Not every employee at your shop needs a GCC High license. The real question a GCC High migration should start with is how many of your people actually touch CUI, not whether you need to migrate at all.
Getting that scoping question wrong, in either direction, is what turns a straightforward migration into a bigger, slower, more expensive project than it needed to be.
Related Topic: What Is a System Security Plan? | Everything You Should Know
This Isn’t Just a DoD Question Anymore
It’s easy to assume GCC High only matters if you’re working directly under a Department of Defense contract. That assumption is getting less safe by the year. The same CUI handling requirements that drive GCC High decisions for defense manufacturers increasingly show up in contracts with other federal agencies too, including agencies like the IRS and Veterans Affairs.
A shop that’s never touched a DoD contract directly can still end up needing this conversation because of who else they’re doing business with.
This matters for the scoping exercise above, not just for whether you need to have the conversation at all. If CUI is entering your environment through a non-DoD federal contract, the same mapping question applies: who on your team actually touches it, and does that group look like your whole company or a handful of specific roles.
Related Topic: How to Achieve DFARS Cybersecurity Compliance
Why CMMC Points to GCC High in the First Place?
The connection between CMMC and GCC High isn’t arbitrary, and understanding it helps explain why a lighter tier sometimes won’t satisfy an assessor.
CMMC requires CUI to sit in a cloud environment that meets FedRAMP Moderate or higher, and separately aligns with DoD Impact Level 4 (IL4) for CUI workloads. GCC High is Microsoft’s FedRAMP High authorized, IL4-aligned environment, which is why it comes up constantly in these conversations even though Microsoft offers several other government cloud tiers that don’t meet that bar.
Knowing that distinction is what lets you push back if someone tries to sell you GCC High for a workload that never actually needed FedRAMP High in the first place.
The Question Most Shops Skip
Somewhere early in a GCC High conversation, it’s tempting to treat it as an all-or-nothing decision. Either the whole company moves to GCC High, licenses and all, or nobody does. That framing feels simpler, especially when a deadline is looming and there’s pressure to just get something done. It’s also usually wrong, and skipping past it is where the real cost surprises start.
The actual question is narrower: which of your people, specifically, send, receive, or store CUI as part of their job. Everyone else can often stay exactly where they are, on a standard commercial Microsoft 365 tenant, at standard commercial pricing. Answering that question honestly, before signing anything, is what actually determines whether a GCC High migration costs you a modest monthly increase or a full company-wide licensing overhaul.
When the Answer Really Is Everyone
Sometimes the honest answer is that nearly the whole company touches CUI, and a full migration is the right call. One manufacturer we worked with went through exactly this reasoning.
Every department, from the shop floor scheduling production against customer drawings to the front office handling correspondence tied to those same contracts, turned out to have some legitimate reason to send or receive CUI at some point. A purchasing coordinator forwarding a spec sheet. A scheduler referencing a customer print to plan a production run. None of it looked dramatic on its own, but taken together it meant CUI was already moving through nearly every part of the business.
Once that became clear, a partial migration would have meant constantly managing exceptions, tracking who was on which tenant, and hoping nobody sent something sensitive from the wrong account.
Migrating everyone to GCC High, all at once, ended up being the simpler and ultimately cheaper path, because the alternative was policing a boundary that barely existed in practice.
When the Answer Is Only a Few People
Just as often, the honest answer is the opposite. Another shop we worked with went through the same exercise and landed somewhere very different. Once they actually mapped out who handled CUI day to day, it came down to a handful of roles, not the whole company. Accounting, general office staff, and most of production had no real reason to touch CUI at all. The work those roles did was real and important to the business, it just never intersected with a customer’s controlled technical data.
That shop started with a single GCC High license for the person who genuinely needed it, with a full rollout planned for months later once budget allowed. Limit GCC High migration to actual CUI users to reduce costs, maintain security, simplify transitions, and minimize potential migration risks significantly.
Why This Decision Has to Happen Before Migration, Not During?
Both of these are legitimate outcomes. Neither is automatically the safe choice or the risky one. What actually matters is doing the CUI mapping exercise first, honestly, before committing to a licensing tier for the whole company. Guess wrong here and you either pay for licenses nobody needed, or leave real CUI moving through accounts that were never meant to hold it.
