#device-control

ASR rules don't detect malware, they block the specific techniques malware needs to work. Here's what each major rule actually stops, and how it fits into Intune's wider hardening toolkit.

A USB drive is a fully hardened fleet's last unhardened door. How Intune actually identifies a plugged-in device and decides Allow, Block, or Read-only.