Control USB functionality on managed macOS devices. Use this policy to block USB storage devices from mounting and prevent external USB HID peripherals (keyboards, mice) from connecting.
BYOD Compatibility: macOS
Minimum System Requirements: macOS 12.0+
Supported Platforms: macOS
Overview
The Apple USB Policy lets administrators restrict USB access on managed macOS devices in two ways:
Disable USB Storage — Blocks USB storage devices such as flash drives and external disks from mounting, preventing unauthorized data transfer.
Disable HID — Blocks external USB Human Interface Devices (keyboards, mice) from being recognized. Internal keyboards, trackpads, and Apple Bluetooth devices are not affected.
When HID blocking is enabled, you can selectively allow specific USB HID devices by adding them to the HID Whitelist using their Vendor ID and Product ID.
Policy Fields
Disable USB Storage
Property | Value |
Field name |
|
Type | Boolean |
Default |
|
Minimum OS | macOS 12.0+ |
If set to true, blocks USB storage devices (flash drives, external disks) from mounting. No data transfer is possible through USB storage while this setting is active.
Disable HID
Property | Value |
Field name |
|
Type | Boolean |
Default |
|
Minimum OS | macOS 12.0+ |
If set to true, blocks external USB HID peripherals (keyboards, mice). The device's built-in keyboard, trackpad, and Apple Bluetooth accessories are not affected by this setting.
HID Whitelist
Property | Value |
Field name |
|
Type | Array of dictionaries |
Default | — |
Minimum OS | macOS 12.0+ |
A list of USB HID devices that are allowed to connect even when Disable HID is enabled. Each entry requires two sub-fields:
Sub-field | Display Name | Type | Required | Description |
| Vendor ID | Integer | Yes | USB Vendor ID of the allowed device (decimal). |
| Product ID | Integer | Yes | USB Product ID of the allowed device (decimal). |
Tip: You can find a device's Vendor ID and Product ID on macOS by opening System Information → USB and selecting the connected device. The values are displayed in hexadecimal — convert them to decimal before entering them in the policy.
Example Configuration
Field | Value |
Disable USB Storage |
|
Disable HID |
|
HID Whitelist | Vendor ID: |
In this example, all USB storage is blocked, all external USB HID devices are blocked except the device matching Vendor ID 1452 and Product ID 641 (which would remain functional).
Notes
Changes to this policy take effect after the device syncs with the MDM server.
Blocking USB storage prevents the volume from mounting — the physical connection is not disabled.
The HID Whitelist is only evaluated when Disable HID is set to
true. If HID blocking is off, the whitelist has no effect.Internal keyboards, trackpads, and Apple Bluetooth peripherals are never blocked by the Disable HID setting.