A USB stick is still one of the easiest ways for data to leave a business and for malware to walk in. Intune USB device control lets you decide, per device and per user, whether removable storage can be read, written or used at all, without sending a technician to every desk. This guide covers the options Microsoft gives you, which one to pick, and how to roll it out without breaking printers or the finance team’s encrypted backup drive.
Three ways to control USB in the Microsoft stack
Microsoft offers more than one tool for this, and they overlap. Picking the right one first saves a lot of rework.
Option
What it does
Best for
Simple Windows policy settings (for example Storage/RemovableDiskDenyWriteAccess)
Blanket allow or deny, such as read-only USB for everyone
Quick wins where nobody needs exceptions
Defender for Endpoint device control (Intune Device Control profile)
Granular allow, deny and audit rules by device type, vendor, product, serial number, user and access type
Most businesses: block by default, allow approved drives
Microsoft Purview endpoint DLP
Content-aware rules, for example block copying files labelled Confidential to USB
Regulated data where the content matters more than the device
Microsoft also documents device installation restrictions, which stop Windows installing the driver for a device class or ID. They are blunt and can block things you did not intend, so I only use them for specific hardware classes.
For a typical 20 to 500 person business, the second option is the sweet spot. It is managed from Intune, it reports into Microsoft Defender XDR, and it handles the “block everything except these approved encrypted drives” policy that most auditors want to see.
What device control can and cannot see
An important detail from Microsoft’s documentation: on Windows, “removable media” does not mean every USB device. Device control applies to removable media that creates a drive letter (such as E:), CD and DVD drives, Windows Portable Devices such as phones and tablets, and printers. A USB keyboard, mouse or headset is not removable storage and is not affected by a storage rule.
That is good news for a rollout. You can set removable storage to deny without worrying about peripherals. The catch is printers and portable devices, covered below.
Device control requires Windows 10 or Windows 11 with a current Defender antimalware client. Microsoft states it is not supported on Windows Server, and macOS has its own device control configuration. On licensing, Microsoft lists a subscription with Microsoft Defender for Endpoint Plan 1 capabilities as the requirement. Microsoft 365 E3 includes Plan 1 and E5 includes Plan 2. If you are on Business Premium, which includes Microsoft Defender for Business, confirm device control is available in your tenant before you plan around it.
Plan the policy before you build it
Answer these questions first. They become your rules.
Does anyone genuinely need to write to USB? Usually a handful: IT, someone who sends files to a print shop, a manager who takes board packs to meetings.
Should USB be read-only for everyone else, or fully blocked? Read-only is a good compromise when staff receive files from clients on a stick.
Will you issue approved encrypted drives? If so, record the vendor ID, product ID or serial numbers so you can allow those specifically.
Do you want auditing only for a few weeks first? You should. Audit mode shows who is using USB and for what before you block anything.
Do any users rely on phones connected by cable (MTP) or CD/DVD drives? Decide whether those count as allowed.
Build it in Intune: step by step
In the Microsoft Intune admin center, go to Endpoint security > Attack surface reduction.
Open the Reusable settings tab and create a Removable storage group for your approved drives. Define them by vendor and product ID or by serial number. Create a second group that matches all removable storage.
Back on the policy tab, select Create policy, choose platform Windows and profile Device Control.
Enable device control and set the default enforcement. Start with Allow plus audit rules while you gather data.
Add rules: audit write access to all removable storage; allow full access to the approved drive group for the IT and exception groups.
Assign the policy to a pilot device group and watch the results in advanced hunting in the Microsoft Defender portal for two to four weeks.
When you are confident, change the main rule from audit to deny for write (or for all access), and widen the assignment.
Microsoft’s walkthroughs also show the equivalent custom OMA-URI settings under ./Vendor/MSFT/Defender/Configuration/ if you prefer custom profiles. The endpoint security profile is easier to read and review, so I recommend it unless you already manage device control by XML.
The printer gotcha
This is the one that generates the Monday morning calls. If you set device control default enforcement to Deny, Microsoft notes that it applies to all device control families, including printers, CD/DVD and portable devices, not just USB storage. Suddenly nobody can print.
Two ways to avoid it:
Scope the protected device types to removable media only, so default enforcement does not reach printers.
Or keep default deny and add an explicit allow rule for printers.
Test printing, phone charging over USB and any docking stations during the pilot. Docks are usually fine, but a dock with a built-in card reader will show up as removable storage.
Pair device control with encryption
Blocking unapproved drives is half the job. The approved drives also need protecting. If your business issues USB drives, use hardware-encrypted models or require BitLocker To Go. Windows has a BitLocker policy to deny write access to removable drives that are not protected by BitLocker, which Intune can deploy through the endpoint security disk encryption profile or the settings catalog.
Combined, the result is simple to explain to staff: you can read a client’s USB stick, but you can only write to a company-issued encrypted drive. That is a defensible position for cyber insurance questionnaires and most compliance frameworks.
For regulated data, add Purview endpoint DLP on top. Device control decides which drives are allowed. DLP decides which files can go to them. A sensitivity label on a patient record or a client contract can block the copy even to an approved drive.
