# Test session changes when Defender device control targets users

> Why can locking or signing out of a device change the outcome of a user-targeted device-control rule?

- Canonical URL: https://update.dsesecurity.com/updates/dse-20260917-138-test-session-changes-when-defender-device-control-targets-users/
- Publisher: Detection Systems & Engineering (DSE Security)
- Author: DSE Security Editorial Team
- Published: 2026-09-17T16:32:42+00:00
- Modified: 2026-09-17T16:42:36+00:00
- Last reviewed by DSE: 2026-09-17
- Resource type: Guide
- DSE priority: Information
- Topics: Cybersecurity, IT
- Reading time: 1 minutes

## What you need to know

Why can locking or signing out of a device change the outcome of a user-targeted device-control rule?

## Potentially affected

Use this check for Microsoft Defender for Endpoint device-control policies whose rules depend on users or user groups. Document the platform, targeting method and intended access before testing removable-device operations.

## DSE recommendation

DSE recommends making the session state a required field in device-control test results.

## Article

## Source facts

Device control evaluates user sessions when enforcing policies that target particular users or groups. Microsoft says a lock or sign-out can cause user conditions to stop matching, and describes that behavior as expected. Microsoft also warns against combining user or group conditions inside rules with Intune user-group targeting. [Microsoft Learn](https://learn.microsoft.com/en-us/defender-endpoint/device-control-policies).

## Applicability

Use this check for Microsoft Defender for Endpoint device-control policies whose rules depend on users or user groups. Document the platform, targeting method and intended access before testing removable-device operations.

## DSE recommendation

DSE recommends making the session state a required field in device-control test results. Choose a documented targeting approach, then describe the access expected during active use, lock and sign-out. Review unattended workflows that depend on removable media with the application owner so their required behavior is explicit before a broad policy change.

## Verification

Use approved test media containing nonsensitive data. Exercise the same permitted operation while the intended user is active and after the relevant session transition. Record the rule, session state and observed result. Investigate differences against the rule conditions before adding an exception; repeat the test after correcting the targeting configuration.

## Official references

[Microsoft Learn: Device control policies in Microsoft Defender for Endpoint](https://learn.microsoft.com/en-us/defender-endpoint/device-control-policies). Source reviewed September 17, 2026.

## Primary reference

- Name: Device control policies in Microsoft Defender for Endpoint - Microsoft Defender for Endpoint | Microsoft Learn
- Authority: Microsoft Learn
- URL: https://learn.microsoft.com/en-us/defender-endpoint/device-control-policies
- Source publication date: Not stated by the source

## Citation and use

Preferred citation: “Test session changes when Defender device control targets users,” DSE Security, https://update.dsesecurity.com/updates/dse-20260917-138-test-session-changes-when-defender-device-control-targets-users/
Publishing principles: https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/
Usage and citation policy: https://update.dsesecurity.com/usage/
Copyright © 2026 Detection Systems & Engineering. All rights reserved.