Block USB Storage in Intune: 2 Easy Methods

Before you block USB storage in Intune, it helps to understand exactly what the restriction targets and what it leaves untouched. This is one of the most common points of confusion for admins who are new to Intune endpoint security. The settings in this guide control removable storage access. They do not disable the physical USB ports, and they do not block every USB device connected to the computer.

Full block versus write block only

The two methods covered in this guide behave differently depending on which setting you use:

For most organisations, a full block is the better starting point because it prevents both reading from and writing to removable storage. If you need to allow users to read from a USB drive but prevent them from copying company data to it, the Deny Write Access approach gives you that flexibility.

Before you block USB storage in Intune, confirm the following are in place:

• Windows 10 or Windows 11 devices enrolled in Microsoft Intune
• An appropriate Intune role, such as Intune Administrator, Endpoint Security Manager, or Policy and Profile Manager
• A Microsoft Entra ID security group containing the Windows devices you want to target
• A USB flash drive available for testing after the policy applies

The Settings Catalog is the cleanest way to block USB storage in Intune. It uses a Windows Administrative Templates setting exposed through Intune and applies a full block across removable storage classes.

1. 1

   Create a new configuration policy

   Sign in to the Microsoft Intune admin center and navigate to:

   Devices›Manage devices›Configuration›Create›New policy

   
2. 2

   Select platform and profile type

   On the Create a policy screen, configure the following and click Create:

   • Platform: Windows 10 and later
   • Profile type: Settings catalog

   
3. 3

   Name the policy

   On the Basics tab, give the policy a clear name your team will recognise. A consistent naming convention makes policies easier to manage as your Intune environment grows.

   • Name: CFG-WIN-Block-USB-Storage
   • Description: Blocks all removable USB storage access on managed Windows devices.

   Click Next.

   
4. 4

   Add the setting

   On the Configuration settings tab, click Add settings. The Settings picker opens on the right. Search, or browse to:

   Administrative Templates›System›Removable Storage Access

   Find All Removable Storage classes: Deny all access and add it to the policy.

   Device scope tip

   If Intune shows both user-scoped and device-scoped versions of the setting, choose the device-scoped setting. When you block USB storage in Intune, the restriction should apply to the device, not only to a specific signed-in user.

   

   Back on the Configuration settings tab, set the value to Enabled and click Next.

   
5. 5

   Assign and create

   On the Assignments tab, click Add groups under Included groups and select your target Windows device group. Click through Scope tags, review the summary, and click Create.

   

   The policy is now created and will be delivered to devices in the assigned group when they next check in with Intune.

This method uses the Endpoint security area of Intune rather than a standard Configuration profile. It's the right approach if you want to block write access to USB drives but still allow users to read from them, or if you're already managing removable media as part of a broader Attack Surface Reduction strategy.

1. 1

   Navigate to Attack Surface Reduction

   Endpoint security›Attack surface reduction›Create Policy

   
2. 2

   Select platform and profile

   • Platform: Windows
   • Profile: Device Control

   Click Create.

3. 3

   Name the policy and configure the setting

   Give the policy a descriptive name on the Basics tab. On Configuration settings, expand the Storage category and locate Removable Disk: Deny Write Access. Set this to Enabled.

   Important

   The setting is called Deny Write Access, so setting it to Enabled means you are enabling the denial. In simple terms: Enabled = write access is blocked. Disabled or Not configured means write access is allowed by default.

   
4. 4

   Assign and create

   On the Assignments tab, add your target Windows device group, click through Scope tags, review the summary, and click Create.

One of the most important decisions when you block USB storage in Intune is whether to assign the policy to a device group or a user group. For USB storage blocking, a device group is the recommended choice.

Here's why: a USB storage block is a machine-level security control. The goal is for the restriction to apply to that Windows device regardless of who signs in. Device targeting makes the policy easier to understand, easier to report on, and easier to exclude cleanly when a specific device needs an exception.

