Restrict USB storage with Intune

Been tasked with a proof of concept for Intune to restrict USB drives but allow company issued ones. This is the writeup on how I solved this use case.

Create an Intune Device Configuration profile according to ths following Microsoft documentation.

https://learn.microsoft.com/en-us/mem/intune/configuration/administrative-templates-restrict-usb

So the trick is to use a combination of the Allow Installation of devices that match any of these device instance IDs, Allow Installation of devices using drivers that match these device setup classes GUIDs, Apply layered order of evaluation, and Prevent installation of devices that match any of these device IDs and set it to GENDisk