Azure Government for defense contractors

Short answer

GCC High covers mail, files, Teams and identity. It doesn’t cover the file server in the back office, the CAD workstations, the ERP database or the virtual desktops your engineers log into. If those handle the same CUI or ITAR data, they need a home inside the same boundary, and for most defense contractors moving to GCC High that home is Azure Government.

Azure Government is Microsoft’s US government cloud for infrastructure and platform services. It runs in physically isolated datacenters and networks located only in the US, with contractual commitments to store customer data in the US and to limit potential access to systems processing customer data to screened US persons (Azure Government). Microsoft validates eligibility before you get access (Azure Government, how to buy).

The part most people get wrong is that commercial Azure is not the weak option. It holds the same FedRAMP High authorization and the same third-party DFARS 7012 attestation (DFARS offering). The difference is narrower than that, and for a contractor already on GCC High it’s usually decisive.

Azure Government vs commercial Azure

Both clouds run on the same underlying technology and the same security controls (comparing Azure Government and global Azure). Here’s where they actually differ.

	Commercial Azure	Azure Government
FedRAMP High P-ATO	Yes (DFARS offering, comparison)	Yes (DFARS offering, comparison)
Third-party (3PAO) attestation against DFARS 252.204-7012	Yes (DFARS offering)	Yes (DFARS offering)
DoD Impact Level 4 and 5 provisional authorizations	No. US regions hold IL2 (audit scope)	Yes (DFARS offering, audit scope)
Contractual commitment to store customer data in the US	Not part of the commitment (DFARS offering, comparison)	Yes (DFARS offering, comparison)
Access to systems processing your data limited to screened US persons	Not part of the commitment (DFARS offering, comparison)	Yes (DFARS offering, comparison)
Datacenters	Global regions	Physically isolated, US only: US Gov Arizona, US Gov Texas, US Gov Virginia (Azure Government)
Who can sign up	Anyone	Eligible government entities, their solution providers and contractors holding government data, validated by Microsoft (how to buy)
Portal and endpoints	portal.azure.com and commercial endpoints	portal.azure.us and separate government endpoints (comparison)
Services and features	Full catalog	Same core services; some services and features aren’t available or are configured differently (comparison)
Identity	Microsoft Entra ID, which pairs with commercial Microsoft 365 and GCC (CMMC guidance)	Microsoft Entra Government, which pairs with GCC High (plan identity)

Microsoft says the US storage and screened US persons commitments “may be of interest to customers using the cloud to store or process data subject to US export control regulations” (comparison), and that most agencies and their partners are best aligned with Azure Government (ITAR offering). If you hold ITAR or EAR technical data, that line is the one that matters.

Microsoft says an accredited third-party assessor has attested that both Azure and Azure Government meet the applicable requirements of DFARS 252.204-7012, and both hold FedRAMP High (DFARS offering). The clause’s cloud baseline is FedRAMP Moderate (DFARS 252.204-7012). Azure Government still adds the US storage and screened US persons commitments that matter for export-controlled data (DFARS offering, comparison), and it shares identity with GCC High (plan identity). For a company already moving to GCC High, splitting the boundary across two clouds and two identity systems is rarely worth it.

What runs there

Azure Government has the same building blocks as commercial Azure. The services contractors usually need are inside its FedRAMP High and DoD Impact Level 4 audit scope (audit scope):

• File shares. Azure Files, or a Windows file server on a virtual machine, for the shared drives and project folders that never fit neatly in SharePoint (audit scope).
• Virtual desktops. Azure Virtual Desktop runs in Azure Government (audit scope). Deployed inside a properly designed CUI boundary, it keeps controlled data off the laptop in front of the user. More in what is Azure Virtual Desktop and our Azure Virtual Desktop page.
• Databases. Azure SQL Database, SQL Managed Instance, PostgreSQL and MySQL, or SQL Server on a virtual machine for older line-of-business apps (audit scope).
• Line-of-business apps. ERP, MRP, PLM and CAD license servers that can’t move to Microsoft 365, rebuilt on Azure Government virtual machines or platform services (audit scope).
• Backup. Azure Backup is in scope too, so the copies stay inside the same boundary as the originals (audit scope).

Two cautions. Some services and features in commercial Azure aren’t available in Azure Government, so every workload gets checked before it’s designed (comparison). And Impact Level 5 workloads in the US Gov regions need extra configuration to meet Microsoft’s compute and storage isolation requirements (audit scope). Many contractors don’t need IL5, but if your contract says it, it changes the design.

It isn’t a lift and switch. Azure Government has its own portal and endpoints, and Microsoft says log data in Azure Monitor can’t be moved from Azure into Azure Government (comparison). If you already run workloads in commercial Azure, they’re rebuilt or migrated, and your history stays where it is.

Identity with GCC High

This is the practical reason the two belong together. A Microsoft Entra Government tenant can support both Office 365 GCC High and Azure Government (plan identity). Managing an Azure Government subscription requires identities from Microsoft Entra Government, not from a commercial directory (plan identity).

So when your GCC High tenant is built, the same identities, the same multifactor authentication and the same Conditional Access policies can govern who reaches the file server, the database and the virtual desktop. One boundary, one identity system, one set of evidence for your system security plan.

Pair GCC High with commercial Azure instead and Microsoft says separate identities are required for each cloud (plan identity). That’s two sets of accounts to secure, two places to look when something goes wrong, and a harder boundary to explain to an assessor.

The full sequence of a move, including where Azure Government fits, is in our GCC High migration checklist. If only part of the company handles CUI, the same logic applies to an enclave. See GCC High enclave or full migration.

Licensing

Azure Government isn’t open sign-up. Microsoft validates eligibility before access is provisioned (how to buy). For a private company, that rests on holding or processing government data (how to buy).

We walk you through Microsoft’s Azure Government sign-up and eligibility procedure, and your organization submits it. Cloud Kings resells Microsoft 365 GCC High, Azure Government and Microsoft 365 Commercial licensing through an authorized government channel. We pick what your obligations require, not the most complete option. We don’t carry Azure Government Secret.

Licensing details for both clouds are on our GCC High licensing page.

What you still own

Moving servers to Azure Government doesn’t move your obligations. Microsoft is explicit about this:

• Compliance stays with you. There is no ITAR certification, and you’re wholly responsible for your own compliance with applicable laws and regulations (ITAR offering).
• Design stays with you. You choose the regions your applications and data run in, and you design encryption that meets ITAR requirements. Microsoft doesn’t inspect, approve or monitor your applications (ITAR offering).
• Export controls stay with you. You’re responsible for designing and deploying to meet the EAR, ITAR and similar rules, and Microsoft warns not to put sensitive or restricted information in Azure resource names (comparison).
• Your security plan stays with you. Scoping, your system security plan, your people and your affirmation are still yours.

Our shared responsibility matrix sets out which NIST SP 800-171 requirements typically sit with a provider and which stay with you. Azure Government gives you a better place to stand. It doesn’t stand there for you.

Talk it through

We design, build and manage Azure Government environments as part of the same migration plan as your GCC High tenant, with the same boundary and the same identity. Tell us what runs on your servers today and who uses it, and we’ll go through what belongs in Azure Government and what doesn’t. The full picture is on our Microsoft 365 GCC High migration page, with this topic under GCC High and Azure Government.

Book a free scoping call.

We waive the setup fee when you sign up for managed services for 48 months.