Restrict printing to corporate locations

Question

I was approached with the question if we can restrict printing with Intune. We have Intune managed clients where users are Admin, as we only protect the identity (Azure AD Conditional Access, CASB) and documents (Azure Information Protection) and the client is never entering the corporate network.

Now Security wants to limit printing to corporate printers.

I can't think of any way to achieve that, but I hope the community has solutions.

Maybe Applocker, PowerShell or policies I don't know?

thijs lecomte · Answer

Philip Büchler&nbsp;&nbsp;It's only possible to blocking printing as a whole through MAM.There is no built-in solution in-place.&nbsp;I also can't think of a custom solution for the same.

moe_kinani · Answer

It looks like you can achieve the objective using ‘MAM policies’, have you tried it?https://microsoftintune.uservoice.com/forums/291681-ideas/suggestions/11600817-prevent-printout-via-mam-policy

philip büchler · Answer

This unfortunately is for mobile OS. I was looking for a solution for Windows.

thijs lecomte · Answer

You could do that with WIP - https://docs.microsoft.com/en-us/windows/security/information-protection/windows-information-protection/protect-enterprise-data-using-wip

But be aware, the implementation is cumbersome and not straight forwarrd

I try to stay away from it as much as possible

philip büchler · Answer

Funny enough, this customer uses WIP and I can confirm its cumbersomeness. It would only work if we used RMS as well though. And then, I think, it would prevent printing on a document level.What the CISO wants to achieve is to limit printing to company printers. So a user can't print on his printer at home, but can print in the office. I will recommend to use AIP and solve it on a document level.Meanwhile I might test this out: https://docs.microsoft.com/en-us/mem/intune/configuration/device-restrictions-windows-10#printerSetting the network printer as default and not allowing adding new printers.

Forum Discussion

Restrict printing to corporate locations

Share

Resources