What is GCC High? Microsoft 365 GCC High, explained for defense shops
Published 2026-10-23, 13 min read
GCC High is Microsoft 365 run as a separate US government cloud: Exchange Online, SharePoint, OneDrive and Teams, built to DoD's Level 4 controls, for defense contractors that hold DoD CUI or ITAR technical data. The FedRAMP Marketplace lists it at High. You cannot just sign up: Microsoft checks that your data qualifies first.
- FedRAMP Marketplace
- Class D (High)FedRAMP Certified since 2024-12-26
- Built to
- DoD SRG Level 4Microsoft's design target for its controls
- Where content sits
- US datacentersAt rest, only in the US
- Who can reach content
- Screened US citizensMicrosoft staff, after background checks
- ITAR contract terms
- GCC High onlyOf Microsoft's Office 365 Government clouds
- Before you buy
- Eligibility checkNo trials; checked again at renewal
What GCC High is
GCC stands for Government Community Cloud. Microsoft runs Microsoft 365 in four separate clouds. Above the public one, each step is built to a stricter level of the DoD Cloud Computing Security Requirements Guide (SRG) and sold to a narrower group of buyers. GCC High is the third step, and the one Microsoft builds for the defense industrial base.
Step 1
Commercial
Public cloud
Any business, available globally: the Microsoft 365 most companies run.
Step 2
GCC
SRG L2
US federal, state, local and tribal government, and contractors holding data for it.
Step 3
GCC High
SRG L4
Federal agencies, the defense industrial base and government contractors.
Step 4
DoD
SRG L5
The Department of Defense only.
GCC, GCC High and DoD share four promises that commercial Microsoft 365 does not make, in the words of Microsoft's Office 365 Government service description:
- Customer content is kept logically apart from Microsoft's commercial customers.
- Customer content is stored at rest only in US datacenters: mailboxes, SharePoint sites, Teams chats, Forms and Planner data.
- Only screened Microsoft staff can reach customer content.
- It carries the certifications and accreditations US public-sector customers need.
GCC High adds the defense layer: Level 4 controls, US-citizen staff screening and ITAR contract terms. It is also a different place on the internet. Users sign in at login.microsoftonline.us, mail lives at outlook.office365.us and files at sharepoint.us, so a GCC High tenant is a new tenant, not a licence you switch on in the one you have.
Who can buy it: the eligibility check
GCC High is not sold on size. Microsoft's test is the data you hold, not how many people you employ, and its partner list has a channel for orders under 500 seats. Government bodies qualify as themselves; a private company qualifies when it holds regulated government data and can prove it.
- 01ApplyFill in Microsoft's eligibility form for GCC High. Nothing is set up until it is approved.
- 02Prove the dataShow you hold a qualifying type of data. For ITAR data that can mean proof of your registration with the State Department; otherwise sponsorship by a government body with handling requirements.
- 03Order through a partnerUnder 500 seats, through an AOS-G partner on Microsoft's list; from 500 seats, an Enterprise Agreement through a licensing partner. There is no web sign-up and no trial.
- 04Prove it againEligibility is checked again every time the contract renews.
These are the kinds of data Microsoft accepts from a private company, from its Microsoft 365 Government buying guide. A machine shop almost always qualifies on the first two, and an overseas parent may have to buy through its US subsidiary.
- International Traffic in Arms Regulations (ITAR) dataTypical for a shop
- Controlled Unclassified Information (CUI)Typical for a shop
- DoD Impact Level data
- DoD or DoE Unclassified Controlled Nuclear Information (UCNI)
- Criminal Justice Information (CJI)
What it covers
Four questions decide whether a cloud can hold a defense shop's files: its FedRAMP status, whether the vendor signs ITAR terms, who can see the data, and whether it meets the cloud duties in DFARS 252.204-7012. Here is what each source says about GCC High.
Certified (High)
The FedRAMP Marketplace lists “Microsoft 365 Government Community Cloud-High” as FedRAMP Certified, Class D (High), since 2024-12-26 (package FR1824057433). Microsoft says GCC and GCC High have ATOs from US agencies.
