You implement Microsoft 365 Endpoint data loss prevention (Endpoint DIP). You have computers that run Windows 11 and have Microsoft 365 Apps…

Endpoint DLP policies work only on devices that are first onboarded to Microsoft Defender for Endpoint. The supported onboarding methods for Windows 10/11 include deploying the Windows Defender ATP (Endpoint DLP) onboarding / configuration package by script, GPO, or Intune. Once the package is installed, the device reports to the service and DLP policies can inspect and protect local content. Therefore, deploying the Endpoint DLP configuration package satisfies the stated goal.

B. No – Without the onboarding package the devices are not registered with Defender for Endpoint, so Endpoint DLP policies cannot evaluate or protect files.

1. Microsoft Purview – “Get started with endpoint DLP” → Prerequisite step 2: “Onboard the devices by deploying the Windows Defender ATP onboarding package.”

https://learn.microsoft.com/en-us/purview/endpoint-dlp-getting-started#step-2-onboard-the-devices

2. Microsoft Defender for Endpoint Docs – “Onboard Windows 10

Windows 11

and Windows Server devices” → “Download the onboarding package and deploy by script

GPO

or Intune.”

https://learn.microsoft.com/en-us/microsoft-365/security/defender-endpoint/configure-endpoints?view=o365-worldwide