audit_deny_all_removable_media.md

Device control policy sample: audit_deny_all_removable_media

Description: Audit and deny all removable media
Device Type: Apple Removable Media

A device control policy is a combination of policy rules, groups and settings.
This sample is based on the sample files.
To configure the sample, follow the deployment instructions.

Policy Rules

Name	Devices		Rule Type	Access			Notification
	Included	Excluded		Read	Write	Execute
Audit Deny all Removable Media	All Removable Media Devices (details)	.	Audit Denied	📄	📄	📄	Send event and Show notification

Groups

All Removable Media Devices

This is a group of type device. The match type for the group is all.

Operator	Property	Value
	primaryId	removable_media_devices

Available properties for All Removable Media Devices

View JSON

{
    "$type": "device",
    "id": "531278a2-a318-48d7-8e6a-0f0fd7589b07",
    "name": "All Removable Media Devices",
    "query": {
        "$type": "all",
        "clauses": [
            {
                "$type": "primaryId",
                "value": "removable_media_devices"
            }
        ]
    }
}

Settings

Setting Name	Setting Value	Description	Documentation
SecuredDevicesConfiguration	{'appleDevice': {'disable': True}, 'removableMedia': {'disable': False}, 'portableDevice': {'disable': True}, 'bluetoothDevice': {'disable': True}}	Defines which device's primary ids should be secured by Defender Device Control. If this configuration isn't set the default value will be applied, meaning all supported devices will be secured.	documentation
DefaultEnforcement	Deny	Control Device Control default enforcement. This is the enforcement applied if there are no policy rules present or at the end of the policy rules evaluation none were matched.	documentation
UXNavigationTarget	http://www.microsoft.com	Notification hyperlink	documentation

Files

This policy is based on information in the following files:

• audit_deny_all_removable_media.json

Deployment Instructions

Device control policy rules and groups can be deployed through the following management tools:

Mac

• Mac Deployment with Intune
• Mac Deployment with JAMF
• Manual Mac Deployment

Mac Policy

Mac Deployment with Intune

1. Create the .mobileconfig file

Copy the contents below into a file, and save it.

<?xml version="1.0" encoding="utf-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1">
    <dict>
        <key>PayloadUUID</key>
        <string>C4E6A782-0C8D-44AB-A025-EB893987A295</string>
        <key>PayloadType</key>
        <string>Configuration</string>
        <key>PayloadOrganization</key>
        <string>Microsoft</string>
        <key>PayloadIdentifier</key>
        <string>com.microsoft.wdav</string>
        <key>PayloadDisplayName</key>
        <string>Microsoft Defender settings</string>
        <key>PayloadDescription</key>
        <string>Microsoft Defender configuration settings</string>
        <key>PayloadVersion</key>
        <integer>1</integer>
        <key>PayloadEnabled</key>
        <true/>
        <key>PayloadRemovalDisallowed</key>
        <true/>
        <key>PayloadScope</key>
        <string>System</string>
        <key>PayloadContent</key>
        <array>
            <dict>
                <key>PayloadUUID</key>
                <string>99DBC2BC-3B3A-46A2-A413-C8F9BB9A7295</string>
                <key>PayloadType</key>
                <string>com.microsoft.wdav</string>
                <key>PayloadOrganization</key>
                <string>Microsoft</string>
                <key>PayloadIdentifier</key>
                <string>com.microsoft.wdav</string>
                <key>PayloadDisplayName</key>
                <string>Microsoft Defender configuration settings</string>
                <key>PayloadDescription</key>
                <string/>
                <key>PayloadVersion</key>
                <integer>1</integer>
                <key>PayloadEnabled</key>
                <true/>
                <key>dlp</key>
                <dict>
                  <key>features</key>
                    <array>
                        <dict>
                            <key>name</key>
                            <string>DC_in_dlp</string>
                            <key>state</key>
                            <string>enabled</string>
                        </dict>
                    </array>
                </dict>
                <key>deviceControl</key>
                <dict>
                    <key>policy</key>
                    <string>
{
    "groups": [
        {
            "$type": "device",
            "id": "531278a2-a318-48d7-8e6a-0f0fd7589b07",
            "name": "All Removable Media Devices",
            "query": {
                "$type": "all",
                "clauses": [
                    {
                        "$type": "primaryId",
                        "value": "removable_media_devices"
                    }
                ]
            }
        }
    ],
    "rules": [
        {
            "id": "23d42678-ca49-453d-bef0-cf48ffe8c6ae",
            "name": "Audit Deny all Removable Media",
            "includeGroups": [
                "531278a2-a318-48d7-8e6a-0f0fd7589b07"
            ],
            "entries": [
                {
                    "$type": "removableMedia",
                    "id": "21fd9576-8deb-4824-98cc-8c29564a74b1",
                    "enforcement": {
                        "$type": "auditDeny",
                        "options": [
                            "send_event",
                            "show_notification"
                        ]
                    },
                    "access": [
                        "read",
                        "write",
                        "execute"
                    ]
                }
            ]
        }
    ],
    "settings": {
        "features": {
            "appleDevice": {
                "disable": true
            },
            "removableMedia": {
                "disable": false
            },
            "portableDevice": {
                "disable": true
            },
            "bluetoothDevice": {
                "disable": true
            }
        },
        "global": {
            "defaultEnforcement": "deny"
        },
        "ux": {
            "navigationTarget": "http://www.microsoft.com"
        }
    }
}
                    </string>
                </dict>
            </dict>
        </array>
    </dict>
</plist>

2. Deploy the .mobileconfig file using Intune

   1. Navigate to https://endpoint.microsoft.com/ > Devices > macOS > ** Configuration profiles
   2. Click on create + New Policy
   3. Select Profile type Templates
   4. Select Custom profile
   5. Enter the name of the policy, optionally a description, and then click Next
   6. Select the device deployment channel
   7. Choose the .mobileconfig that you created
   8. Click "Next"
   9. Scope, assign and deploy the policy.

Manual Mac Deployment

1. Create the .json file

Save the .json to a file

{
    "groups": [
        {
            "$type": "device",
            "id": "531278a2-a318-48d7-8e6a-0f0fd7589b07",
            "name": "All Removable Media Devices",
            "query": {
                "$type": "all",
                "clauses": [
                    {
                        "$type": "primaryId",
                        "value": "removable_media_devices"
                    }
                ]
            }
        }
    ],
    "rules": [
        {
            "id": "23d42678-ca49-453d-bef0-cf48ffe8c6ae",
            "name": "Audit Deny all Removable Media",
            "includeGroups": [
                "531278a2-a318-48d7-8e6a-0f0fd7589b07"
            ],
            "entries": [
                {
                    "$type": "removableMedia",
                    "id": "21fd9576-8deb-4824-98cc-8c29564a74b1",
                    "enforcement": {
                        "$type": "auditDeny",
                        "options": [
                            "send_event",
                            "show_notification"
                        ]
                    },
                    "access": [
                        "read",
                        "write",
                        "execute"
                    ]
                }
            ]
        }
    ],
    "settings": {
        "features": {
            "appleDevice": {
                "disable": true
            },
            "removableMedia": {
                "disable": false
            },
            "portableDevice": {
                "disable": true
            },
            "bluetoothDevice": {
                "disable": true
            }
        },
        "global": {
            "defaultEnforcement": "deny"
        },
        "ux": {
            "navigationTarget": "http://www.microsoft.com"
        }
    }
}

2. Use mdatp config device-control policy set --path <full-path-to-policy.json> to apply the policy.

Mac Deployment with JAMF

Instructions on how to deploy the policy with JAMF can be found here

Learn more

• Mac device control examples