • Sets default as required using Set-Printer or RUNDLL32 PRINTUI.DLL.
3) Deploy that script or a packaged Win32 app via Intune with System context, assigned to the device group.
Because it runs as SYSTEM, mappings are created in a machine-wide context so every user signing in sees the same printers — no manual per-user setup.

Customer

We tried scripts before, but mappings were inconsistent after reboots or when users deleted printers. How do we make this “persistent” and self-healing?

Technician

Step 2 — Make Intune printer mappings persistent
Instead of a one-time script, use Intune’s Proactive Remediations or a Win32 app with detection logic:
• Detection script checks if required printers (e.g. LDN-FrontDesk) exist and point to the correct print server or Universal Print connector.
• Remediation script re-creates missing or broken queues silently in SYSTEM context.
• Configure as device-targeted so any user changes get auto-corrected on the next run.
This turns your printer deployment into a self-healing, persistent configuration instead of a best-effort script.

Customer

What about drivers? Some queues need vendor drivers, others can use class drivers. Can Intune handle that when deploying to devices?

Technician

Great question — drivers decide whether this feels “set and forget” or fragile.
Step 3 — Handle printer drivers in an Intune world
• For on-prem print servers: install and manage vendor drivers centrally; devices only see shared queues, so Intune just maps them.
• For direct TCP/IP queues: use a Win32 package to install the proper PCL/PS driver first, then create queues with Add-PrinterDriver + Add-Printer.
• For cloud-first: consider Universal Print; assign printers to Azure AD device groups so they appear per device in Windows 10/11 without complex scripts.
All of this can be wrapped into the same device-targeted deployment so your mappings and drivers remain aligned.

Customer

We also need location-based printing. Users roam between branches, but each device should keep its local site printers. Can this recipe cover that?

Technician

Yes — that’s exactly where device-based Intune printer deployment shines.
Step 4 — Map printers per site using device groups
• Create dynamic or assigned device groups based on naming convention, OU, or tags (e.g. all devices in the Paris office → DEV-Print-PAR).
• Scope each printer deployment (script/Win32/Universal Print assignment) to the corresponding device group only.
• Result: every device in that site automatically gets the correct set of printers; when users roam, the printers follow the device, not the user — exactly what you want for front desks, labs, classrooms, and warehouses.

Customer

We still have some legacy GPO printer deployments. Can we run this Intune device-based model side by side while we migrate?

Technician

Absolutely — just be deliberate.
Step 5 — Coexistence and clean cutover
• Start by excluding pilot devices from legacy GPOs (WMI filters / security filtering) and applying the Intune device-targeted printer recipe there.
• Confirm queues, defaults and drivers match your expectations.
• Gradually expand Intune assignments while shrinking GPO scope until all relevant devices are fully managed via Intune.
• Avoid double-mapping the same queue from GPO and Intune to prevent duplicates and confusion.
We can help design a migration schedule if you share your current GPOs and print servers.

Customer

What’s the best way to troubleshoot if printers still don’t appear on some Intune-managed devices?

Technician

For stubborn endpoints, check in this order:
• Confirm the device is in the correct Azure AD device group and Intune shows the script/Win32 app as installed.
• Run your detection script locally to verify it expects the same printer name and server path.
• Check DeviceManagement-Enterprise-Diagnostics-Provider logs and script output for errors while running as SYSTEM.
• Ensure network/firewall allows access to print server or Universal Print endpoints.
• Validate drivers are present or installed by the package.
With a proper detection+remediation loop, printers should self-correct on the next Intune cycle.

Customer

That makes sense. If we share our print server list and groups, can you help us build the exact scripts and assignments?

Technician

Definitely.
Summary: To deploy printers to devices, not users with Intune, build device-based Azure AD groups, push printer mappings via SYSTEM-context scripts or Win32 apps, add detection/remediation for persistent mappings, and integrate Universal Print or print servers cleanly. This recipe gives every user on a managed device the right printers, every time. Share your details and open the chat for a tailored deployment plan.

Quick answer: the accepted fix

Accepted fix for Intune printer deployment: use device-targeted Azure AD groups plus SYSTEM-context scripts or Win32 apps to map shared printers, add detection/remediation so queues auto-heal, and avoid relying only on user-targeted policies. This creates persistent printer mappings per device for all users.

FAQ

Step-by-step: Intune persistent mapping recipe

1. Create Azure AD device groups per location/role for printer targeting.
2. On print servers, tidy queues and drivers; decide which printers each device group should see.
3. Package a SYSTEM-context PowerShell/Win32 solution that installs drivers (if needed) and adds the required printers.
4. Add detection/remediation logic so missing or modified queues are automatically corrected.
5. Assign policies/apps to device groups in Intune; monitor install status and logs.
6. Phase out legacy GPO deployments once device-based mappings are confirmed stable.

Note for mixed environments (macOS & others)

1. For macOS, consider using print servers with IPP/LPD and configuration profiles from your MDM; Intune for macOS can deploy printer profiles per device or user as needed.
2. For Linux/VDI/RDS, map printers centrally on the server and keep Intune responsible for Windows endpoints only.

Sources

• Microsoft — Intune Win32 app management
• Microsoft — Universal Print overview
• Microsoft — Intune fundamentals and best practices

Matt ● replies in < 1 min

Technician Expert

⭐⭐⭐⭐⭐ Trusted by 27,000+ customers

Alex · Expert's Assistant

Start Chat

5 Tech Support Specialists are online right now.