Regarding TLS SMTP communications: there is an issue with downgrade attacks. Basically, you can't trust the protocol to be 100% encrypted, so you need to encrypt the email's content yourself.
You also need to consider Microsoft's own infrastructure (not just the SMTP traffic for sending mail from one O365 domain to another) given Edward Snowden's 2013 revelation of PRISM. PRISM was a US government program to snoop on US citizens' communications (even the 100% domestic content) merely because they were transfered between Microsoft's and other major internet companies' internal servers that just happened to be hosted across continents.
I don't think you'll get an authoritative answer on this topic.
That said, there was some serious embarrassment suffered by these providers for not encrypting these communications in the first place. It's reasonable to assume that all of them (as well as the rest of the industry's heavyweights) scrambled to fix this as soon as they could.
Nearly three years later, it should now be safe to assume that these transfers are now secure.
However, because you can't know for sure, any truly sensitive information should have its content encrypted so that even Microsoft cannot read it. (This additionally protects you from subpoenas.)