GCC High for CMMC: When a Small Defense Shop Actually Needs It

What is Microsoft 365 GCC High?

GCC High is a Microsoft 365 environment Microsoft built for the Department of Defense’s contractors. Its service description says it’s for “contractors holding or processing DoD controlled unclassified information (CUI) or subject to International Traffic in Arms Regulations (ITAR).” It runs Exchange, SharePoint, OneDrive, and Teams, but in a government cloud that’s separate from the one most businesses use.

Microsoft assesses GCC High against NIST SP 800-53 at the FIPS 199 High level, and its compliance pages say it’s designed to DoD Security Requirements Guide Impact Level 4 controls. There are no trials. You go through a validation process before Microsoft builds the environment.

If you’re still working out whether you hold CUI at all, start with what CUI is. This guide assumes you’ve answered that.

How is GCC High different from Commercial and GCC?

There are three Microsoft 365 clouds a contractor might land in, and they differ in who can use them, what Microsoft commits to, and where they run.

• Commercial is the Microsoft 365 most businesses have. It’s global, and anyone can buy it.
• GCC is for government agencies and contractors holding data on behalf of the US government. Microsoft’s how-to-buy page lists its commitments as FedRAMP High, DFARS, CJIS, IRS 1075, and DISA SRG L2.
• GCC High lists FedRAMP High, ITAR, DFARS, and DISA SRG L4 controls.

Some of what people say sets GCC High apart is actually true of GCC too. Both store customer content at rest only in US datacenters. Both restrict access to customer content to Microsoft staff who passed US citizenship verification and background checks. Both are FedRAMP High.

The real differences are these:

1. ITAR. Microsoft “will only agree to ITAR contract language for the GCC High environment.” Its ITAR page adds that customers sign extra agreements notifying Microsoft they intend to store ITAR data. There’s no ITAR certification from anyone. Microsoft says it designs these services to support your ITAR program.
2. A separate cloud. GCC High runs on Azure Government. Microsoft’s Intune government overview describes the government cloud as “a datacenter that’s physically separate from the commercial instances.” For Intune, GCC is the same instance as commercial. GCC High isn’t.
3. Who you can collaborate with. GCC High users can share SharePoint and OneDrive files “only with other organizations in GCC-High.”

One thing that isn’t different: the support desk. Microsoft says support for both GCC and GCC High sits outside the accreditation boundary. Don’t paste CUI into a support ticket in either one.

Does CMMC or DFARS require GCC High?

No. Neither rule names a product. DFARS 252.204-7012(b)(2)(ii)(D) says that if you use an external cloud service provider to store, process, or transmit covered defense information, you “shall require and ensure” that the provider “meets security requirements equivalent to those established by the Government for the Federal Risk and Authorization Management Program (FedRAMP) Moderate baseline.” The provider also has to comply with the clause’s rules on cyber incident reporting, malicious software, media preservation, forensic access, and damage assessment. We cover the rest of that clause in our DFARS 7012 guide.

So the bar is FedRAMP Moderate equivalent, and the choice of how to meet it is yours. Microsoft’s DFARS page names its US government clouds, Office 365 U.S. Government and U.S. Government Defense, as having FedRAMP Moderate authorization and being “adequate for DFARS.” It doesn’t make that statement about commercial Microsoft 365. If you want to keep CUI in Commercial, you’d have to show your assessor that it meets the FedRAMP Moderate equivalent requirement yourself. That’s an argument to have before an assessment, not during one.

The CMMC rule itself still stands on NIST SP 800-171 Rev 2, as we explain in our CMMC Level 2 requirements guide. Since that guide published, DoD issued Class Deviation 2026-O0025, Revision 3, signed September 3, 2026. It carries forward the July 13 suspension: Level 1 (Self) and Level 2 (Self) only, baseline compliance with NIST SP 800-171 Rev 2 under 7012, and the November 2026 Phase 2 transition suspended. None of that changes the 7012 cloud requirement.

When does CUI push you to GCC High, and when can GCC or Commercial work?

ITAR is the clearest line. If export-controlled technical data under ITAR lives in your email and files, GCC High is the Microsoft 365 environment Microsoft supports for it. Validation can require proof of registration with the State Department for ITAR data.

For DoD CUI without ITAR, Microsoft’s own guidance leans the same way. Its how-to-buy page calls GCC “the hero offering for all customers that don’t hold FedRAMP High or DoD controlled unclassified information (CUI).” Read the other way, Microsoft expects DoD CUI to sit a step up, in GCC High. GCC still carries DFARS in its commitment list, so it’s not ruled out. Ask your prime what they expect, and get the answer in writing.

The other option is to shrink the problem. If CUI only touches a few people, you don’t have to move the whole company. Put those people in a CUI enclave and leave everyone else in Commercial. For a lot of small manufacturers, the CUI is the drawing package, and only a handful of people ever open it.

What does GCC High cost in effort?

We won’t put a number on it here. Licensing goes through Microsoft’s channels and depends on your seat count. But the effort is easy to list:

• Eligibility and validation. You prove you hold CUI or ITAR data before Microsoft builds the tenant. Revalidation is required at renewal.
• Licensing channel. GCC High is sold only through an Enterprise Agreement or Microsoft’s AOS-G partners. Web Direct and the general CSP channel aren’t options for it.
• A new tenant. It’s a separate cloud, so it’s a migration. Mail, files, and Teams move across. Microsoft says devices “need to unenroll from the current tenant, and then re-enroll,” and there “isn’t a built-in way” to move them.
• Feature gaps. Intune’s government overview lists Windows Autopilot and Remediations as not available, with no plans to add them. Viva Engage isn’t in GCC High. Some Defender anti-phishing features aren’t there yet. Teams calling goes through Direct Routing.
• Third-party apps. Your CRM, ERP, backup tool, and email security add-on each need a version that connects to the government cloud. Microsoft notes that third-party services sit outside its compliance commitments, so each one is its own scoping question.
• Outside collaboration. Customers and suppliers in Commercial can’t open a shared SharePoint link the way they could before. Plan for how drawings go in and out.

Check every line-of-business app before you sign anything. The licenses are the easy part.

Key takeaways

What this looks like when we do it

Limehawk isn’t a Microsoft AOS-G partner, a C3PAO, or an assessor. We can’t sell you GCC High licenses or certify you. What we do is the IT work on either side of that decision.

First we scope. We map where CUI and ITAR data actually go: which mailboxes, which file shares, which machines on the plant floor. That tells you whether the answer is a whole-company move, an enclave, or staying put. Then we check every app you rely on against the government cloud before anyone buys anything.

If GCC High is the answer, we handle the tenant work our Microsoft 365 administration covers in any tenant: enforced MFA, conditional access, email hardening, and documentation that matches what’s configured. We run tenant-to-tenant migrations tested first and cut over on nights and weekends. Our manufacturing IT page covers how we keep the OT side walled off while the office moves.

Got a prime asking where your CUI lives and no clean answer yet? Book a call and we’ll map it with you.