Frequently asked questions
Will Intune USB device control block keyboards and mice?
No. Defender for Endpoint device control applies to removable storage that creates a drive letter, CD/DVD drives, portable devices and printers. Keyboards, mice and headsets are not in scope for storage rules.
Can I allow only company-issued USB drives?
Yes. Create a reusable removable storage group in Intune that matches your approved drives by vendor ID, product ID or serial number, then allow that group and deny everything else.
Does device control work on Windows Server or Mac?
Microsoft states device control is not supported on Windows Server. macOS is supported through Defender for Endpoint on Mac with its own policy format, which Intune can deploy as a configuration profile.
Not sure who is copying data to USB today? Start with a free Microsoft 365 security assessment and we will show you what your Defender and Intune data already reveals.
A USB stick is still one of the easiest ways for data to leave a business and for malware to walk in. Intune USB device control lets you decide, per device and per user, whether removable storage can be read, written or used at all, without sending a technician to every desk. This guide covers the options Microsoft gives you, which one to pick, and how to roll it out without breaking printers or the finance team’s encrypted backup drive.
Three ways to control USB in the Microsoft stack
Microsoft offers more than one tool for this, and they overlap. Picking the right one first saves a lot of rework.
Storage/RemovableDiskDenyWriteAccess)Microsoft also documents device installation restrictions, which stop Windows installing the driver for a device class or ID. They are blunt and can block things you did not intend, so I only use them for specific hardware classes.
For a typical 20 to 500 person business, the second option is the sweet spot. It is managed from Intune, it reports into Microsoft Defender XDR, and it handles the “block everything except these approved encrypted drives” policy that most auditors want to see.
What device control can and cannot see
An important detail from Microsoft’s documentation: on Windows, “removable media” does not mean every USB device. Device control applies to removable media that creates a drive letter (such as
E:), CD and DVD drives, Windows Portable Devices such as phones and tablets, and printers. A USB keyboard, mouse or headset is not removable storage and is not affected by a storage rule.That is good news for a rollout. You can set removable storage to deny without worrying about peripherals. The catch is printers and portable devices, covered below.
Device control requires Windows 10 or Windows 11 with a current Defender antimalware client. Microsoft states it is not supported on Windows Server, and macOS has its own device control configuration. On licensing, Microsoft lists a subscription with Microsoft Defender for Endpoint Plan 1 capabilities as the requirement. Microsoft 365 E3 includes Plan 1 and E5 includes Plan 2. If you are on Business Premium, which includes Microsoft Defender for Business, confirm device control is available in your tenant before you plan around it.
Plan the policy before you build it
Answer these questions first. They become your rules.
Build it in Intune: step by step
Endpoint security > Attack surface reduction.Microsoft’s walkthroughs also show the equivalent custom OMA-URI settings under
./Vendor/MSFT/Defender/Configuration/if you prefer custom profiles. The endpoint security profile is easier to read and review, so I recommend it unless you already manage device control by XML.The printer gotcha
This is the one that generates the Monday morning calls. If you set device control default enforcement to Deny, Microsoft notes that it applies to all device control families, including printers, CD/DVD and portable devices, not just USB storage. Suddenly nobody can print.
Two ways to avoid it:
Test printing, phone charging over USB and any docking stations during the pilot. Docks are usually fine, but a dock with a built-in card reader will show up as removable storage.
Pair device control with encryption
Blocking unapproved drives is half the job. The approved drives also need protecting. If your business issues USB drives, use hardware-encrypted models or require BitLocker To Go. Windows has a BitLocker policy to deny write access to removable drives that are not protected by BitLocker, which Intune can deploy through the endpoint security disk encryption profile or the settings catalog.
Combined, the result is simple to explain to staff: you can read a client’s USB stick, but you can only write to a company-issued encrypted drive. That is a defensible position for cyber insurance questionnaires and most compliance frameworks.
For regulated data, add Purview endpoint DLP on top. Device control decides which drives are allowed. DLP decides which files can go to them. A sensitivity label on a patient record or a client contract can block the copy even to an approved drive.
Frequently asked questions
Will Intune USB device control block keyboards and mice?
No. Defender for Endpoint device control applies to removable storage that creates a drive letter, CD/DVD drives, portable devices and printers. Keyboards, mice and headsets are not in scope for storage rules.
Can I allow only company-issued USB drives?
Yes. Create a reusable removable storage group in Intune that matches your approved drives by vendor ID, product ID or serial number, then allow that group and deny everything else.
Does device control work on Windows Server or Mac?
Microsoft states device control is not supported on Windows Server. macOS is supported through Defender for Endpoint on Mac with its own policy format, which Intune can deploy as a configuration profile.
Microsoft’s device control configuration guide covers every setting and the OMA-URI paths. If you want help designing the rules, our Defender for Endpoint service includes device control, and our endpoint security baseline bundles it with ASR rules and disk encryption. For content-aware controls, see our DLP policy configuration work.
Not sure who is copying data to USB today? Start with a free Microsoft 365 security assessment and we will show you what your Defender and Intune data already reveals.