Various techniques and solutions are described for rule-based access to removable storage devices. For example, a request can be received to perform a file system operation using a removable storage device that is formatted with a file system that does not support access controls. A rules-based check of the received request can be performed by a service by checking the request against a plurality of rules. Based on results of the rules-based check, the request can be allowed or denied.