Skip to main content

Device control: USB and removable media

Microsoft documentedDefender for Endpoint · Source checked 2026-10-22 · Not yet verified in tenant · Sources: [1][2][3][4][5][6][7][8][9][10]

What it is​

Device control in Defender for Endpoint decides whether a user can read, write or execute on removable storage, CD/DVD, Windows Portable Devices (phones, cameras) and printers. On macOS it also covers Apple devices and Bluetooth file transfer. It is enforced by the Defender engine on the endpoint and reports every decision to the portal. It is off by default. When off, everything is allowed.

It is not Windows device installation restrictions (the ADMX "Prevent installation of devices" policies). Those block the driver install at the PnP layer. Device control controls access to a device that is already installed. It is also not Endpoint DLP. DLP looks at content and can capture copies of files that leave the machine. Device control looks at the device.

A Windows device is only in scope if it mounts a drive letter. Keyboards, mice, docks, webcams and audio devices never get one, so they are not touched. No exclusion needed.

Licensing and prerequisites​

  • MDE Plan 1 is enough for enforcement on Windows and macOS. Defender for Business works too. The report and advanced hunting need the E5 reporting entitlement.
  • Windows 10 or 11, antimalware platform 4.18.2103.3 or later. VID_PID matching needs 4.18.2104, WPD 4.18.2107, printers 4.18.2205, file-level masks 4.18.2207. Windows Server is not supported even though the Intune profile lists it.
  • macOS: Defender 101.96.85 or later, onboarded. Full Disk Access for com.microsoft.dlp.daemon (the standard mdatp-xplat FDA profile covers it) and DC_in_dlp enabled in Defender preferences.
  • Intune, or Group Policy on Windows, or Jamf on macOS. One per machine. If GPO and Intune both land on a Windows device, GPO wins.

How it works​

The model is the same on both platforms: groups, rules, entries, default enforcement.

  • A group is a filter on device properties. On Windows the properties are PrimaryId (device family), InstancePathId, DeviceId, HardwareId, FriendlyNameId, BusId, SerialNumberId, VID, PID, VID_PID and DeviceEncryptionStateId (preview, BitLocker state). Printers add PrinterConnectionId. Match types are MatchAny, MatchAll, MatchExcludeAny, MatchExcludeAll. On macOS a group is a query built from all, any and not with clauses primaryId, vendorId, productId, serialNumber, encryption (apfs), groupId and the SD card media* clauses.
  • A rule has an included group list and an excluded group list. The device must be in all included groups and none of the excluded groups. Then the rule's entries are evaluated.
  • An entry is one action for one access mask. Windows types are Allow, Deny, AuditAllowed, AuditDenied. macOS types are allow, deny, auditAllow, auditDeny. Enforcement entries are checked in order until the requested access is matched. Audit entries run after the decision and all matching ones fire. An entry can be scoped with Sid (user) and ComputerSid (machine).
  • The Windows access mask is a bitwise OR: 1 disk read, 2 disk write, 4 disk execute, 8 file read, 16 file write, 32 file execute, 64 print. Read-only at disk level is 1. Disk-level read plus file-level read is 9. macOS uses named access values: read, write, execute for removableMedia, or generic_read, generic_write, generic_execute for any type.
  • If no rule matches, default enforcement applies. Allow unless you set Deny. It is global: Deny also blocks printers, CD/DVD and WPD unless you scope device types with SecuredDevicesConfiguration (Windows) or settings.features (macOS).

Intune does not honour rule order. Make rules non-intersecting with explicit excludes.

Windows AuditDenied options: 0 nothing, 1 toast, 2 event, 3 both. AuditAllowed option 2 sends the event. Toast at most once per hour. Advanced hunting keeps at most 300 RemovableStoragePolicyTriggered events per device per day.

Windows policy reaches the device as XML, one file per rule and one per group under the Defender CSP. The Intune Device Control profile and reusable settings groups generate that XML for you. macOS policy is one JSON document with groups, rules and settings, embedded as a string under the deviceControl > policy key of a com.microsoft.wdav mobileconfig payload. Advanced conditions (network, VPN, file, print job groups referenced from Parameters) are Windows XML only.

