Microsoft Purview JIT Enforcement Logic: Scope, Onboarding, and Classification

SC-401 By islever Editorial Last updated

Implement and manage Microsoft Purview Insider Risk Management

Short answer

Yes, No, No. Statement 1 is true because User1 is in scope and Device1 is onboarded, allowing JIT to block the action despite the file being unevaluated. Statement 2 is false because User2 is not in the JIT scope. Statement 3 is false because Device3 is not onboarded, preventing JIT enforcement.

Question

HOTSPOT
You have a Microsoft 365 E5 subscription that uses Microsoft Purview and just-in-time (JIT) protection. Fallback action in case of failure is set to Block users from completing actions.
The subscription contains the users shown in the following table.
Exhibit: Microsoft Purview JIT Enforcement Logic: Scope, Onboarding, and
The subscription contains the devices shown in the following table.
Exhibit: Microsoft Purview JIT Enforcement Logic: Scope, Onboarding, and
The devices contain the files shown in the following table.
Exhibit: Microsoft Purview JIT Enforcement Logic: Scope, Onboarding, and
For each of the following statements, select Yes if the statement is true. Otherwise, select No.
NOTE: Each correct selection is worth one point.
Exhibit: Microsoft Purview JIT Enforcement Logic: Scope, Onboarding, and

Key Takeaways

JIT protection requires both the user to be in the defined scope AND the device to be onboarded to Defender for Endpoint; file classification enhances precision but is not always mandatory for basic action blocking.

Determines JIT protection outcomes based on user scope, device onboarding, and file classification. Correct answers are Yes, No, No, reflecting that JIT blocks unevaluated files if user/device criteria are met, but fails if the user is out of scope or the device is offboarded.

Common mistake: Selecting 'Yes' for all statements because the fallback is 'Block', ignoring that JIT only applies if the specific user-device-context conditions are met. Another mistake is assuming 'Not evaluated' files are exempt from JIT checks.

Expert Analysis

The question tests the enforcement logic of Microsoft Purview Just-in-Time (JIT) Protection for data access, specifically how it interacts with user scope, device onboarding status, and file classification state.

  1. Statement 1: User1 copies File1 to USB.
  • User Scope: User1 is explicitly listed in the JIT protection scope.
  • - Device Status: Device1 is 'Onboarded' to Microsoft Defender for Endpoint.
  • - File State: File1.docx is 'Not evaluated'.
  • - Logic: JIT protection does not strictly require a sensitivity label or classification evaluation to trigger. It evaluates the context of the action (e.g., copying to removable media). Since the user is in scope and the device is onboarded, the action is subject to JIT policies. The fallback is set to 'Block users from completing actions'. Therefore, the attempt is blocked. Answer: Yes.
  • - Note on common confusion: Some learners believe 'Not evaluated' files are ignored. However, JIT can apply based on location/user context even without explicit file classification labels. The comment stating 'JIT cannot enforce without classification' is incorrect; JIT enforces on the action against protected resources.

2. Statement 2: User2 attaches File2 to email.

  • User Scope: User2 is NOT listed in the JIT protection scope table.
  • - Device Status: Device2 is 'Onboarded'.
  • - File State: File2.pdf is 'Sensitive' (has a label).
  • - Logic: JIT protection requires the user to be included in the JIT scope configuration. Since User2 is excluded from the scope, JIT policies do not apply to their actions, regardless of the file's sensitivity or the device's onboarding status. No block occurs via JIT. Answer: No.

3. Statement 3: User3 copies File3 to OneDrive.

  • User Scope: User3 is listed in the JIT protection scope.
  • - Device Status: Device3 is 'NOT onboarded'.
  • - File State: File3.xlsx is 'Confidential' (has a label).
  • - Logic: JIT protection relies on the device agent (Defender for Endpoint) to monitor and enforce restrictions on local endpoints. If the device is not onboarded, the JIT agent cannot monitor the activity or enforce the block. Therefore, the action proceeds (or at least is not blocked by JIT). Answer: No.

Official Reference

https://learn.microsoft.com/en-us/purview/jit-protection

This link opens the official vendor documentation in a new tab.

Exam Strategy

When analyzing JIT scenarios, first check if the user is in the JIT scope list. If no, the answer is immediately No (unless another policy applies). If yes, check if the device is onboarded. If not onboarded, JIT cannot enforce, so the answer is No. Only if both are true should you consider the file state and action type.

Frequently Asked Questions

Does JIT require a file to have a sensitivity label?

No. While sensitivity labels help define policies, JIT can block actions like copying to removable drives based on user scope and device onboarding status alone, even if the file is 'Not evaluated'.

What happens if the device is not onboarded to Defender?

JIT protection cannot enforce restrictions on that device because the necessary endpoint agent is missing. The action will likely proceed unless blocked by other mechanisms.

More SC-401 FAQ →

Discussion 5 contributions

Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.

From public community threads 5

  1. RickySmith 👍 13
    Y - User/Device onboarded and protected and fallback set to block, so "Not evaluated" file will be blocked. N - User 2 is not included in scope for JIT protection N - Device is not onboarded to Defender
  2. Farreller 👍 2
    If User1 attempts to copy File1.docx to a removable USB drive, JIT will block the action. User1 is in JIT scope ✅ Device1 is onboarded ✅ File1.docx is not evaluated ❌ → JIT cannot enforce without classification. Answer: No If User2 signs in to Device2 and attempts to attach File2.pdf to an email, JIT will block the action. User2 is not configured for JIT ❌ Even though Device2 is onboarded and File2.pdf is evaluated, JIT does not apply to User2. Answer: No If User3 attempts to copy File3.xlsx to a network share, JIT will generate an audit event. User3 is in JIT scope ✅ Device3 is not onboarded ❌ File3.xlsx is not evaluated ❌ → No enforcement or audit because device is not onboarded. Answer: No ✅ Final Answers: Statement 1: No Statement 2: No Statement 3: No
  3. Alcpt 👍 1
    Yes , No, No File1.docx (Not evaluated) - JIT can still protect it based on location/user policies. JIT primarily needs device onboarding and user scope - file classification enhances precision but isn't required for basic JIT functionality.
  4. MultiCloudIronMan 👍 1
    YYY Every action is blocked because every scenario contains a JIT failure, and your fallback setting forces a hard block.
  5. Scrambles 👍 1
    “JIT cannot enforce without classification” is backwards, because an unevaluated file is exactly what JIT blocks

Reader comments & corrections

No reader corrections yet — spotted an error or have a note? Share it below.

Log in to comment, report an error, or add a note about this question.

Using Sensitivity Labels to Restrict Microsoft 365 Copilot Access

S-grade

Microsoft Purview Retention Policy Conflict Resolution

S-grade

Maximum Primary Elements in Microsoft Purview EDM Classifier

S-grade

Encrypting Emails with Azure Storage Keys via DLP

S-grade

← Back to SC-401 Study Guide