Getting Started

Getting Started

This guide will walk you through installing DeviceControlPolicy editor and creating your first policy.

Installation

1. Download the latest release from the Releases page
2. Open the downloaded .zip file
3. Drag DeviceControlPolicy to your Applications folder
4. Launch the application from Applications or Spotlight

Application Layout

The application uses a three-pane layout common in macOS applications:

Pane	Purpose
Sidebar (left)	Navigate between Policy sections (Groups, Rules, Settings) and Preview
List (center)	View and select items within the current section
Detail (right)	Edit the selected item's properties

Creating a New Policy

1. Launch DeviceControlPolicy editor
2. The app automatically creates a new empty policy document
3. Alternatively, choose File > New (⌘N) to create a new policy

A new policy contains:

• One empty device group
• One empty rule
• Default settings

Opening an Existing Policy

1. Choose File > Open (⌘O)
2. Navigate to your .json policy file
3. Select the file and click Open

The application can open policy files created by:

• This application
• Microsoft's sample policies
• Any valid device control policy JSON file

Saving Your Policy

The application uses macOS's auto-save feature:

• Changes are saved automatically as you work
• The document title shows "Edited" when there are unsaved changes
• Use File > Save (⌘S) to save immediately
• Use File > Save As to save a copy with a new name

Your First Policy: Block USB Storage Write

Let's create a simple policy that blocks write access to removable media:

Step 1: New Policy

1. Select New in from the File menu, or type Command+N
2. Select Save in from the File menu, or type Command+S
3. Name it "Block USB Storage" and save to the location of your choosing

Step 2: Device Group

1. If not already selected, select Groups in the sidebar
2. Click on the already created New Device Group in the list view
3. The click into the Name field and name it "All Removable Media"
4. In the Query section, set:
   • Query Type: All (AND)
   • Clause Type: Primary ID
   • Value: Removable Media Devices

Step 2: Rule

1. Select Rules in the sidebar
2. Click on the already created New Rule in the list view
3. Name it "Block USB Write Access"
4. Under Include Groups, add "All Removable Media"
5. Expand the existing entry and change the values:
   • Type: Removable Media
   • Access: write
   • Enforcement: Deny

Step 3: Configure Settings

1. Select Settings in the sidebar
2. Set Removable Media to Enabled
3. Set Default Enforcement to Allow (so read access is still permitted)

Step 4: Validate and Save

1. Choose File > Validate Policy (⇧⌘V) to verify your policy
2. If valid, save your policy with File > Save (⌘S)

Step 5: Test your config locally before MDM deployment

Warning

You can set a device control policy manually, only if it wasn't already set via MDM

1. Launch the Terminal.app
2. Use this command:
   sudo mdatp config device-control policy set --path <full-path-to-policy.json>
3. After the policy is applied use this command to inspect:
   sudo mdatp device-control policy preferences list
4. If you need to make changes, you can edit your policy file, reapply it, and see changes immediately
5. Once you are satisfied, use this command to undo the policy:
   sudo mdatp config device-control policy reset
6. Upload the verified configuration to your MDM of choice.

See this Microsoft page for more details about manual deployment:
https://learn.microsoft.com/en-us/defender-endpoint/mac-device-control-manual

Next Steps

• Working with Groups - Learn about device matching queries
• Working with Rules - Understand entries and enforcement options
• Settings - Configure feature toggles and global settings