Intune Device restriction (USB Block) Showing not applicable

%3CLINGO-SUB%20id%3D%22lingo-sub-2420317%22%20slang%3D%22en-US%22%3EIntune%20Device%20restriction%20(USB%20Block)%20Showing%20not%20applicable%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-2420317%22%20slang%3D%22en-US%22%3EHi%2C%3CBR%20%2F%3EWe%20have%20configured%20USB%20block%20policy%20using%20device%20restrictions%20in%20Intune%20and%20deployed%20to%20All%20devices%20and%20Users%20but%20policy%20saying%20it%20is%20not%20applicable%20for%20device%2Fusers%3CBR%20%2F%3EFYI.%20we%20are%20using%20windows%2010%201909%20build.%3C%2FLINGO-BODY%3E%3CLINGO-LABS%20id%3D%22lingo-labs-2420317%22%20slang%3D%22en-US%22%3E%3CLINGO-LABEL%3EUSB%20Control%3C%2FLINGO-LABEL%3E%3C%2FLINGO-LABS%3E%3CLINGO-SUB%20id%3D%22lingo-sub-2420590%22%20slang%3D%22en-US%22%3ERe%3A%20Intune%20Device%20restriction%20(USB%20Block)%20Showing%20not%20applicable%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-2420590%22%20slang%3D%22en-US%22%3E%3CP%3EHi%26nbsp%3B%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fuser%2Fviewprofilepage%2Fuser-id%2F799279%22%20target%3D%22_blank%22%3E%40Mdrafik-Shaikh%3C%2FA%3E%26nbsp%3B%20-%20Hope%20you%20have%20configured%20via%20the%20policy%20under%20%3CEM%3EDevice%3C%2FEM%3E%20-%26gt%3B%20%3CEM%3EConfiguration%20profiles%3C%2FEM%3E%20-%26gt%3B%20%3CEM%3EDevice%20Restriction%3C%2FEM%3E%20-%26gt%3B%20%3CEM%3EGeneral%3C%2FEM%3E%20-%26gt%3B%20%3CEM%3ERemovable%20storage%3C%2FEM%3E%20to%3CEM%3E%3CSTRONG%3E%20Block%20.%3C%2FSTRONG%3E%3C%2FEM%3E%3C%2FP%3E%3CP%3EAnd%20assigned%20it%20to%20all%20users%20%26amp%3B%20devices%20in%20the%20assignment%3F%3C%2FP%3E%3CP%3E%3CSPAN%20class%3D%22lia-inline-image-display-wrapper%20lia-image-align-inline%22%20image-alt%3D%22AmarnathK_1-1623029145839.png%22%20style%3D%22width%3A%20400px%3B%22%3E%3CIMG%20src%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fimage%2Fserverpage%2Fimage-id%2F286718i3C0AC0D4CA09E8EC%2Fimage-size%2Fmedium%3Fv%3Dv2%26amp%3Bpx%3D400%22%20role%3D%22button%22%20title%3D%22AmarnathK_1-1623029145839.png%22%20alt%3D%22AmarnathK_1-1623029145839.png%22%20%2F%3E%3C%2FSPAN%3E%3C%2FP%3E%3CP%3EAs%20per%20Microsoft%2C%20this%20policy%20is%20compatible%20with%20the%20below%20editions%20and%20windows%2010%201909%20build.%26nbsp%3B%3C%2FP%3E%3CP%3E%3CSPAN%20class%3D%22lia-inline-image-display-wrapper%20lia-image-align-inline%22%20image-alt%3D%22AmarnathK_0-1623028923863.png%22%20style%3D%22width%3A%20400px%3B%22%3E%3CIMG%20src%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fimage%2Fserverpage%2Fimage-id%2F286717i56C2717EE7205CDA%2Fimage-size%2Fmedium%3Fv%3Dv2%26amp%3Bpx%3D400%22%20role%3D%22button%22%20title%3D%22AmarnathK_0-1623028923863.png%22%20alt%3D%22AmarnathK_0-1623028923863.png%22%20%2F%3E%3C%2FSPAN%3E%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3ECan%20you%20add%20the%20screenshot%20of%20your%20configuration%26nbsp%3B%20%26amp%3B%20status%20to%20your%20question%20to%20understand%20the%20scenario%20better%3F%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-2421004%22%20slang%3D%22en-US%22%3ERe%3A%20Intune%20Device%20restriction%20(USB%20Block)%20Showing%20not%20applicable%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-2421004%22%20slang%3D%22en-US%22%3E%3CP%3E%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fuser%2Fviewprofilepage%2Fuser-id%2F725402%22%20target%3D%22_blank%22%3E%40AmarnathK%3C%2FA%3E%26nbsp%3B%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EI%20have%20configured%20same.