Azure active directory backup/best practice?

So we want to use azure for SSO and such but we want to make sure we minimize the risk of ransomware hitting the active directory and shutting us out. Is there a backup solution service for AD or is there best practice we should be following instead?

active directory azure azure active directory backup best practice cybersecurity directory practice