* Device1 - No
Device1 is not onboarded.
* Device2 - Yes
Microsoft Purview Insider Risk Management can capture forensic evidence from both Windows and macOS devices. To do so, devices must be onboarded to Microsoft Purview and have the Microsoft Purview client installed.
* Device3 - No
The Microsoft Purview Client must be installed.
Note:
User devices eligible for forensic evidence capturing must be onboarded to the Microsoft Purview portal and must have the Microsoft Purview Client installed.
Reference:
https://learn.microsoft.com/en-us/purview/insider-risk-management-forensic-evidence-configure