In short : Yes
- Microsoft primary responsibility is to provide an up and running infrastructure in the cloud. They do have data protection system but it doesn’t totally cover every risks that can affect your data.
- Knowing that most of causes of data loss are caused by human actions
- And that Office 365 data protection system have their limits.
Note that For Emails you’ll need E3 O365 plan with In-Place Hold or Litigation Hold configured to have more than 30 days deleted email retention.
If your data are important to you, and if you might have user asking to restore an old email or document, you need a data protection software to the rescue such as Veeam, backupify etc.
If you wish to know more about those solutions, please contact me.