Group-Based User Management

In most organizations, users already exist in groups – by department, role, location, or access level. MyQ is designed to reflect and extend that structure rather than replace it. Getting group design right before rollout reduces per-user administration. When groups are synchronized and mapped to MyQ configuration, new users can receive the appropriate rights, queues, terminal actions, policies, and accounting rules through group membership.

Plan group-based rules before synchronizing users. If rights, queues, terminal actions, policies, quotas, and accounting rules are already assigned to groups, newly imported users can receive the correct configuration through their group membership instead of being configured one by one.

What Groups Control

Groups are a key unit of configuration across several areas of MyQ:

• User Rights
  Access levels – who can view logs, manage printers, run reports, administer queues – are assigned to groups, not just individuals. Decide which administrative roles exist in your organization and map them to groups before configuring rights.

• Queue Access and Driver Provisioning
  Access to specific print queues can be restricted by group. When MyQ Desktop Client printer provisioning is configured, queues can be assigned per user or group, reducing manual workstation configuration.

• Terminal Actions
  Terminal actions, such as Easy Scan, Easy Copy, access to device-native applications, and ID card registration, can be scoped to specific user groups. Plan these assignments together with your group structure so users see only the actions intended for their role.

• Policies
  Print option restrictions – duplex enforcement, color restrictions, page limits – are applied via policies assigned to groups. Define policies at the group level where possible, and verify the effective policy behavior where multiple policies or overlapping groups apply.

• Accounting
  Groups are the foundation of quota and cost management. See Accounting Groups and Cost Centers below.

Accounting Groups and Cost Centers

Tying accounting to group membership can reduce manual quota assignment. When group synchronization and quota rules are configured correctly, newly synchronized users can receive the appropriate group-based accounting rules as part of the sync process.

Accounting Groups

Accounting groups assign a shared quota to a set of users. All members draw from the same balance, which resets on a defined schedule. This model suits departments or organizational units with a collective print budget. Individual quota rules can still be applied on top of group quotas where exceptions are needed.

Cost Centers

Cost centers allow individual users to allocate activity across multiple budget lines. A user with access to several cost centers chooses which one to charge at the point of printing or scanning. This model suits organizations where individuals work across projects or departments and need to attribute usage accordingly.

Designing Your Group Structure

The most practical starting point is your existing directory structure. If your AD or Entra ID groups already reflect meaningful organizational divisions, synchronize them directly into MyQ and build your configuration on top of them.

Where the directory structure does not map cleanly to your MyQ requirements, you can create internal MyQ groups that are not present in the directory and populate them by combining multiple sync sources or using attribute filters during sync.

A useful pattern is to run AD or Entra ID sync first, export the result to CSV, modify group memberships programmatically – for example via PowerShell – and then run a second CSV sync source to apply the adjustments. Scheduling the CSV sync to run after the directory sync finishes keeps it current automatically.

When configuring group synchronization, pay attention to the synchronization level. Full synchronization mirrors the directory exactly – users are added to and removed from groups as their directory membership changes. Add new only adds memberships and never removes them, which means a user who leaves a department in the directory retains their MyQ group membership until manually corrected – with accounting implications if quotas are group-based. Choose the level that matches how you want MyQ to respond to directory changes.