Just-In-Time (JIT) protection in Microsoft Purview Endpoint DLP blocks egress actions on files that have not yet been scanned (status: Not evaluated) for users within the JIT protection scope.

1. User1/File1: User1 is in scope. File1 is "Not evaluated" on an onboarded device (Device1). JIT blocks the copy action until evaluation completes.
2. User2/File2: User2 is not in scope ("Not configured"). JIT protection does not apply, regardless of file status.
3. User3/File3: Although User3 is in scope, Device3 is not onboarded to Microsoft Purview. DLP and JIT policies only function on onboarded endpoints; therefore, no audit event or block occurs.

Microsoft Purview Documentation: "Learn about Just-In-Time protection (preview)," Section: How JIT protection works.

Microsoft Purview Documentation: "Get started with Endpoint data loss prevention," Section: Onboarding devices to Microsoft Purview.

Microsoft Purview Documentation: "Endpoint DLP settings," Section: Just-In-Time protection.