> ## Documentation Index
> Fetch the complete documentation index at: https://syteca.com/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# USB Access Approval

> Set up the request-and-approve workflow for blocked USB devices in Syteca, and see what happens on the user's side when they try to use one.

When a USB monitoring rule uses the **Block access until administrator's approval** action, a blocked device becomes a *request* rather than a flat denial — the user sees a prompt, types a justification, and a trusted user (Approver) decides whether to allow it. This page covers the setup on the admin side and what the user sees on the endpoint.

<Note>
  This feature is **not currently supported for macOS Clients**.
</Note>

## Set up the approval workflow (admin)

<Steps>
  <Step title="Add a USB monitoring rule">
    [Add a USB monitoring rule](/docs/session-monitoring/usb-devices/usb-rules#add-a-usb-monitoring-rule) following the normal flow.
  </Step>

  <Step title="Choose the block-until-approval action">
    On the **Additional Actions** tab, in the **Actions** section, select **Block access to mass storage device until administrator's approval**.
  </Step>

  <Step title="Pick the Approvers">
    In the **Users Who Can Approve Access** drop-down below the checkbox, select the trusted users who should receive the request.

    <Note>
      Approvers must have valid email addresses on their [user account](/docs/administration/users/users#edit-a-user) to receive email requests. Alternatively, Approvers can process requests directly on the [Access Requests](/docs/pam/access/access-requests) tab without using email.
    </Note>
  </Step>

  <Step title="(Optional) Customize the user message">
    Enter a custom message to display on the Client computer when a blocked device is plugged in — for example, *"Plug your USB drive into a corporate device only. Enter a business justification below."*
  </Step>

  <Step title="Finish the rule">
    Complete the **Assigned Clients** tab and click **Finish** as in the normal [add-rule flow](/docs/session-monitoring/usb-devices/usb-rules#add-a-usb-monitoring-rule).
  </Step>
</Steps>

<Note>
  By default, access requests **expire after 30 minutes** if not processed. Change this in [System Settings](/docs/administration/configuration/system-settings) on the Configuration page.
</Note>

## What the user sees (endpoint)

When a user plugs in a USB device covered by a block-until-approval rule:

<Steps>
  <Step title="The user plugs in the device">
    A prompt opens on the Client computer.
  </Step>

  <Step title="The user submits a request">
    The user enters a comment (typically a business justification) and clicks **Request Access**.

    <Warning>
      If the device was already plugged in *before* the session started, it's blocked silently with no prompt. To request access, the user must unplug and re-plug the device.
    </Warning>
  </Step>

  <Step title="Approvers receive the request">
    The request is emailed to the Approvers configured on the rule, and also appears on the **Access Requests** tab of the Management Tool. An Approver clicks the email link, or opens the [Access Requests](/docs/pam/access/access-requests) tab, and chooses **Approve** or **Deny** with an optional comment.
  </Step>

  <Step title="The user sees the decision">
    The Approver's decision and comment appear on the user's screen.

    * **Approved:** the user must **unplug and re-plug the device** before they can use it. Once re-plugged, the device works without further restrictions for the session.
    * **Denied:** the user cannot use the device unless they submit a new request and an Approver approves it.
  </Step>
</Steps>

<Frame caption="The access request prompt shown on a Client computer when a blocked device is plugged in.">
  <img src="https://mintcdn.com/syteca/FKrkO8bEqEQ6WSgs/images/administration/usb-devices/access-request-prompt.png?fit=max&auto=format&n=FKrkO8bEqEQ6WSgs&q=85&s=69f30dbc5812c7a45dcf05689055efe6" alt="Client computer prompt for a blocked USB device with a comment field and Request Access button" width="1913" height="1065" data-path="images/administration/usb-devices/access-request-prompt.png" />
</Frame>

## Related

<CardGroup cols={2}>
  <Card title="USB Devices overview" icon="usb" href="/docs/session-monitoring/usb-devices/overview">
    The conceptual overview and device class reference.
  </Card>

  <Card title="USB monitoring rules" icon="list-checks" href="/docs/session-monitoring/usb-devices/usb-rules">
    Add, edit, delete rules, and define exceptions.
  </Card>

  <Card title="Access requests" icon="inbox" href="/docs/pam/access/access-requests">
    Process USB and PAM access requests in one place.
  </Card>

  <Card title="Endpoint access control" icon="shield-check" href="/docs/administration/access/endpoint-access-control">
    A similar request-and-approve workflow for Client logins.
  </Card>
</CardGroup>