> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/reference-and-developer-docs/role-based-access-control/inventory-agent-permissions/device-control.md).

# Device Control

Manage policies for external devices connected to endpoints. Controls access permissions for USB drives, Bluetooth devices, and other peripherals. For more information, see [Device control](/cortex-xdr-5.x/protect-your-endpoints/install-and-manage-endpoints/harden-endpoint-security/device-control.md).

{% hint style="warning" %}

### Caution

Device Control is critical for data loss prevention. Overly restrictive policies may impact productivity, while permissive policies may enable data exfiltration. Balance security requirements with operational needs.
{% endhint %}

| Permissions | Description                                                                                                                                                                                                                                                                                                                                                                          | Roles Example                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          |
| ----------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ |
| None        | <p>Cannot view the following pages under <strong>Inventory</strong> → <strong>Endpoints</strong>:</p><ul><li>Device Control Violations</li><li>Disk Encryption Visibility</li><li><p>Under Policy Management:</p><ul><li>Device Permanent/Temporary Exceptions</li><li>Settings: Device Management</li><li>Extensions: Policy Rules</li><li>Extensions: Profiles</li></ul></li></ul> | SOC Tier-1 Analyst: Not part of daily triage.                                                                                                                                                                                                                                                                                                                                                                                                                                                          |
| View        | Read-only access for the pages listed above.                                                                                                                                                                                                                                                                                                                                         | <ul><li>SOC- Tier 2 Analyst: Understanding device control helps investigate data exfiltration or unauthorized device usage. Critical for insider threat investigations</li><li>SOC Tier-3 Analyst: View, but may need view/edit for emergency containment of data exfiltration (blocking all USB devices), but should require approval</li><li>Threat Hunter: Device control visibility helps understand potential data exfiltration vectors. Hunters need to know what devices are allowed.</li></ul> |
| View/Edit   | All view capabilities, plus managing policies and exceptions. Additional action permissions with View/Edit permissions, such as Device Control Rules and Device Control Exceptions.                                                                                                                                                                                                  | Security Engineer: Responsible for device control rule development and maintenance. Creates and optimizes device policies.                                                                                                                                                                                                                                                                                                                                                                             |

**Device Control sub-permissions**

| Sub-permission            | Description                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  | Roles Example                                                                                                                                                                    |
| ------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| Device Control Rules      | <p>Enables users to permit/prevent device connection, prevent data writing, and allow connection but log all activity.</p><ul><li>Checked: Users can create, edit, delete, and enable/disable device control rules (<strong>Inventory</strong> → <strong>Endpoints</strong> → <strong>Policy Management</strong> → <strong>Extensions</strong> → <strong>Policy Rules</strong>).</li><li>Unchecked: Rule actions are disabled within profiles.</li></ul><p>To manage device control rules, users also need the <strong>Agent Extension Policies</strong> permission to access the profiles where rules are configured.</p>                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                   | Security Engineer: Responsible for device control rule development and maintenance. Creates rules for different device types, vendors, and use cases.                            |
| Device Control Exceptions | <p>Create exceptions to device control rules for specific devices or users.</p><p>Users can create, edit, and delete permanent or temporary exceptions that override device control rules (<strong>Inventory</strong> → <strong>Endpoints</strong> → <strong>Policy Management</strong> → <strong>Extensions</strong> → <strong>Device Permanent Exceptions</strong>, or <strong>Device Temporary Execptions</strong>).</p><div data-gb-custom-block data-tag="hint" data-style="info" class="hint hint-info"><p><strong>Note</strong></p><p>Exceptions bypass device control rules and can create security gaps. Implement approval workflows and regular exception reviews. Consider requiring business justification for all exceptions.</p></div><ul><li>Checked: Users can add device exceptions.</li><li>Unchecked: The Add Exception action is disabled.</li></ul><div data-gb-custom-block data-tag="hint" data-style="info" class="hint hint-info"><p><strong>Tip</strong></p><p>Consider adding Device Control Rules. Understanding existing rules is essential before creating exceptions. Exceptions should be targeted to specific rules to minimize security impact.</p></div> | Security Engineer: Responsible for exception management with proper documentation. Creates exceptions based on approved business requests with appropriate scope and expiration. |

**Required and recommended permissions**

Consider adding the following permissions:

| Permission               | Permission Level | Reasons                                                                                                                                                                                    |
| ------------------------ | ---------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ |
| Agent Groups             | View             | Required. Must understand group structure to target device control rules and policies correctly. Incorrect targeting can block legitimate devices or allow unauthorized ones.              |
| Agent Extension Policies | View             | Strongly Recommended. Device Control rules and profiles are managed through extension policies. An extension policy context is needed to understand the full device control configuration. |
| Agent Administrations    | View             | Strongly Recommended. View endpoints to correlate device violations with endpoint data and understand which endpoints are generating events.                                               |
| Cases & Issues           | View             | Strongly Recommended. Review device-related security events to inform policy decisions. Understanding data exfiltration attempts helps create effective rules and policies.                |
| Host Insights            | View             | Recommended. View detailed endpoint device information, including connected devices, USB history, and compliance status.                                                                   |


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/reference-and-developer-docs/role-based-access-control/inventory-agent-permissions/device-control.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.