Always start with a small pilot device group rather than assigning to all devices immediately. Deploy to a handful of test machines, confirm the block works as expected, check that no legitimate business workflows are disrupted, and then expand the assignment to the full fleet.

After creating the policy and waiting for the device to check in, confirm that it was received and processed successfully. Navigate to:

The report can show Succeeded, Error, Conflict, Pending, or Not applicable. For a successful test deployment, the target device should show Succeeded with no Error or Conflict.

Intune reporting confirms the policy was delivered to the device. You should also verify the actual behaviour on the endpoint itself. Reporting tells you the policy arrived; the endpoint test tells you what the user will experience.

How to test

Plug a USB flash drive into the managed Windows device. Open File Explorer and try to access the drive. If the full block policy applied correctly, you'll see an access denied message similar to this:

If you used the Deny Write Access method instead, the drive opens and you can read files from it. However, attempting to copy a file to the drive returns an access denied error.

This is the definitive confirmation that you've successfully blocked USB storage. The access denied error on the endpoint is what you're aiming for, not just a green status in the Intune portal.

If you've followed the steps above but the policy shows Pending after an extended wait, or the USB drive is still accessible on the endpoint after the policy reports Succeeded, work through the following checks in order.

1. 1

   Force a sync

   The most common reason a policy stays Pending is that the device hasn't checked in or hasn't reported its latest status. Standard maintenance check-ins happen on a schedule, but you can force a sync manually.

   From the Intune admin center:

   Devices›All devices›[device name]›Sync

   

   From the device itself: Settings › Accounts › Access work or school › [connected work account] › Info › Sync

   From Company Portal: open Company Portal on the device and use Settings › Sync, or go to the device details and check status.

2. 2

   Confirm the device is in the correct group

   Open Microsoft Entra admin center and check the membership of the security group the policy is assigned to. If the target device isn't a member, the policy will not reach it. If you're using a dynamic device group, remember that group membership can take time to calculate — for urgent testing, use a small static pilot device group.

3. 3

   Confirm the device is enrolled in Intune

   Open the device record in Intune and verify that the device is managed by Intune. A device that is only Microsoft Entra joined but not Intune enrolled will not receive the policy. These are related states, but they are not the same thing.

4. 4

   Check for policy conflicts

   If the policy status shows Conflict rather than Succeeded, another policy is configuring the same setting with a different value. Open the policy report, review the per-setting status, and identify the setting causing the conflict, then check which other policies also target the same device and configure the same setting. To resolve it, set the duplicate setting to Not configured in one of the policies, sync the device, and refresh the report.

5. 5

   Unplug, replug, and restart if needed

   If the policy reports Succeeded but the USB drive is still accessible, unplug the USB drive and plug it in again. If the result doesn't change, restart the device and test again in a fresh Windows session.

In most organisations, a small number of devices may need to be excluded from a USB block. For example, an IT technician may have a dedicated troubleshooting laptop that needs to use bootable USB media, or a specific team may have approved workstations used to receive data from physical drives.

Because this guide recommends assigning the policy to a device group, the cleanest exception design is also device-based: include a device group, and exclude a device group.

1. 1

   Create a dedicated exception group

   In Microsoft Entra ID, create a dedicated security group for approved exception devices, for example: GRP-USB-Policy-Exception-Devices

2. 2

   Add only approved devices

   Add only the approved device objects to this group.

3. 3

   Exclude the group from the policy

   Open your USB block policy and go to:

   Properties›Assignments›Edit›Excluded groups›Add groups

   Select your exception device group, review the assignment, and save the policy. Any device in that exception group will be skipped by the policy assignment.

Now that you know how to block USB storage in Intune, you can protect your managed Windows fleet from data exfiltration and removable-media risk in just a few minutes, without affecting keyboards, mice, or other normal USB input devices. A single Settings Catalog policy deployed to a device group is the fastest, most reliable way to get there.