These conditions include that a device must be one of these : * Azure Active Directory (Azure AD) joined
- Hybrid Azure AD joined
- AAD registered
AND enable device monitoring and onboard your endpoints before you can monitor and protect sensitive items on a device. Both of these actions are done in the Microsoft 365 Compliance portal. However, device that have previously been onboarded into Microsoft Defender for Endpoint, will already appear in the managed devices list.
https://docs.microsoft.com/en-us/microsoft-365/compliance/endpoint-dlp-getting- started?view=o365-worldwide