Enable WebUsb Ask for Urls Policy in Microsoft Edge to Control USB Device Access using Intune
Hey, let’s learn how to Enable WebUsb Ask for Urls Policy in Microsoft Edge to Control USB Device Access Using Intune. The WebUsbAskForUrls policy in Microsoft Edge is designed to control which websites can request access to USB devices. By defining specific URL patterns, organizations can allow only trusted sites to ask users for USB access.
If this policy is not configured, the browser defaults to global settings or user preferences, which may not always align with organizational security standards.This policy is important because it helps ensure that sensitive USB devices are only accessed by secure and approved websites.
For users, this policy simplifies security management by removing the burden of deciding which sites can access USB devices. For organizations, it provides peace of mind knowing that data flow between browsers and USB devices is restricted to vetted platforms. This balance improves both usability and safety within the workplace.
An example of using this policy would be in a university or research lab where only specific websites, such as trusted educational portals or research databases, are allowed to communicate with lab equipment via USB. Similarly, a company may permit only its internal web applications, like device management tools, to connect with specialized hardware.
What are the Advantages of Enabling this Policy using Intune?
1. Prevents unsafe or malicious websites from using USB devices
2. Ensures only trusted sites can request USB access
3. Protects sensitive data and devices from misuse
4. Reduces user mistakes by setting clear rules
5. Supports safe and efficient work in schools, labs, and companies
Enable WebUsb Ask for Urls Policy in Microsoft Edge to Control USB Device Access using Intune
When the WebUsbAskForUrls policy is not enabled, any website can ask to use USB devices. This can confuse users, and they might allow unsafe sites by mistake. As a result, both devices and data face higher security risks.
When the policy is enabled, only trusted websites chosen by the organization can request USB access. This removes guesswork for users and keeps workflows safe. It also gives the organization stronger security and better control over device usage.
- Block USB Device Access using Intune
- Enable Compression Dictionary Transport Support in Microsoft Edge to Accept Web Content using Intune
- Enable Built-In Translator Option for Webpages in Google Chrome and Microsoft Edge Browser using Intune
Create a Profile
To start deploying a policy in Intune, sign in to the Microsoft Intune Admin Center. Then go to Devices> Configuration under the Manage devices> Policies> Create> New policy. In the create a profile window, add the platform Windows and later, profile type is Settings Catalog. Then click the create button.
First Step
To configure a policy in Intune, start with the Basics step, where you enter the policy name (e.g Allow WebUSB on specific sites), provide a short description (such as To Allow WebUSB on specific sites) and the platform is Windows.
Configuration Settings
In the Configuration settings, you can see the Add settings button. Click the Add Settings to browse or search the catalog for the settings you want to configure. In the Settings picker, you can search for the Settings quickly. Here, I choose the Microsoft Edge\Content settings category, select Allow WebUSB on specific sites.
Once you have selected Allow WebUSB on specific sites and closed the Settings picker. You will see it on the Configuration page. Here we have only two settings: Enable or Disable. By default, it will be set to Disable. If you want to disable these settings, click on the Next button.
Enable WebUSB Policy
If we enable or configure this policy, you can enable the WebUSB policy by toggling the switch. After reviewing or adding more settings, you can click the Next button to proceed.
Scope Tags
In Intune, Scope Tags are used to control who can view and modify a policy. The scope tag is not mandatory, so you can skip this section. It functions as a tool for organisation and access management, but assigning it is optional. Click Next if they’re not required for your setup.
Assignments
In the Assignments tab, you choose the users or devices that will receive the policy by clicking Add Group under Include Group, select the group that you want to target (e.g Test_HTMD_Policy) and then click Next to continue.
Last Step
At the final Review + Create step, we see a summary of all configured settings for the new profile; after reviewing the details and making any necessary changes by clicking Previous. We click Create to finish, and a notification confirms that the “Allow WebUSB on specific sites created successfully”.
Device and User Check-in Status
To view a policy’s status, go to Devices > Configuration in the Intune portal, select the policy (like Allow WebUSB on specific sites ), and check that the status shows Succeeded (1). Use manual sync in the Company Portal to speed up the process.
Client Side Verification
To confirm if a policy has been applied, use the Event Viewer on the client device. Go to Applications and Services Logs > Microsoft > Windows > Device Management > Enterprise Diagnostic Provider > Admin. From the list of policies, use the Filter Current Log option and search for Intune event 814.
| Event Details |
|---|
| MDM PolicyManager: Set policy string, Policy (WebUsbAskForUrls)Area: (microsoft_edqe~Policy~microsoft_edqe~ContentSettinqs), EnrollmentID requestinq merqe: (EB427D85-802F-46D9-A3E2-D5B414587F63), Current User: (Device), Strinq: (), Enrollment Type: (0x6), Scope: (0x0). |
How to Remove Assigned groups from WebUSB Policy
After creating the policy, if you want to remove the specific group that you previously selected, you can easily do that. First, go to Devices > Configuration policies. In the Configuration policy section, search and select the policy. In the Assignment section, you will find an Edit option and click on it. Then, click the Remove option and Review+ save button.
For detailed information, you can refer to our previous post – Learn How to Delete or Remove App Assignment from Intune using by Step-by-Step Guide.
How to Delete WebUSB Policy from Intune Portal
If you want to delete this policy for any reason, you can easily do so. First, search for the policy name(Allow WebUSB on specific sites) in the configuration section. When you find the policy name, you will see a 3-dot menu next to it. Click on the 3 dots, then click the Delete button.
For detailed information, you can refer to our previous post – How to Delete Allow Clipboard History Policy in Intune Step by Step Guide.
Need Further Assistance or Have Technical Questions?
Join the LinkedIn Page and Telegram group to get the latest step-by-step guides and news updates. Join our Meetup Page to participate in User group meetings. Also, Join the WhatsApp Community to get the latest news on Microsoft Technologies. We are there on Reddit as well.
Author
Anoop C Nair has been Microsoft MVP from 2015 onwards for 10 consecutive years! He is a Workplace Solution Architect with more than 22+ years of experience in Workplace technologies. He is also a Blogger, Speaker, and Local User Group Community leader. His primary focus is on Device Management technologies like SCCM and Intune. He writes about technologies like Intune, SCCM, Windows, Cloud PC, Windows, Entra, Microsoft Security, Career, etc.
Discussion