Short answer. Most defense contractors do not need GCC High in order to pass a CMMC Level 2 assessment. Microsoft’s own guidance is that the need for CMMC certification is not a deciding factor for choosing your cloud environment. What forces GCC High is export controlled data under ITAR or EAR, a DISA Impact Level 4 requirement, DoD controlled unclassified information, or a contract clause that names the environment. If none of those apply to you, GCC is the environment Microsoft calls its hero offering. And Microsoft does not publish a public per user list price for GCC High, so any figure you have been quoted came from a partner price sheet, not from Microsoft.

This page answers the three questions defense and federal buyers actually ask before they commit a tenant: which environment do we need, does CMMC force GCC High, and what does GCC High really cost. Every rule and figure below is sourced to Microsoft’s published licensing and service documentation or to the federal acquisition regulations themselves.

Updated: August 27, 2026

GCC vs GCC High: which Microsoft government cloud does your organization need?

Choose the lowest environment that can legally hold your data, and let the data type decide, not the sales conversation. Microsoft sells four Microsoft 365 environments, and they are not tiers of quality. They are separate accreditation boundaries with different authorizations, different purchase channels and different feature sets.

Decision criterion Commercial GCC GCC High DoD
Who it is for Any organization Government entities and sponsored contractors holding controlled information Contractors holding DoD CUI or ITAR regulated data The Department of Defense
Published authorizations FedRAMP High for services in scope FedRAMP High, DFARS, CJIS, IRS 1075, DISA SRG Level 2 FedRAMP High, ITAR, DFARS, DISA SRG Level 4 controls DISA SRG Level 5
ITAR and export controlled data No No Yes Yes
Federal Contract Information only Sufficient Sufficient More than required More than required
Non export controlled CUI Not appropriate Sufficient in most cases Sufficient More than required
Personnel handling customer data No US citizenship requirement Screened US citizens Screened US citizens, plus OFAC, BIS and DDTC list validation and fingerprint checks Adds Department of Defense IT-2 adjudication
Data storage Not guaranteed inside the United States Continental United States Continental United States Continental United States
Purchase channel Any Enterprise Agreement through an LSP, AOS-G, MPSA, Web Direct, CSP Enterprise Agreement through an LSP, or AOS-G. No Web Direct, no CSP, no MPSA Enterprise Agreement only
Trial available Yes Yes, one month, Office 365 GCC only No No
Eligibility validation required before purchase No Yes Yes Yes

Two lines in that table decide most cases. The first is ITAR. If your technical data is export controlled, GCC is off the table and the conversation is over. The second is the purchase channel. GCC High cannot be bought on a credit card, cannot be bought through a CSP reseller relationship, and has no trial tenant. Microsoft requires an eligibility validation form before the environment is established at all, and licenses are sold only through select partners: licensing solution providers transacting an Enterprise Agreement, or AOS-G partners for organizations under 500 seats.

What accepted data types actually qualify you

Microsoft validates non government organizations against a specific list. Accepted government data types include International Traffic in Arms (ITAR) data, Controlled Unclassified Information, Department of Defense Unclassified Controlled Nuclear Information, Department of Energy UCNI, Criminal Justice Information, and Department of Defense Impact Level data. An international commercial entity can qualify, but regulated data could be required to be purchased through a US subsidiary. Proof of membership in one of those groups is required. Wanting a more secure tenant is not an eligibility category.

Schedule a CMMC Readiness Consultation

There is no Microsoft product called GCC Moderate

GCC Moderate is not a SKU. Microsoft’s four environments are Commercial, GCC, GCC High and DoD. The word Moderate leaks in from a different document: DFARS 252.204-7012 requires that where a contractor uses an external cloud service provider to process, store or transmit covered defense information, that provider must meet security requirements equivalent to the FedRAMP Moderate baseline. Buyers hear FedRAMP Moderate, look at the government cloud that is not GCC High, and fuse the two into GCC Moderate.

The confusion is expensive, because it hides the real fact: GCC does not merely meet FedRAMP Moderate, it is authorized at FedRAMP High. So is Microsoft 365 Commercial for the services in its scope, and so are both Azure and Azure Government. The FedRAMP baseline named in DFARS is a floor that several environments clear. It is not the thing that separates GCC from GCC High. When a contract or a reseller says GCC Moderate, get it in writing whether they mean the GCC environment or simply a FedRAMP Moderate equivalent platform.

