Test session changes when Defender device control targets users

Source facts

Device control evaluates user sessions when enforcing policies that target particular users or groups. Microsoft says a lock or sign-out can cause user conditions to stop matching, and describes that behavior as expected. Microsoft also warns against combining user or group conditions inside rules with Intune user-group targeting. Microsoft Learn.

Applicability

Use this check for Microsoft Defender for Endpoint device-control policies whose rules depend on users or user groups. Document the platform, targeting method and intended access before testing removable-device operations.

DSE recommendation

DSE recommends making the session state a required field in device-control test results. Choose a documented targeting approach, then describe the access expected during active use, lock and sign-out. Review unattended workflows that depend on removable media with the application owner so their required behavior is explicit before a broad policy change.

Verification

Use approved test media containing nonsensitive data. Exercise the same permitted operation while the intended user is active and after the relevant session transition. Record the rule, session state and observed result. Investigate differences against the rule conditions before adding an exception; repeat the test after correcting the targeting configuration.

Official references

Microsoft Learn: Device control policies in Microsoft Defender for Endpoint. Source reviewed September 17, 2026.