323 / 410Controls and enhancements in FedRAMP's Moderate baseline (what the clause asks) and High baseline
Read on fedramp.gov Marketplace
ITAR terms
“Microsoft will only agree to ITAR contract language for the GCC High environment.” The terms are not automatic: you sign an extra agreement telling Microsoft you will store ITAR data. And no product is ITAR certified; Microsoft says so itself.
Read on Microsoft ITAR offering
Support excluded
Microsoft staff have no standing access to GCC High; anyone granted temporary access to content must first pass the screening below, US citizenship included. Support is different: it “isn't included in the service accreditation boundary” and gives no ITAR data-handling assurance.
Read on GCC High service description
In DFARS scope list
Microsoft lists GCC High among the services in scope for DFARS and says Office 365 U.S. Government is FedRAMP Moderate authorized and adequate for DFARS. Its promise to support the clause's cloud-provider duties is worded for Azure Government and Office 365 U.S. Government Defense, so get the GCC High position in writing.
Read on Microsoft DFARS offering
The US-person answer has two halves. The people who run GCC High and can reach your content are screened; this is the list Microsoft publishes for anyone given access to customer content.
| Check | What Microsoft verifies |
|---|---|
| US citizenship | Verified |
| Employment history | Seven years verified |
| Education | Highest degree verified |
| Social Security number | Checked as valid |
| Criminal history | Seven years, felony and misdemeanor, state, county, local and federal |
| Treasury OFAC list | Checked |
| Commerce BIS list | Checked |
| State DDTC debarred list | Checked |
| Fingerprints | Checked against FBI databases |
GCC High and DoD service description, read 2026-10-23
The other half is support. A support engineer is not inside that boundary, so the rule for your shop is simple: never paste CUI or ITAR data into a ticket until you have confirmed the agent is cleared to see it. Microsoft says the same thing.
So the clause asks for Moderate, and the Marketplace lists GCC High at High. The second half of the sentence, incident reporting, malware, media and forensics under paragraphs (c) to (g), is the part to get in writing; DFARS 252.204-7012 explained walks through each. The clause binds whatever the CMMC program does next. Where CMMC stands today:
- In force today
- DFARS 252.204-7012 still applies: NIST SP 800-171 Rev 2 on systems that hold covered defense information, cyber incidents reported to DoD within 72 hours, and FedRAMP Moderate or equivalent for any cloud that holds it. DFARS 252.204-7012(b)(2), (c)
- Suspended
- Phase 2, due in November 2026, is suspended for every contractor, whatever its size: contracts are not adding the third-party Level 2 (C3PAO) or Level 3 (DIBCAC) requirements. DoW CIO memo of 2026-07-13, applied by Class Deviation 2026-O0025 Rev 3
- Not yet known
- The outcome of the CMMC Reform Task Force review is not confirmed as of 2026-10-23: no report or rule change has been published. Federal Register search, 2026-10-23
Where Microsoft's line stops
Buying GCC High does not put every Microsoft service inside the line. Microsoft publishes one list of GCC High services in scope for DFARS and a shorter one for ITAR. If ITAR drawings are the reason you are buying, keep them in services that sit on both, and ask Microsoft in writing before you rely on anything else.
| GCC High service | DFARS list | ITAR list |
|---|---|---|
| Exchange Online | Listed | Listed |
| SharePoint Online | Listed | Listed |
| OneDrive | Listed | Listed |
| Teams | Listed | Listed |
| Office Online | Listed | Listed |
| Office Pro Plus | Listed | Not listed |
| Entra ID | Listed | Not listed |
| Defender for Office 365 | Listed | Not listed |
| Purview portal | Listed | Not listed |
| Forms | Listed | Not listed |
| Planner | Listed | Not listed |
| Power Apps | Listed | Not listed |
| Power Automate | Listed | Not listed |
| Power BI | Listed | Not listed |
| Bookings | Not listed | Listed |
The bigger gap is everything on your side. Microsoft's commitments cover its own infrastructure and operations; it says plainly that customers stay responsible for how they set up and protect what runs in their tenant.
