Manage policies for external devices connected to endpoints. Controls access permissions for USB drives, Bluetooth devices, and other peripherals.
### Caution
Device Control is critical for data loss prevention. Overly restrictive policies may impact productivity, while permissive policies may enable data exfiltration. Balance security requirements with operational needs.
| Permissions | Description | Roles Example |
| ----------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ |
| None | <p>Cannot view the following pages under <strong>Inventory</strong> → <strong>Endpoints</strong>:</p><ul><li>Device Control Violations</li><li>Disk Encryption Visibility</li><li><p>Under Policy Management:</p><ul><li>Device Permanent/Temporary Exceptions</li><li>Settings: Device Management</li><li>Extensions: Policy Rules</li><li>Extensions: Profiles</li></ul></li></ul> | SOC Tier-1 Analyst: Not part of daily triage. |
| View | Read-only access for the pages listed above. | <ul><li>SOC- Tier 2 Analyst: Understanding device control helps investigate data exfiltration or unauthorized device usage. Critical for insider threat investigations</li><li>SOC Tier-3 Analyst: View, but may need view/edit for emergency containment of data exfiltration (blocking all USB devices), but should require approval</li><li>Threat Hunter: Device control visibility helps understand potential data exfiltration vectors. Hunters need to know what devices are allowed.</li></ul> |
| View/Edit | All view capabilities, plus managing policies and exceptions. Additional action permissions with View/Edit permissions, such as Device Control Rules and Device Control Exceptions. | Security Engineer: Responsible for device control rule development and maintenance. Creates and optimizes device policies. |
**Device Control sub-permissions**
| Sub-permission | Description | Roles Example |
| ------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| Device Control Rules | <p>Enables users to permit/prevent device connection, prevent data writing, and allow connection but log all activity.</p><ul><li>Checked: Users can create, edit, delete, and enable/disable device control rules (<strong>Inventory</strong> → <strong>Endpoints</strong> → <strong>Policy Management</strong> → <strong>Extensions</strong> → <strong>Policy Rules</strong>).</li><li>Unchecked: Rule actions are disabled within profiles.</li></ul><p>To manage device control rules, users also need the <strong>Agent Extension Policies</strong> permission to access the profiles where rules are configured.</p> | Security Engineer: Responsible for device control rule development and maintenance. Creates rules for different device types, vendors, and use cases. |
| Device Control Exceptions | <p>Create exceptions to device control rules for specific devices or users.</p><p>Users can create, edit, and delete permanent or temporary exceptions that override device control rules (<strong>Inventory</strong> → <strong>Endpoints</strong> → <strong>Policy Management</strong> → <strong>Extensions</strong> → <strong>Device Permanent Exceptions</strong>, or <strong>Device Temporary Execptions</strong>).</p><div data-gb-custom-block data-tag="hint" data-style="info" class="hint hint-info"><p><strong>Note</strong></p><p>Exceptions bypass device control rules and can create security gaps. Implement approval workflows and regular exception reviews. Consider requiring business justification for all exceptions.</p></div><ul><li>Checked: Users can add device exceptions.</li><li>Unchecked: The Add Exception action is disabled.</li></ul><div data-gb-custom-block data-tag="hint" data-style="info" class="hint hint-info"><p><strong>Tip</strong></p><p>Consider adding Device Control Rules. Understanding existing rules is essential before creating exceptions. Exceptions should be targeted to specific rules to minimize security impact.</p></div> | Security Engineer: Responsible for exception management with proper documentation. Creates exceptions based on approved business requests with appropriate scope and expiration. |
**Required and recommended permissions**
Consider adding the following permissions:
| Permission | Permission Level | Reasons |
| ------------------------ | ---------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ |
| Agent Groups | View | Required. Must understand group structure to target device control rules and policies correctly. Incorrect targeting can block legitimate devices or allow unauthorized ones. |
| Agent Extension Policies | View | Strongly Recommended. Device Control rules and profiles are managed through extension policies. An extension policy context is needed to understand the full device control configuration. |
| Agent Administrations | View | Strongly Recommended. View endpoints to correlate device violations with endpoint data and understand which endpoints are generating events. |
| Cases & Issues | View | Strongly Recommended. Review device-related security events to inform policy decisions. Understanding data exfiltration attempts helps create effective rules and policies. |
| Host Insights | View | Recommended. View detailed endpoint device information, including connected devices, USB history, and compliance status. |