Configure device restriction settings in Microsoft Intune

Intune includes device restriction policies that help administrators control Android, iOS, macOS, and Windows devices. These restrictions let you control a wide range of settings and features to protect your organization's resources. For example, administrators can:

  • Allow or block the device camera
  • Control access to Google Play, app stores, viewing documents, and gaming
  • Block built-in apps, or create a list of apps that allowed or prohibited
  • Allow or prevent backing up files to cloud and storage accounts
  • Set a minimum password length, and block simple passwords

These features are available in Intune, and are configurable by the administrator. Intune uses "configuration profiles" to create and customize these settings for your organization's needs. After you add these features in a profile, you can then push or deploy the profile to devices in your organization.

This article shows you how to create a device restrictions profile. You can also see all the available settings for the different platforms.

Create the profile

  1. Sign in to the Microsoft Endpoint Manager Admin Center.

  2. Select Devices > Configuration profiles > Create profile.

  3. Enter the following properties:

    • Name: Enter a descriptive name for the policy. Name your policies so you can easily identify them later. For example, a good policy name is iOS: Block camera on devices.

    • Description: Enter a description for the policy. This setting is optional, but recommended.

    • Platform: Choose the platform of your devices. Your options:

      • Android
      • Android enterprise
      • iOS/iPadOS
      • macOS
      • Windows Phone 8.1
      • Windows 8.1 and later
      • Windows 10 and later
    • Profile type: Select Device restrictions.

      To create a device restrictions profile for Windows 10 Team devices, such as Surface Hub, then choose Device restrictions (Windows 10 Team).

  4. Depending on the platform you chose, the settings you can configure are different. Choose your platform for detailed settings:

  5. When you're done, select OK > Create to save your changes.

The profile is created and shown on the profiles list.

Next steps

After the profile is created, it's ready to be assigned. Next, assign the profile and monitor its status.