Microsoft has service contracts with the DOD which to my knowledge have not been compromised.
I think there are some completely valid reasons for businesses to use Microsoft cloud services:
Shift some of the burden of responsibility to a third party. Organizations love this shit
Microsoft has some of the best paid security analysts and engineers in the industry. Chances are they’d be able to detect and mitigate attacks attacks better than a small local team of not highly paid sysadmins.
Microsoft is large enough to get some assistance from 3 letter agencies. That’s almost never going to happen with smaller companies.