%20Please%20check%20attached%20screen%20shots%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-2421335%22%20slang%3D%22en-US%22%3ERe%3A%20Intune%20Device%20restriction%20(USB%20Block)%20Showing%20not%20applicable%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-2421335%22%20slang%3D%22en-US%22%3E%3CP%3E%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fuser%2Fviewprofilepage%2Fuser-id%2F799279%22%20target%3D%22_blank%22%3E%40Mdrafik-Shaikh%3C%2FA%3E%26nbsp%3B%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EWhat%20happens%20when%20you%20manually%20configure%20this%20setings%20with%20a%20csp%3F%26nbsp%3B%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3E%3CSPAN%20class%3D%22lia-inline-image-display-wrapper%20lia-image-align-inline%22%20image-alt%3D%22Rudy_Ooms_0-1623056201643.png%22%20style%3D%22width%3A%20400px%3B%22%3E%3CIMG%20src%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fimage%2Fserverpage%2Fimage-id%2F286783iC06091CB40FC40AB%2Fimage-size%2Fmedium%3Fv%3Dv2%26amp%3Bpx%3D400%22%20role%3D%22button%22%20title%3D%22Rudy_Ooms_0-1623056201643.png%22%20alt%3D%22Rudy_Ooms_0-1623056201643.png%22%20%2F%3E%3C%2FSPAN%3E%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3Enot%20applicable%20%3A%20You%20would%20think%20you%20don't%20have%20the%20proper%20windows%20version%3F%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3E%3CSPAN%3EThis%20policy%20isn't%20supported%20on%20this%20platform.%20For%20example%2C%20iOS%2FiPadOS%20policies%20don't%20work%20on%20Android.%20Samsung%20KNOX%20policies%20don't%20work%20on%20Windows%20devices.%3C%2FSPAN%3E%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3E%3CSPAN%3EAnd%20when%20I%20am%20looking%20at%20the%20pictures%2C%20its%20co%20managed.%20Is%20this%20your%20first%20device%20configuration%20profile%3C%2FSPAN%3E%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3E%3CSPAN%3E%3CA%20href%3D%22https%3A%2F%2Fdocs.microsoft.com%2Fen-us%2Fmem%2Fconfigmgr%2Fcomanage%2Fworkloads%23device-configuration%22%20target%3D%22_blank%22%20rel%3D%22noopener%20noreferrer%22%3ECo-management%20workloads%20-%20Configuration%20Manager%20%7C%20Microsoft%20Docs%3C%2FA%3E%3C%2FSPAN%3E%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3E%3CSPAN%3EYou%20don't%20have%20to%20switch%20the%20workloads%2C%20or%20you%20can%20do%20them%20individually%20when%20you're%20ready.%20Configuration%20Manager%20continues%20to%20manage%20all%20other%20workloads%2C%20including%20those%20workloads%20that%20you%20don't%20switch%20to%20Intune%2C%20and%20all%20other%20features%20of%20Configuration%20Manager%20that%20co-management%20doesn't%20support%3C%2FSPAN%3E%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-2421375%22%20slang%3D%22en-US%22%3ERe%3A%20Intune%20Device%20restriction%20(USB%20Block)%20Showing%20not%20applicable%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-2421375%22%20slang%3D%22en-US%22%3E%3CP%3EHi%26nbsp%3B%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fuser%2Fviewprofilepage%2Fuser-id%2F620702%22%20target%3D%22_blank%22%3E%40Rudy_Ooms%3C%2FA%3E%26nbsp%3B%2C%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EYes%2C%20its%20co-managed%20and%20moved%20all%20workload%20to%20Intune%20except%20application%20and%20windows%20updates.%3C%2FP%3E%3CP%3EAll%20Configured%20policies%20working%20fine%2C%20ie.%20Endpoint%20Antivirus%20policy%2C%20ASR%2C%20Baseline%20policy%20only%20USB%20policy%20having%20some%20issue.%3C%2FP%3E%3CP%3EIm%20using%20following%20windows%20version.%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EI%20will%20check%20with%20CSP%20and%20update.%3C%2FP%3E%3CP%3E%3CSPAN%20class%3D%22lia-inline-image-display-wrapper%20lia-image-align-inline%22%20image-alt%3D%22Mdrafik-Shaikh_0-1623059905978.png%22%20style%3D%22width%3A%20400px%3B%22%3E%3CIMG%20src%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fimage%2Fserverpage%2Fimage-id%2F286795i4EE084BD10FC76B1%2Fimage-size%2Fmedium%3Fv%3Dv2%26amp%3Bpx%3D400%22%20role%3D%22button%22%20title%3D%22Mdrafik-Shaikh_0-1623059905978.png%22%20alt%3D%22Mdrafik-Shaikh_0-1623059905978.png%22%20%2F%3E%3C%2FSPAN%3E%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3C%2FLINGO-BODY%3E
Occasional Contributor
Hi,
We have configured USB block policy using device restrictions in Intune and deployed to All devices and Users but policy saying it is not applicable for device/users
FYI. we are using windows 10 1909 build.
10 Replies

