GCC vs GCC High vs commercial Microsoft 365
Published 2026-10-22
Microsoft sells the same Outlook, Teams and SharePoint in different clouds, and the rule only cares about one thing: what data goes in. Federal contract information under FAR 52.204-21 comes with 15 basic safeguards and no cloud authorization. Covered defense information is different. Once it sits in a cloud, DFARS 252.204-7012(b)(2)(ii)(D) says the provider must meet the FedRAMP Moderate baseline or its equivalent, and must follow the clause's incident rules: reports within 72 hours, images kept for at least 90 days.
So pick by data type, not by licence name. We read Microsoft's own service descriptions and compliance pages for commercial Microsoft 365, GCC, GCC High and Azure Government, and the FedRAMP Marketplace, on the same day. Not sure which data you hold? Start with FCI vs CUI.
- In force today
- DFARS 252.204-7012 still applies: NIST SP 800-171 Rev 2 on systems that hold covered defense information, cyber incidents reported to DoD within 72 hours, and FedRAMP Moderate or equivalent for any cloud that holds it. DFARS 252.204-7012(b)(2), (c)
- Suspended
- Phase 2, due in November 2026, is suspended for every contractor, whatever its size: contracts are not adding the third-party Level 2 (C3PAO) or Level 3 (DIBCAC) requirements. DoW CIO memo of 2026-07-13, applied by Class Deviation 2026-O0025 Rev 3
- Not yet known
- The outcome of the CMMC Reform Task Force review is not confirmed as of 2026-10-23: no report or rule change has been published. Federal Register search, 2026-10-23
Microsoft 365 GCC High
The one Microsoft 365 environment Microsoft names for DoD CUI and signs ITAR terms for, with US-only storage and screened US-citizen staff.
Read the Microsoft 365 GCC High notesMicrosoft 365 Commercial
FAR 52.204-21's 15 safeguards name no cloud authorization, so a shop with no CUI can work toward Level 1 in the tenant it already has.
Read the Microsoft 365 Commercial notesAzure Government
FedRAMP High under the JAB, a DFARS 7012 attestation and contractual US-person limits, for the servers and apps GCC High does not cover.
Read the Azure Government notes
Four clouds against the rule
Rows inside the boundary are what DFARS 252.204-7012 and ITAR ask of a cloud that holds your data. Rows outside it are the day-to-day differences. Every word was read on Microsoft's own pages, or in the FedRAMP Marketplace, on 2026-10-22.
| What the rule asks | Microsoft 365 Commercial | Microsoft 365 GCC | Microsoft 365 GCC High | Azure Government |
|---|---|---|---|---|
| Inside the boundary | ||||
| FedRAMP status in the Marketplace (the rule asks for Moderate or equivalent)DFARS 252.204-7012(b)(2)(ii)(D) | Not in Marketplace | Certified (Moderate) | Certified (High) | Certified (High) |
| Microsoft lists it for the DFARS 7012 cloud duties (72-hour reporting, 90-day images)DFARS 252.204-7012(c)–(g) | Not in scope list | In DFARS scope list | In DFARS scope list | 3PAO attestation |
| Inside Microsoft's NIST SP 800-171 attestationDFARS 252.204-7012(b)(2)(i) | Not in scope | In scope | In scope | In scope |
| Data stored in the US, content access limited to screened US citizens22 CFR 120–130 (ITAR) | Not stated | Support excluded | Support excluded | Contractual commitment |
| Microsoft signs ITAR contract terms22 CFR 120–130 (ITAR) | Not in scope list | No, GCC High only | ITAR terms | ITAR terms |
| Where Microsoft points DoD CUIDFARS 252.204-7012(a), covered defense information | Not stated | Customers without DoD CUI | DoD CUI and ITAR | Most DIB contractors (Microsoft) |
| Outside the boundary | ||||
| Eligibility check before you can buy | Not stated | Required | Required | Required |
| Free trial | Not stated | US government only | No trials | Trial on request |
| Sharing files with other companies | Not stated | Not stated | GCC High orgs only | Not stated |
| Teams phone calling | Not stated | Not stated | Direct Routing only | Not stated |
What the words mean
- MeetsCertified (Moderate)In scopeRequiredCertified (High)ITAR termsDoD CUI and ITAR3PAO attestationContractual commitmentMost DIB contractors (Microsoft)Trial on request
- The vendor's own documentation, or the official register, says so. Read on the date shown.
- PartialIn DFARS scope listSupport excludedCustomers without DoD CUIUS government onlyGCC High orgs onlyDirect Routing only
- Covers part of the requirement, or the vendor claims it and the official register does not show it.
- Check with vendorNot in MarketplaceNot in scope listNot stated
- Not stated in what we read. Ask the vendor in writing before you rely on it.
