Share via

Block mobile phones when connected to a device as Removable Storage

Josep Marzo 20 Reputation points
2024-05-22T13:21:53.0233333+00:00

Hi all,

I'm trying to block all USB removable media connected to my company's laptops to about security breaches. I'm able to block USB pendrives and external hard drives, but If a connect a mobile phone (Android) to a laptop and set the connection to "File Transfer" or "PTP connection", I'm able to copy files from/to the mobile phone's storage. For the block, I've created a Configuration Profile in InTune only for Windows devices for now, but I'd also want to block MacOS devices.

One of the differences between both type of device connection is that when I connect a USB pendrive or external HD, it creates a new drive and assigns a drive letter, but this doesn't happen with mobile phones.

If I run a KQL query, I see that an external usb drive creates a "UsbDriveMounted" record in the "DeviceEvents" table but this doesn't happen when connecting a mobile phone. In this case, I get a "PnpDeviceConnected" record. The problem with that last record type is that I get it when connecting any USB device. There's a field in the record called "ClassName" in "AdditioinalFields" which identifies mobile phones as "WPD", but I'm not sure yet if this "WPD" identifies only mobile phones or other kind USB devices.

Am I taking the correct approach for this or there's any other easier way of blocking those kind of devices? I've been only able to make tests with an Android device but I'd also like to block iOS devices.

Thanks in advance for your help.

Microsoft Intune Security
Microsoft Intune Security
Microsoft Intune: A Microsoft cloud-based management solution that offers mobile device management, mobile application management, and PC management capabilities.Security: The precautions taken to guard against crime, attack, sabotage, espionage, or another threat.
491 questions
0 comments

2 answers

Sort by: Most helpful
Most helpful Newest Oldest
  1. Josep Marzo 20 Reputation points
    2024-05-22T15:23:18.98+00:00

    I guess I solved it.

  2. ZhoumingDuan-MSFT 17,080 Reputation points Microsoft External Staff
    2024-05-23T05:37:39.6733333+00:00

    @Josep Marzo, Thanks for posting in Q&A.

    Based on my research, we can create a device control policy for mac to block all USB devices.

    Here are some links you can refer.

    https://learn.microsoft.com/en-us/microsoft-365/security/defender-endpoint/mac-device-control-intune?view=o365-worldwide

    https://github.com/MicrosoftDocs/microsoft-365-docs/blob/8f06eeece74af5c98ab0b453d821ed0b0161f998/microsoft-365/security/defender-endpoint/mac-device-control-intune.md

    Non-official, just for reference.

    https://learn.microsoft.com/en-us/microsoft-365/security/defender-endpoint/mac-device-control-overview?view=o365-worldwide

    Moreover, if you want to block mobile phones when connected to device, we can configure WPD Devices: Deny read access and WPD Devices: Deny write access settings in Intune policy, which will block phones, media players, auxiliary displays, and CE devices.

    https://admx.help/?Category=Windows_10_2016&Policy=Microsoft.Policies.RemovableStorageAccess::WPDDevices_DenyRead_Access_1

    User's image

    Non-official, just for reference.

    Hope above information can help you.

    If the answer is helpful, please click "Accept Answer" and kindly upvote it. If you have extra questions about this answer, please click "Comment".

    Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.

Your answer

Answers can be marked as Accepted Answers by the question author, which helps users to know the answer solved the author's problem.