Pharos Cloud 4.0 Release Notes - November 2024

Pharos Cloud 4.0 Release Notes

This release represents the latest version of Pharos Cloud. This update includes several important new features including:

• Direct Print Enhancements

  • Off-network Direct IP Printing through the cloud

  • Support for Type 4 Drivers (Preview Mode)

• Secure Release: Device Profiles

• Secure Scan New Features and Improvements

  • Customizable Scan Options

  • Support for Microsoft 365 in Scan to Email

  • Scan to One Drive Scan to SharePoint Improvements

  • Secure Scan Usability Improvements

• Secure Release: Added the setting for Cloud Connector to the Web Console

• Secure Release: Encryption Improvements

  • Added option to disable job name encryption for jobs submitted by Print Scout

• Print Scout Improvements

  • Direct Print Enhancements

    • Direct IP Printing through the Cloud

    • Support for Type 4 Drivers (Preview Mode)

  • Microsoft Universal Print: Added Paper Tray Selection

Direct Print Enhancements

This release includes improvements to Direct Print that drive efficiency and improve user experience.

• Off-network Direct IP Printing through the Cloud

• Support for Type 4 Drivers (Preview Mode)

Off-network Direct IP Printing through the cloud

Pharos Direct Print was only suitable for environments where printers and users are on the same network segment or have line-of-sight connectivity. However, this approach is not suitable for geographically separated sites or environments where users and printers are on different network segments, where direct communication with printers isn't possible.

Pharos’s new off-network direct IP printing capability now allows users to send print jobs to printers across disparate networks via the cloud. Off-network direct IP printing enables seamless printing across the organization, regardless of physical or network boundaries, ensuring that users can reliably print to any Pharos-managed direct printer, even without a direct network path.

Prerequisites

• Off-network direct IP printing leverages the same cloud-based delivery pathway used by Secure Release and requires both the Direct Print license and Secure Print License. Organizations with only a Direct Print license will not have access to the off-network IP printing capability.

• Latest Print Scout v 7.37.5.100 installed on user workstations and/or App Servers installed on the printers’ network.

• Cloud-based delivery is enabled on the Pharos web console.

Key Benefits

Off-network direct IP printing provides the following benefits:

• Seamless Printing Across Networks - Users can print to any company printer, regardless of geographic location or network boundaries. This is especially useful for remote workers or employees who move between locations or enterprises where printers are hosted in a separate or isolated network segment for security reasons.

• Enhanced Security - Print jobs are securely handled using temporary cloud storage, where they are automatically deleted after printing to minimize data exposure. To ensure maximum confidentiality, Zero Knowledge Encryption (ZKE) is applied, safeguarding the content of print jobs while they are briefly stored in the cloud.

Supported Clients

Off-network direct IP printing supports the following clients

• Windows Print Scout

• macOS Print Scout

Note: Off-network direct IP printing is not supported on Pharos Chrome Print.

Limitation

Off-network direct IP printing limited to Print Scout Release (or Push Print) delivery method. Cloud Release (or Pull Print) is not supported.

How Off-network direct IP printing works

The following outlines how Off-network direct IP printing operates, assuming that Direct Print is configured, and Cloud Delivery is enabled in the web console.

1. The user sends a print job from a workstation with Print Scout installed.

2. The Print Scout checks for a direct connection ("line of sight") to the target printer. If this connection is available, the print job is sent directly to the printer.

3. If a direct connection to the printer is not available, Pharos Cloud switches to cloud delivery.

   1. The user’s workstation Print Scout uploads the print job to the cloud for temporary storage, where it is encrypted with Zero Knowledge Encryption (ZKE) for enhanced security.

   2. The Pharos Cloud sends job release instructions to one of the Print Scouts within the same network as the target printer.

   3. When a Print Scout (workstation or Print Server) receives the release instructions, it will verify the connection to the target printer and either accept or reject the release request.

   4. Once the Print Scout accepts the release instructions, it will download the job data from the cloud and send the job to the target printer.

   5. The releasing Print Scout will update the cloud with the progress status of the print job release.

   6. The user is notified whether the print job was successfully completed or failed to release.

   7. The print job is immediately deleted from the job store once it is released. Failed or cancelled jobs are removed according to the specified purge rules.

For existing Secure Release customers, the following settings play a key role in how print jobs are delivered to printers. Understanding how these settings impact the routing of print jobs is essential when using Off-network Direct IP Printing with Secure Release.

• If the Restrict Print Scout Release is enabled, direct print jobs via the cloud will be handled by the App Server Print Scout or the user’s originating Print Scout. Jobs will never be handled by other users’ Print Scout.

