GCC High enclave or full migration: how to decide

Short answer

If only a small, well-defined group in your company touches DoD CUI, a GCC High enclave can help you manage costs compared with moving everyone. If CUI shows up across email, sales, engineering and the shop floor, moving the whole company gives you one high bar and no line to police. Either way, CUI should never sit on commercial Microsoft 365.

If your company handles DoD CUI under DFARS clause 7012 or ITAR data, Microsoft’s guidance points you to GCC High. For the product-family context, see GCC High, GCC, or commercial. The next question is who moves. You can move everyone into a GCC High tenant, or you can build an enclave: a separate GCC High tenant for the people and workloads that handle CUI, while everyone else stays on commercial Microsoft 365.

Microsoft’s CMMC guidance describes both approaches. Here’s how to decide.

Not sure what counts as CUI in your business? Start with what counts as CUI.

What an enclave is, and what a full migration is

GCC High is a separate tenant in Microsoft’s government cloud, not a setting on the commercial tenant you have now. That’s true for both options.

• Full migration. Everyone moves into GCC High. Mail, files, Teams and identity for the whole company live in one government tenant, and the commercial tenant is retired.
• Enclave. Only the people and systems that handle CUI get GCC High accounts. Everyone else stays in commercial Microsoft 365. Some people end up with an account in each.

For companies with several business units, Microsoft’s guidance suggests putting all of them in one GCC High environment, which gives you the high bar regardless of each unit’s requirements.

Who an enclave suits

An enclave tends to fit when:

• A small, stable group handles CUI, such as one program team or one engineering cell.
• CUI arrives through a few known channels and you can name them.
• Most of the company never sees a drawing, a spec or a contract with CUI markings.
• The people outside the enclave rarely need to work on CUI with the people inside it.
• You can keep the boundary documented and enforced over time, not just at go-live.

Who an enclave doesn’t suit

An enclave gets harder to defend when:

• CUI comes in by email to whoever the customer happens to write to. Microsoft says the most common spillage happens through personal storage, especially email.
• Sales, purchasing, quality and engineering all touch the same controlled drawings.
• People move between programs often, so the in-scope group keeps changing.

Microsoft’s guidance makes the point directly: if personal data solutions such as mailboxes don’t meet the bar, or sit in a commercial cloud, you can end up with far more scope outside the boundary than inside it.

What changes for users

A full migration changes everyone’s tenant once. An enclave changes a smaller group’s daily routine for good, and they carry the extra work.

• Two identities. Enclave users typically have a commercial account for everyday work and a GCC High account for CUI work. That means two sign-ins and two mailboxes, and a habit of picking the right one every time.
• Two of everything else. Two calendars, two Teams profiles, two OneDrives.
• Sharing across the line. GCC High can work with organizations in Commercial or GCC only after both sides set up cross-cloud access, and the people on the other side join as guests. More in sharing and Teams after moving to GCC High.
• Feature gaps. GCC High trails commercial on some features. Viva Engage isn’t available, PSTN Calling and Conferencing aren’t either, and Microsoft lists other differences such as Shifts.

Enforcing the boundary

An enclave is only as good as the line around it. The tools Microsoft provides to hold that line include:

• Data loss prevention. Microsoft Purview DLP policies can identify, monitor and automatically protect sensitive information across Exchange, SharePoint, OneDrive and Teams chat and channel messages, as well as Office apps and Windows and macOS devices. In an enclave, the commercial tenant is where you watch for CUI that shouldn’t be there.
• Sensitivity labels. Labels can apply encryption and content markings such as headers, footers and watermarks, and encryption can restrict what specific people can do with a file.
• Conditional Access. Conditional Access policies act as if-then rules on sign-in. They can block access, or require multifactor authentication, a compliant device or an approved app before granting it. That’s how you keep enclave data off devices you don’t manage.
• Identity. A Microsoft Entra Government tenant can support both Office 365 GCC High and Azure Government, so your enclave identity can cover both.

