Does our data stay under our control, and what does that mean in practice?

“For Microsoft customers we monitor via Azure Lighthouse inside your own tenant: log data stays in your subscription, our access is least-privilege and visible in your audit logs, and when you leave you revoke the delegation without any migration.”