• If the Force delivery through Print Servers is enabled, direct print jobs via the cloud can only be handled by App Server Print Scout.

Pharos Web Console Update

A new Delivery section has been added to the Direct > Settings tab of the Pharos Web Console. To enable Off-network Direct IP printing through the cloud, toggle the option Enable Cloud-based delivery setting in the Delivery section. When Cloud-based delivery is enabled, print jobs will be routed through the cloud if there is no direct connection to the target printer and will be immediately sent to the designated printer.

Support for Type 4 Print Drivers (Preview Mode)

Pharos Direct Print has been updated to support Type 4 print drivers. Type 4 drivers are a newer class of printer drivers introduced in Windows Server 2012, and are designed to enhance security, simplify installation, and improve overall performance.

Previously, the Driver Capture Tool (installed by the Print Scout) only worked with Type 3 print drivers, so the list of available manufacturer drivers for Direct Print queues was limited to Type 3 print drivers.  With this update, the Driver Capture Tool's functionality has been updated to include the ability to configure and upload Type 4 print drivers, providing the same level of support as currently available for Type 3 drivers. Support for type 4 print drivers ensures compatibility with the latest printer features and technologies. 

For details on the updates in the Driver Capture Tool to support Type 4 Print, refer to the Print Scout Improvements and Bugfixes section of this document.

Web Console Update

When creating Direct Print queue in the Direct > Direct Printers tab, all Type 4 print drivers that were uploaded using the Driver Capture Tool will be displayed as available options in the Pharos web console.

Secure Release: Device Profiles

In the previous version, Secure Release settings were applied uniformly to all devices. This update introduces the Device Profiles feature, giving administrators greater control over device-level configurations.

With Device Profiles, Secure Release settings can now be customized for each printer, allowing for tailored configurations rather than applying the same settings across all printers. For instance, administrators can now set different default paper sizes for scanning, such as Letter for devices in the US and A4 for devices in Europe.

Web Console Update

The following updates have been made to the web console with the introduction of the Device Profiles feature.

New Device Profiles sub-tab

A new Device Profiles sub-tab has been added under the Secure tab, enabling administrators to manage device profiles, including the ability to:

• Create New Profiles

• Customize Secure Release and Secure Scan Options

• Duplicate Profiles

• Delete Profiles

The Device Profiles tab includes the following action buttons:

• Add - Create a new profile.

• Duplicate - Copy an existing profile to create a duplicate.

• Delete - Remove an existing profile.

Default Profile 

By default, a single Default Profile is created, which includes default Secure Release and Secure Scan options. Administrators cannot rename or delete this system-generated profile but can modify its settings.

All printers listed in the Secure Printers tab are assigned the Default Profile by default. Administrators can reassign printers to different profiles through the Secure Printers tab if specific configurations are needed. Any new devices that get added will get the Default Profile assigned to them automatically. Administrators can also edit the Default Profile.

Secure Release Settings moved to Device Profiles

The following settings have been moved from the Settings > Secure Release Settings tab to the new Device Profile Settings > User Experience for improved management.

• Device Logon Experience

• Proximity card registration (previously called Enable Proximity Card Registration)

• Network Timeout (Seconds)

• Number of documents displayed on device

• The Secure Scan Settings have been migrated to the Device Profiles section

Device Logon Experience

• The Device Logon Experience setting includes a new Review Documents option in addition to Secure Print, Device Home, and Touchless Printing. When enabled, users will be directed to the Review Documents(showing the list of documents submitted) screen immediately after logging in.

• The Device Logon Experiencesetting defines the printer’s user interface behavior during the login process on a device. This setting allows administrators to configure and customize how users authenticate themselves when logging into a device, including:

  • Secure Print

  • Review Documents

  • Device Home

  • Touchless Printing

Moved Secure Scan Settings to Device Profiles

The Secure Scan Settings tab previously located in the Secure tab has been moved to the new Device Profiles tab.

Note: If Secure Scan was previously enabled in the Secure Scan Settings screen, the scan settings will be migrated to the default device profile. This ensures that secure printers will continue to function with the Secure Scan feature enabled. However, if Secure Scan was not enabled, the scanning feature in the default device profile will be set to "off," meaning scanning will remain disabled by default until manually activated.

Updated Secure Printers tab

• The Secure Printers tab now includes a new Assign Device Profile option, allowing administrators to assign Device Profiles to devices. Once a Device Profile is assigned to one or more devices, the administrator can edit or delete the profile, with a warning message displayed.

