A Microsoft 365 GCC High tenant is a separate environment built for U.S. defense contractors and other organizations that handle controlled unclassified information (CUI), export-controlled data, or other regulated government data. It runs in Microsoft’s U.S. government cloud, is supported by screened U.S. personnel, and is the only Microsoft 365 environment where Microsoft will agree to ITAR contract language.
That makes it one of the most common names in a CMMC conversation, and one of the most misunderstood. Some contractors assume they need it. Others assume it’s simply a pricier license rather than a cybersecurity decision. This guide explains what it is, how it differs from commercial Microsoft 365 and standard GCC, who qualifies, whether you actually need it, and what migrating involves. It’s general information, not licensing or legal advice.
What Is Microsoft GCC High? A Look at Microsoft’s Government Cloud
GCC stands for Government Community Cloud, and GCC High (sometimes abbreviated GCCH) is one of Microsoft’s government cloud environments. Microsoft built these environments for the U.S. public sector, within the broader Microsoft cloud, to give eligible organizations the familiar workloads, such as Exchange Online, SharePoint, OneDrive, and Microsoft Teams, with added security and compliance commitments. Microsoft’s documentation still labels the service Office 365 GCC High in places, and the terms mean the same thing here.
Microsoft describes four things that set its government environments apart:
- An exclusive community. The data centers serve government agencies and companies authorized to hold controlled information on their behalf.
- Screened personnel. Access to your data is limited to screened Microsoft personnel who are U.S. citizens and pass background checks.
- Third-party audits. An auditor assesses the infrastructure, and the results support federal authorizations.
- U.S. data residency. Data is stored within the continental United States.
GCC High adds a physically separate foundation. It’s paired with Microsoft Entra ID in the isolated Azure Government cloud, which is built for data sovereignty and is why its sign-in addresses differ from commercial. Microsoft says GCC High supports organizations that need compliance with DoD Impact Level 4, DFARS 252.204-7012, NIST SP 800-171, and ITAR.
GCC and GCC High: How FedRAMP, ITAR, and Standard GCC Compare
Microsoft offers four tiers in this family: commercial Microsoft 365, standard GCC, GCC High, and a DoD environment reserved for the Department of Defense. Contractors choose among the first three.
| | Commercial | Standard GCC | GCC High |
| Built for | Any business | Government and eligible contractors | Defense contractors and organizations handling CUI, ITAR, or DoD data |
| Microsoft’s compliance commitments | Supports CMMC Level 1 | FedRAMP High, DFARS, CJIS, IRS 1075, DoD SRG Level 2 | FedRAMP High, DFARS, ITAR, DoD SRG Level 4 |
| ITAR contract terms from Microsoft | No | No | Yes, the only environment |
| Identity platform | Commercial Entra ID | Commercial Entra ID | Entra ID in Azure Government |
| Sign-in address | login.microsoftonline.com | login.microsoftonline.com | login.microsoftonline.us |
| How you buy | Standard commercial channels | Several channels, including a partner or reseller | Only through select partners; eligibility validated; no trial |
So what’s the difference between GCC and GCC High? In short, the high-end environment is more isolated, and it’s the one that carries Microsoft’s ITAR commitments. Microsoft’s own CMMC guidance is blunt: standard GCC isn’t suitable for the most sensitive types of CUI, including ITAR data, because that data requires U.S. sovereignty that only GCC High offers.
The acronyms in that table trip people up, so here is what they mean. FedRAMP is the federal program that grants cloud services an authorization, and both GCC and GCC High list FedRAMP High. DFARS 252.204-7012 requires a cloud provider that stores CUI for a contractor to meet the FedRAMP Moderate baseline or equivalent, among other terms. Impact Level 4 is a DoD cloud security level that the DISA Security Requirements Guide defines, and GCC High is built to it. It’s not what the DFARS clause requires of a contractor’s cloud provider, so don’t buy for it unless your contract asks for it. Our DFARS 252.204-7012 guide covers the clause.
Who Uses GCC High? Government Agencies, Defense Contractors, and Other GCC High Customers
GCC High customers fall into two groups: government agencies, and nongovernment organizations sponsored to hold or process controlled information. In practice that means federal agencies and, more often, defense contractors across the defense industrial base (DIB).
Microsoft validates eligibility for the Microsoft Government Cloud before it sells the service. Accepted data types include ITAR data, CUI, unclassified nuclear information, criminal justice information, and DoD impact-level data. You submit an eligibility form and work with a Microsoft account team or a qualified partner, and you must show that you belong in one of those groups. An international company can qualify, though regulated data may require buying through a U.S. subsidiary.
Microsoft’s documentation often groups GCC High and DoD together, but contractors don’t use the DoD environment. It’s reserved for the Department of Defense, and contractors use GCC High.
Do You Need GCC High for CMMC Compliance?
This is the question we’re asked most. The honest answer depends on the data your organization handles and the compliance requirements in your contract, not on whose name is on it. Don’t assume that a contract mentioning CUI automatically requires GCC High.
- If you handle ITAR or other export-controlled data, plan on it. Microsoft will only sign ITAR contractual commitments for GCC High. The ITAR doesn’t name a product, so other approaches exist, but each carries its own requirements. See our guide to ITAR vs. EAR.
- If you handle CUI under a DoD contract, it’s the environment Microsoft supports for CMMC Level 2 and Level 3 (the 110 requirements of NIST 800-171), when configured appropriately. Contractors handling CUI should also confirm their prime’s and assessor’s expectations early, since they have a say.
