Securing Bluetooth on Windows Devices with Intune

Organizations increasingly rely on Bluetooth peripherals such as headsets, keyboards, and speakers for productivity, but unmanaged device connections pose serious risks. By configuring Windows Policy CSP for Bluetooth through Intune, IT admins can ensure that only specific, approved Bluetooth devices are allowed, while file transfer and untrusted device access are blocked to protect company data. This post is a step-by-step guide to use Intune to block (or allow) Bluetooth devices.

Why Secure Bluetooth Connections?

Bluetooth allows seamless pairing of devices, but it can also be a pathway for unauthorized file transfer, data leakage, and malicious access. For regulated sectors and companies prioritizing data protection, controlling which Bluetooth services and devices are trusted is essential.

Intune + Settings catalogue:

Microsoft Intune lets you define security policies for your managed Windows devices. To enforce restrictions at the Bluetooth service level, we can use the settings catalogue for Bluetooth, available on Pro, Enterprise, Education, and IoT editions.

Using ServicesAllowedList: Allow Only Specific Bluetooth Services

The ServicesAllowedList policy enables you to specify which Bluetooth profiles and services are permitted. This is done by listing allowed service UUIDs in canonical format, separated by semicolons.

The following UUID Devices will only (you can add more devices to the list based on your needs) be able to pair and communicate with peripherals matching these profiles; all other Bluetooth peripheral types (e.g., file transfer devices, unapproved speakers) are blocked.

Intune block bluetooth using settings Catalog

• Open Microsoft Intune Admin Center

• Go to Devices –> Windows –>Configuration > policies –>New policy create or edit a configuration profile.

• Select Platform as Windows 10 and later and Platform Type as Settings catalog

• Name the profile, description and click Next

• In the configuration settings, Click Add settings and search for Bluetooth and Allow them.

Select the following :

• Allow Advertising

• Allow Discoverable Mode

• Allow Prepairing

• Services Allowed List (with list of UUID as stated above or your custom list if you have)

• Assign the policy to targeted device groups and click Next to create the policy. (TEST TEST TEST before production rollout)

This method allows enterprise IT teams to enforce granular Bluetooth controls using Intune, meeting key security hardening and compliance requirements without sacrificing approved device functionality

By restricting Bluetooth to only essential services, companies proactively prevent unauthorized device connections and protect sensitive data from being transferred or accessed by rogue peripherals. This approach can be tailored for different user groups or device types, ensuring both security and productivity.

References:

• Microsoft Policy CSP – Bluetooth Documentation