• A new Device Profile column has been added to the Secure Printers tab that shows which Device Profile is assigned to each device. This allows administrators to easily see and manage the profiles associated with each device. 

Notes:

• For existing sites, the settings from the Secure > Settings tab will automatically be migrated to the Default Profile in the Device Profiles tab. This ensures that any previously configured settings are retained and applied to the default profile.

• Administrators do not need to re-secure the device after the update; simply refreshing the screen on the device will apply the updated settings.

Secure Scan New Features and Improvements

Customizable Scan Options

With this update, administrators now have the flexibility to set up default scan options to match your organization’s specific preferences.

The new Device Profiles tab includes a Default Profile with its own default scan options. By default, all printers are assigned to this Default Profile, and the scan options set within it will be applied universally to all the printers. To use different scan options for specific printers, administrators will need to create and apply a separate Device Profile for those printers.

Note: In the previous version of Pharos Cloud, Secure Scan included a predefined set of default scan options for KM, HP, and Toshiba printers. With the introduction of Device Profiles, these predefined scan settings are now overridden. You will need to set up new scan options within Device Profiles, as any previous configurations will no longer apply.

Support for Microsoft 365 in Scan to Email

Pharos Cloud’s integrated scanning capability has been enhanced with the ability to send emails using Microsoft 365, in addition to the previously supported SMTP. When configuring the "Scan to Email" feature, Administrators can now choose between Microsoft 365 or SMTP for sending scanned documents.

The new Secure > Device Profiles tab in the web console offers a Scan to Email feature with the following options.

• Microsoft 365 - This option integrates with Microsoft's cloud-based email service, allowing users to use their existing Microsoft 365 account to send scanned documents. It’s a convenient choice for organizations using Microsoft 365, as it leverages the same email infrastructure.

• SMTP (Simple Mail Transfer Protocol) - This is a standard method for sending emails and can be used with any email provider. Administrators can configure the SMTP settings with details like the server address, port, and authentication information. SMTP is a flexible option that works with a wide range of email services.

When the Microsoft 365 option is selected, all Email SMTP settings are hidden, leaving only the "Enable Editable To: Field" and “Max File Size” settings visible.

Scan to OneDrive and Scan to SharePoint Improvements

Scan to SharePoint and Scan to OneDrive are now separate options in the new Device Profiles screen. Previously, enabling the Scan to Office 365: Enable User Authentication setting activated both, but now administrators can enable or disable them individually.

Secure Scan Usability Improvements

• Editable File Name for Scans

Users can now edit the file name of a scan file directly within the printer panel.

• Enhanced Navigation for OneDrive and SharePoint

When scanning to OneDrive or SharePoint, users will now see breadcrumb trails of the folders they’ve navigated through. These breadcrumbs are interactive, allowing users to click on any folder in the path to quickly jump back to a specific location. This improvement provides easier and more intuitive navigation.

• Improved Back and Cancel Button Functionality

The Back and Cancel buttons have been updated to function reliably, ensuring a smoother user experience.

Secure Release: Added the Cloud Connector Setting to the Web Console

The Secure Release Settings section of the Pharos web console now includes a Cloud Connector toggle, allowing administrators to easily enable or disable it. This change lets organizations manage their Cloud Connector settings independently, reducing reliance on Pharos Support. Previously, this option was hidden and required Pharos to activate it, but now it is directly accessible in the console.

Pharos Web Console Update

The new Cloud Connector toggle switch in the Secure > Settings > Secure Release Settings screen allows administrators to enable or disable Cloud Connector.

• When Cloud Connector is turned ON, devices can be secured against the Cloud Connector. Administrators will need to use the Device Deployment Utility (DDU) to secure printers against the Cloud Connector and make those printers "cloud-connected”.

Note: Only HP and Ricoh printers are currently supported by the Cloud Connector. For other printer manufacturers that don’t support the Cloud Connector, the Local Connector will need to be used.

• When Cloud Connector is turned OFF, devices won’t be able to be secured against the Cloud Connector. Devices can be secured with the Local Connector to secure devices. 

For information on how to configure Cloud Connected Devices, refer to the Configuring Cloud Connected Devices document.

Cloud Connector behavior for new and existing sites

• For sites with the Cloud Connector enabled, the new Cloud Connector toggle switch in the Secure Release Settings will be ON by default.

• If a site either doesn't have the Cloud Connector enabled or is a new site, the Cloud Connector toggle switch in the Secure Release Settings will be set to OFF by default. Administrators will need to manually enable it if they want to use the Cloud Connector.

