The point isn't about the tool, it's about where and by whom the tool is run.

Office 365 is cloud based, that's what makes it potentially non-compliant. Having Excel in your company, on your computer, and the data never leaves that computer is a totally different scenario.