Check that each control you plan on is available in GCC High before you design around it, because Microsoft lists feature differences between environments. The controls also need evidence. Your system security plan has to describe how the boundary works, and someone has to keep checking that it still does.

How scope and your SSP change

Under the CMMC rule, assets that process, store or transmit CUI are in your Level 2 assessment scope, along with the assets that protect them. Each one goes in your asset inventory, your SSP and your network diagram.

An asset only counts as out of scope if it can’t process, store or transmit CUI and doesn’t provide security protections for CUI assets. Assets that can handle CUI but aren’t meant to, because of your policies and procedures, are still documented in the SSP as Contractor Risk Managed Assets.

So an enclave doesn’t make the rest of the company disappear from your assessment by itself. You have to be able to show why the commercial side can’t, or doesn’t, hold CUI. A full migration trades that argument for a bigger, simpler boundary. Our shared responsibility matrix shows which NIST SP 800-171 requirements typically sit with a provider and which stay with you.

What drives the cost

We don’t quote this before seeing your environment. These are the things that move the number:

• Licenses. How many people need GCC High, and how many still need commercial licenses alongside it. Enclave users may need both.
• Users and data. How many mailboxes, sites and files move. Microsoft doesn’t support cross-cloud tenant-to-tenant mailbox migration, and cross-tenant OneDrive migration isn’t supported for GCC High users, so each workload is planned and moved on its own.
• Apps and integrations. Every line-of-business app, add-in and integration has to be checked for GCC High support.
• Boundary upkeep. DLP rules, labels, Conditional Access and monitoring in two tenants instead of one.
• Training and support. Two identities mean more help desk calls and more habits to build.
• Servers and systems. File servers, databases and CAD or ERP workloads that handle the same CUI need a home inside the boundary.
• Growing later. Expanding an enclave means moving more commercial mail and files across the cloud boundary, which Microsoft’s built-in cross-tenant tools don’t cover. If you expect it to grow, cost a full migration now too.

See also what CMMC Level 2 costs.

Decision checklist

Answer these before you pick:

1. Can you name every person who handles CUI today?
2. Will that list look about the same next year?
3. Does CUI ever arrive by email to people outside that list?
4. Do people outside the list share files or drawings with people inside it?
5. Which apps, file servers and CAD or ERP systems touch CUI?
6. Can you support two identities and two mailboxes for some staff?
7. Who will own DLP, labels and Conditional Access across both tenants?
8. Can you describe the boundary in your SSP, and show evidence it works?
9. Do any of your primes or contracts require GCC High in writing?

Mostly “yes, easily” on 1 to 4 points toward an enclave. Mostly “not sure” points toward moving everyone.

The whole move, phase by phase, is on the GCC High migration checklist.

How Azure Government fits

GCC High covers mail, files, Teams and identity. File servers, databases, line-of-business apps, CAD workstations and virtual desktops that handle the same data need a home inside the same boundary, usually Azure Government.

Azure Government runs in physically isolated US datacenters and networks, with contractual commitments to store customer data in the US and to limit potential access to systems processing customer data to screened US persons. It also holds DoD Impact Level 4 and 5 provisional authorizations. Customers are subject to eligibility validation.

An enclave that keeps its CAD files on a commercial file server isn’t much of an enclave. We design, build and manage Azure Government environments as part of the same migration plan, and Cloud Kings resells Microsoft 365 GCC High, Azure Government and Microsoft 365 Commercial licensing through an authorized government channel. More on where the environment lives and on GCC High licensing.

How we help

We start with your data and your contracts, then help you draw the boundary. We walk you through Microsoft’s GCC High sign-up and eligibility procedure, and your organization submits it. Work begins within five business days of signature.

The full sequence is on our Microsoft 365 GCC High migration page.

Talk it through

Tell us who handles CUI, where it comes from and what your contracts say. We’ll walk through enclave and full migration side by side.

Book a free 15-minute scoping call.

We waive the setup fee when you sign up for managed services for 48 months.