Secure Release: Encryption Improvements

Added option to disable job name encryption for Print Scout job submissions

Encryption settings are now visible and manageable through the Pharos Cloud web console. Previously, these settings were controlled by Pharos and not accessible to administrators. Additionally, job name encryption has been de-coupled from the Cloud Connector feature. Job name encryption now functions independently without depending on whether the Cloud Connector is enabled or not.

Administrators can now view and modify encryption settings through the web console, giving them the option to enable or disable zero-knowledge encryption for the job name. For instance, for existing customers where Cloud Connector is disabled, print jobs sent through Print Scout show encrypted job names in Pharos Cloud, making it harder for users to identify their print jobs in the User Portal, Mobile App, or cloud-connected devices. With this update, administrators have the flexibility to turn off job name encryption if desired, making it easier to identify print jobs.

Pharos Web Console Update

A new Advanced Encryption section in Secure > Settings > Secure Release Settings > Document Handling on the Pharos web console has been added. This includes settings that allow administrators to decide if they want to apply Zero Knowledge Encryption (ZKE) for print job names.

Additionally, it includes a setting that shows how the content of the print jobs is encrypted. This encryption is based on a combination of settings, which are outlined in the "Print Job Content" section of the document.

• Print Job Name– This setting allows you to choose whether to encrypt print job names (document names) or leave them visible on the User Portal or Pharos Mobile App in plain text.

  • When enabled, job names will be encrypted meaning they will be shown in an encrypted format on the User Portal and Mobile App for jobs submitted by a Print Scout.

  • When disabled, the job names will not be encrypted meaning they will appear in clear, readable text on the User Portal and Mobile App for jobs submitted by a Print Scout.

Note: This setting applies to print jobs submitted via Print Scouts only.

• Print Job Content– This read-only setting controls whether the content of a print job (the actual document) will receive advanced encryption.

  • When Print Job Content encryption is enabled, the document content is encrypted using the ZKE within the Print Scout before being uploaded to cloud storage. The document will also be encrypted with an AWS managed S3 KMS key while at rest within cloud storage.

  • When Print Job Content encryption is disabled, the document content will not be encrypted using the ZKE within the Print Scout before being uploaded to cloud storage. The document will, however, be encrypted with an AWS managed S3 KMS key while at rest within cloud storage.

Note: The Print Job Content setting is read-only and cannot be modified. The status of this setting — whether it is enabled or disabled, depends on the following conditions related to the Cloud Connector and Cloud Release.

• 
  

  • When the Cloud Connector is OFF (for on-premises setup via Local Connector) or when the Cloud Connector is ON, but Cloud Release is OFF, print job content encryption is automatically enabled and cannot be disabled in both cases.

  • When Cloud Release is ON (indicating that Cloud Connector is also ON), the print job content encryption is automatically disabled. This means that job data sent to the cloud by Print Scouts will not use ZKE (Zero-Knowledge Encryption). However, these jobs will still be encrypted at rest with S3 KMS (Key Management Service).

Note: Cloud Release requires the Cloud Connector to be ON, so you cannot enable Cloud Release without first enabling Cloud Connector.

Print Scout Improvements and Bug Fixes

Off-network Direct IP Printing through the Cloud

This release introduces Off-network Direct IP Printing which enables seamless printing across an organization, allowing users to print to any Pharos managed direct printer, regardless of physical location or network connection, without needing a direct network path to the printer.

The Print Scout component of the Pharos Cloud has been updated to support Off-network Direct IP Printing through the Cloud.

Support for Type 4 Drivers (Preview Mode)

The Print Scout has been updated to support installation of Type 4 Print Drivers.

Driver Capture Tool Update

The Print Scout installs the Driver Capture Tool, which is used to upload drivers as well as set up related finishing options to the cloud so they can be used for print queue deployment.

The user interface of the Driver Capture Tool has been enhanced for improved usability. Key updates to the Driver Capture Tool include

• Administrators are now presented with the option to either Upload a Driver or Modify a Driver Profile when launching the Driver Capture Tool. Additionally, the tool no longer pre-selects a driver; instead, it allows an Admin to manually choose a driver from the list.

• The Driver Capture Tool now displays a cloud icon next to drivers that have already been uploaded to Pharos Cloud.

• A new Group View button has been added to help administrators easily differentiate between drivers stored in the cloud and those that can be uploaded to the cloud. While drivers are initially listed alphabetically, admins can now use the Group View buttonto organize them into two categories:

  • Drivers can be uploaded to the cloud - Drivers installed on the workstation and ready to be uploaded to the cloud.

