Search the ManageEngine site:  
 

Help Center

Quick Start

File Auditing

File Analysis

Data Risk Assessment

Endpoint DLP

Cloud Protection

General settings

Release notes

Troubleshooting

Guides

Third-party software Contact us

Device Restriction

Device Restriction profiles let you restrict access to USB devices, Bluetooth peripherals, Wi-Fi adapters, and CD/DVD drives across managed endpoints. The restrictions are enforced through Group Policy and applied across all endpoints associated with the policy.

For USB devices, you can deny:

  • Read access.
  • Write access
  • Execute access.

For bluetooth devices, Wi-Fi adapters, and CD/DVD drives, access can be either:

  • Fully allowed.
  • Completely blocked.

If you require more granular USB device control, such as defining the scope of policy enforcement or creating allowlists or blocklists of USB devices, use Removable Storage Control policies instead.

Configuring a Device Restriction profile

Follow the steps below to create a new Device Restriction profile:

  • Select Endpoint DLP from the apps drop-down.
  • Go to Configuration > Global Restriction Profiles > Device Restriction.
  • Click + Add New Profile in the top-right corner.
  • Enter a Name and a Description.
  • Select the USB actions that you wish to restrict:
    • Deny Read Access: Prevents users from reading data from USB devices.
    • Deny Write Access: Prevents users from writing data to USB devices.
    • Deny Execute Access: Prevents users from executing files directly from USB devices.
    • Deny All Accesses: Applies all three restrictions above at once.
  • Select Allow or Block for Bluetooth, WiFi, and CD/DVD Drive.

    • Note: Blocking Wi-Fi disables the network adapter entirely. Blocking Bluetooth disables all Bluetooth functionality, including audio devices and peripherals.

  • Click Save.
  • Enforce the Device Restriction profile on endpoints by mapping it to the corresponding DLP policy.

Note: If multiple Device Restriction profiles are mapped to the same DLP policy, or if a Device Restriction profile and a Removable Storage Control policy are both active for the same endpoint, the more restrictive setting takes precedence.

Mapping Device Restriction profiles to endpoints

To enforce Device Restriction on endpoints, created profiles have to be mapped to the DLP policy linked to the targeted endpoints.

Follow the steps below to map device control profiles to endpoints:

  • Select Endpoint DLP from the apps drop-down.
  • Go to Configuration > DLP Policies.
  • Select the DLP policy that is linked to the endpoints to which you wish to apply the Device Restriction profile.
  • Under Global Restriction Profiles, click Device Restriction.
  • Select the Device Restriction profile you wish to enforce on endpoints.
  • Click Save to update the Device Restriction policy.

Blocklisted devices migration

If you previously configured device blocklists on this page, those devices have been migrated to Removable Storage Control as a custom list. They are not automatically set to blocked, as their enforcement depends on how your Removable Storage Control policy is configured. To view and manage that custom list, refer to the Removable Storage Control help page.

Topics in this page:

Don't see what you're looking for?

  • Visit our community

    Post your questions in the forum.

     

  • Request additional resources

    Send us your requirements.

     

© 2026 Zoho Corporation Pvt. Ltd. All rights reserved.