Do you need GCC High for CMMC, or is GCC Moderate enough?

CMMC by itself does not require GCC High. Microsoft is explicit: both Azure and Azure Government can help you meet CMMC obligations, you can obtain CMMC certification for solutions deployed to either environment, and the need for CMMC certification is not a deciding factor for choosing your cloud environment. CMMC is an assessment of your implementation of NIST SP 800-171 practices. It is not applicable directly to cloud services, which is why no cloud platform carries a CMMC certification of its own.

That is the opposite of what most of the market tells defense contractors, so here is the reasoning laid out. DFARS 252.204-7012 sets the cloud service provider bar at FedRAMP Moderate equivalency. GCC clears it at FedRAMP High. NIST SP 800-171 is a subset of the NIST SP 800-53 controls already assessed under FedRAMP, so a FedRAMP High baseline addresses and exceeds the 800-171 requirements. The platform is not what fails an assessment. Configuration discipline and audit evidence are.

The four things that do force GCC High

  1. Export controlled data. ITAR or EAR regulated technical data. GCC High supports ITAR. GCC does not.
  2. A DISA Impact Level requirement. GCC is authorized at DISA SRG Level 2. GCC High can demonstrate equivalency to Impact Level 4. The DoD environment is authorized at Level 5. If your contract requires IL4, GCC cannot get you there.
  3. DoD controlled unclassified information. Microsoft’s own positioning is that GCC remains the offering for every customer that does not hold FedRAMP High or DoD CUI.
  4. A contract clause that names the environment. Some primes and some programs specify GCC High in the flow down. That is a contractual obligation, and no amount of technical equivalence argument overrides it. Read the clause.

What does not get you GCC High

  • Upgrading a Commercial tenant to E5. Licensing tier and accreditation boundary are unrelated.
  • Applying Microsoft Purview sensitivity labels to CUI in a Commercial tenant. Labeling changes handling, not the authorization of the environment holding the data.
  • A reseller who says they will make your tenant compliant. GCC High requires Microsoft eligibility validation before the environment exists.
  • An Azure Government subscription on its own. Azure Government and Microsoft 365 GCC High are separate purchases in separate service families.
  • A Plan of Action and Milestones. A POA&M manages a gap. It does not create an authorization.

How much does Microsoft 365 GCC High cost, including licensing and migration?

Microsoft does not publish a public per user list price for Microsoft 365 GCC High, and we are not going to invent one. GCC High is available through Volume Licensing only, after eligibility validation, which means your real rate comes off a licensing solution provider price sheet under an Enterprise Agreement, or from an AOS-G partner if you are under 500 seats. There is no Web Direct price to look up, because there is no Web Direct channel for GCC High.

What Microsoft does publish is the price movement, and it is worth knowing before you sign. Effective July 1, 2026, Microsoft raised the government suites:

Suite Environments Increase effective July 1, 2026 Commercial anchor SKU
Microsoft 365 G3 GCC, GCC High, DoD 8 percent Microsoft 365 E3, $36.00 to $39.00 per user per month
Microsoft 365 G5 GCC, GCC High, DoD 5 percent Microsoft 365 E5, $57.00 to $60.00 per user per month
Office 365 G3 GCC 13 percent Office 365 E3, $23.00 to $26.00 per user per month
Office 365 G5 GCC 8 percent Office 365 E5, $38.00 to $41.00 per user per month

Note what that table shows and what it does not. Microsoft published percentage increases for the government SKUs and dollar figures only for the commercial anchors. The government columns carry percentage correlations to commercial rates rather than discrete dollar amounts. Anyone quoting you a precise GCC High list price per user per month is quoting a partner price sheet, and you should ask to see it.

The cost structure, which is the part nobody itemizes

Licensing is the line item you will be shown. It is rarely the line item that decides the program.

