You have configured REST Action: Tag Assigned to Content Action Failed, as below:
{"labelName":"Classification", "parentLabelName":"Confidential", "justificationText":"The Document contains confidential Information."}
DLP 15.+
CASB + Office365 Securlet
CASB backend logs show API the label failed with error code 403. Office365 Securlet does not have the required permission
Office365 Securlet needs to be reactivated to fetch new API permissions.
Please refer to Remediation with Microsoft Purview Information Protection Labels
1. You must reactivate the Office 365 Securlet in your CloudSOC tenant to enable the use of the new InformationProtectionPolicy.Read.All API permission
2. The priority of the tagging data-at-rest (DAR) action should match the MPIP sensitivity label priority.