> illegal as much as it is the storing of GDPR sensitive data in it (ie PII of customers and/or employees)

A lot of data is GDPR sensitive. Also, if some of the data must not be processed by Office 365, a lot of the advantage of Office 365 disappears.