{
    "api_version": "1",
    "kind": "dse_post",
    "self": "https://update.dsesecurity.com/api/v1/posts/dse-20260917-138-test-session-changes-when-defender-device-control-targets-users/",
    "item": {
        "id": "https://update.dsesecurity.com/updates/dse-20260917-138-test-session-changes-when-defender-device-control-targets-users/",
        "slug": "dse-20260917-138-test-session-changes-when-defender-device-control-targets-users",
        "url": "https://update.dsesecurity.com/updates/dse-20260917-138-test-session-changes-when-defender-device-control-targets-users/",
        "alternate_urls": {
            "markdown": "https://update.dsesecurity.com/updates/dse-20260917-138-test-session-changes-when-defender-device-control-targets-users.md",
            "json": "https://update.dsesecurity.com/api/v1/posts/dse-20260917-138-test-session-changes-when-defender-device-control-targets-users/"
        },
        "title": "Test session changes when Defender device control targets users",
        "summary": "Why can locking or signing out of a device change the outcome of a user-targeted device-control rule?",
        "format": {
            "slug": "guide",
            "name": "Guide"
        },
        "priority": {
            "slug": "info",
            "name": "Information"
        },
        "featured": false,
        "image": {
            "theme": "cyber-defense",
            "label": "Cyber defense",
            "alt": "Layered glass and metal cyber-defense structure with controlled blue and gold signal paths.",
            "card_url": "https://update.dsesecurity.com/assets/editorial/cyber-defense-card.webp?v=1.8.20",
            "hero_url": "https://update.dsesecurity.com/assets/editorial/cyber-defense-hero.webp?v=1.8.20",
            "social_url": "https://update.dsesecurity.com/assets/editorial/cyber-defense-social-v2.jpg?v=1.8.20",
            "width": 2400,
            "height": 1350
        },
        "topics": [
            {
                "slug": "cybersecurity",
                "name": "Cybersecurity",
                "url": "https://update.dsesecurity.com/topic/cybersecurity/"
            },
            {
                "slug": "it",
                "name": "IT",
                "url": "https://update.dsesecurity.com/topic/it/"
            }
        ],
        "author": {
            "name": "DSE Security Editorial Team",
            "url": "https://update.dsesecurity.com/#editorial-team",
            "type": "Organization"
        },
        "publisher": {
            "name": "Detection Systems & Engineering",
            "url": "https://dsesecurity.com/"
        },
        "published_at": "2026-09-17T16:32:42+00:00",
        "modified_at": "2026-09-17T16:42:36+00:00",
        "reviewed_on": "2026-09-17",
        "reading_minutes": 1,
        "word_count": 203,
        "potentially_affected": "Use this check for Microsoft Defender for Endpoint device-control policies whose rules depend on users or user groups. Document the platform, targeting method and intended access before testing removable-device operations.",
        "dse_recommendation": "DSE recommends making the session state a required field in device-control test results.",
        "primary_source": {
            "name": "Device control policies in Microsoft Defender for Endpoint - Microsoft Defender for Endpoint | Microsoft Learn",
            "url": "https://learn.microsoft.com/en-us/defender-endpoint/device-control-policies",
            "published_on": null,
            "authority": "Microsoft Learn"
        },
        "publishing_principles": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/",
        "usage_info": "https://update.dsesecurity.com/usage/",
        "copyright_notice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.",
        "content_html": "<h2>Source facts</h2>\n<p>Device control evaluates user sessions when enforcing policies that target particular users or groups. Microsoft says a lock or sign-out can cause user conditions to stop matching, and describes that behavior as expected. Microsoft also warns against combining user or group conditions inside rules with Intune user-group targeting. <a href=\"https://learn.microsoft.com/en-us/defender-endpoint/device-control-policies\" target=\"_blank\" rel=\"noopener noreferrer\">Microsoft Learn</a>.</p>\n<h2>Applicability</h2>\n<p>Use this check for Microsoft Defender for Endpoint device-control policies whose rules depend on users or user groups. Document the platform, targeting method and intended access before testing removable-device operations.</p>\n<h2>DSE recommendation</h2>\n<p>DSE recommends making the session state a required field in device-control test results. Choose a documented targeting approach, then describe the access expected during active use, lock and sign-out. Review unattended workflows that depend on removable media with the application owner so their required behavior is explicit before a broad policy change.</p>\n<h2>Verification</h2>\n<p>Use approved test media containing nonsensitive data. Exercise the same permitted operation while the intended user is active and after the relevant session transition. Record the rule, session state and observed result. Investigate differences against the rule conditions before adding an exception; repeat the test after correcting the targeting configuration.</p>\n<h2>Official references</h2>\n<p><a href=\"https://learn.microsoft.com/en-us/defender-endpoint/device-control-policies\" target=\"_blank\" rel=\"noopener noreferrer\">Microsoft Learn: Device control policies in Microsoft Defender for Endpoint</a>. Source reviewed September 17, 2026.</p>",