Windows Bluetooth is not handled here; use the Bluetooth policy CSP. File evidence (a copy of what was written to USB) is Endpoint DLP, not device control.

Configure​

Worked example used in every tab: block all removable storage, allow one USB stick read-only by serial number, keyboards and mice untouched.

Windows

  1. Intune admin center > Endpoint security > Attack surface reduction > Reusable settings tab > Add. Name it Approved USB. Configuration settings > Add > Removable storage > Edit instance. Property SerialNumberId, value the stick's serial. Review + Add. Max 100 instances per group.
  2. Add a second reusable group All removable storage. Property PrimaryId, value RemovableMediaDevices.
The Reusable settings tab under Endpoint security, where device groups are created once and referenced from any Device Control profile. Source: Microsoft Learn, CC BY 4.0.
The Reusable settings tab under Endpoint security, where device groups are created once and referenced from any Device Control profile. Source: Microsoft Learn, CC BY 4.0. · captured 2026-10-22
Picking a reusable settings group as an Included ID or Excluded ID inside a Device Control rule. Source: Microsoft Learn, CC BY 4.0.
Picking a reusable settings group as an Included ID or Excluded ID inside a Device Control rule. Source: Microsoft Learn, CC BY 4.0. · captured 2026-10-22
  1. Endpoint security > Attack surface reduction > Create policy. Platform Windows, profile Device Control. Name it.
  2. Configuration settings > Device Control > Add. This is your rule.
    • Rule 1 Deny all removable storage: Included ID = All removable storage, Excluded ID = Approved USB. Entry Type Deny, Access mask Read, Write, Execute. Add a second entry Type AuditDenied, Options show notification and send event, same mask.
    • Rule 2 Approved USB read only: Included ID = Approved USB. Entry Type Allow, Access mask Read. Second entry Type Deny, Access mask Write, Execute. Third entry AuditDenied, Options 3, Write, Execute.
  3. Leave the other sections (Device Installation Restrictions, Removable Storage Access, Storage, Connectivity, Bluetooth) unconfigured. They are separate Windows CSPs that share the profile.
The Device Control profile configuration page in the Intune admin center, where rules, entries and access masks are defined. Source: Microsoft Learn, CC BY 4.0.
The Device Control profile configuration page in the Intune admin center, where rules, entries and access masks are defined. Source: Microsoft Learn, CC BY 4.0. · captured 2026-10-22
  1. Assign to a device group. Do not combine Intune user-group targeting with Sid conditions in entries.

The profile UI cannot change default enforcement or device types. Leave default at Allow and let the explicit Deny rule do the work, or push these via a custom OMA-URI profile (Devices > Configuration > Create > Windows 10 and later > Templates > Custom). Microsoft recommends the profile plus reusable settings over raw OMA-URI XML. Use OMA-URI only for what the UI lacks, such as advanced conditions.

SettingOMA-URIValue
Enable device control./Vendor/MSFT/Defender/Configuration/DeviceControlEnabledInteger, 1
Default enforcement./Vendor/MSFT/Defender/Configuration/DefaultEnforcementInteger, 1 allow, 2 deny
Device types./Vendor/MSFT/Defender/Configuration/SecuredDevicesConfigurationString, pipe-separated, no spaces, for example RemovableMediaDevices
A custom OMA-URI profile row carrying a PolicyRules XML file, the path used for anything the Device Control profile UI cannot set. Source: Microsoft Learn, CC BY 4.0.
A custom OMA-URI profile row carrying a PolicyRules XML file, the path used for anything the Device Control profile UI cannot set. Source: Microsoft Learn, CC BY 4.0. · captured 2026-10-22

