M365 is a SaaS service and Microsoft operates in what is commonly called the Shared Responsibility Model. This means that the customer also shares responsibility for the data in the SaaS cloud – not just Microsoft. Microsoft is clear that elements like data backup, data security etc are the customer’s responsibility. Also, the recovery points MS provides are merely recycle bin functionality. They are not a backup in that there isn’t a second copy of the data made and kept in an alternate location. The basic MS recovery point mechanism is considered insufficient for most regulatory requirements – and may be ok for a small (50 members or less) organization. But any businesses that are large or even medium size will not rely on it. Microsoft is also quite clear in their M365 service agreement that they encourage the use of 3rd party data protection methods for the safety of the data in the cloud.