Related Topic: What Is a POA&M? Complete Guide for Defense Contractors
What Happens When You Wait Too Long or Scope It Wrong?
Getting the scoping decision right matters more the closer you get to a hard deadline, and one real migration we supported shows exactly why.
The Legacy Software Problem
A fabrication shop with roughly 250 licensed users was working against a hard self-attestation deadline in early December. This wasn’t a simple mailbox move. A full tenant-to-tenant migration meant relocating SharePoint sites, OneDrive accounts, and Entra ID identities (what Microsoft called Azure Active Directory before the rename) into the new environment, all before cutover, since CUI was already sitting in shared drives and SharePoint libraries that nobody had fully mapped out beforehand.
Partway through the migration, the team discovered that a legacy production-scheduling application everyone depended on daily couldn’t authenticate properly against the new tenant. The application had never been built with a government cloud environment in mind, and nobody had checked its compatibility until it was already in the middle of the move.
That’s not a rare problem. Plenty of shops run at least one piece of older, mission-critical software that was never designed with GCC High’s authentication requirements in mind.
Finding that out during the migration, instead of before it, turns a planned technical project into an unplanned scramble, right when there’s the least amount of time to fix it.
The shop evaluated wireless infrastructure for FIPS encryption and tested BitLocker settings before allowing endpoints to securely handle CUI data. None of that is exotic. It’s the kind of gap that only surfaces once someone actually goes looking, which is exactly why it should get checked before a migration starts, not discovered partway through one.
The Cost That Keeps Climbing
The same migration ran into a second, related problem. GCC High licensing costs were higher than commercial pricing to begin with, and delays in getting the tenant fully set up and validated meant the timeline kept stretching, with licensing costs climbing the longer the process dragged on. A migration that starts months before a deadline, with time to test legacy software compatibility and lock in pricing early, looks very different from the same migration compressed into the final weeks.
GCC High, GCC, and GCC Moderate Aren’t the Same Decision
One more scoping mistake worth naming: assuming GCC High is automatically the right tier. Microsoft actually offers a few different government community cloud tiers, and they’re not interchangeable. Choose standard GCC for lighter FCI requirements or GCC Moderate for suitable CUI needs, avoiding GCC High’s stricter rules and complexity.
The difference isn’t academic. GCC High carries real cost and administrative overhead beyond standard commercial or even standard GCC pricing, and that overhead is worth paying for when your CUI exposure actually requires it.
Verify GCC High requirements during CUI mapping to avoid unnecessary licenses, oversized migrations, and higher costs when lighter tiers meet needs.
Related Topic: FCI vs. CUI: What Every Defense Subcontractor Needs to Know
Know Where Your MSP’s Responsibility Actually Ends
One more scoping conversation worth having before migration starts: exactly where your provider’s responsibility ends and yours begins. GCC High doesn’t remove the need for this clarity, it raises the stakes on it.
Create a written responsibility matrix before migration, clearly assigning CUI security controls between your organization and provider to prevent costly confusion.
Related Topic: Why Passing CMMC Starts With Finding the Gaps First?
What To Do With This
Map exactly who handles CUI before signing GCC High contracts to accurately control migration costs, timelines, licensing needs, and disruptions.
Schedule a free consultation with our CMMC-certified team to talk through what the right GCC High scope actually looks like for your environment. If you’re already working through CMMC compliance services with us, this is exactly the kind of decision worth getting right before a migration starts, not partway through one. A CMMC gap assessment is also a good way to confirm exactly where your CUI actually lives before you scope a migration around it.
Related Topic: CMMC Enclave vs. Enterprise: Which Compliance Model Works Best?
FAQ
What’s the difference between GCC and GCC High?
Standard GCC is built for federal, state, and local government contractors with lighter compliance needs, often centered on FCI. GCC High is built specifically for CUI and ITAR-controlled data, with stricter access, personnel, and data residency requirements than standard GCC.
Do all employees need a GCC High license?
No. Only employees who actually send, receive, or store CUI as part of their role need to be on GCC High. Employees who never touch CUI can often remain on a standard commercial Microsoft 365 tenant, which is typically less expensive.
How much does a GCC High migration typically cost?
Control migration costs by licensing only CUI users, testing necessary legacy software, and starting early to avoid expensive deadline-driven complications later.