macOS

  1. Build the JSON (PowerShell / Terminal tab), validate it on a test Mac.
  2. Download demo.mobileconfig from the mdatp-devicecontrol repo. Replace the string value under deviceControl > policy with your JSON. Keep the dlp block that enables DC_in_dlp. Save as device-control.mobileconfig.
  3. Intune admin center > Devices > macOS > Configuration > Create > New policy. Platform macOS, profile type Templates, template Custom. Deployment channel Device channel. Upload the file. Assign.
The macOS custom configuration profile in Intune with the device control mobileconfig uploaded. Source: Microsoft Learn, CC BY 4.0.
The macOS custom configuration profile in Intune with the device control mobileconfig uploaded. Source: Microsoft Learn, CC BY 4.0. · captured 2026-10-22
  1. Make sure the Full Disk Access profile is already assigned and reporting compliant.

Verify​

Windows, on the endpoint. Plug in an unapproved stick. A toast appears with the rule name and device name, at most once an hour. Device Manager shows the device as blocked with details on click. Get-MpComputerStatus reflects the applied policy. Learn does not document an event log channel or event IDs for device control, so advanced hunting is the record.

Device Manager showing a removable device that device control has blocked. Source: Microsoft Learn, CC BY 4.0.
Device Manager showing a removable device that device control has blocked. Source: Microsoft Learn, CC BY 4.0. · captured 2026-10-22

macOS, on the endpoint.

mdatp health --details device_control

Healthy output has active : ["v2"], v2_configured : true, v2_state : "enabled", v2_sensor_connection : "created_ok", v2_full_disk_access : "approved". Then confirm what landed:

mdatp device-control policy preferences list
mdatp device-control policy rules list
mdatp device-control policy groups list

preferences list shows Default Enforcement. Mount the unapproved stick, expect the notification with the link from navigationTarget.

Portal. Defender portal > Reports > Endpoints > Device control card > open the report. It shows audit events (USB mount/unmount, PnP connect) and policy events with rule, access, verdict, media name, class, device ID, vendor ID, serial number and bus type. Filter on time range, media class name and device ID. Up to six hours lag. Export caps at 500 events; stream to Sentinel for more.

Advanced hunting. Learn's query, trimmed to what an auditor needs:

DeviceEvents
| where ActionType == "RemovableStoragePolicyTriggered"
| extend parsed = parse_json(AdditionalFields)
| extend RemovableStorageAccess = tostring(parsed.RemovableStorageAccess)
| extend RemovableStoragePolicyVerdict = tostring(parsed.RemovableStoragePolicyVerdict)
| extend RemovableStoragePolicy = tostring(parsed.RemovableStoragePolicy)
| extend MediaClassName = tostring(parsed.ClassName)
| extend MediaInstanceId = tostring(parsed.DeviceInstanceId)
| extend MediaSerialNumber = tostring(parsed.SerialNumber)
| extend VID_PID = strcat(tostring(parsed.VendorId), "_", tostring(parsed.ProductId))
| project Timestamp, DeviceName, InitiatingProcessAccountName, RemovableStoragePolicy, RemovableStorageAccess, RemovableStoragePolicyVerdict, MediaClassName, MediaInstanceId, MediaSerialNumber, VID_PID, FolderPath, FileSize
| order by Timestamp desc

RemovableStorageAccess is the mask the device asked for. Use it when an approved device still fails. PnPDeviceBlocked and PnPDeviceAllowed in the same table come from Windows device installation restrictions, not this policy.

Advanced hunting results for RemovableStoragePolicyTriggered events, with the parsed policy, access and verdict columns. Source: Microsoft Learn, CC BY 4.0.
Advanced hunting results for RemovableStoragePolicyTriggered events, with the parsed policy, access and verdict columns. Source: Microsoft Learn, CC BY 4.0. · captured 2026-10-22