        "content_text": "Source facts\nDevice control evaluates user sessions when enforcing policies that target particular users or groups. Microsoft says a lock or sign-out can cause user conditions to stop matching, and describes that behavior as expected. Microsoft also warns against combining user or group conditions inside rules with Intune user-group targeting. Microsoft Learn.\nApplicability\nUse this check for Microsoft Defender for Endpoint device-control policies whose rules depend on users or user groups. Document the platform, targeting method and intended access before testing removable-device operations.\nDSE recommendation\nDSE recommends making the session state a required field in device-control test results. Choose a documented targeting approach, then describe the access expected during active use, lock and sign-out. Review unattended workflows that depend on removable media with the application owner so their required behavior is explicit before a broad policy change.\nVerification\nUse approved test media containing nonsensitive data. Exercise the same permitted operation while the intended user is active and after the relevant session transition. Record the rule, session state and observed result. Investigate differences against the rule conditions before adding an exception; repeat the test after correcting the targeting configuration.\nOfficial references\nMicrosoft Learn: Device control policies in Microsoft Defender for Endpoint. Source reviewed September 17, 2026.",
        "content_markdown": "## Source facts\n\nDevice control evaluates user sessions when enforcing policies that target particular users or groups. Microsoft says a lock or sign-out can cause user conditions to stop matching, and describes that behavior as expected. Microsoft also warns against combining user or group conditions inside rules with Intune user-group targeting. [Microsoft Learn](https://learn.microsoft.com/en-us/defender-endpoint/device-control-policies).\n\n## Applicability\n\nUse this check for Microsoft Defender for Endpoint device-control policies whose rules depend on users or user groups. Document the platform, targeting method and intended access before testing removable-device operations.\n\n## DSE recommendation\n\nDSE recommends making the session state a required field in device-control test results. Choose a documented targeting approach, then describe the access expected during active use, lock and sign-out. Review unattended workflows that depend on removable media with the application owner so their required behavior is explicit before a broad policy change.\n\n## Verification\n\nUse approved test media containing nonsensitive data. Exercise the same permitted operation while the intended user is active and after the relevant session transition. Record the rule, session state and observed result. Investigate differences against the rule conditions before adding an exception; repeat the test after correcting the targeting configuration.\n\n## Official references\n\n[Microsoft Learn: Device control policies in Microsoft Defender for Endpoint](https://learn.microsoft.com/en-us/defender-endpoint/device-control-policies). Source reviewed September 17, 2026."
    },
    "json_ld": {
        "@context": "https://schema.org",
        "@graph": [
            {
                "@type": "Organization",
                "@id": "https://dsesecurity.com/#organization",
                "name": "Detection Systems & Engineering",
                "alternateName": "DSE Security",
                "url": "https://dsesecurity.com/",
                "logo": {
                    "@type": "ImageObject",
                    "url": "https://update.dsesecurity.com/assets/dse-logo-20260812.png?v=1.8.20"
                }
            },
            {
                "@type": "Organization",
                "@id": "https://update.dsesecurity.com/#editorial-team",
                "name": "DSE Security Editorial Team",
                "url": "https://update.dsesecurity.com/",
                "parentOrganization": {
                    "@id": "https://dsesecurity.com/#organization"
                }
            },
            {
                "@type": "WebSite",
                "@id": "https://update.dsesecurity.com/#website",
                "name": "DSE Updates",
                "alternateName": "DSE Security Knowledge Hub",
                "url": "https://update.dsesecurity.com/",
                "inLanguage": "en-US",
                "publisher": {
                    "@id": "https://dsesecurity.com/#organization"
                },
                "potentialAction": {
                    "@type": "SearchAction",
                    "target": {
                        "@type": "EntryPoint",
                        "urlTemplate": "https://update.dsesecurity.com/?q={search_term_string}"
                    },
                    "query-input": "required name=search_term_string"
                }
            },
            {
                "@type": "WebPage",
                "@id": "https://update.dsesecurity.com/updates/dse-20260917-138-test-session-changes-when-defender-device-control-targets-users/",
                "url": "https://update.dsesecurity.com/updates/dse-20260917-138-test-session-changes-when-defender-device-control-targets-users/",
                "isPartOf": {
                    "@id": "https://update.dsesecurity.com/#website"
                },
                "lastReviewed": "2026-09-17"
            },
            {
                "@type": "BreadcrumbList",
                "@id": "https://update.dsesecurity.com/updates/dse-20260917-138-test-session-changes-when-defender-device-control-targets-users/#breadcrumbs",
                "itemListElement": [
                    {
                        "@type": "ListItem",
                        "position": 1,
                        "name": "DSE Updates",
                        "item": "https://update.dsesecurity.com/"
                    },
                    {
                        "@type": "ListItem",