  • Drivers available in the cloud - Drivers already uploaded to the cloud, including pre-defined drivers and those already uploaded to the cloud

Supported Type 4-Drivers

Not all Type 4 drivers follow the Windows recommended standard, and as such they may not currently work with our Type 4 driver support. If a driver does not behave as expected when trying to upload or install queues with that driver, Pharos can work with you try to expand the implementation to cover the particular driver.

Pharos has tested the Canon, KM, Lexmark and Ricoh Universal Type 4 drivers, as well as a variety of HP and Xerox device-specific drivers.

• Canon Generic PCL6 V4

• HP OfficeJet Pro 9020 series PCL-3

• HP PageWide Color MFP 780-785 PCL6 (V4)

• HP Smart Universal Print

• Konica Minolta Universal V4 PCL

• Lexmark Generic v4 XPS

• Lexmark Universal v4 XL

• (Ricoh) PCL6 V4 Driver for Universal Print

• Xerox VersaLink C500 V4 PCL6

Type 4 Driver Known Issues and Limitations

• Print Scout Compatibility

Print Scout version 7.37 or later is needed to successfully upload or install Type 4 drivers. Older versions of Print Scout won’t install any print queues that are configured with a Type 4 driver and won’t show an error message to indicate the failure.

• Retention of presets, shortcuts, and favorites are not supported for Canon, Ricoh, Lexmark, and Konica Minolta Type 4 Drivers. These need to be manually recreated. However, with HP and Xerox print drivers, these presets, shortcuts, and favorites can be copied or transferred along with user preferences.

• Supported Manufacturer Print Drivers

Pharos has tested print drivers, primarily universal or generic ones, from the manufacturers listed below, and we anticipate that most other drivers from the same manufacturers should work if they follow the same Type 4 standards and specifications. However, Pharos cannot guarantee that all other drivers will work seamlessly and suggest performing your own testing to ensure compatibility and proper functionality for Type 4 drivers. If a driver doesn’t function as expected, Pharos can work with you to adjust the implementation to support the driver.

• Canon

• Konica Minolta

• Lexmark

• Ricoh

• HP

• Xerox

• Xerox and Canon User Preferences UI

When a Canon or Xerox Type 4 driver is initially installed, it only includes the basic user interface. To install the custom user interface (such as the User Preferences UI), administrators must complete additional steps. For example, Xerox drivers require admin users to run a separate MSI installer to add the User Preferences UI after the driver is installed.

If a driver is uploaded or captured before completing these extra steps, only the basic UI will be captured, and you won’t have access to the custom options (e.g. User Preferences UI). To avoid this, ensure the custom UI is installed before capturing or uploading the driver. If you have already uploaded the driver before installing the custom UI, you'll need Pharos Support to help fix this issue.

• KM Preferences UI shows ‘Please select model in [Device Settings]’ link.

When you open the KM Preferences UI, it shows ‘Please select model in [Device Settings]’ link as shown in the image below. Clicking this link will close the Printing Preferences window—it will need to be reopened manually.

Microsoft Universal Print Integration: Add Paper Tray Selection

The Universal Print secure queue has been enhanced to include additional finishing options.

• Paper Source: A new drop-down called Paper Source has been added to the Paper Quality >Tray Selection option. This allows users to select a specific paper tray from which their document will be printed.

• The following new options have been added under Printer Features, accessible via the Advanced button:

• Output Bin: Users can now choose their preferred output tray for printing.

• Stapling: Users can now choose their preferred stapling option:

  • None (default)

  • Top left

  • Top right

  • Bottom left

  • Bottom right

  • Left edge (2 staples)

  • Top edge (2 staples)

  • Right edge (2 staples)

  • Bottom edge (2 staples)

  • Saddle stitching

• Document Binding

  • None (default)

  • Bind (auto)

  • Left edge (stitching)

  • Top edge (stitching))

  • Right edge (stitching)

  • Bottom edge (stitching)

• Hole Punching 

  • None (default)

  • Hole punch (auto)

Note: If users do not explicitly select paper source and output tray options, the system will default to either a standard configuration or the printer’s default settings.

Sentry Print Service (Local Connector) versions

The latest Pharos Sentry Print Service (Local Connector) includes two versions: the tagged version(2411.318.3346) and the MSI version(24.11.5433.0). During installation or upgrade, the MSI version is shown in the Control Panel. However, when securing the device, the tagged version is displayed on the Secure Printers screen under the Secured Version column. The tagged version is also shown in the Sentry Print Service Deployment and Runtime Logs.

Component Release Versions

This release includes the following software components and release versions.

*Note: Secure Release mobile apps and the Chrome extension are published after the Cloud Services are updated.