Hi @Mdrafik-Shaikh  - Hope you have configured via the policy under Device -> Configuration profiles -> Device Restriction -> General -> Removable storage to Block .

And assigned it to all users & devices in the assignment?

AmarnathK_1-1623029145839.png

As per Microsoft, this policy is compatible with the below editions and windows 10 1909 build. 

AmarnathK_0-1623028923863.png

 

Can you add the screenshot of your configuration  & status to your question to understand the scenario better?

 

@AmarnathK 

 

I have configured same. Please check attached screen shots

 

@Mdrafik-Shaikh 

 

What happens when you manually configure this setings with a csp? 

 

Rudy_Ooms_0-1623056201643.png

 

not applicable : You would think you don't have the proper windows version?

 

This policy isn't supported on this platform. For example, iOS/iPadOS policies don't work on Android. Samsung KNOX policies don't work on Windows devices.

 

And when I am looking at the pictures, its co managed. Is this your first device configuration profile

 

Co-management workloads - Configuration Manager | Microsoft Docs

 

You don't have to switch the workloads, or you can do them individually when you're ready. Configuration Manager continues to manage all other workloads, including those workloads that you don't switch to Intune, and all other features of Configuration Manager that co-management doesn't support

Hi @Rudy_Ooms ,

 

Yes, its co-managed and moved all workload to Intune except application and windows updates.

All Configured policies working fine, ie. Endpoint Antivirus policy, ASR, Baseline policy only USB policy having some issue.

Im using following windows version.

 

I will check with CSP and update.

Mdrafik-Shaikh_0-1623059905978.png

 

 

@Mdrafik-Shaikh 

 

I tried manully with CSP and it is not working

 

 

Mdrafik-Shaikh_1-1623060747312.png

 

Mdrafik-Shaikh_2-1623060796022.png

 

 

 

What's the DeviceManagement-Enterprise-Diagnostic-Provider event log showing? most of the times it could tell you a lot more... Try to sync the device and watch the event log

@Rudy_Ooms Policy issue has been resolved, we have reconfigured the co-management and moved Resource access, Endpoint protection and device configuration to Intune.

@Mdrafik-Shaikh Glad that it is working for you and thanks for taking the time to update. Did you found out the thing which caused the policy failure, it will be helpful for the members.

Hi, thanx for your response. So if I understand it correctly... so the issue was there were still some workloads not moved to Intune like the link I posted?

@Rudy_Ooms Yes, Device configuration workload.