Scope is the one CMMC decision you pay for twice when it is wrong. You pay once to build the boundary, and again to move it after assessment prep, a prime’s questionnaire, or your own Affirming Official finds CUI on the wrong side of it. 

Every other part of a Level 2 program inherits that boundary. The System Security Plan (SSP) describes it, the 110 NIST SP 800-171 requirements are implemented inside it, and the score your organization posts in the Supplier Performance Risk System (SPRS) speaks for it. 

The rules for drawing it are written down. They sit in 32 CFR 170.19, the DoW CIO’s CMMC Level 2 Scoping Guide, version 2.13, and Section F of the CMMC Program FAQ, Revision 2.4. Below, we apply those documents to the Microsoft environments defense contractors run. 

The Timeline Moved. The Scoping Rules Did Not. 

The Department of War suspended CMMC Phase II on July 13, 2026. However, the same release keeps every Phase I Level 2 self-assessment requirement in place, and the DoW CIO’s implementing memo states that the requirements in DFARS 252.204-7012 remain in effect. 

A Level 2 self-assessment is scoped under 32 CFR 170.19, the same section that governs a Level 2 third-party certification assessment. Moving the third-party date did not change the scope of what is assessed for a Level 2 certification nor does it change what belongs inside the certification boundary. 

In both cases, your organization draws the boundary, and your Affirming Official affirms it in SPRS under 32 CFR 170.22. In a certification assessment, a third-party assessor validates that scope; it does not set it. The affirmation is a representation to the government either way. 

Trace the Data Before You Draw the Boundary 

Scope starts with where CUI goes. The server room and the org chart come later, if at all. 

Start from the contracts carrying DFARS 252.204-7012 and list what each one delivers to you: drawings, specifications, technical data, test results. Your contract with the government or prime contractor should clearly articulate what will be considered CUI; if those details are lacking, it is worth the conversation to see if you can get more clarity. 32 CFR Part 2002  provides a general definition of what counts as CUI, and the DoW’s CUI Quick Reference Guide provides guidance on marking CUI. 

Then follow one CUI item from arrival to destruction. A drawing that comes in by email lands in a mailbox, gets saved to a OneDrive folder, syncs to a laptop, goes to a shared Teams channel for review, and prints on the plotter by the shop floor. Every system that stores, processes, or transmits CUI needs to be tracked as a CUI Asset. 

Two FAQ answers close the usual escape routes. CUI stays CUI when encrypted (B-A8), and hard-copy CUI joins the information system the moment someone scans, photographs, uploads, or emails it (C-A11). 

Scope diagrams have a long tradition of describing the network someone intended to build. The data flow describes the one that exists. 

Only Out-of-Scope Assets Need Separation 

The Scoping Guide sorts every asset into one of five categories, and the assessment treatment differs sharply between them. 

Source: CMMC Level 2 Scoping Guide v2.13, Table 1 and pages 5 to 9. 

One sentence in the guide settles an argument that keeps recurring: “Effective separation involves logically or physically separating assets and is required only for Out-of-Scope Assets.” A Contractor Risk Managed Asset does not need a dedicated network or a firewall between it and your CUI. It needs an SSP entry that holds up. 

The guide also closes the loophole in the other direction: “An asset that falls into any in-scope asset category cannot be considered an Out-of-Scope Asset.” Calling a laptop out of scope does not make it out of scope if it can reach CUI in a file share. 

And it limits the reach of the rule. In its guidance on enclaves, page 12 of the Level 2 Scoping Guide states that enterprise-wide controls do “not mean all assets across the entire OSA enterprise are automatically part of a CMMC Assessment Scope.” Your organization makes the boundary decision and has to defend it, so make that decision deliberately. 

Your Commercial Tenant Is in Scope Until Something Proves Otherwise 

In the environments we assess before a migration, CUI is more often on premises than in the cloud. Someone downloads a drawing from a government web portal and saves it to a local file share, and from then on the file share, its server, its backups, and every workstation that opens it are CUI Assets. Other organizations are not yet handling CUI at all and are preparing for the contract that will bring it. 

That matters for two reasons. The mailboxes, OneDrive accounts, SharePoint sites, and Teams chats holding CUI will be classified as CUI Assets, and the cloud service holding them has to meet DFARS 252.204-7012’s cloud requirement: security equivalent to the FedRAMP Moderate baseline (FAQ E-A1). Encrypting the files first does not change the requirement that a cloud service provider be FedRAMP moderate approved (E-A2). 

Microsoft’s own DFARS compliance documentation names Azure Government, Office 365 U.S. Government, and Office 365 U.S. Government Defense as the services where it supports the 7012 requirements that apply to cloud service providers. It makes no such statement for commercial Microsoft 365.  

