Nearly every time I ask someone, who mentions Office365, about how they are protecting their data being stored in O365, they are shocked to learn that Microsoft isn't doing it for them.
That's right, Microsoft doesn't protect your data. IF you delete a user mailbox or just a few emails, good luck in getting it back in a reliable and repeatable way, and if its been longer than 30 days since you had that data, I wouldn't even try.
There are a ton of great solutions to protect Office365 data, I especially like Datto's SaaS Protection, but the bottom line is that if the data you and your team keep in your Office 365 email, Sharepoint, OneDrive, etc, is important to you, then you need to take the extra step to pay for a 3rd party data protection service. Datto's option is easy to setup and very affordable with no data size limits and so are some of the others out there...just get something, because Microsoft isn't doing this for you.