You’ve probably already done some math on this. Seat count, license tier, maybe a configuration you’ve seen referenced. That work isn’t wasted, but there’s almost always something that looks different once the requirements are examined line by line. Either a gap that needs to be closed or a cost that doesn’t need to be there.
The strategy session is where that gets sorted out.
The right setup depends on three things (and you probably know one of them):
01
Your CMMC level
What CMMC level your contracts require
01
Your user count
How many users need to be in the environment
01
Your CUI Flow
How CUI flows through your organization
Those three variables determine which licenses are necessary and which aren’t.
For organizations under 500 users, the licensing math looks different than it does at scale. (And the right answer isn’t always the most expensive one.)
Agile IT reviews licensing against those variables during every new engagement and every renewal. When there’s overspend relative to your compliance level, we find it. When there’s a gap, we find that too.
GCC High isn’t available through a standard Microsoft reseller or directly from Microsoft. For organizations under 500 seats, it moves through a specific set of authorized partners called AOS-G resellers. Agile IT is one of the original six.
1 of 6
ORIGINAL AOF-G RESELLERS
<500 Seats
Restricted Purchase Channel
Because licensing requirements and platform configurations change regularly, the AOS-G partner you work with needs to stay current on what works and have the tenured experience to configure it correctly.
Few partners have that depth. Fewer still have built the volume of GCC High environments we have.
This isn’t a walkthrough of licensing options. It’s a working conversation about your environment specifically.
You’ll come in with what you know: your contracts, your user count, your current setup. Agile IT brings the variables you may not have accounted for yet. What comes out of that conversation is the right configuration at the right cost.
You leave knowing exactly what you need and why.
Tell us where you are and what you’re working toward.
We will respond within one buisness day.
No. GCC High satisfies a hosting requirement. It doesn’t satisfy NIST 800-171. Conditional access policies, audit log retention, identity governance, and CUI boundary documentation all require decisions and evidence that exist outside the platform. The environment is the foundation. Compliance is what gets built on top of it.
Not necessarily. The right license tier depends on your CMMC level, your user count, and how CUI moves through your organization. For many organizations under 500 users, the correct configuration is a lower tier than what they arrive expecting to buy. The strategy session is where that gets determined.
Most general MSPs are built around commercial Microsoft environments. GCC High is different enough in its configuration requirements that experience in commercial tenants doesn’t transfer directly. If your current MSP isn’t specialized in configuring GCC High environments specifically, that’s worth understanding before the build begins.
No. GCC High is a restricted purchase channel. For organizations under 500 seats, it’s only available through AOS-G authorized partners. Agile IT is one of them.
Both are government cloud environments, but they serve different compliance thresholds. GCC meets FedRAMP High and DFARS requirements. GCC High meets those plus ITAR and DISA SRG Level 4 controls, making it the appropriate environment for organizations handling CUI under DFARS 252.204-7012 or subject to ITAR. If you’re pursuing CMMC Level 2 and handling CUI, GCC High is typically where that conversation leads.
It depends on your contract requirements and how CUI flows through your organization. CMMC Level 2 doesn’t mandate GCC High by itself, but DFARS 252.204-7012 obligations and the nature of the CUI you handle often point there. The strategy session determines which environment is right for your specific situation.
Yes, with some differences from commercial Microsoft 365 worth knowing upfront. PSTN calling isn’t available natively and requires Direct Routing. External file sharing is restricted to other GCC High organizations. Viva Engage isn’t available in the environment. For most defense contractors these aren’t operational blockers. They’re configuration decisions that get addressed during the build.
You’ll have a clear picture of the right license configuration for your compliance level and user count. If there’s optimization available in what you’re currently carrying, that gets identified. If CMMC readiness work is the logical next step, that conversation starts here. Either way, you leave with a defined path forward, not a proposal that requires further interpretation.
You’ve done the preliminary work. Now let’s make sure what you’re building will hold up under compliance scrutiny without costing more than it needs to.
