Removable Storage (USB) Activity (30 days)
The question it answers: Which devices mounted USB drives in the last 30 days, and how many files were copied to them?
Which devices mounted USB drives in the last 30 days, and how many files were copied to them? A starting point for data-loss investigations and for deciding whether device control policies are needed.
At a glance
Section titled “At a glance”| Where in the app | Tenant › Defender & Security Operations › USB Storage Activity |
| Workload | Security |
| Kind | Findings list · dashboard tile |
| Data | Read from Microsoft 365 when someone first opens it, then kept for the report cache lifetime (Settings > Data & cache, 1 hour unless changed). |
| Licence | Defender for Endpoint P2. |
| Report id (API and MCP) | tenant.secops.usb-activity |
Columns
Section titled “Columns”| Column | Key | Type |
|---|---|---|
| Severity | Severity | Status |
| Activity | Category | Text |
| Device | Subject | Link |
| Check | Setting | Text |
| Drives / mounts | Value | Text |
| Finding | Finding | Text |
| Users / sample files | Detail | Text |
| Last mount | When | Date |
| Files written | Number | Number |
A findings list hides columns that no row fills. Severity is Critical, Serious, Warning, OK or Info; rows rated Critical, Serious or Warning need attention (Working with findings).
What it needs
Section titled “What it needs”Licence: Defender for Endpoint P2.
Application permissions on the IntensiveReports app registration (all permissions):
| Permission | API | What it allows | Note |
|---|---|---|---|
ThreatHunting.Read.All | Microsoft Graph | Run hunting queries and read shared saved hunting queries |
Data sources it reads
POST /v1.0/security/runHuntingQuery (DeviceEvents, DeviceFileEvents)
Through the API and MCP
Section titled “Through the API and MCP”GET /ir-api/v1/reports/tenant.secops.usb-activity?size=100An AI assistant reads it with the MCP tool get_report and the id tenant.secops.usb-activity. The client needs the Read grant for Security. See Using the API.