Security Policy Errors

How to Block USB Devices on Windows 11 Using Microsoft Intune

Steve K Oct 19, 2026 868 views

Question details

The user needs to configure and troubleshoot a Microsoft Intune policy to effectively block USB storage device usage on Windows 11 computers.

How to Block USB Devices on Windows 11 PCs Using Microsoft Intune

Product: Microsoft Intune
Device & OS: Windows 11
Scenario: Configuring an Endpoint Security device control policy to restrict removable USB storage access across an organization's endpoints.
Observed behavior: The policy may fail to apply properly if assigned to user accounts instead of devices, or if the Windows 11 endpoints have not recently synced to retrieve the latest MDM policies.

Before you start

Ensure you have Endpoint Administrator privileges in the Microsoft Intune admin center and that the target Windows 11 devices are properly enrolled and compliant.

Solution 1Recommended

Assign the USB Device Control Policy to Device Groups

Assigning the restriction policy directly to device groups rather than user accounts ensures the USB block applies universally to the hardware regardless of who logs in.

When deploying hardware-level restrictions like USB removable storage blocking, targeting device groups is highly recommended. User-based assignments can lead to inconsistent application depending on the login session.

Access the Intune Admin Center

Navigate to Attack Surface Reduction

Go to Endpoint security in the left-hand navigation pane, then select Attack surface reduction.

Edit the Device Control Policy

Select your existing Device Control policy for Windows 10 and later, or create a new profile specifically for removable storage access control.

Modify Assignments

Navigate to the Assignments tab. Remove any existing 'User Groups' and click 'Add groups' to include the appropriate 'Device Groups' containing your Windows 11 endpoints.

Save and Deploy

Review your changes and click 'Save'. The policy will be deployed to the targeted endpoints during their next check-in cycle.

Assign the USB Device Control Policy to Device Groups

Policy Application Delay: Intune policies are not applied instantly. It may take some time, or require users to sign out, restart, or manually sync their machines before the USB restriction takes full effect.

Solution 2

Manually Force a Policy Sync on the Endpoint

Force the Windows 11 endpoint to check in with Intune to download and apply the newly assigned USB restriction policies immediately.

Free Microsoft Office alternative

Looking for a Lightweight Office Suite for Your Secured Endpoints?

While securing your Windows 11 endpoints with Intune, you might also be evaluating cost-effective software deployments. WPS Office provides a free, highly compatible, and lightweight alternative to Microsoft Office, perfect for secure, restricted enterprise environments.

100% compatible with Microsoft Word, Excel, and PowerPoint formats.Lightweight installation with minimal system resource consumption on endpoints.Familiar user interface requiring zero learning curve for employees.Secure and efficient local document processing for offline environments.

Frequently Asked Questions

Why isn't my Intune USB block policy working on Windows 11?

The most common reason is assigning the policy to user groups instead of device groups. Additionally, ensure the device has synced with Intune recently, as policy application is not instantaneous and may require a device restart.

Does blocking USB devices in Intune also block USB mice and keyboards?

No. If configured correctly using Removable Storage Access rules under Attack Surface Reduction, the policy will only block mass storage devices like USB flash drives. Input devices like USB mice and keyboards will continue to function normally.

How can I check if the device control policy applied successfully?

You can verify the policy status in the Microsoft Intune admin center by checking the device's configuration profile status, or locally on the Windows 11 PC by generating and viewing the Advanced Diagnostic Report for MDM.

Can I make exceptions for specific authorized USB drives?

Yes. Intune's advanced device control policies allow administrators to create exclusions based on specific hardware IDs or instance IDs, enabling the use of company-authorized IT drives while blocking all other unapproved removable storage.

Microsoft Office Security Issues