Runbook: Intune Policy — Block USB Storage on Managed Windows Devices

Purpose

USB storage is a high-impact data-exfiltration vector in a HIPAA environment. Blocking removable USB storage via Intune Device Configuration is a quick, high-value control that stops casual bulk copy of PHI and also closes a common malware-delivery path (malicious USB drops). This runbook walks through the policy creation, deployment, compliance impact, and exception process.

Related story: FIDO2-014. Related:

• compliance/hipaa-controls.md (HIPAA 164.312(a)(1), 164.310(d)(1))
• runbooks/intune-mam-mobile.md (companion mobile control)

---

Scope

• Target: All Intune-managed Windows devices (company-owned workstations and laptops; the Cloud PC if Intune-enrolled)
• Out of scope: macOS (not currently in the Intune estate), iOS/Android (handled via MAM — see intune-mam-mobile.md), server-class OS (Palo Alto management servers, domain controllers — physical access controlled at facility layer)
• What is blocked: Removable storage class devices (USB mass-storage, MTP devices presenting as storage, SD/microSD cards in USB readers)
• What is not blocked: USB peripherals that are not storage (keyboards, mice, YubiKeys, webcams, headsets, network adapters, card readers for smart-cards). The policy targets only the removable storage device class.

---

Policy Configuration

Path in Intune

Intune admin center → Devices → Configuration → Create → New Policy

Field	Value
Platform	Windows 10 and later
Profile type	Templates → Device restrictions
Name	cirius-win-block-usb-storage
Description	Blocks removable USB storage on all managed Windows devices. HIPAA 164.312(a)(1).
Scope tags	prod

Navigate to General settings in the profile, then scroll to the Removable storage section (Intune historically labels this under General on the Device restrictions template; in newer settings catalog revisions the same setting is under Hardware → Removable storage).

Setting	Value
Removable storage	Block
USB connection	Allow (we still allow keyboards, mice, YubiKeys)

If the organization also wants to block write-access only (allow read for legacy use cases), toggle:

Setting	Value
Write protection for removable drives	Enable

For HIPAA, block outright is the recommended default. Read-only is a compromise tier we use only as a temporary measure while exceptions are in transit to approval.

Assignment

• Included groups: AllManagedWindowsDevices (Intune dynamic device group targeting deviceOSType -eq "Windows" and Intune-managed)
• Excluded groups: USBStorageExceptionGroup (empty by default — add approved exception devices only via the exception process below)

Applicability

Set an applicability rule so the policy applies only to:

• OS edition = Professional, Enterprise, or Education
• OS version ≥ Windows 10 1809 (required for the CSP)

---

Deployment Plan

Do not flip this on everyone at once. Staged rollout lets us catch anyone with a legitimate workflow that depends on USB storage without expecting all of them to speak up first.

1. Day 0 — Pilot group (Rory only)

   • Apply policy to a pilot-only group containing Rory's workstation
   • Attempt to mount a USB drive — confirm block behavior, confirm YubiKey still works
   • Review Intune reporting for the policy to confirm applied status

2. Day 2 — Expand pilot (Rory, Kevin, Greg)

   • Add Kevin and Greg to the pilot group
   • Ask each to report any workflow friction

3. Day 7 — Broad rollout

   • Switch assignment to AllManagedWindowsDevices with the exception group empty
   • Announce via email: what is blocked, why, how to request an exception, where to read this runbook

4. Day 7–14 — Watch window

   • Monitor exception requests
   • Address any broken workflows within 24 hours (either grant exception or provide an alternative path such as SharePoint / OneDrive / encrypted share)

5. Day 14 — Steady state

   • Policy is the baseline going forward
   • Add a check to runbooks/monthly-security-review.md confirming the policy is still applied and the exception group is still scoped

---

Compliance Impact

Framework	Control	Impact
HIPAA	164.312(a)(1) Access control — technical policy limiting access to PHI	Positive — removes a major exfiltration path
HIPAA	164.310(d)(1) Device and media controls	Positive — media (USB storage) is now policy-governed
HIPAA	164.312(b) Audit controls	Intune reports blocked access attempts; feed into monthly review
SOC2	CC6.1 Logical and physical access controls	Positive
SOC2	CC6.7 Restricts transmission and movement of information	Positive
HITRUST	01.v Information Access Restriction	Positive

Auditor-facing evidence:

• Screenshot of the Intune policy configuration
• Intune device-compliance report showing policy applied to all managed Windows devices
• Exception log (see below) showing the process is functioning

---

Exception Process

USB storage exceptions are rare and time-bound. Do not create permanent exceptions for an individual user — exceptions are for a specific device and a specific purpose with an expiry date.

Request

User (or their manager) raises an exception request via:

1. Open a SecOps story in COMP project titled USB exception — <user> — <reason>
2. Include:
   • User and the device ID
   • Business justification (why is this necessary, why is the alternative — SharePoint / OneDrive / encrypted share — not sufficient)
   • Specific USB device (manufacturer, model, serial if possible)
   • Expiry date (default: 30 days)

Review

• First reviewer: Rory — technical feasibility and scope
• Second reviewer: Adriana — compliance risk, especially if PHI is involved
• Approval: Both reviewers must sign off
• Execution: Rory adds the device to the USBStorageExceptionGroup in Intune (device-scoped, not user-scoped); policy exclusion takes effect on next device check-in (typically under 1 hour)

Expiry

• Exceptions auto-expire per the requested date
• A calendar reminder to Rory 3 days before expiry triggers removal of the device from the exception group
• If the exception needs to continue, the user re-requests — no silent extensions

Logging

All exceptions live as stories in SecOps with status reflecting the lifecycle (OPEN → APPROVED → EXPIRED). The exception log is a first-class audit artifact.

---

Monitoring and Review

• Add a quarterly check to runbooks/monthly-security-review.md confirming:
  • Policy is still assigned to AllManagedWindowsDevices
  • Exception group membership matches approved exception stories
  • No device is exempted without a story in OPEN or APPROVED state
• Intune compliance report: alert on any managed Windows device not showing the policy as applied (likely device offline or check-in lag; escalate if

  7 days)

---

Known Gotchas

• YubiKeys are not blocked. YubiKey enumerates as a HID/FIDO device, not as mass storage. The block policy does not affect them.
• Printers over USB are not blocked by this policy (they are not mass storage). If printer-specific control is needed, add a separate policy.
• Some combination dongles (USB hub with attached storage) may be partially blocked — the storage face of the dongle is blocked, peripherals attached to the hub continue to work.
• First-time rollout on a laptop that had a USB drive mounted at the moment of policy application may show the drive as mounted until the next reboot. The block prevents new mounts.
• Windows Sandbox and Hyper-V guests see the host policy; ensure sandbox use does not mask the block unintentionally.

---

Rollback

• Re-assign the policy with Removable storage = Not configured or switch the policy state to disabled via settings catalog
• Rollback takes effect on next device check-in (under 1 hour for most devices)
• Communicate rollback reason and planned re-application to all staff to avoid misaligned expectations

---

Related Controls

• runbooks/intune-mam-mobile.md — companion mobile control (MAM for personal phones)
• runbooks/twingate-compliance-enforcement.md — device compliance gate on resource access; the USB block is one input to device compliance posture
• compliance/hipaa-controls.md — consolidated HIPAA Security Rule mapping