- Covered by GCC High
- Mail in Exchange Online
- Files in SharePoint and OneDrive
- Teams chats and meetings
- Microsoft's datacenters and the staff who run them
- Still yours to protect
- The laptops and phones that open the files
- Add-ins and apps connected to the tenant
- Support tickets
- Your settings, and anything you build on the tenant
- The file server, ERP and CAM stations in the shop
What changes for a small shop moving onto it
For the people at the desks, less than you would think. Microsoft says its government clouds match the commercial features as closely as they can: Outlook, Word, Excel, Teams and SharePoint are the same apps. The work is in the move itself, and in how you deal with everyone outside the new tenant.
That outside world is the real change. A GCC High tenant lives in Microsoft's US government cloud, and Microsoft keeps that cloud apart from the commercial one by default. Guest access between a GCC High shop and a prime on ordinary Microsoft 365 only works once both sides switch on cross-cloud collaboration, so the first call to make is to your primes' IT teams, not to Microsoft.
Moving a small shop onto GCC High
0 of 13 done
Tick each step as you finish it. Nothing is saved or sent.
The feature-by-feature differences Microsoft lists for GCC High (phone calling, file sharing, Viva Engage, sign-in with PIV and CAC cards) are set out in the GCC vs GCC High comparison. If a managed service provider will run the move and the tenant afterwards, it joins your assessment scope; the MSPs that run CMMC for small shops are compared separately.
When GCC High is not the answer
GCC High fits one shape of company well: CUI or ITAR data that arrives by email and spreads through Office files across most of the staff. For other shapes there is usually a smaller box that meets the same rule.
Your orders carry FAR 52.204-21 and federal contract information, but no CUI and no ITAR data.
Level 1 is the 15 basic safeguarding requirements of FAR 52.204-21, and none of them names a cloud authorization. Microsoft's own buying guide calls GCC, not GCC High, the offering for customers without DoD CUI.
Three drafters and a buyer touch CUI; the other twenty people never do.
Assets that are physically or logically separated from CUI assets are out of scope, so a small box for the few can beat moving the whole company.
Drawings live on a file server, in the ERP or on CAM stations, not in mail and Office files.
GCC High is Microsoft 365 only. Servers need an infrastructure cloud that meets the same 7012 test; the Marketplace lists Azure Government at High and AWS GovCloud at High.
The only controlled data is ITAR technical data that moves as files between you and a few partners.
ITAR does not treat sending or storing technical data as an export when it is encrypted end to end with FIPS-validated modules (or at least AES-128 strength) and kept out of 126.1 countries.
Questions shops ask about GCC High
What does GCC High stand for?
Government Community Cloud High. Microsoft's full name for it is Office 365 Government Community Cloud - High; it is sold as Microsoft 365 GCC High, and the FedRAMP Marketplace lists it as “Microsoft 365 Government Community Cloud-High”.
Is GCC High FedRAMP High?
The FedRAMP Marketplace lists it as FedRAMP Certified, Class D (High), since 2024-12-26, so yes: High. DFARS 252.204-7012 only asks for Moderate or equivalent for a cloud that holds covered defense information, so GCC High is above the bar the clause sets.
Do I need GCC High for CMMC?
No rule names a product. The clause asks that any cloud holding CUI meet FedRAMP Moderate or equivalent, and CMMC Level 2 checks the same thing. Microsoft describes GCC High as able to show “necessary inheritance for CMMC”, which is why it is the usual Microsoft answer, but an enclave or another listed service can meet the rule too. The alternatives are compared side by side. A cloud that is not on the Marketplace at Moderate has to prove FedRAMP Moderate equivalency instead.
Is GCC High ITAR certified?
No product is ITAR certified; Microsoft says there is no compliance certification for ITAR. What GCC High offers is contract terms: Microsoft agrees to ITAR contract language for GCC High only, through an extra agreement you sign before storing ITAR data. Your own registration and controls are still yours; see what ITAR compliance means.
Can a ten-person shop buy GCC High?
Yes. Eligibility depends on the data, not the headcount, and Microsoft lists partners that sell GCC High under 500 seats. There is no free trial, so ask the partner how you can test the tenant with real work before you move everyone.
Is GCC High the same as Microsoft 365 DoD?
No. The DoD environment is built to SRG Level 5 and only Department of Defense entities can buy it. Contractors buy GCC High, which Microsoft builds to Level 4 controls.