                        "position": 2,
                        "name": "Test session changes when Defender device control targets users",
                        "item": "https://update.dsesecurity.com/updates/dse-20260917-138-test-session-changes-when-defender-device-control-targets-users/"
                    }
                ]
            },
            {
                "@type": [
                    "Article",
                    "TechArticle"
                ],
                "@id": "https://update.dsesecurity.com/updates/dse-20260917-138-test-session-changes-when-defender-device-control-targets-users/#article",
                "identifier": "https://update.dsesecurity.com/updates/dse-20260917-138-test-session-changes-when-defender-device-control-targets-users/",
                "url": "https://update.dsesecurity.com/updates/dse-20260917-138-test-session-changes-when-defender-device-control-targets-users/",
                "headline": "Test session changes when Defender device control targets users",
                "description": "Why can locking or signing out of a device change the outcome of a user-targeted device-control rule?",
                "abstract": "Why can locking or signing out of a device change the outcome of a user-targeted device-control rule?",
                "articleBody": "Source facts\nDevice control evaluates user sessions when enforcing policies that target particular users or groups. Microsoft says a lock or sign-out can cause user conditions to stop matching, and describes that behavior as expected. Microsoft also warns against combining user or group conditions inside rules with Intune user-group targeting. Microsoft Learn.\nApplicability\nUse this check for Microsoft Defender for Endpoint device-control policies whose rules depend on users or user groups. Document the platform, targeting method and intended access before testing removable-device operations.\nDSE recommendation\nDSE recommends making the session state a required field in device-control test results. Choose a documented targeting approach, then describe the access expected during active use, lock and sign-out. Review unattended workflows that depend on removable media with the application owner so their required behavior is explicit before a broad policy change.\nVerification\nUse approved test media containing nonsensitive data. Exercise the same permitted operation while the intended user is active and after the relevant session transition. Record the rule, session state and observed result. Investigate differences against the rule conditions before adding an exception; repeat the test after correcting the targeting configuration.\nOfficial references\nMicrosoft Learn: Device control policies in Microsoft Defender for Endpoint. Source reviewed September 17, 2026.",
                "datePublished": "2026-09-17T16:32:42+00:00",
                "dateModified": "2026-09-17T16:42:36+00:00",
                "mainEntityOfPage": {
                    "@id": "https://update.dsesecurity.com/updates/dse-20260917-138-test-session-changes-when-defender-device-control-targets-users/"
                },
                "inLanguage": "en-US",
                "isAccessibleForFree": true,
                "author": {
                    "@type": "Organization",
                    "name": "DSE Security Editorial Team",
                    "url": "https://update.dsesecurity.com/#editorial-team"
                },
                "publisher": {
                    "@id": "https://dsesecurity.com/#organization"
                },
                "image": {
                    "@type": "ImageObject",
                    "@id": "https://update.dsesecurity.com/updates/dse-20260917-138-test-session-changes-when-defender-device-control-targets-users/#primaryimage",
                    "url": "https://update.dsesecurity.com/assets/editorial/cyber-defense-social-v2.jpg?v=1.8.20",
                    "contentUrl": "https://update.dsesecurity.com/assets/editorial/cyber-defense-social-v2.jpg?v=1.8.20",
                    "width": 1200,
                    "height": 630,
                    "caption": "Test session changes when Defender device control targets users"
                },
                "articleSection": [
                    "Cybersecurity",
                    "IT"
                ],
                "keywords": [
                    "Cybersecurity",
                    "IT",
                    "Guide",
                    "Information priority"
                ],
                "genre": "Guide",
                "about": [
                    {
                        "@type": "Thing",
                        "name": "Cybersecurity",
                        "url": "https://update.dsesecurity.com/topic/cybersecurity/"
                    },
                    {
                        "@type": "Thing",
                        "name": "IT",
                        "url": "https://update.dsesecurity.com/topic/it/"
                    }
                ],
                "wordCount": 203,
                "timeRequired": "PT1M",
                "publishingPrinciples": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/",
                "usageInfo": "https://update.dsesecurity.com/usage/",
                "copyrightHolder": {
                    "@id": "https://dsesecurity.com/#organization"
                },
                "copyrightNotice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.",
                "citation": {
                    "@type": "CreativeWork",
                    "name": "Device control policies in Microsoft Defender for Endpoint - Microsoft Defender for Endpoint | Microsoft Learn",
                    "url": "https://learn.microsoft.com/en-us/defender-endpoint/device-control-policies"
                }
            }
        ]
    }
}