  • Suite licensing. G3 or G5 per user per month, on an Enterprise Agreement or AOS-G paper, at a rate you negotiate rather than look up.
  • Eligibility and validation. An intake form, proof of your accepted data type, and elapsed calendar time before the environment is provisioned at all. This is a schedule cost, not an invoice cost, and it lands before anything else can start.
  • Tenant build. A new tenant, new identity architecture, conditional access, device compliance, DLP, and the CUI boundary itself. GCC High supports federated multifactor authentication using PIV and CAC cards, which is capability you may need to build rather than inherit.
  • Cross cloud migration. Mailboxes, SharePoint sites, OneDrive content, Teams, and endpoint management move across a cloud boundary. Microsoft states that cross tenant OneDrive migration is not supported for Government Cloud users including GCC, GCC High and DoD, and that Power Platform tenant to tenant moves between GCC and public clouds are not supported in either direction. Third party migration tooling and a longer coexistence window are the consequence.
  • Feature loss you have to design around. Real, documented, and often discovered late. See the next section.
  • Third party tools inside the CUI boundary. Every non Microsoft tool touching CUI has to be assessed too. That is scope, and scope is cost.
  • Ongoing evidence production. A CMMC Level 2 assessment is an evidence exercise. The artifacts do not generate themselves.
  • No rehearsal environment. Microsoft offers no trial of GCC High or DoD. There is a one month trial of Office 365 GCC and nothing equivalent above it. You cannot pilot GCC High before you buy it.

How does Microsoft 365 GCC High compliance differ from Microsoft 365 Commercial?

The difference is not the feature list. It is the compliance boundary, and four things move. Commercial and GCC High run the same productivity apps; what changes is who may operate the environment, what data it is permitted to hold, which authorizations it carries, and what your contract makes you responsible for.

  • Who operates it. Microsoft 365 Commercial support personnel are not restricted to screened US persons. GCC High runs in a segregated US government environment operated by screened US persons. If your data is export controlled, that single fact is usually the whole decision, because ITAR restricts access by foreign persons regardless of how well the data is encrypted.
  • What data it may hold. Commercial is appropriate for Federal Contract Information and for CUI only in narrow, well argued cases. GCC High is the environment Microsoft positions for export controlled CUI under ITAR or EAR, for DoD CUI, and for contracts that name DISA Impact Level 4.
  • Which authorizations it carries. The comparison table above sets these out per environment. The one that governs is DISA Impact Level 4, which Commercial does not carry.
  • What you still owe either way. This is the part buyers miss. DFARS 252.204-7012(b)(2)(ii)(D) requires any external cloud service provider that stores, processes or transmits covered defense information to meet security requirements “equivalent to those established by the Government for the Federal Risk and Authorization Management Program (FedRAMP) Moderate baseline.” Paragraph (c)(1)(ii) requires you to report a cyber incident to DoD at https://dibnet.dod.mil within 72 hours of discovery, and paragraph (e) requires you to preserve images of affected systems for at least 90 days. No tenant discharges those three obligations. They are yours in Commercial and they are still yours in GCC High.

Two corrections worth making explicitly, because both cost money. CMMC does not require GCC High. The rule names no cloud environment, and a great many contractors handling non export controlled CUI meet CMMC Level 2 in GCC. And Microsoft publishes no public per user list price for GCC High. It carries a licensing premium over Commercial and is sold through Microsoft agreements and authorized partners, so any per user figure or premium percentage you have been quoted came from a partner price sheet, not from Microsoft. Treat published “GCC High costs X percent more” claims as unsourced.

One more trap that is specific to the SKU rather than the environment: buying Office 365 GCC High rather than Microsoft 365 GCC High moves an incomplete SKU into a government cloud. Office 365 has no Microsoft Intune, no Microsoft Entra ID P1 or P2 for Conditional Access, and no Microsoft Defender for Endpoint, so several CMMC requirement families would still have no enforcement point in your tenant. See Is Office 365 CMMC compliant? for that distinction, and Is Microsoft Intune CMMC compliant? for what changes on the endpoint side in GCC High.

What you actually give up when you move to GCC High

These are documented Microsoft feature differences, not opinions, and they change how people work on day one:

  • External sharing narrows sharply. Users in GCC High can share only with other organizations in GCC High.
  • Non GCC High email addresses on user profiles are not supported. Alert emails will not be delivered to them.
  • File requests are not available in Office 365 Government.
  • Phone System and Audio Conferencing are delivered via Direct Routing in GCC High and DoD. PSTN Calling and PSTN Conferencing are not available.
  • Exchange Online Unified Messaging integration with an on premises IP-PBX is not supported.
  • Viva Engage for enterprise is not available in GCC High or DoD.
  • Microsoft support is outside the accreditation boundary. Microsoft’s guidance is not to share controlled, sensitive or confidential information with customer support personnel, and states that GCC High and DoD support does not provide FedRAMP, DoD SRG, ITAR, IRS 1075 or CJIS data handling compliance assurances. Your support process needs a rule for that, in writing.

Residency and sovereignty are two different questions, and Copilot has now joined them

If someone has told you to move up because your data has to stay in the United States, they have answered the wrong question. Both GCC and GCC High already keep customer data in the continental United States. Microsoft separates the two ideas explicitly: data residency refers to where customer data is stored and processed, while data sovereignty refers to the legal, operational, and personnel controls that govern access to that data. Residency is therefore almost never what separates GCC from GCC High. What changes as you move up is the personnel and jurisdictional control over access, which is why an export control obligation, rather than a storage requirement, is normally what forces the higher tenant.

Two consequences follow, and both belong in the business case rather than in the technical annex.

  • Release cadence is part of the price. Microsoft’s own guidance on the government environments states that feature availability may differ, that release timing typically lags behind commercial environments, and that third party integrations are more restricted in higher isolation environments. That is a permanent operating condition, not a launch inconvenience. If a program depends on a capability arriving on the commercial schedule, moving up the isolation boundary changes the roadmap you are able to promise.
  • Microsoft 365 Copilot is available above Commercial, but it lives inside the boundary. Microsoft documents Copilot as available in GCC, GCC High and DoD, operating entirely within the customer’s government cloud tenant, with prompts, responses and generated content remaining in the government cloud and Copilot inheriting the security and compliance controls of the underlying environment. Feature availability again aligns with each environment’s isolation boundary. So AI capability is not a reason to stay in Commercial, and it is not a reason to move up either. The decision rule does not change: classify the data first, name the capabilities your programs actually depend on, confirm each of those is available in the environment your data legally requires, and if one is missing, treat the gap as a design problem rather than a reason to reopen the tenant choice.

What does not move is where the obligation sits. Microsoft’s stated position is that customers remain responsible for configuring Microsoft 365 to meet their specific regulatory obligations. A more isolated environment buys a different accreditation boundary and a different operating population. It does not buy a configured tenant, an assessment, or the evidence a C3PAO assessor will ask to see, and it is worth pricing that gap before the licensing conversation rather than after it.

Primary source: Understand Microsoft U.S. government cloud environments for Microsoft 365 and Microsoft 365 Copilot on Microsoft Learn.

How the CMMC timeline changes the decision

The CMMC Program rule sits at 32 CFR part 170. The acquisition side is DFARS clause 252.204-7021, which became effective on November 10, 2025, and phases in across a three year period running through November 9, 2028. The clause requires a contractor to have and maintain the requisite CMMC level for the life of the contract.

The practical consequence for the environment decision: your certification level is set by the solicitation, and the assessment is of your system, not of Microsoft’s. Moving to GCC High when your data does not require it enlarges the boundary you have to assess, lengthens the migration, and removes capability from your users, without changing the level you have to certify at. Moving too late, when a contract does require it, is worse. Read the clause in the solicitation, classify your data honestly, then pick the environment.

Which contract clause is actually driving this, and what each one says

Not one clause in the federal cybersecurity stack names a cloud environment. This page keeps telling you to read the clause. This is the list to read. Six citations carry effectively every cybersecurity obligation a defense contract puts on you, and none of them says GCC, GCC High, Commercial, or Microsoft. What can force a specific environment is an export control rule, a DISA Impact Level requirement, or a program instruction someone wrote into your solicitation. If you cannot point at one of those three, the environment is an engineering decision you own, not a compliance mandate you inherited.

Citation Title and clause date What it obliges Names an environment?
FAR 52.204-21 Basic Safeguarding of Covered Contractor Information Systems (Nov 2021) Fifteen safeguarding controls on systems that process, store or transmit Federal contract information. Paragraph (b)(2) states these requirements do not relieve you of other safeguarding requirements for controlled unclassified information established under Executive Order 13556. No
DFARS 252.204-7012 Safeguarding Covered Defense Information and Cyber Incident Reporting FedRAMP Moderate baseline equivalency for any external cloud service provider, the 72 hour DIBNet report, and 90 day media preservation. Set out in full earlier on this page. No
DFARS 252.204-7019 Notice of NIST SP 800-171 DoD Assessment Requirements (Nov 2023) A current assessment, meaning not more than three years old unless the solicitation specifies less, with summary level scores posted in the Supplier Performance Risk System. No
DFARS 252.204-7020 NIST SP 800-171 DoD Assessment Requirements (Nov 2023) Defines the Basic, Medium and High assessment types. The Basic is your own self assessment at low confidence; the other two are conducted by the government. Paragraph (g)(1) requires you to insert the substance of the clause into all subcontracts other than those for commercially available off the shelf items. No
DFARS 252.204-7021 Contractor Compliance With the Cybersecurity Maturity Model Certification Level Requirements (Nov 2025) Describes CMMC as a framework for assessing a contractor’s compliance with applicable information security protections, pointing to 32 CFR part 170, and provides that CMMC assessments will not duplicate other comparable DoD assessments. No
DFARS 252.204-7025 Notice of Cybersecurity Maturity Model Certification Level Requirements (Nov 2025) The pre award side. Requires the current CMMC status to be entered in the Supplier Performance Risk System at the level the solicitation requires, for each system that will handle Federal contract information or controlled unclassified information. No

Read the pattern rather than the individual rows. Every one of these clauses regulates your system and your evidence. The assessment subject is the covered contractor information system, the reporting surface is the Supplier Performance Risk System, and the confidence level is set by who performs the assessment rather than by where the data lives. A tenant is an input to that system. It is never a substitute for it, and that is why no clause names one. Here is the concrete test. DFARS 252.204-7019 requires a summary level score for each covered contractor information system relevant to the offer, posted in the Supplier Performance Risk System. Nothing about buying a higher tenant produces that score, and no licensing agreement posts it on your behalf.

Two consequences you can act on this week. First, the flow down at 252.204-7020(g)(1) passes the substance of the clause down the supply chain, not a tenant choice, so a prime’s environment decision does not automatically become yours. Second, when a prime or a reseller tells you GCC High is required, ask which citation says so. If the answer is 252.204-7012 or either CMMC clause, the answer is wrong on the face of the text, and the real driver is either an export control rule, an Impact Level, or a program specific instruction that should be quotable straight out of the contract.

Primary sources for the table, in order: FAR 52.204-21, DFARS 252.204-7019, DFARS 252.204-7020, DFARS 252.204-7021 and DFARS 252.204-7025 on Acquisition.gov, and the CMMC Program rule at 32 CFR part 170 on the eCFR.

How i3Solutions approaches this decision

i3Solutions has spent three decades building Microsoft platforms for defense industrial base and federal organizations operating under DFARS 252.204-7012 flow downs, NIST SP 800-171 obligations and export control rules. Our position on this question is deliberately unfashionable: we start by trying to keep you out of GCC High, because the cheapest compliant environment is the one that holds your data legally with the fewest capabilities removed from your users.

That means classifying the data first, reading the actual contract clauses second, and only then scoping a tenant. When GCC High is genuinely required, we treat the move as a cross cloud rebuild with a coexistence plan, an evidence plan, and a named owner for every artifact a C3PAO assessor will ask for.

That approach changes the answer often enough to be worth stating plainly. On one defense contractor engagement, the assessment recommended partial-variant adoption with email and document storage on GCC High and the remainder of the productivity suite on Commercial; the contractor’s licensing economics improved materially relative to a full GCC High migration.

Related reading from i3Solutions

Frequently asked questions

How does Microsoft 365 GCC High compliance differ from Microsoft 365 Commercial?

The difference is the compliance boundary, not the feature list. Microsoft 365 Commercial support personnel are not restricted to screened US persons, and Commercial does not carry the DISA Impact Level 4 authorization or the ITAR handling commitments that export controlled data requires. GCC High runs in a segregated US government environment operated by screened US persons, and it is what Microsoft positions for export controlled CUI under ITAR or EAR, for DoD CUI, and for contracts naming DISA Impact Level 4. What does not change is your own obligation: DFARS 252.204-7012(b)(2)(ii)(D) requires your cloud provider to meet security requirements equivalent to the FedRAMP Moderate baseline, and paragraphs (c) and (e) put the 72 hour DIBNet report and the 90 day media preservation duty on you in either tenant. CMMC itself names no environment, so many contractors handling non export controlled CUI meet Level 2 in GCC. Microsoft publishes no public per user list price for GCC High.

GCC vs GCC High: which Microsoft government cloud does our organization need?

Pick the lowest environment that legally holds your data. Microsoft 365 Commercial is appropriate only when you handle Federal Contract Information and no CUI. GCC is the right answer for most defense contractors handling non export controlled CUI: it carries FedRAMP High, DFARS, CJIS, IRS 1075 and DISA SRG Impact Level 2, and Microsoft calls GCC the hero offering for every customer that does not hold FedRAMP High or DoD controlled unclassified information. GCC High is required when your data is export controlled under ITAR or EAR, when a contract requires DISA SRG Impact Level 4, or when a clause names the environment. The DoD environment is reserved for the Department of Defense itself and is authorized at DISA SRG Impact Level 5. The working rule i3Solutions applies is to keep you out of GCC High unless one of those triggers is real, because every step up removes capability from your users and enlarges the boundary a C3PAO assessor has to examine.

Do we need GCC High for CMMC, or is GCC Moderate enough?

CMMC by itself does not require GCC High. Microsoft states that the need for CMMC certification is not a deciding factor for choosing your cloud environment, and that a contractor using an external cloud service provider to process, store or transmit covered defense information must ensure that provider meets security requirements equivalent to the FedRAMP Moderate baseline. Both Microsoft 365 Commercial and GCC exceed that bar, and Azure and Azure Government both hold FedRAMP High. So the FedRAMP baseline is not the discriminator. What forces GCC High is export controlled data under ITAR or EAR, a DISA SRG Impact Level 4 or 5 requirement, DoD controlled unclassified information, or a contract clause that names the environment. There is no Microsoft SKU called GCC Moderate. The word Moderate comes from the FedRAMP baseline named in DFARS 252.204-7012, not from a product name.

How much does Microsoft 365 GCC High cost, including licensing and migration?

Microsoft does not publish a public per user list price for Microsoft 365 GCC High. GCC High is sold only through Volume Licensing, so your actual rate comes off a licensing solution provider price sheet under an Enterprise Agreement, or from an AOS-G partner if you are under 500 seats. Microsoft does publish the price movement: effective July 1, 2026, Microsoft 365 G3 rose 8 percent and Microsoft 365 G5 rose 5 percent across GCC, GCC High and DoD alike, against commercial anchors of Microsoft 365 E3 moving from $36.00 to $39.00 per user per month and Microsoft 365 E5 moving from $57.00 to $60.00 per user per month. Migration cost is driven by the fact that GCC High is a separate tenant, not a setting on your existing one, so the work is a cross cloud tenant to tenant migration with no in place upgrade path and no trial tenant to rehearse in. Before you price the tenant, price the alternative: an environment your contracts do not actually require is the most expensive line in the program, and that is the first thing i3Solutions tries to talk a client out of.

Is GCC Moderate a real Microsoft product?

No. Microsoft sells four Microsoft 365 environments: Commercial, GCC, GCC High and DoD. Buyers say GCC Moderate because DFARS 252.204-7012 requires a cloud service provider to meet security requirements equivalent to the FedRAMP Moderate baseline, and the word attaches itself to the government cloud that is not GCC High. When a contract or a reseller says GCC Moderate, confirm in writing whether they mean the GCC environment or simply a FedRAMP Moderate equivalent platform, because those are different statements with different consequences.

Can we upgrade our existing Microsoft 365 Commercial tenant to GCC High in place?

No. GCC High is a separate environment established only after Microsoft validates your eligibility, and it is physically and virtually segmented from Commercial. Moving means standing up a new tenant and migrating identities, mailboxes, sites, files, Teams and endpoint management across a cloud boundary. That is system integration and data management work: identity mapping, content migration, and re-pointing every integration across a compliance boundary. Several of the tools you would reach for do not cross that boundary: Microsoft states that cross tenant OneDrive migration is not supported for Government Cloud users including GCC, GCC High and DoD, and that Power Platform tenant to tenant moves between GCC and public clouds are not supported in either direction. Plan the migration as a rebuild with data movement, not as an upgrade.

Does any CMMC or DFARS clause require GCC High?

No. None of the clauses that carry the obligation names a cloud environment. FAR 52.204-21 (Nov 2021) sets fifteen safeguarding controls for systems handling Federal contract information. DFARS 252.204-7012 sets FedRAMP Moderate baseline equivalency for an external cloud service provider, the 72 hour DIBNet report and the 90 day media preservation duty. DFARS 252.204-7019 and 252.204-7020 (both Nov 2023) govern the NIST SP 800-171 assessment: current within three years, summary level scores posted in the Supplier Performance Risk System, and a Basic, Medium or High confidence level depending on who performs it. DFARS 252.204-7021 (Nov 2025) describes CMMC as a framework for assessing a contractor’s compliance with applicable information security protections and points to 32 CFR part 170, and DFARS 252.204-7025 (Nov 2025) requires the current CMMC status to be entered in the Supplier Performance Risk System before award. Not one of them says GCC, GCC High or Microsoft. What forces GCC High is export controlled data, a DISA Impact Level requirement, or a program instruction written into the solicitation. If someone tells you a clause requires it, ask them to quote the citation.

Is Microsoft 365 Copilot available in GCC High?

Yes. Microsoft documents Microsoft 365 Copilot as available in GCC, GCC High and DoD, operating entirely within the customer’s government cloud tenant, with prompts, responses and generated content remaining in the government cloud and Copilot inheriting the security and compliance controls of the underlying environment. The caveat is cadence rather than availability. Microsoft states that feature availability may differ across the government environments, that release timing typically lags behind commercial environments, and that third party integrations are more restricted in higher isolation environments. So Copilot is neither a reason to stay in Commercial nor a reason to move above it. Treat it the way you treat the rest of the environment decision, by naming the specific capabilities your programs depend on and asking when each one lands in the environment you are considering.

Sources

Every rule and figure on this page is drawn from primary documentation: Microsoft 365 Government how to buy (eligibility, validation, sales channels, LSP and AOS-G partner lists, trials, environment commitments), Office 365 GCC High and DoD service description (background screening, feature differences, support boundary), Microsoft Azure CMMC compliance documentation (FedRAMP Moderate equivalency, NIST SP 800-171 relationship, environment choice), the Microsoft 365 packaging and pricing updates effective July 1, 2026, the DFARS clause at 252.204-7012, the CMMC Program rule at 32 CFR part 170, and the DFARS clause at 252.204-7021 effective November 10, 2025.

Get the clause read before you buy the tenant

If you are being told you need GCC High, the next artifact you need is not a quote. It is a CUI data classification and a clause review: an inventory of what your organization actually holds, mapped against the DFARS and CMMC language in your live solicitations and prime flow downs, with a written recommendation of Commercial, GCC or GCC High and the reason for it.

That is a document your committee can approve against, and it is cheaper than the wrong tenant. It is also the artifact that tells you whether the migration on your roadmap has to happen at all. Bring your solicitations and your prime flow downs, and we will read them with you before anyone signs a licensing agreement.

Start with the i3Solutions senior Microsoft architects who run CMMC readiness, or request a CUI classification and clause review before you commit budget to an environment.

Schedule a CMMC Readiness Assessment
Smiling businessman in formal suit for i3solutions website.

About the Author

Michael Branson, Founder / COO, i3Solutions. LinkedIn

Michael Branson co-founded i3Solutions 30 years ago and brings executive, operational, and technical perspective to organizations working in complex, secure, and regulated environments. His work focuses on governance, compliance, secure operating models, and the operational discipline required to turn technology investments into practical business systems.

Schedule a CMMC Readiness Consultation