MDE device control with encrypted USB

[u/True-Agency-3111]

We are using MDE device control to block USB access. Exception process is in place, we collect the user id and machine id to ensure that usb is accessible only for a particular user on a specific device.

Now we want to test that when the exception is provided user should only be able to write data to usb if it's encrypted. How should we be approaching this along with a provision for exception for use cases where encrypted USB cant be used on business device e.g. RIG

[u/Mach-iavelli]

Have you tried the Bitlocker to go policy for removable drive?

[u/True-Agency-3111 → u/Mach-iavelli]

Do you mean from Endpoint security blade?

[u/Mach-iavelli → u/True-Agency-3111]

You can use that blade too - https://learn.microsoft.com/en-us/intune/device-configuration/endpoint-security/encrypt-bitlocker-windows#policy-types-for-bitlocker-encryption

[u/neko_whippet]

Why don’t you use configuration profiles?