Step 1 — Find the Device Instance ID of the approved drive

Plug the drive into a test machine and run:

Get-PnpDevice -Class DiskDrive | Where-Object InstanceId -like "USBSTOR*" |
    Select-Object FriendlyName, InstanceId | Format-List

The output looks like this:

USBSTOR\DISK&VEN_KINGSTON&PROD_DATATRAVELER&REV_0000\60A44C4258C1F3B1A9E5&0

The final segment before &0 is the unique serial. Copy the entire string — that’s what goes into the whitelist.

Step 2 — Enable layered order of evaluation

Without this setting, the block policy takes absolute priority and your whitelist will never work. This is the #1 reason this configuration fails.

Intune → Devices → Configuration → Settings catalog → Administrative Templates > System > Device Installation > Device Installation Restrictions:

• “Apply layered order of evaluation for Allow and Prevent device installation policies across all device match criteria” → Enabled

Step 3 — Add the Instance ID exceptions

In the same policy:

• “Allow installation of devices that match any of these device instance IDs” → Enabled
• Add one line per approved drive, using the full string from Step 1

Step 4 — Block the generic USB storage class

• “Prevent installation of devices that match any of these device IDs” → Enabled
• Value: USBSTOR
• Tick “Also apply to matching devices that are already installed” — otherwise drives that have ever been connected stay functional

Step 5 — Add the write-access safety net

If a device slips past the filters above, at least it can’t carry data out:

• Custom OMA-URI: ./Vendor/MSFT/Policy/Config/Storage/RemovableDiskDenyWriteAccess
• Type: Integer, Value: 1

Step 6 — Test in the right order

Assign the policy to a pilot group of 3–5 machines. Test in this sequence:

1. Approved drive → must mount and write
2. Unapproved drive → must not appear in Explorer at all
3. USB external hard disk → test separately, it uses a different device class
4. USB mouse/keyboard/webcam → must work unchanged (if not, you’ve blocked too broadly)

Step 7 — Verify enforcement on the client

Get-WinEvent -LogName "Microsoft-Windows-DeviceSetupManager/Admin" -MaxEvents 30 |
    Select-Object TimeCreated, Id, Message | Format-List

For explicit blocks, the Microsoft-Windows-Kernel-PnP/Configuration log shows the error code of the rejected device.

Operational warning: if an approved drive breaks and gets replaced, the new serial isn’t whitelisted. You need a documented helpdesk procedure for adding a new serial, or the policy becomes a business blocker and somebody will disable it entirely over a weekend.