Although a cloud solution provides highly available, globally accessible services and removes the requirement to manage and patch local file and application servers it does not provide backup protection for your data in the event of corruption or deletion.
Therefore, a backup for Office 365 is highly recommended to protect that data migrated into the cloud, by backing up a copy of your data to an alternate location.
As you consider and evaluate public cloud services, it’s critical to understand the shared responsibility model and which security tasks are handled by the cloud provider and which tasks are handled by you. The workload responsibilities vary depending on whether the workload is hosted on Software as a Service (SaaS), Platform as a Service (PaaS), Infrastructure as a Service (IaaS), or in an on-premises datacentre
For all cloud deployment types, you own your data and identities. You are responsible for protecting the security of your data and identities, on-premises resources, and the cloud components you control (which varies by service type).
Regardless of the type of deployment, the following responsibilities are always retained by you: