How Does Microsoft Backup Office 365?
The short answer? They don’t.
Resilience <> Backup
In a broad sense ‘backup’ of Office 365 resources is managed through a number of methods that, in the main, would actually be considered resilience solutions. Multiple copies of data at rest, cross region replication and multi-geo capabilities all provide backup of sorts but definitely do not meet my criteria for what a backup is.
For both SharePoint and Exchange there are recycle bin concepts that provide protection against deletion, again, not backup.
For other objects (users, Office 365 Groups, Microsoft Teams, etc.) there are, again, recycle bin like concepts some of which are self-service, some would require a service call to Microsoft.
The issue with all of the above constructs is that none of them provide the same protections as true backup. There is no protection against corruption, no protection against rogue employees and no protection against malicious attack. Without these protections, you are carrying risk. Risk that you need to determine is managed satisfactorily for your organisational needs.
Broadly speaking, Microsoft protect Office 365 using resilience techniques. Resilience is not backup.