Restrict printing to corporate locations

[Philip Büchler]

I was approached with the question if we can restrict printing with Intune. We have Intune managed clients where users are Admin, as we only protect the identity (Azure AD Conditional Access, CASB) and documents (Azure Information Protection) and the client is never entering the corporate network. 

Now Security wants to limit printing to corporate printers. 

I can't think of any way to achieve that, but I hope the community has solutions. 

Maybe Applocker, PowerShell or policies I don't know?

[#2]

It looks like you can achieve the objective using ‘MAM policies’, have you tried it?

https://microsoftintune.uservoice.com/forums/291681-ideas/suggestions/11600817-prevent-printout-via-...

[#3]

@Philip Büchler 

It's only possible to blocking printing as a whole through MAM.

There is no built-in solution in-place.

I also can't think of a custom solution for the same.

[#4]

This unfortunately is for mobile OS. I was looking for a solution for Windows.

[#5]

You could do that with WIP - https://docs.microsoft.com/en-us/windows/security/information-protection/windows-information-protect...

But be aware, the implementation is cumbersome and not straight forwarrd

I try to stay away from it as much as possible

[#6]

Funny enough, this customer uses WIP and I can confirm its cumbersomeness. It would only work if we used RMS as well though. And then, I think, it would prevent printing on a document level.
What the CISO wants to achieve is to limit printing to company printers. So a user can't print on his printer at home, but can print in the office. I will recommend to use AIP and solve it on a document level.

Meanwhile I might test this out: https://docs.microsoft.com/en-us/mem/intune/configuration/device-restrictions-windows-10#printer
Setting the network printer as default and not allowing adding new printers.