There’s solutions provided for this. Not all cloud providers make a guarantee that they can’t get at your data, and I’m not sure if they offer that assurance how you could double check it definitively.
Here’s Microsoft’s docs on this:
For their basic best practices (which doesn’t completely answer your question): https://www.microsoft.com/en-us/trustcenter/privacy/who-can-access-your-data-and-on-what-terms
For the storage service, they don’t yet allow using your own encryption keys, which would prevent outside entities from accessing it with the blessing of the vendor:
But they allow it for some stuff with Key Vault:
