By Justin Bowen, Sr. Vice President, Delivery Services, i3solutions

The platform decision is already made. Somebody signed for Dynamics 365, the licenses are sitting in a tenant, and the question in front of you now is who actually implements it. Three firms have quoted. One is a staffing supplier offering four developers at a rate you can defend to finance. One is the reseller who sold the licenses and has a partner logo on the proposal. One is a national integrator whose statement of work reads exactly like the one it would write for a retailer. None of the three has asked which cloud the system has to run in, and that is the question that decides whether any of this works, because your program data lives under contract clauses that do not care how good the demo looked.

Who do we hire for Dynamics 365 implementation in a government contractor environment?

You hire a Microsoft delivery partner that can implement inside the government cloud your contracts require. That rules out three of the firms most likely to be quoting: a staffing supplier, the reseller who sold the licenses, and the accounting consultant who owns your business systems judgment. Three qualifications separate a firm that can do this work from one that cannot. It can tell you which Dynamics 365 apps actually exist in GCC, GCC High and DoD before it writes a scope, because they are not the same list and the difference will change your design. It can carry your DFARS and NIST SP 800-171 obligations into the configuration and into the evidence package, rather than treating compliance as somebody else’s deliverable. And it staffs the engagement with people your contract permits to touch the data. i3solutions has completed more than 20 Dynamics 365 integration engagements. All i3solutions Dynamics 365 developers and consultants are U.S.-based. i3solutions installs and helps configure applications inside IL4 and IL6 government cloud environments and other government networks.

1. Four different firms answer to the word “hire”. Decide which one you need first

The most common way this goes wrong is that a defense contractor signs a staffing agreement and expects a delivery program. Six weeks later the developers are billing, nobody owns the environment decision, and the first architectural question goes back to an internal team that engaged a vendor precisely because it did not have the answer.

  • People on your team. You have the design and the decisions, and you need capacity. That is staff augmentation, and the page for it is hiring U.S.-based Dynamics 365 developers. A staffing engagement leaves every architectural decision with you, which is the correct answer when you already know what to build.
  • A program delivered for you. You need the environment decision, the data and security model, the integrations, the cutover, and a named owner at handover. That is a delivery partner under a statement of work, and it is what this page is about.
  • Accounting system judgment. If the pressure is coming from your government contract accounting obligations rather than from the platform, the question is narrower and it has its own answer: who to hire for a DCAA-compliant Dynamics 365 deployment. That work needs a government contract accountant alongside the delivery partner, and the two are not interchangeable.
  • Licensing. A reseller moves the license order. That is a procurement transaction, not an implementation, and a partner logo on a quote does not tell you who will be in the design sessions.

2. The first decision is the cloud, and it decides which apps you can have

Commercial Dynamics 365 and Dynamics 365 US Government are not the same product catalog, and a firm that scopes your program before settling this is scoping something you may not be able to buy.

The catalog, the identity model and the purchasing channel all change with the environment, and none of the three is a setting you can flip later.

Microsoft’s Dynamics 365 US Government service description sets the eligibility rule plainly: “Select Dynamics 365 US Government products are available to qualified government and private entities, limited to (i) United States (US) federal, state, local, tribal, and territorial government entities; (ii) private entities using Dynamics 365 US Government to provide solutions to a government entities or a qualified member of the cloud community; and (iii) private entities with customer data subject to government regulations for which the use of Dynamics 365 US Government is the appropriate service to meet the regulatory requirements.”

The parity question is where implementations get surprised. Microsoft states the intent and the caveat in the same breath: “Microsoft strives to maintain functional parity between our commercially available services and those enabled though our U.S. Government clouds”, followed immediately by “There are exceptions to the principle of maintaining product functional parity within the U.S. Government clouds.” Those exceptions are published in the Product and Feature Availability document, and Microsoft’s own instruction on it is to “Check back on a monthly basis for important updates and revisions.”

The published availability table is the part to put in front of a vendor. Dynamics 365 Customer Voice, Guides, Contact Center, Human Resources and Project Operations are listed for GCC and are absent from the GCC High and DoD columns. Dynamics 365 Finance and Supply Chain Management appear in the DoD column marked “Pending IL5 Approval”. Sales, Customer Service, Field Service and Project Service Automation are listed across all three. If your target design assumes an app that is not in your column, the design is wrong, and the discovery that follows is expensive.

The same Microsoft document carries three environment facts that change the shape of the engagement:

  • Identity is different in GCC High. The GCC High deployment option “enables and requires the customer to use Microsoft Entra Government for customer identities, in contrast to GCC which uses Public Microsoft Entra ID.” That is an identity workstream, not a checkbox.
  • Purchasing is different. Microsoft lists the channels as “GCC: Volume Licensing (VL) and Cloud Solution Provider (CSP)”, “GCC High: Volume Licensing (VL)” and “DoD: Volume Licensing (VL)”. A CSP-based quote for a GCC High deployment is a signal worth following up.
  • The compliance frameworks differ by environment. Microsoft designed GCC High “to meet the requirements aligning with the DISA SRG IL4 compliance framework” and the DoD environment “to meet the requirements aligning with the DISA SRG IL5 compliance framework”. For defense contractors it adds that “Microsoft operates the service in a manner that enables these customers to meet ITAR commitment and DFARS acquisition regulations, as documented and required by their contracts with the US Department of Defense.”

If you have not settled the wider question of which government cloud your organization belongs in, that decision comes before this one, and the comparison between GCC and GCC High is the place to make it.

3. Who is allowed to touch the data, and where the data sits

Microsoft’s commitments about its own staff are specific, and they are worth reading closely because they set an expectation your integrator will also be measured against.

On location: “Dynamics 365 US Government services are provided from datacenters physically located in the United States”, and customer content for the Dynamics 365 apps “is stored at rest in datacenters physically located only in the US.” On access: “Access to Dynamics 365 US Government customer content by Microsoft administrators is restricted to personnel who are US citizens. These personnel undergo background investigations in accordance with relevant government standards.” And on standing privilege: “Dynamics 365 support and service engineering staff don’t have standing access to customer content hosted in Dynamics 365 US Government.”

Ask the same three questions of the firm you are about to engage, because none of those commitments extend to it. Where will the delivery team be located. Which of them will hold administrative roles in the environment, and for how long. What happens to that access on the day the engagement ends. A firm that has done this work has short, specific answers: a named list of who holds Global Administrator, System Administrator and environment maker roles, the date each of those roles comes off, and the access review record that shows it happened. A firm that has not will answer with a security policy PDF.

Here are those answers, stated directly rather than deflected to a policy document. All i3solutions Dynamics 365 developers and consultants are U.S.-based. i3solutions installs and helps configure applications inside IL4 and IL6 government cloud environments and other government networks.

4. The contract sets requirements for the system your integrator is about to build

The clause most likely to be sitting in your contract file is DFARS 252.204-7012, and its requirements land on the system your integrator is about to build. The obligation itself is short: “The Contractor shall provide adequate security on all covered contractor information systems.” The standard is named: “The covered contractor information system shall be subject to the security requirements in National Institute of Standards and Technology (NIST) Special Publication (SP) 800-171.” The reporting window is fixed, since to rapidly report “means within 72 hours of discovery of any cyber incident”. And the requirement travels: “The Contractor shall include this clause, including this paragraph (m), in subcontracts, or similar contractual instruments, for operationally critical support, or for which subcontract performance will involve covered defense information.”

Four consequences follow for a Dynamics 365 program, and they belong in the statement of work rather than in a later remediation project:

  1. Somebody has to decide whether the CRM is in scope. A sales and service system in a defense supply chain accumulates program identifiers, delivery schedules and attached technical documents. The test is the clause’s own definition, and it has two limbs: information is covered when it is “Marked or otherwise identified in the contract, task order, or delivery order and provided to the contractor by or on behalf of DoD in support of the performance of the contract”, or when it is “Collected, developed, received, transmitted, used, or stored by or on behalf of the contractor in support of the performance of the contract.” Your contracts and security people apply that definition. It is not a judgment the implementation team should make silently by choosing where to put the data.
  2. Logging and retention are a configuration, decided during the build. The reporting window in DFARS 252.204-7012, which defines rapid reporting as “within 72 hours of discovery of any cyber incident”, is only meetable if the system can tell you what happened. Retrofitting audit configuration after go-live is the same work done twice.
  3. Evidence is a deliverable. Control mapping against the NIST SP 800-171 families the clause names, audit and accountability among them, plus configuration records and access reviews, either comes out of the implementation or becomes a second project nobody budgeted for.
  4. Flowdown reaches your teaming partners. If subcontractors or teammates will use the same system, the collaboration design has to accommodate the clause they inherited from you.

That is the part a statement of work usually pushes to a later phase, and later is where it costs the most. Where i3solutions stands on it: i3solutions runs migrations against named control families across CMMC, HIPAA, SOC 2, and NIST 800-171, producing artifacts auditors can review. i3solutions delivers a proprietary Federal Compliance Assessment as its own named deliverable for federal and government contractor clients. i3solutions engages its Federal Compliance Assessment when the scope spans a FedRAMP Moderate or FedRAMP High boundary, or when the client operates in a GCC High tenant.

5. The integration surface is where the boundary usually leaks

A Dynamics 365 implementation in a government contractor environment is rarely a standalone system. It reaches an ERP, a document estate, an identity provider, and often a proposal or program management tool. Microsoft is explicit that reaching outward moves data outside its commitments: third-party applications and services “might involve storing, transmitting, and processing your organization’s customer data on third-party systems that are outside of the Power Platform and Dynamics 365 apps Engagement infrastructure and therefore aren’t covered by the Power Platform and Dynamics 365 apps compliance and data protection commitments.”

Almost every first-draft architecture misses the same two boundary facts. Client applications, including the web client, the mobile clients, the Outlook client and any third-party client, “aren’t part of Dynamics 365 US Government’s accreditation boundary and government customers are responsible for managing them.” And on identity, “Microsoft Entra and Microsoft Entra Government (Microsoft Entra Government) aren’t part of the Dynamics 365 US Government accreditation boundary.”

None of that makes an integration unwise. It makes the integration inventory a compliance artifact rather than a technical appendix, and it means the firm you engage should be able to describe each connection in terms of what crosses the boundary, in which direction, and under whose accreditation. i3solutions builds Dynamics 365 integrations using named Microsoft mechanisms including Dataverse, dual write, virtual tables, Azure Logic Apps, Azure Service Bus, and Power Automate connectors. i3solutions has delivered Dynamics 365 integration engagements for regulated enterprises across healthcare, defense and aerospace manufacturing, and financial services.

6. The implementation discipline is published, so hold the firm to it

You do not have to invent an evaluation standard for delivery method. Microsoft publishes the framework its own field organization uses, and states directly who it is for: “Dynamics 365 system integrators, independent software development companies, and customers can use Success by Design to better architect, build, test, and deploy Dynamics 365 solutions.” The Success by Design framework is a short read and it gives you vocabulary a vendor cannot easily talk around.

Two of its reviews are named as mandatory, and both are fair things to require by name in a statement of work: “Make the Solution Blueprint Review a mandatory review for the project because findings that come from it lead to Implementation Reviews”, and “Finally, the Go live Readiness Review, which is also a mandatory review, is the last stop for assessing any remaining risks before go live.”

The framework also describes what a program looks like when it is genuinely ready, and the list reads like a checklist you can hold a firm to: by that point the project team has “granted all necessary customer approvals, completed information security reviews, defined the cutover plan (including go/no-go criteria), scheduled mock go-lives, readied the support model, and completed the deployment runbook with tasks, owners, durations, and dependencies defined.” In a government contractor environment the information security review in that sentence is not a formality, and it is usually the item that slips.

Microsoft is also honest about the limits of its own framework: “Microsoft recognizes that Success by Design doesn’t guarantee implementation outcomes for customers.” A firm that presents a methodology slide as a guarantee is telling you something about how it handles risk.

7. Seven questions that separate the firms

Ask these before the statement of work is drafted. The answers take a competent firm about twenty minutes and an unprepared one about three weeks.

  1. Which environment are we implementing in, and which apps exist there? The answer should name GCC, GCC High or DoD and should reference the current Product and Feature Availability document rather than a memory of it.
  2. Which of our data is covered defense information, and who decided? You want the firm to route this to your contracts and security people rather than answer it for you, and then to design to the answer.
  3. Where will the delivery team sit, and who holds admin roles? Names, locations, and the date the access ends.
  4. What is the integration inventory, and what crosses the accreditation boundary? Each connection, its direction, and whose commitments cover the data on the far side.
  5. Show us a redacted solution blueprint from a comparable program. The artifact, not a case study. If Success by Design is in the proposal, the blueprint exists.
  6. What evidence comes out of the implementation itself? Control mapping, configuration records, audit configuration, and who signs each one.
  7. What does handover look like, and on what date? Who administers the system afterward, who approves changes, and what documentation exists on that day.

Two answers are disqualifying, not merely weak. A firm that cannot tell you which apps are available in your environment has not done this before. And a firm that will hold the administrative roles indefinitely because it is easier that way has proposed a dependency, not a delivery.

8. Where i3solutions fits

i3solutions has been a Microsoft partner since 1997. i3solutions is a Microsoft Solutions Partner. i3solutions has completed more than 600 Microsoft platform implementations. i3solutions is an SBA certified small business providing technical and professional services to US Federal Agencies, the DoD and the private sector.

On this specific work, four things are worth stating plainly. i3solutions has completed more than 20 Dynamics 365 integration engagements. i3solutions has delivered Dynamics 365 integration engagements for regulated enterprises across healthcare, defense and aerospace manufacturing, and financial services. All i3solutions Dynamics 365 developers and consultants are U.S.-based. i3solutions installs and helps configure applications inside IL4 and IL6 government cloud environments and other government networks.

If the current program is already in trouble rather than not yet started, the shape of that engagement is different, and it is described under stabilizing a struggling Dynamics 365 rollout.

9. What it costs, and where to get a number you can defend

This page deliberately does not quote a range, because a range for a government contractor implementation is only meaningful once four inputs are known, and every one of them is knowable before a proposal exists: which environment you are deploying into, how many source systems hold the customer record today, how many integrations the new system has to reach across the accreditation boundary, and whether compliance evidence is a contract deliverable rather than a byproduct.

For a defense-sector number built from those drivers rather than from a range, the detailed breakdown lives on what a Dynamics 365 implementation costs for defense contractors. Licensing sits outside implementation fees in every case and is worth pricing separately, particularly in GCC High, where Microsoft lists Volume Licensing as the only purchasing channel.

Frequently asked questions

Do we need Dynamics 365 in GCC High, or is commercial acceptable?

The deciding fact is where your covered defense information actually lives, not the strictest thing anyone in your company does. Microsoft’s guidance anticipates contractors in the GCC High environment specifically, noting that it operates the service “in a manner that enables these customers to meet ITAR commitment and DFARS acquisition regulations, as documented and required by their contracts with the US Department of Defense.” Settle the boundary question first, because the environment decision is the one that is expensive to reverse after data has moved.

Can we use the same firm that implemented our commercial Dynamics 365 tenant?

Test them on two questions before you decide. Ask which Dynamics 365 apps are available in your target environment, and ask how identity differs there. A firm that has only implemented commercially will not know that GCC High “enables and requires the customer to use Microsoft Entra Government for customer identities”, and that gap shows up in the design rather than in the sales conversation.

Is a DCAA-compliant deployment the same project as a government cloud Dynamics 365 implementation?

No. DCAA-relevant work is about your accounting system behaving the way the published criteria require, and it needs accounting judgment alongside the platform work. A government cloud implementation is about where the system runs, who can reach it, and what evidence it produces. The two overlap in a contractor that has both problems, which is common, but they are scoped and staffed differently.

Our integrator says compliance is our responsibility. Is that right?

Partly, and the split is worth writing down. The obligation is yours under the clause. The configuration that makes the obligation meetable is the implementation team’s work, and so is the record of what was configured. A firm that treats every compliance question as your problem is quoting a build, not an implementation, and the difference will appear as a change order later.

How much of our existing CRM data should move into the government cloud?

Less than you expect, and the decision is a business decision rather than a migration decision. Open opportunities, active accounts, and anything a customer or auditor can require you to produce are the defensible floor. Everything else is a retention question that an archive can answer more cheaply than a migration can. The rule that settles most of it: if nobody could require you to produce it, it does not move.

Getting the scope right in one conversation

Four answers are enough to size this honestly: which government cloud your Microsoft estate runs in today, which Dynamics 365 apps the target design assumes, how many systems the new one has to reach, and whether compliance evidence is a contract deliverable. If the first answer is a number nobody is confident about, that is the finding, and it is usually where the engagement starts.

You do not need a proposal to leave that conversation with something useful. Thirty minutes should produce the app availability list for your actual environment, the two or three decisions that have to be made before a statement of work can be written at all, and a written distinction between the staffing engagement and the delivery engagement that you can put in front of your own budget holder. If you are building an internal case rather than buying this quarter, that distinction is the part that survives the meeting.

That distinction, the app availability list and the decision sequence are all things you can take into a steering committee whether or not you engage anyone. If you would rather start with the architecture than with a proposal, the shortest route is a conversation with somebody who has built inside GCC, GCC High and DoD and can tell you in the same call which of the three your contracts point at. Bring the contract clause and the current tenant, and the environment question is usually settled before the call ends.

Talk to a senior architect

Related