- NoNot in scopeNo, GCC High onlyNo trials
- The vendor's own documentation says it does not.
Pick the cloud by the data you hold
The cloud follows the most sensitive file you keep in it. One marked drawing in a SharePoint library puts that tenant inside your CUI boundary, so answer for the worst case, not the typical day.
The cloud for it
Microsoft 365 GCC High, or keep CUI out of Microsoft 365
- A cloud holding covered defense information must meet FedRAMP Moderate or its equivalent, plus the incident rules. DFARS 252.204-7012(b)(2)(ii)(D)
- Microsoft's buying guide calls GCC the offering for customers that don't hold DoD CUI. Microsoft 365 Government, how to buy
A small CUI footprint can live in a separate enclave instead of a whole GCC High tenant. Compare the GCC High alternatives.
What the FedRAMP Marketplace shows
The rule's test is FedRAMP Moderate or equivalent, so the Marketplace is the first place to look. It now labels an authorized offering "FedRAMP Certified" with a class: Class C is Moderate, Class D is High. Microsoft's GCC service description says FedRAMP High; the GCC package the Marketplace certifies is at Moderate, with a second GCC package at High still In Process. Moderate is the bar the clause sets, so GCC clears it either way.
| Listing | Status | Covers |
|---|---|---|
| Microsoft 365 Government Community Cloud & Supporting ServicesMSO365MT | FedRAMP Certified, Class C (Moderate)Certified since 2014-11-20 | GCC |
| Microsoft 365 Government Community Cloud & Supporting ServicesMSO365MTA | FedRAMP In Process, Class D (High)Status as of 2026-10-19 | GCC, a second package at High |
| Microsoft 365 Government Community Cloud-HighFR1824057433 | FedRAMP Certified, Class D (High)Certified since 2024-12-26 | GCC High |
| Azure Government (includes Dynamics 365)F1603087869 | FedRAMP Certified, Class D (High)Certified since 2020-04-29 | Azure Government |
| Azure Commercial CloudF1209051525 | FedRAMP Certified, Class D (High)Certified since 2019-05-03 | Commercial Azure (not Microsoft 365) |
GCC High is FedRAMP Certified at High, Class D, on its own product page, certified since 2024-12-26. That matches Microsoft's FedRAMP page, which says GCC and GCC High hold ATOs from US agencies, and its service description, which says GCC High is assessed against NIST SP 800-53 at FIPS 199 High. Older copies of the Marketplace data that still show it In Process are out of date; read the live product page. For your SSP you still want the paper, not the label.
Why GCC is the wrong middle ground for CUI
GCC looks like the sensible middle. It is a government cloud, it stores content in the US, staff who touch content are screened, and Microsoft lists it under DFARS and inside its NIST SP 800-171 attestation. Microsoft's own buying guide still draws the line elsewhere.
“GCC remains the hero offering for all customers that don't hold FedRAMP High or DoD controlled unclassified information (CUI).”
Two more lines settle it for a machine shop. Among the Office 365 Government environments, Microsoft agrees to ITAR contract language for GCC High only. And GCC support runs on the same terms as worldwide Office 365, with no assurance about where the agent sits or what citizenship they hold.
What changes when you move to GCC High
GCC High is a separate cloud, not a licence upgrade, so it changes daily work as well as the paperwork. These are the differences Microsoft's own GCC High service description lists.
| What changes | What Microsoft says |
|---|---|
| Buying | Through Volume Licensing, after an eligibility check; eligibility is checked again at every renewal. |
| Trying it first | No trials are available for GCC High. |
| Sharing files | Users can share only with other organizations in GCC High. |
| Phone calls in Teams | Microsoft's PSTN calling and conferencing are not available; phone and audio conferencing come through Direct Routing. |
| Viva Engage | Not available in GCC High. |
| Signing in | Federated MFA can use PIV and CAC cards. |
| Support tickets | Support sits outside the accreditation boundary, with no ITAR data-handling assurance. |
The sharing line matters most to a subcontractor. Ask your prime which cloud it runs before you migrate, and plan how drawings will move between you. Email is its own question, covered in CMMC- and ITAR-ready email compared.
The four clouds, one by one
Microsoft 365 Commercial
What it is. The Microsoft 365 most businesses run: Exchange, SharePoint, OneDrive and Teams in Microsoft's worldwide multitenant cloud. Microsoft keeps it outside its NIST SP 800-171 attestation and its DFARS and ITAR scope lists.