Troubleshoot​

SymptomLikely causeFix
Policy never applies on WindowsPlatform version below 4.18.2103.3, or a BOM or unescaped & in the XMLCheck version with the MsMpEng.exe hunting query from the FAQ. Re-save the XML from the raw GitHub sample, validate with MpCmdRun.exe -DeviceControl -TestPolicyXml
Policy applies but devices stay accessibleDevice control not enabled, or default Allow with no Deny rule, or only audit rulesSet DeviceControlEnabled to 1. Audit-only inherits default enforcement. Pair every audit entry with Allow or Deny
Approved USB still blockedIt needs more than Read. Some Kingston encrypted sticks need Execute on their CD-ROM partition, some WD drives need disk-level WriteRead RemovableStorageAccess in hunting, grant that mask. To deny writes on those, use the file-level mask (16) instead of disk-level (2)
Approved USB matched on Windows but not macOSSerial number is not cross-platform in the same form, or the device has noneserialNumber on macOS does not match devices without a serial. Use vendorId plus productId instead
Keyboard or mouse blockedNot device control. HID devices have no drive letter and are out of scopeLook at the Device Installation Restrictions or Removable Storage Access sections of the same profile, or an ADMX policy. Those are separate CSPs
Printers stopped workingDefault enforcement Deny covers printersScope SecuredDevicesConfiguration to RemovableMediaDevices, or add an Allow rule for PrinterDevices
macOS shows v2_configured : falseProfile not delivered, or JSON invalid, or DC_in_dlp not enabledValidate with mdatp device-control policy validate. Check the dlp block is still in the mobileconfig
macOS v2_full_disk_access not approvedFull Disk Access profile missing for com.microsoft.dlp.daemonDeploy the mdatp-xplat Full Disk Access profile. Without it some operations are not blocked
macOS active shows ["v1","v2"]Old v1 device control config still presentRemove the v1 configuration
Empty folder created on a denied USBDocumented behaviour. Empty folders are not blocked by file-level Write DenyNothing to fix. Any non-empty file is still blocked
Rule works on a test machine, not in productionIntune user-group targeting combined with Sid entries, or GPO and Intune both appliedUse one targeting method. If GPO exists on the device, GPO wins

Gotchas and limits​

  • Default enforcement is global. Deny hits printers, CD/DVD and WPD too. Scope device types or add allow rules first, then flip the default.
  • The Intune profile cannot set default enforcement or device types. That needs OMA-URI or GPO. OMA-URI for globals plus the profile for rules on the same device is fine.
  • Rule order is not honoured in Intune. "First match wins on conflict" is only predictable in XML and GPO.
  • InstancePathId ends in a slot number that changes between ports. Use a trailing wildcard, or match SerialNumberId, VID_PID or DeviceId. HardwareId is shared across devices of the same model.
  • Hunting labels differ from policy names: "DeviceId" is InstancePathId, "Vendor Id" is HardwareId, "Media name" is FriendlyNameId.
  • One physical device can create several Device Manager entries (removable media plus WPD). Allow all of them or it half works.
  • Keyboards, mice and docks need no exclusion. A dock with a card reader or SSD bay does present a drive letter, and that storage is controlled like any USB stick.
  • BitLocker To Go is not a substitute, but DeviceEncryptionStateId (preview) matches BitlockerEncrypted or Plain, so you can allow encrypted sticks only.
  • Entra Sid conditions need noninteractive Graph access from the device. Conditional Access forcing interactive auth breaks the match. Lock or sign-out can drop user conditions. Prefer Intune group targeting.
  • macOS has no FriendlyNameId, InstancePathId, HardwareId, printer control or advanced conditions, but has Apple device, portable device, Bluetooth and APFS clauses. Android on macOS is only restricted in PTP mode.
  • Limits: 350,000 characters of OMA-URI XML, 100 instances per reusable group, 100 groups per profile, 300 hunting events per device per day, 500 rows per export.

Further reading​

No macOS device control post from the last 12 months met the bar; the Microsoft Tech Community macOS guide is from mid 2025 and was left out.

My notes​

TODO: Sohail's notes after verification.

Changelog​

DateChangeSource
2026-10-22Drafted from Learn[1]
2026-10-22Added Learn images, diagrams, further reading