Explanation:
Box 1: File policy
It is possible to apply a sensitivity label to a file in real-time when it's downloaded from Microsoft SharePoint Online, based on the file's content. This can be achieved by using a combination of file policies in Microsoft Defender for Cloud Apps (formerly Cloud App Security) and sensitivity labels configured within Microsoft Purview Information Protection.
Box 2: Access policy
It is possible to restrict Dropbox sign-ins to Intune-compliant devices using a combination of Intune and Microsoft Entra ID Conditional Access policies. This is achieved by configuring a Conditional Access policy that requires devices to be marked as compliant by Intune before granting access to Dropbox.
Reference:
https://learn.microsoft.com/en-us/purview/sensitivity-labels-sharepoint-onedrive-files
https://learn.microsoft.com/en-us/answers/questions/2115107/restricting-access-to-a-web- application-based-on-d