What a GCC High migration costs, and what drives it

Short answer

We won’t publish a figure for a GCC High migration, and we’d be wary of anyone who does without seeing your environment. What we can give you is the list of things you’re actually paying for, and the one decision that moves nearly all of them: whether everyone moves into GCC High or only the people who handle CUI.

If your company handles DoD CUI or ITAR data, Microsoft’s guidance points you to GCC High. CUI should never sit on commercial Microsoft 365. Getting to GCC High is a move into a separate tenant in Microsoft’s government cloud, not an upgrade to the one you have. That’s why the cost is shaped less by headcount than by what you move, what you rebuild and what you leave behind.

Why we won’t publish a number

Search for this and you’ll find confident figures that can’t all be right. A small office with clean data and a handful of people touching CUI and a manufacturer with CAD servers, an ERP system and CUI in three departments are both “GCC High migrations.” They aren’t comparable projects, and one published figure would mislead at least one of them.

So instead of a number, here are the nine buckets a proposal should separate out. If two quotes are far apart, one of these almost always explains it.

1. Licensing: eligibility-gated, through a government channel

GCC High isn’t sold on Microsoft’s web store, and there are no trials. Microsoft validates eligibility first, and a private company has to show it holds regulated data such as CUI or ITAR data. Licensing is then bought through Microsoft’s government licensing channels, not the ordinary commercial route. Microsoft can also re-verify eligibility later.

What moves this bucket:

• How many people need a GCC High license.
• Whether some of them also keep a commercial license. In an enclave, some people may need both.
• Which plan your obligations actually require, rather than the most complete option.

GCC High is a recurring cost, not a one-off. That matters more for budgeting than the first invoice.

2. Tenant build and hardening

Nothing carries over from your commercial tenant by itself. Identity, Conditional Access, device management, logging, sensitivity labels and data loss prevention are all built again in the new tenant. Intune for GCC High runs as a separate instance built on Azure Government, with its own list of features that aren’t available.

What moves this bucket: how many policies, devices and admin roles you have, how much of today’s configuration is documented, and how many controls you need to evidence for your system security plan.

3. Data volume and the workloads being moved

This is where tooling assumptions break. Microsoft doesn’t support cross-cloud tenant-to-tenant mailbox migration, and gives Office 365 Worldwide to Government Cloud as the example. Its cross-tenant OneDrive migration isn’t supported for GCC High users. So there’s no single built-in move. Each workload is planned and moved on its own.

What moves this bucket:

• How many mailboxes, SharePoint sites, Teams and OneDrives move.
• How much data sits in each, and how much of it should move at all.
• Whether old data with CUI in it has to be found and cleaned out of the commercial side.

4. Third-party app replacements

Every line-of-business app, add-in and integration has to be checked for GCC High support. Custom apps have to reach your data through government endpoints such as graph.microsoft.us, not the commercial ones. Some apps won’t support GCC High at all, and Microsoft lists features that differ or aren’t available, such as Viva Engage and Shifts.

What moves this bucket: how many apps touch your Microsoft 365 data, and how many of those need a replacement, a reconfiguration or a workaround.

5. Teams calling and Direct Routing

PSTN Calling and Conferencing aren’t available in GCC High. Teams phone and audio conferencing are delivered through Direct Routing. If your people make and take calls in Teams today using Microsoft’s calling plans, that has to be redesigned.

What moves this bucket: how many users need a phone number, how many sites and numbers you port, and whether you need audio conferencing.

6. Azure Government for servers

GCC High covers mail, files, Teams and identity. File servers, databases, CAD and ERP systems and virtual desktops that handle the same CUI need a home inside the same boundary, usually Azure Government. Azure Government runs in physically isolated US datacenters, with commitments on US data storage and access limited to screened US persons. It also holds DoD Impact Level 4 and 5 provisional authorizations.

It isn’t a copy of commercial Azure. It has its own portal and endpoints, some services aren’t available, and logs can’t be moved from Azure into Azure Government. Eligibility is validated here too.

What moves this bucket: how many servers and workloads handle CUI, and whether they move as they are or get rebuilt.

7. User disruption and training

Everyone in scope gets a new sign-in, a new mailbox and, in many cases, re-enrolled devices. Some features they rely on today may not exist in GCC High.

What moves this bucket: how many people move, how many have two accounts afterwards, and how much help desk support you plan for cutover.

8. Running two tenants during coexistence

Until the commercial tenant is retired, you pay for and secure both. Sharing between the two clouds isn’t on by default. GCC High can work with organizations in Commercial or GCC only after both sides set up cross-cloud access, and people on the other side join as guests.

In an enclave, coexistence never ends. Two tenants means two sets of policies, two sets of logs and a boundary you keep proving.

What moves this bucket: how long both tenants run side by side, and how many external partners you need cross-cloud access with.

9. Ongoing management

The migration ends. The environment doesn’t. Policies drift, staff join and leave, Microsoft changes features, and your evidence has to stay current. This is the line most proposals underweight, and it decides what the environment costs to keep.

What moves this bucket: how much you manage in-house, how many tenants you run, and how much evidence your assessment requires.

The biggest lever: full migration or enclave

Most of the nine buckets scale with one decision. If only a small, well-defined group handles CUI, a GCC High enclave can help manage costs compared with placing more users and workloads in GCC High. Fewer licenses, fewer mailboxes, fewer devices and fewer apps to check.

The trade is real. Enclave users carry two identities, coexistence becomes permanent, and the boundary has to hold in configuration, not just on a diagram. If CUI arrives by email to whoever a customer writes to, an enclave gets hard to defend. Moving everyone gives you one high bar and no line to police.

We cover the decision in detail in GCC High enclave or full migration.

Other levers worth knowing:

• Starting early. Eligibility validation comes before anything can be provisioned. Starting before a contract deadline is the largest saving within your control.
• A clean commercial tenant. Documented policies and known data make the rebuild smaller.
• Moving less. Old data that doesn’t need to come across shouldn’t.

How we scope it

We don’t quote a GCC High migration before seeing your environment. A number produced without knowing your users, data, apps and contracts is a guess you’d end up budgeting against.

Scoping starts with your data and your contracts. We look at who handles CUI, where it comes from, what lives in your tenant today, which apps and servers touch it, and how you make calls. That’s what turns the nine buckets into a real proposal. If you’d rather work through the move yourself first, use our GCC High migration checklist.

We walk you through Microsoft’s GCC High sign-up and eligibility procedure, and your organization submits it. Cloud Kings resells Microsoft 365 GCC High, Azure Government and Microsoft 365 Commercial licensing through an authorized government channel. Work begins within five business days of signature.

The full sequence is on our Microsoft 365 GCC High migration page, licensing details are on our GCC High licensing page, and how we approach pricing in general is in what it costs. If CMMC is the reason you’re moving, see what CMMC Level 2 costs.

Questions worth putting to any quote

• Did you assume everyone moves, or an enclave?
• Is licensing in the number, and for how many people?
• How are mail and OneDrive being moved, given Microsoft’s own cross-tenant tools don’t cover this move?
• Which of our apps did you check for GCC High support?
• Is Teams calling and Azure Government included?
• What does the environment cost to run after cutover?

Talk it through

Tell us who handles CUI, what your contracts say and what you run today. We’ll go through the nine buckets against your environment.

Book a free scoping call.

We waive the setup fee when you sign up for managed services for 48 months.