You see sync failure status in DLP Enforce under the setting Manage / Application Detection / Configuration:
CloudSOC DLP Enforce Integration
You have configured the application detection configuration for SharePoint in DLP Enforce, but the O365 Securlet in CloudSOC Store does not have SharePoint (Sites) feature enabled.
If you do not want the Office 365 Securlet to scan SharePoint sites. You can remove the SharePoint application detection configuration in DLP Enforce.
If you need to keep the SharePoint application detection configuration, you will need to re-activate the Office365 Securlet in CloudSOC and adding the "Sites" feature.
In some cases, the additional step of de-activating the CDS entry in the CloudSOC may be required. For steps on doing that, see Your Application Detection configurations are showing sync failure status (broadcom.com).