The USB stick, the print job, the clipboard, the browser upload, all of them are visible to it. Anything that was never written to a file is not.

It is stated plainly in the documentation, and no other limit on this product matters as much. Working around it is a question of policy design rather than of configuration.

• The wording is unambiguous. Where data is never written to a file on the local device, there is nothing for Endpoint DLP to scan or classify. The example given is somebody opening a document in Word and saving it straight onto a USB device without it ever touching the local disk.
• Which means the removable media rule cannot stand on its own. Something has to govern the hardware as well as the file, and that something is Defender for Endpoint device control for removable storage. The documentation sends you there deliberately.
• Every other exit route where data never lands on local disk has the same problem. Build your coverage assumptions on file activity alone and the hole will sit precisely in the scenario that worried you enough to buy the product.
• What works in practice is three layers doing different jobs. Device control decides whether removable storage can be used at all. Endpoint DLP governs what happens to files that genuinely exist on disk. And sensitivity labeling keeps the classification attached to the document wherever it ends up.