Who it fits. A shop whose contracts carry only FAR 52.204-21 and federal contract information, with no CUI and no ITAR technical data anywhere in the mailbox or the file shares.
| What the rule asks | What we found |
|---|---|
| Inside Microsoft's NIST SP 800-171 attestation | Not in scope |
| Microsoft lists it for the DFARS 7012 cloud duties (72-hour reporting, 90-day images) | Not in scope list |
| Microsoft signs ITAR contract terms | Not in scope list |
Checked on learn.microsoft.com, 2026-10-22
Check with the vendor before you buy.
Microsoft 365 GCC
What it is. Office 365 Government in the GCC environment: logically separated from commercial tenants, customer content stored in the US, content access limited to screened staff. The Marketplace lists GCC as FedRAMP Certified at Moderate since 2014-11-20, and a second GCC package at High as In Process.
Who it fits. State and local agencies, and contractors that hold government-regulated data but no DoD CUI. Microsoft's own buying guide calls it the offering for customers that don't hold FedRAMP High or DoD CUI.
| What the rule asks | What we found |
|---|---|
| FedRAMP status in the Marketplace (the rule asks for Moderate or equivalent) | Certified (Moderate) |
| Microsoft signs ITAR contract terms | No, GCC High only |
| Where Microsoft points DoD CUI | Customers without DoD CUI |
Checked on learn.microsoft.com, 2026-10-22
Check with the vendor before you buy.
Microsoft 365 GCC High
What it is. Office 365 GCC High: the environment Microsoft built for the DoD and for contractors holding DoD CUI or ITAR data, assessed against NIST SP 800-53 at FIPS 199 High, run by screened US citizens, with US-only storage and ITAR contract terms.
Who it fits. A shop that receives marked drawings, specs or CUI email from a prime, or handles ITAR technical data, and wants its whole Microsoft 365 tenant inside the boundary.
| What the rule asks | What we found |
|---|---|
| FedRAMP status in the Marketplace (the rule asks for Moderate or equivalent) | Certified (High) |
| Microsoft signs ITAR contract terms | ITAR terms |
| Sharing files with other companies | GCC High orgs only |
Checked on learn.microsoft.com, 2026-10-22
Check with the vendor before you buy.
Azure Government
What it is. Microsoft's physically isolated US government Azure: servers, storage, databases and virtual desktops in US-only regions, with contractual US-storage and screened-US-person commitments and a FedRAMP High JAB authorization.
Who it fits. A shop that runs a file server, an ERP or a CAM workstation pool holding CUI and wants to move it to the cloud, next to a GCC High tenant for email and files.
| What the rule asks | What we found |
|---|---|
| FedRAMP status in the Marketplace (the rule asks for Moderate or equivalent) | Certified (High) |
| Data stored in the US, content access limited to screened US citizens | Contractual commitment |
| Where Microsoft points DoD CUI | Most DIB contractors (Microsoft) |
Checked on learn.microsoft.com, 2026-10-22
How we read Microsoft
Questions small shops ask
Can I keep CUI in GCC?
Microsoft lists GCC under DFARS and inside its NIST SP 800-171 attestation, but its own buying guide says GCC is the offering for customers that don't hold DoD CUI, and it signs ITAR terms for GCC High only. A shop holding DoD CUI that stays in GCC is going against the vendor's own guidance. Get Microsoft's position for your contract in writing before you rely on it.
Is commercial Microsoft 365 enough for CMMC Level 1?
It can be. Level 1 is the 15 safeguards of FAR 52.204-21, and none of them names a cloud authorization, so the work is in how the tenant is set up and run. Microsoft says commercial Office 365 is outside its NIST SP 800-171 attestation, so it is the wrong home for CUI. The Level 1 checklist walks the 15 items.
Do I need GCC High for ITAR?
Inside Microsoft 365, GCC High is the environment Microsoft signs ITAR contract language for. ITAR itself has no product certification, and other vendors offer US-person controls for files and email, so GCC High is one answer rather than the only one. Microsoft's eligibility check may ask for proof of your DDTC registration; the ITAR registration guide covers who must register.
Does the CMMC Phase 2 suspension change which cloud I need?
No. The suspension stops contracts from adding third-party assessment requirements; DFARS 252.204-7012 still applies, and its cloud paragraph still asks for FedRAMP Moderate or equivalent wherever covered defense information sits. The cloud decision rests on 7012, not on the CMMC phase. DFARS 7012 explained.
Can GCC High users work with primes on commercial Microsoft 365?
Microsoft's GCC High service description says users can share files only with other organizations in GCC High, and that alert emails do not go to non-GCC High addresses on a user profile. Ask your prime which cloud it uses, and test the exchange of a sample drawing before you move real work.
Why does this page not list what each cloud costs?
We leave cost out on purpose. Microsoft sends government buyers to its account team or a partner, after the eligibility check. Choose the cloud by the data you hold first, then ask for quotes.