When storing personal data outside of the organization, you need to have a proper agreement with data processor that handles all the GDPR-related issues, handles responsiblities and liability, verifies issues such as will the data be transferred outside EU jurisdiction to USA servers, etc. In general, organizations have these legal issues already settled with Microsoft due to their other contracts for e.g. Office and Azure and such.
For any new vendor you can't put the same data unless/until you have all these legal arrangements in place; and if that vendor says "ah, we're in USA, we don't care about GDPR" then you simply can't use them for such data.