Microsoft 365 GCC High migration

The deciding factor is the data you hold and what your contracts say, not the fact that you work in defense.

You probably need GCC High if any of these is true:

• Your contract includes DFARS clause 252.204-7012 and you actually receive or create covered defense information. If that data sits in a cloud service, the clause requires the provider to meet security requirements equivalent to the FedRAMP Moderate baseline and to support DoD's incident reporting and forensics requirements. Microsoft's DFARS guidance names Office 365 U.S. Government and U.S. Government Defense as the Office 365 services that are adequate for DFARS, and its GCC High service description says the environment exists for contractors holding DoD CUI or subject to ITAR.
• You hold ITAR or EAR technical data. Export rules control who can access it. GCC High restricts access to customer content to screened US citizens, and Microsoft says GCC isn't suitable to hold CUI Specified (for example, ITAR data).
• A contract or a prime requires GCC High in writing. Then the decision is already made.

You probably don't need it if you hold only Federal Contract Information under FAR 52.204-21. Microsoft's CMMC guidance says commercial Microsoft 365 supports organizations meeting CMMC Level 1, while GCC High supports Level 2 and Level 3 when configured appropriately.

So GCC High is not the safe default. It costs more, trails commercial on some features, and fewer apps support it. With DoD CUI that trade is usually worth it. Without it, it isn't. More on the decision in GCC High or Commercial: which do you need? and what counts as CUI.

One more thing people get wrong: GCC is not a cheaper GCC High. Microsoft describes GCC as the offering for customers that don't hold FedRAMP High or DoD CUI.

GCC High is not on Microsoft's web store, and there are no trials. Microsoft validates eligibility before an environment is set up. For a private company, eligibility rests on the regulated data you hold, such as CUI or ITAR data, and Microsoft requires proof. Microsoft can also re-verify eligibility later and suspend service for customers who no longer qualify.

Nothing else can be provisioned until validation is done, so start it as soon as the decision is made. We walk through what Microsoft's validation asks for with you before the migration plan is set.

The most expensive mistake in this migration is treating it as a data move. It is a scoping exercise that happens to involve moving data.

Before anything is copied, you need to know what is CUI, where it will live, who can reach it, and how that will be evidenced. Migrate first and design the boundary afterwards and you will do the migration twice: once to get there, and once to fix what should never have been brought across.

The first scoping decision is whether everyone moves or only the people who handle CUI. Microsoft's CMMC guidance describes both. Putting all business units in GCC High gives one high bar everywhere. A smaller enclave can help manage costs compared with placing more users and workloads in GCC High. The cost of an enclave is two identities for some people and a line that has to be enforced and understood. How to choose is in GCC High enclave or full migration.

GCC High is a new tenant in Microsoft's government cloud, not a setting on the one you have. Microsoft states that cross-cloud tenant-to-tenant mailbox migration isn't supported, giving Office 365 Worldwide to Government Cloud as the example, and that its cross-tenant OneDrive migration isn't supported for GCC High users. So there is no single built-in move. Each workload is planned and moved on its own.

The work, in order:

• Confirm the need, then walk you through Microsoft's GCC High sign-up and eligibility validation.
• Design the CUI boundary: who and what is in scope, and where the line is enforced.
• Provision the GCC High tenant and licensing through an authorized channel.
• Build identity, Conditional Access, device management and logging in the new tenant. Nothing carries over by itself.
• Check every line-of-business app, add-in and integration for GCC High support. Some will not have it.
• Map external collaboration (see "What's different afterwards" below) and decide what replaces each path.
• Pilot, then migrate mail, files, Teams and identity in planned waves.
• Cut over mail routing, then retire the commercial tenant on a schedule you choose.

Use our GCC High migration checklist.

What staff will notice is in what changes for your staff.

GCC High covers mail, files, Teams and identity. File servers, databases, line-of-business apps and virtual desktops that handle the same data need a home inside the same boundary, usually Azure Government. For desktops, see Azure Virtual Desktop in Azure Government.

Azure Government runs in physically isolated datacenters and networks located only in the US, with contractual commitments to store customer data in the US and to limit potential access to systems processing customer data to screened US persons. Customers are subject to eligibility validation, and the regions are US Gov Arizona, US Gov Texas and US Gov Virginia. Microsoft notes those commitments matter for data subject to export controls. Azure Government also holds DoD Impact Level 4 and 5 provisional authorizations.

Commercial Azure also holds FedRAMP High and a third-party DFARS 7012 attestation. The US storage and screened US persons commitments are the difference.

It isn't a copy of commercial Azure. It has its own portal and endpoints, some services and features aren't available, and log data can't be moved from Azure into Azure Government. Identity can line up with GCC High, because a Microsoft Entra Government tenant can support both Office 365 GCC High and Azure Government.

We design, build and manage Azure Government environments as part of the same migration plan, with the same boundary and the same identity. We can supply the Azure Government licensing too (see Licensing). More in Azure Government for defense contractors.

Plan for these before cutover, not after:

• Sharing. Sharing SharePoint and OneDrive content with organizations in Commercial or GCC only works after both sides set up cross-cloud access. Guest access across Microsoft's cloud boundaries isn't enabled by default, and each tenant has to configure it for the other. More in sharing and Teams after moving to GCC High.
• Teams calling. PSTN Calling and Conferencing aren't available in GCC High. Phone System and Audio Conferencing are delivered through Direct Routing.
• Missing features. Viva Engage isn't available in GCC High, and Microsoft lists other differences, including Shifts and some anti-phishing capabilities that aren't yet available.
• Third-party apps. Fewer support GCC High. Anything your business depends on gets checked first.

Microsoft sells GCC High licensing only through Enterprise Agreement licensing solution providers and its AOS-G partners, not through the ordinary CSP route or web direct. Azure Government is also available only after Microsoft validates eligibility.

Cloud Kings resells three licensing programs: Microsoft 365 GCC High, Azure Government and Microsoft 365 Commercial. The government licensing comes through an authorized government channel. We pick the plan from what your obligations require, not the most complete option. Details on the GCC High licensing page.

Moving to GCC High doesn't move your obligations. Microsoft's DFARS guidance says your organization is wholly responsible for ensuring compliance with applicable laws and regulations. Your company still owns its system security plan, its scoping decisions, its people and its affirmation. Microsoft's ITAR guidance says the same about export controls: there is no ITAR certification, and the customer stays responsible. Our shared responsibility matrix sets out which of the 110 NIST SP 800-171 requirements typically sit with a provider and which stay with you. Read it before any provider quotes this work. See also CMMC compliance.

We are not a C3PAO and we do not certify anyone.

We do not quote this work before seeing your environment. How long it takes and what it costs depend on what you already have, how much of it there is, and how quickly your side can make decisions. A number produced without knowing those is a guess you would end up budgeting against.

What we will commit to is a start: work begins within five business days of signature. If a particular engagement cannot start inside that window, we say so before you sign.

We also offer managed IT services for businesses that want ongoing support. What moves the number on this migration is in what a GCC High migration costs.

• GCC High licensing
• Azure Government environment
• GCC High or Commercial: which do you need?
• Shared responsibility matrix
• Free CMMC gap indicator
• CMMC compliance
• 10 reasons to move CUI to GCC High