- If you handle only federal contract information (FCI), you generally don’t need it. Microsoft says commercial Microsoft 365 supports CMMC Level 1. We explain the difference in FCI vs. CUI.
One caution. A government cloud doesn’t make you compliant. Microsoft states that CMMC compliance depends on your configuration, implementation, and operational controls. A well-built environment with weak access policies still fails an assessment. Regulatory compliance also depends on data classification, because you can’t protect CUI you haven’t identified. If you’re not sure whether CUI is in scope, the CMMC Level 2 Readiness Check starts with exactly that question.
How to Tell Whether Your Tenant Is GCC or GCC High
If you’re not sure which one you’re on, look at the addresses. A GCC High tenant signs in at login.microsoftonline.us, and its admin portals use government addresses ending in .us, such as portal.office365.us. Standard GCC runs on Azure commercial infrastructure with commercial Entra ID, so it uses the commercial addresses, including login.microsoftonline.com. Your licensing partner can also confirm it. If your M365 tenant is commercial, it uses the commercial addresses too.
Migrating to GCC High: Licenses, Timeline, and How to Migrate
Moving to GCC High is a tenant migration, not an upgrade. You provision a new tenant in the government cloud and move your email, files, and users into it. Microsoft advises allocating at least three months for the migration phase. In outline, the work runs in five steps:
- Validate eligibility with Microsoft through a partner.
- Scope your CUI and decide who needs the environment.
- Provision and configure the new tenant, including identity, device policies, and access controls.
- Migrate email, SharePoint, and OneDrive data, and retire or move any on-premises servers that hold CUI.
- Cut over and train users.
Licenses and cost. Microsoft notes that service availability and price differ across its environments. In our experience, GCC High pricing isn’t published the way commercial pricing is, and quotes come through a licensing partner or reseller, based on the plan, the license types, and the number of seats. In one client’s case, the estimate came in about 40% above its existing licensing, and the trigger was a practical one: the company needed to send and receive CUI by email. We break down what drives the total in why GCC High migration costs vary.
How you buy. There’s no web checkout and no trial. Per Microsoft’s buying guide, it’s sold through select partners under an Enterprise Agreement or an AOS-G agreement, after eligibility is validated. Check Microsoft’s current channel list, because it changes.
What the project looks like. On a recent migration, the team copied email, SharePoint, and OneDrive data from the old environment to the new one while leaving the source data in place, ran delta and final syncs for new data, and checked email with early users before cutover.
Everyone, or only the CUI users? Microsoft’s guidance leans toward putting all of a company’s users in one environment. It also acknowledges that a data enclave can manage costs, but it warns that the most common spillage happens through personal storage, especially email. Some small manufacturers scope the environment to the handful of roles that touch CUI, and others find it cleaner to move everyone. Either can work. The deciding factor is how CUI actually flows, which makes a data enclave or the full enterprise a scoping decision before it’s a licensing one.
Working with suppliers. Collaboration between GCC High environments and commercial tenants is more restricted. One manufacturer we work with settled on read-only B2B collaboration with suppliers where practical, and limited email for controlled information to approved FedRAMP environments.
What GCC High Doesn’t Do Yet: Microsoft 365 Feature Gaps, Copilot, and Workloads
Microsoft is upfront that GCC and GCC High lack feature parity with commercial Microsoft 365, and it says some of that is by design. New features reach government clouds later than commercial. Microsoft lists Copilot among the services in the FedRAMP scope for GCC High, for example, but features can trail commercial, and a prospect we spoke with was concerned about potential AI compatibility limits. Third-party tools, development workloads, and some integrations can also behave differently.
Before you commit, check Microsoft’s feature availability pages for the workloads you rely on. Plan for managed endpoints too, using Intune device compliance policies and conditional access policies to control which devices can reach CUI. Then test your line-of-business software in the new environment. Surprises here are a common reason migrations run over.
If you’re weighing whether it fits your CUI, your ITAR data, and your budget, our team helps defense manufacturers scope it before any money is spent. We map where CUI actually lives and whether you need GCC High, an enclave, or something lighter. Our CMMC compliance work starts with that scoping.
Take the smaller step first. The CMMC Level 2 Readiness Check takes about eight minutes, never asks for CUI or system names, and returns an estimated SPRS score range and readiness tier, so you can see where you stand before you commit to a migration.
Start the CMMC Level 2 Readiness Check. It’s an educational estimate, not an official assessment or a score to submit to SPRS, and your ranked gap list is shared after you enter your contact details.
Ready to talk through scoping and the migration itself? Schedule a free consultation with our team.
FAQS
Does GCC High make me CMMC compliant?
No. Microsoft says it supports CMMC Level 2 and Level 3 requirements when configured appropriately, and that compliance depends on your configuration, implementation, and operational controls. The environment is a foundation, not a finish line.
How much does a GCC High license cost?
Microsoft says service availability and price differ from commercial. In our experience, quotes come through a licensing partner based on your plan and seat count rather than from a public price list. Budget for migration and configuration work as well as licenses.
Can I try GCC High before I buy it?
No. Microsoft doesn’t offer trials of GCC High or DoD. You validate eligibility and buy through a qualified partner.
Do all my employees need GCC High?
Not always. It depends on who handles CUI and how it flows. Microsoft’s guidance favors a single environment, while some small manufacturers limit it to the roles that touch CUI. Decide before you migrate, not during
