Forensic evidence in Microsoft Purview Insider Risk Management allows capturing screenshots/clips of user activity on endpoints.
Requirements for forensic evidence capture:
The device must be onboarded to Microsoft Purview (via Defender for Endpoint).
The Microsoft Purview client must be installed.
Supported platforms: Windows 10 and Windows 11 (macOS is not supported for forensic evidence).
Now check each device:
Device1 (Windows 11) # Client installed, but not onboarded # # Not eligible.
Device2 (Windows 10) # Onboarded and client installed # # Eligible.
Device3 (macOS) # Onboarded, but client not installed and macOS is not supported # # Not eligible.
Therefore, only Device2 qualifies.
Reference:
Microsoft Learn: Forensic evidence in insider risk management
Microsoft Learn: Onboard devices for insider risk management forensic evidence