Microsoft Intune – Restrict Copying Corporate Data to USB Device

In this post we will see how can we restrict copying corporate data to USB device in Microsoft Intune. With Microsoft Intune we can do endless things and these are very focused on security issues of our devices and user data.

You can restrict copying the data to USB devices in Microsoft Intune by creating a custom profile. Let’s see how to achieve Microsoft Intune USB control. In this post I will show how to prevent our company data in a corporate profile from being used to copy or cut them in removable media.

Microsoft has this article on Prevent data leaks on non-managed devices using Microsoft Intune. Go through the article once as it is very informative.

Microsoft Intune – Restrict Copying Corporate Data to USB Device

Using Microsoft Intune, we will first create a new custom profile. Under the Device Configuration, click Profiles. In the right pane, select Windows 10 and later as Platform and profile as Custom.

On the custom OMA-URI settings page, we add the following information.

• Name: USB Disable Access
• Description: USB Disable Access
• OMA-URI: ./Device/Vendor/MSFT/Policy/Config/Storage/RemovableDiskDenyWriteAccess
• Data Type: Integer
• Value: 1

Click OK when you add the above info.

Next, we assign the settings to our desired groups. After few minutes, the settings should apply the USB restriction policy to our devices.

Login to the client computer. Connect a USB device and copy any corporate file.

Go to the USB device and paste the copied content.

A warning message will appear with a note. You’re trying to copy work protected content to a removable drive. If you select Copy as work protected, it will still not allow the data to be copied over to USB drive.

If you select Copy as work protected, in the next step you see destination folder access denied. It also says you will need administrator permissions to copy to this folder. Let’s click Continue.

What you now see is same access denied window with Try again button. So this is how in Microsoft Intune, you can restrict copying corporate data to USB Device.

I hope you found this post useful. If you have any questions, you can add them in the comments section.