Skip to main content

​
Platform compatibility

[¹] macOS 15 or later, on supervised Macs only. [²] Windows 10 version 2004 or later with KB5005101 installed, or Windows 11. Pro, Enterprise, and Education editions only, not Home. [³] Company-owned (fully managed) devices only. Personal devices enrolled with a work profile are not affected.

​
Set up the control

1

Go to MDM > Controls > Add new control

Select USB storage blocking.
2

Set the access mode (Windows and Android)

On Windows, choose the USB storage access mode from the dropdown:
  • Block — denies read and write access to all removable storage.
  • Allow — no restriction.
On Android, choose the USB data access mode:
  • Block USB file transfer (mouse, keyboard and other peripherals still work) — the default. Employees can’t copy files to or from the device over USB.
  • Block all USB data transfer — blocks every data connection over USB, peripherals included.
  • Allow USB data transfer — no restriction.
3

Select targeting

Choose which devices to apply the control to: all devices, specific device groups, or a custom target.

​
How it works

The control blocks removable storage that the operating system recognizes as storage. It has no allowlist or exceptions, no read-only mode, and no choice of which storage types to block. Devices that don’t present themselves as storage are never blocked: keyboards, mice, webcams, printers, and network adapters keep working. Network drives and shares stay accessible.
Primo pushes a declarative device management configuration that disallows external storage. No additional configuration is required.

​
What’s blocked

  • macOS refuses to mount any external storage: USB keys, external drives, and SD cards.

​
What isn’t blocked

  • Network shares (SMB, NFS).
  • Phones connected to transfer photos or files, because they don’t mount as disks.

​
Requirements

  • macOS 15 or later.
  • A supervised Mac, enrolled through Apple Business with Automated Device Enrollment.
The restriction has no effect on older macOS versions or on unsupervised Macs.

​
Modify or remove the control

Open the control from MDM > Controls to edit or disable it. Disabling stops enforcement but does not remove existing configurations from devices.

​
Troubleshooting

A Mac still mounts a USB drive after applying the control
  • Check that the Mac runs macOS 15 or later.
  • Check that the Mac is supervised. The restriction has no effect on unsupervised Macs.
A USB drive still works on a Windows device after applying the control
  • Restart the device if the drive was already connected when the policy applied.
  • Check that the device runs Windows Pro, Enterprise, or Education, and Windows 10 version 2004 with KB5005101 or Windows 11.
  • Check that USB storage access mode is set to Block.
An employee mounted a USB drive from the terminal after applying the control
  • This is expected on Linux. See the Linux tab in How it works.
An Android device still transfers files over USB
  • Check how the device is enrolled. The control applies to company-owned (fully managed) devices only, not to devices with a work profile.
  • Check that USB data access isn’t set to Allow USB data transfer.