"We've isolated a code change to Microsoft Graph API that introduced a code error, which increased Entra ID directory replication latency and exposed a pre-existing race condition in Universal Print's share creation flow," Microsoft said, adding that the error "caused the retry logic to fail and the share operation to not complete as expected."
How Microsoft describes the failure
Microsoft confirmed on Tuesday that a change to the Microsoft Graph API is the proximate cause of an ongoing Universal Print sharing problem tracked as incident UP1287359. The company said the Graph API code change introduced a coding error that increased Entra ID directory replication latency and exposed a pre-existing race condition in Universal Print's share-creation flow. That combination, Microsoft explained, allowed the retry logic to fail and prevented some share operations from completing as intended.
What users are seeing and who is affected
Affected users may intermittently see "Sharing Print Failed" errors in the Universal Print portal when attempting to create printer shares in certain scenarios. Microsoft said the issue impacts "some users attempting to create printer shares created with the 'Allow all users in my organization' toggle enabled or with specific users or groups selected on the share creation screen." Microsoft has not published which regions are impacted or how many customers are affected, but it labeled the problem an incident — a designation the company uses for service issues with noticeable user impact.
Microsoft's remediation and the immediate workaround
Microsoft is deploying a code change intended to correct the Graph API error. While that work is underway, the company published a 13-step mitigation procedure that administrators can follow to create shares without triggering the failing path. The steps, as provided by Microsoft, are:
- Go to the Azure portal, then Universal Print, then Printers
- Select the printer you want to share
- Click "Printer Share" (or "Share Printer")
- Enter the share name
- Do NOT check "Allow all users in my organization." Leave this unchecked.
- Do NOT select any specific users or groups at this step.
- Click "Share Printer"
- Wait 30 seconds for the share to fully propagate
- Navigate to Universal Print, then Printer Shares
- Select the newly created share
- Go to the "Members" tab (or "Access Control")
- Add users or security groups manually
- If all users need access, add an organization-wide security group (e.g., "All Company") from your Entra ID directory
After applying the workaround, Microsoft advises waiting one to two minutes and retrying if the share creation still fails.
How Microsoft's recent service responses set context
The Universal Print incident is the latest in a string of rapid-response fixes Microsoft has pushed in recent weeks. Last month the company released out-of-band updates to correct broken sign-ins with Microsoft accounts across multiple Microsoft apps. More recently, on Friday Microsoft reverted a service update that was preventing some Microsoft Teams users from launching the desktop client, and over the weekend it issued emergency updates to address known Windows Server issues that were causing security update installation failures and domain controllers to enter a restart loop.
What this means for IT administrators, Microsoft 365 customers, and end users
IT administrators and technologists: Follow the 13-step mitigation and be prepared to add users or organization-wide security groups from your Entra ID directory after creating shares. Expect to monitor propagation delays and to allow short wait times (30 seconds to two minutes) between steps.
Microsoft 365 customers and enterprise procurement leaders: Track incident UP1287359 and Microsoft's deployment of the corrective code change before broadly enabling "Allow all users in my organization" share settings. If organization-wide access is required, the guidance points to adding an organization-wide security group such as "All Company" from Entra ID as the supported route.
End users and help desks: Be aware that attempts to create or access new printer shares may intermittently fail with a "Sharing Print Failed" error. Short delays and a manual member-add step are currently the practical workarounds.
Microsoft's immediate remedial step is a targeted code deployment to the Graph API and the provision of an explicit mitigation procedure for administrators. The company has identified the mechanism — increased Entra ID replication latency exposing a race condition in Universal Print — and has labeled the issue an incident while it applies a fix. Microsoft has not yet published scope details such as impacted regions or user counts, so organizations will need to follow the company's incident updates as they roll out the corrective change and monitor Universal Print behavior closely.
Original reporting: https://www.bleepingcomputer.com/news/microsoft/microsoft-graph-api-code-change-causes-universal-print-share-issues/
