Block USB mass storage devices

Devices -  Configuration Profiles


Create profile


Platform - Windows 10 and later
Profile type - Templates
Template Name - Device Restrictions
Create


Basics
Name - Windows 10 - Block USB mass storage devices



Configuration settings - General
Select - Removable storage - Click - Block


In the same section - scroll down to Direct Memory Access
Use the drop down arrow - Select Enabled
Next


Assignments -
Select - Add groups


Search for and select the group(s)
Select


Assigned groups will now show
Next


Applicability Rules - None
Next

Review and Create
Create