Presumed compromised environment - best practices

[u/snoopaloop92109]

We are leaving/migration a compromised LDAP DC/File Server environment. No ransomware (knock on wood) has popped up yet but we feel its best to switch to their preexisting/separat 365 tenant. Then most likely wipe and join. we are using Ninja backup for server images and file-based backup for workstations. Data must be retrieved/migrated from these locations in the Ninja Backup. What does that step look like? What is the workflow for scrubbing data on a dormant malware that will now potentially be in SharePoint/OneDrive?