The issue where users sometimes can upload files to cloud services and sometimes cannot suggests inconsistent enforcement of Endpoint DLP policies. This can be caused by the unallowed browsers in the Microsoft 365 Endpoint DLP settings are NOT configured. Also, there are file path exclusions in the Microsoft 365 Endpoint DLP settings.
Endpoint DLP can block uploads only when using unallowed browsers. If unallowed browsers are not configured, users might be able to bypass restrictions by switching to a different browser. This could explain why uploads sometimes work and sometimes don't, depending on which browser is used.
File path exclusions allow certain files or folders to be exempt from DLP restrictions. If a specific file location is excluded, files stored there won't trigger DLP policies, leading to inconsistent behavior. This could result in some uploads being blocked while others are allowed.

The issue: Users cannot upload documents with U.S. passport numbers to a legitimate travel management website because Endpoint DLP is blocking it.
Solution: Configure Service domains in Endpoint DLP # this allows defining specific trusted domains where uploads of sensitive information are permitted while still blocking uploads to other, non-approved domains.
Why not others?
Unallowed browsers: Restricts/blocklists browsers, not the issue here.
File path exclusions: Excludes local folders/paths from monitoring, irrelevant to web uploads.
Unallowed apps: Restricts desktop apps, not browser-based sites.
Reference:
Microsoft Learn: Configure service domains for Endpoint DLP

Policy tips in DLP: Policy tips are messages shown to users when their action (such as sending sensitive content via email) conflicts with a DLP policy.
For Exchange email location, policy tips are supported in the following apps:
Outlook for Microsoft 365 (desktop client) #
Outlook on the web (OWA) #
Outlook Mobile (iOS/Android) # Policy tips are not shown in mobile apps. Instead, DLP actions (block/restrict
/send incident report) still apply, but the user does not see a policy tip notification.
Therefore:
Supported: Outlook for Microsoft 365, Outlook on the web.
Not supported: Outlook Mobile apps.
Reference:
Microsoft Learn: Policy tips in DLP
Quote: "Policy tips are supported in Outlook on the web and Outlook 2013 and later. Policy tips are not supported in Outlook mobile apps."

To test Microsoft Purview Advanced Message Encryption (which relies on Azure Information Rights Management), you use the Test-IRMConfiguration cmdlet. It verifies configuration, template availability, and encryption/decryption status.
Test-OAuthConnectivity # tests OAuth authentication.
Test-ClientAccessRule # tests client access rules.
Test-Mailflow # tests mail routing.
Reference: Test-IRMConfiguration cmdlet

Step 1 - Scenario
Microsoft 365 E5 subscription with 100 users and a Microsoft 365 group (Group1).
A sensitivity label (Label1) is published as the default label for Group1.
Label1 contains two sublabels: Sublabel1 and Sublabel2.
Requirement: Ensure Sublabel1 settings are applied by default to Group1.
Step 2 - Understanding label hierarchy
In Microsoft Purview Information Protection, a parent label (Label1) is a container.
Sublabels (Sublabel1, Sublabel2) inherit the parent name but represent distinct configurations (encryption, watermarking, access, etc.).
A parent label itself cannot have a sublabel's settings automatically applied unless policy configuration specifies which sublabel is used as the default publishing option.
Step 3 - Why "Modify the policy of Label1" is correct
To apply Sublabel1 by default, the published policy for Label1 must be modified so that Sublabel1 is the default label within the policy.
Simply reordering sublabels (Option A) does not change the default assignment.
Duplicating Sublabel1's settings into Label1 (Option B) defeats the purpose of having sublabels and adds redundancy.
Deleting the policy of Label1 and publishing Sublabel1 (Option D) would remove flexibility and is unnecessary.
Step 4 - Microsoft Reference
Microsoft Docs: "If you want a sublabel to be applied by default, configure the label policy to select that sublabel as the default label for documents and emails."