GCC High migration checklist

List every contract that carries DFARS 252.204-7012. The clause governs covered defense information, including in the cloud, and flows down to subcontracts that involve it (DFARS 252.204-7012).

Find where DoD CUI and ITAR data live today. Microsoft's GCC High is built for contractors that hold DoD CUI or are subject to ITAR (Microsoft Learn).

Check for CUI Specified, such as ITAR data. Microsoft says GCC isn't suitable to hold CUI Specified (for example, ITAR) (Microsoft Learn).

Ask your primes what they require in writing. Their flow-down terms set the bar you have to meet.

Keep CUI off commercial Microsoft 365 from today. CUI should never sit on commercial Microsoft 365, even while you plan the move.

Gather proof of eligibility. Microsoft validates eligibility before it sets up a GCC High environment, and proof is required (Microsoft Learn).

Submit Microsoft's validation form. Your organization submits it. We can walk you through Microsoft's sign-up and eligibility steps.

Don't plan on a trial. Microsoft doesn't offer GCC High trials, so testing happens in your real tenant.

Order after validation. Microsoft says to order through its account team or a qualified partner once you're validated.

Keep your eligibility evidence current. Microsoft may verify eligibility at any time and can suspend service for customers that aren't eligible.

Choose a full migration or an enclave. Microsoft's guidance describes both, and an enclave can help manage costs (full tenant or enclave).

Name every person and system inside the boundary. Assets that process, store or transmit CUI are in Level 2 scope, along with the assets that protect them (32 CFR 170.19).

Map how CUI arrives, especially by email. Microsoft says the most common spillage happens through personal storage, especially email.

Decide where file servers and CAD or ERP systems go. Microsoft lists Azure Government for FedRAMP High, DFARS 7012, IL4 and IL5 and ITAR workloads (where the environment lives). More in Azure Government for defense contractors.

Write the boundary into your SSP. In-scope assets go in your asset inventory, SSP and network diagram (shared responsibility matrix).

Stand up the Microsoft Entra Government tenant. One Entra Government tenant can support both GCC High and Azure Government identity (Microsoft Learn).

Turn on Conditional Access before users arrive. Policies can block sign-in or require MFA, a compliant device or an approved app (Microsoft Learn).

Enroll devices in Intune's government instance. Intune for GCC High is a separate instance built on Azure Government, not the commercial one (Microsoft Learn).

Check Intune feature gaps first. Microsoft lists Intune features that aren't available in GCC High, so design around them.

Set up sensitivity labels and DLP. Labels add encryption and markings, and DLP watches Exchange, SharePoint, OneDrive and Teams (Microsoft Learn).

Decide how long you keep audit logs. Audit (Standard) keeps most records 180 days by default, and the Management Activity API can feed a SIEM (Microsoft Learn).

Confirm each planned control exists in GCC High. Microsoft lists feature differences between environments (Microsoft Learn).

Inventory every app, add-in and connector. Include scanners, copiers and line-of-business apps that send mail or read files. Each one needs a GCC High check.

Repoint custom apps to government endpoints. GCC High uses graph.microsoft.us and portal.azure.us, and apps reach data only through national cloud endpoints (Microsoft Learn).

Update firewall and proxy allow lists. GCC High uses its own endpoints, such as outlook.office365.us (Microsoft Learn).

Plan phones and dial-in. PSTN Calling and Conferencing aren't available in GCC High. Teams phone and audio conferencing use Direct Routing.

Check features users rely on. Viva Engage isn't available in GCC High, and Shifts isn't either.

List outside organizations you share with, and their cloud. B2B collaboration isn't on by default across national cloud boundaries (Microsoft Learn).

Enable cross-cloud access on your side. GCC High can invite Commercial or GCC guests only after you enable cross-tenant connections with that cloud (Microsoft Learn).

Ask each partner to configure their side. The other organization has to set it up too, or sharing fails. Our guide to sharing and Teams after moving to GCC High includes a checklist to send them.

Tell users how cross-cloud guests work. People from the other cloud join as B2B guests, not as regular users.

Plan each workload's move on its own. Cross-cloud mailbox migration isn't supported, and cross-tenant OneDrive migration isn't supported for GCC High users (Microsoft Learn).

Clean up data before it moves. Less data means less to move, label and check. Data volume is one of the nine buckets in what drives GCC High migration cost.

Run a pilot with IT and one small team. Find sign-in, device and app problems before everyone sees them.

Group everyone else into waves. Move by team and data so the help desk isn't flooded at once.

Brief each wave before it moves. Users get a new sign-in, a new Outlook profile and new Teams links.

Create users and mailboxes in GCC High first. Microsoft says to add users and mailboxes before you update MX so mail keeps flowing (Microsoft Learn).

Lower DNS TTLs ahead of the change. Shorter TTLs make the switch, and any rollback, take effect sooner.

Free the domain in the commercial tenant. Before removal, no users, mailboxes, groups or admin sign-ins can still use it (Microsoft Learn).

Switch MX and mail DNS to the GCC High values. Remove the old MX record, or set it to a lower priority, so mail reaches the new tenant.

Test mail in and out, then run a final sync. Catch anything sent to the old tenant during the change.

Write a rollback plan before cutover. If mail fails, everyone should know who switches what back.

Keep the old tenant read-only until checks pass. Confirm every mailbox, site and file arrived before anything is deleted.

Export the commercial logs you need to keep. Logs can't be moved from Azure to Azure Government.

Remove CUI from commercial and record it. An asset is out of scope only if it can't process, store or transmit CUI.

Cancel licenses you no longer need. In an enclave, some people keep commercial licenses.

Update your SSP, asset inventory and network diagram. They have to match the environment you now run.