Blocking USB Drives on Windows with Intune

The USB drive remains one of the most mundane vectors for data leakage and infection there is: a confidential file copied in seconds onto a stick that will leave the building, ransomware introduced from a drive found in the car park, or simply a departing employee who walks off with the client database in their pocket. No firewall sees that data move, and no antivirus reliably blocks an unknown executable. The physical USB port is a classic blind spot in endpoint security.

On a Windows fleet managed by Microsoft Intune, you can fortunately block or restrict removable storage centrally, without visiting each machine or writing a single line of PowerShell. This article is for IT managers and security leads at small and mid-sized companies, as well as managed service providers, who want to reduce this risk cleanly. The real challenge is not to forbid everything: it is to cut off removable storage without breaking legitimate peripherals like keyboards, mice, headsets or webcams, which use exactly the same connector.

Understand what Intune actually controls

Before configuring anything, grasp one essential distinction: Intune does not block "the USB port" in a physical sense. It applies rules to device classes. A USB stick, an external hard drive or an SD card present themselves to the system as removable storage devices, whereas a keyboard presents itself as a human interface device. These are two different categories, and that is precisely what lets you block one without touching the other.

Two main approaches coexist in Intune, with complementary logic.

• A configuration profile (administrative template or settings catalog) allows simple, blanket settings, for example denying installation of removable storage classes or forcing read-only mode.
• A device control policy, available under endpoint security and backed by Microsoft Defender, offers much finer control based on rules, device groups and conditions.
• Both rely on the Windows configuration service provider and require no manual work on the endpoints themselves.

Choose the right restriction level

Restriction is not binary. Depending on the sensitivity of the data being handled, your industry and your compliance obligations, several postures are possible, from the most permissive to the strictest. The right choice depends as much on the real risk as on legitimate business needs.

From a full block to a targeted allow list

• Full block: neither reading nor writing is possible on removable media. It is the safest option, but also the most constraining.
• Read-only: files already on the drive can still be opened, but nothing can be copied to it. An excellent compromise that prevents exfiltration while letting people receive a document from outside.
• Targeted allow: only specific devices, identified by their hardware or serial ID, are accepted, and everything else is refused.
• Mandatory encryption: allowed media only work when encrypted with BitLocker To Go, so a lost drive stays unreadable.

A concrete example

Take a thirty-person accountancy firm. Staff have no reason to write client files onto a stick, but they occasionally receive documents on physical media. The ideal posture is not a full block: it is read-only by default, paired with a BitLocker To Go requirement for the rare cases where writing is essential, restricted to a handful of people through a dedicated group.

The best USB restriction is not the strictest one: it is the one that cuts the risk without provoking workarounds.

Put the policy in place step by step

A successful rollout always happens in stages. A restriction pushed to the whole fleet at once will invariably block a use nobody had thought of, a technician's diagnostic drive or an industrial peripheral that presents itself as storage.

1. 1Map real usage first: who plugs in what, and why. A short observation period avoids many nasty surprises.
2. 2Create the policy targeting removable storage classes on a pilot group of Windows PCs, never on the whole organization to begin with.
3. 3Set the level you want: full block, read-only, or targeted allow with or without BitLocker To Go.
4. 4Test on a pilot machine with a real USB stick, a real external drive and a USB keyboard to confirm input devices are not affected.
5. 5Communicate with users and present the legitimate alternative before any wider rollout.
6. 6Expand in successive waves, watching tickets and exception requests at each step.

Do not forget usability and alternatives

A security measure that gets in the way too much ends up bypassed, through a personal stick or an email to a consumer mailbox, which makes the risk worse rather than better. Before blocking, always plan a legitimate alternative and communicate clearly, so the restriction is understood rather than resented.

• Offer a credible alternative: a shared SharePoint space or a synced OneDrive folder replaces the stick nicely for moving and exchanging files.
• Explicitly verify that input devices, keyboard, mouse, headset and webcam, still work after the policy applies.
• Provide a simple exception process for occasional, legitimate needs, rather than letting users improvise.
• Document the measure, its scope and its effective date: it is a control frequently expected during an ISO 27001, NIS2 or GDPR audit.

The most common pitfalls

A few mistakes come up again and again. The most frequent is blocking too broadly and accidentally cutting off input devices on some laptop models. Next comes forgetting encryption: allowing sticks without enforcing BitLocker To Go leaves the loss risk fully open. Finally, many teams deploy without documenting, then struggle to prove the control exists on audit day.

How AuPoint makes this simple

Telling removable storage apart from legitimate peripherals means dealing with hard-to-read class identifiers and hardware IDs, and juggling several types of Intune policy. AuPoint provides a ready-to-use USB control policy, in plain language and with no PowerShell. You pick the level you want in a few clicks, you see the impact before applying it thanks to the preview, and you keep an instant rollback if a legitimate use is affected. The break-glass safety mechanism keeps you from locking yourself out, and every policy stays reversible.

FAQ

Will blocking USB storage disable my keyboard or mouse?

No, provided you target the removable storage class and not all USB devices. Keyboards, mice and headsets belong to distinct classes and keep working. You should still validate on a pilot machine, because some composite peripherals can declare themselves in unexpected ways.

What is the difference between read-only mode and a full block?

Read-only lets people view the contents of a stick but forbids copying anything to it: it blocks exfiltration while still allowing files to be received. A full block refuses both reading and writing. Read-only is often the best compromise to start with.

Do I really need to enforce BitLocker To Go?

As soon as you allow writing to removable media, yes. BitLocker To Go encrypts the contents of the drive, so a loss or theft does not expose the data. Without it, a single misplaced stick can be enough to trigger a reportable data breach.

Ready to take back control of your USB ports without breaking day-to-day work? Connect your Microsoft tenant in a few clicks and start free at aupoint.io: preview the impact, roll out in stages, and stay in control at every step.