Do we need to back up Microsoft 365 and other SaaS data?
Usually yes. SaaS providers work under a shared responsibility model: they keep the service available and protect it against their own hardware failures, but protecting your data against deletion, a malicious insider, a compromised account or a retention period that has run out is largely your job. Microsoft's own services agreement recommends that customers regularly back up their content. The built-in safety nets, such as deleted-item folders, recycle bins and version history, have limited retention and can be emptied by someone with the right access. A third-party backup of mailboxes, SharePoint and OneDrive, or the equivalent for Google Workspace, CRM and accounting systems, gives you an independent copy with retention you control. Check the restore process too: restoring one mailbox and restoring a whole tenant after an attack are very different jobs.