Having used O365 + Azure as an administrator, I have found it is much easier to use Azure to trace security events than AWS.

They also have the capability to detect massive file copies/deletions for special locations, etc (i forgot the technical term)

I love AWS, but I have seen some benefits with integrating O365 and Azure.