This control stops USB keys, SD cards and other removable storage from being used on managed devices. Use it to keep company data from being copied onto drives that leave the building.

Overview

(1) Only company-owned, fully managed devices. Personal devices enrolled with a work profile are not affected.

How to use

1. Go to MDM > Controls > Add new control and choose USB storage blocking.
2. On Windows, pick the USB storage access mode from the dropdown:
   • Block: no removable storage device can connect.
3. On Android, pick the USB data access mode:
   • Block USB file transfer (mouse, keyboard and other peripherals still work): the default. Employees cannot copy files to or from the device over USB.
   • Block all USB data transfer: every data connection over USB is blocked, peripherals included.
   • Allow USB data transfer: no restriction.
4. Choose where the control applies: all devices, specific device groups, or a custom target.

macOS and Linux need no extra settings.

How it works on each platform

• macOS. Factorial IT sends an MDM restriction that prevents removable storage from mounting. Nothing else to configure.
   
• Windows. Factorial IT deploys an MDM policy that blocks installing and using removable storage, according to the access mode you chose. Blocked devices show up in Device Manager, and the employee gets a notification saying the device cannot be used.
   
• Linux. Factorial IT applies a configuration that blocks mounting removable storage from the graphical interface, such as the prompt the file manager shows when a USB drive is plugged in. It applies to the whole system, whichever account is signed in.
   
• It does not block mounting by hand from the command line. An account with enough privileges can still mount a USB drive with mount.
   
• Android. Factorial IT applies Android's USB data access setting to company-owned, fully managed devices. Devices enrolled with a work profile (personal devices) ignore it.

With the default option, a USB mouse or keyboard keeps working, but files cannot be moved over USB. Block all USB data transfer needs Android 12 or later on compatible hardware. On other devices, Android only blocks file transfer.

Change or switch off the control

Open the control from MDM > Controls to edit or disable it. Disabling stops enforcement. It does not remove settings already applied on devices.

Troubleshooting and FAQ

Troubleshooting

An employee mounted a USB drive from the terminal on Linux. This is expected. The control only blocks mounting from the graphical interface.

An Android device still transfers files over USB.

• Check how the device is enrolled. Only company-owned, fully managed devices are covered, not devices with a work profile.
• Check that USB data access is not set to Allow USB data transfer.

Block all USB data transfer does not block peripherals on an Android device. The device is older than Android 12 or the hardware is not compatible. In that case Android only blocks file transfer.

FAQ

1. What does the employee see on Windows when they plug in a USB drive?
   A notification saying the device cannot be used. The drive also appears in Device Manager as blocked.
    
2. Does the control work on iPhone and iPad?
   No. It supports macOS, Windows, Linux and company-owned Android devices.
    
3. Will a USB keyboard still work on Android?
   Yes with the default option. No with Block all USB data transfer.
    
4. If I disable the control, are the settings removed from devices?
   No. Enforcement stops, but settings already applied stay on the device.