So the first scoping question in a Microsoft environment is a plain one: Where do you intend to hold CUI? The answer decides whether you are scoping a stand-alone environment or planning a migration. 

There are two common answers to where it should go instead. Move the whole organization into GCC High, or move the part of it that handles CUI into a GCC High enclave and keep the commercial tenant for everyone else. We covered the second path in moving one division into GCC High. 

The Microsoft Asset Map 

This is the table we wish every organization had before its first scoping workshop. It maps common components of a Microsoft environment to the category they usually land in. Your environment decides the final answer, and the reason column is what the SSP has to say. 

An Enclave Narrows Scope When the Separation Is Real 

An enclave—or a subset of the organization that is set up to store or process CUI—puts CUI and the people who handle it inside a smaller boundary, so the rest of the organization stays outside it. In Microsoft terms that usually means establishing a GCC High tenant for the specific staff that need to handle CUI, alongside a commercial tenant for the remainder of the organization.  

The FAQ sets two rules for that design. Encryption alone does not create logical separation, because logical separation “occurs when data transfer between physically connected assets… is prevented by non-physical means such as software or network assets” (F-A3). And properly encrypted CUI can cross enterprise networking components without pulling them into scope, “so long as the enclave is otherwise logically separated” (F-A4). 

“Otherwise” is where enclaves get tested. Cross-tenant identity sync, shared administrator accounts, mail forwarding rules between tenants, and a SharePoint site shared across the boundary for convenience are each open paths that the SSP needs to account for. 

An enclave also has a running cost. Some users carry two identities and two mailboxes for accessing both the commercial tenant and the GCCH tenant. IT maintains two collaboration environments, and sooner or later a file lands in the wrong one because nobody labeled it. Aan enclave is an attractive choice because the CUI footprint is small and stable, however, you need to plan for additional overhead before the build. 

A Virtual Desktop Keeps a Laptop Out of Scope Only When It Is Configured To 

A virtual desktop is the most common way to keep unmanaged or loosely managed devices out of scope. The Level 2 Scoping Guide lists it under Out-of-Scope Assets in Table 1 (page 4): an endpoint hosting a VDI client “configured to not allow any processing, storage, or transmission of CUI beyond the Keyboard/Video/Mouse sent to the VDI client.” The CMMC Program FAQ (F-A1 and F-A2) spells out what that configuration requires: 

1. the session transmits only video, keyboard, and mouse data 

2. copy-paste, file transfers, and any other data exchange across the session are blocked on the server side, and the configuration prevents copying (including screenshots), saving, or printing CUI to the endpoint 

3. multifactor authentication to the virtual desktop server is separate from the unmanaged client, such as a hardware one-time password token or a PKI token with a PIN 

4. only authorized users reach the environment, from allowable locations 

The FAQ is equally direct about the failure case: if the configuration lets the endpoint process, store, or transmit CUI, “the endpoint will be considered a CUI Asset and is in scope of the assessment.” It also adds that “proper configuration of the VDI client must be verified.” Verification means someone checked the server-side settings and the record shows it. 

Azure Virtual Desktop and Windows 365 both expose controls for clipboard, drive and printer redirection, and screen capture protection.  Microsoft Learn pages for AVD RDP properties and screen capture protection, pulled and checked the week this publishes. We compared the two for GCC High in AVD vs. Windows 365 in GCC High. 

Your Providers Are Inside the Boundary Whether They Touch CUI or Not 

The Scoping Guide states that “an External Service Provider (ESP) can be within the OSA’s scope of CMMC requirements.” The FAQ gives the case most organizations have: one provider runs IT support, another manages security tools, and no CUI goes to either. Both “will be assessed as part of the Organization Seeking Assessment’s assessment scope against applicable security requirements,” and neither needs its own CMMC certification (E-A4). 

That puts your provider’s access model in front of the assessor. Who holds administrator rights in the tenant, how those rights are granted, and who approved the last change are questions your provider’s practices have to answer, in writing. 

Whether a provider counts as a cloud service provider depends on the contract chain. If the tenant is licensed to your organization, a provider that resells or administers it is not a CSP (E-A5). 

Agile IT is an ESP in every tenant we administer, and the same questions apply to us. A shared responsibility matrix that names who owns each requirement is how that gets answered before anyone asks. 

Every Scope Change Goes to the Affirming Official 

Scope does not stay drawn. A new contract brings new CUI, an acquisition brings a new tenant, and a new tool brings a new path for data to travel. 

The FAQ places the call on whether a change is significant with the Affirming Official, who “bears the legal and contractual risk of continued compliance” (C-A12). It gives one bright line: a requirement assessed as N/A that becomes applicable after a change requires reassessment. Adding WiFi to a system that earned its status without WiFi is the FAQ’s own example. 

For everything else, F-A5 lays out the sequence: a security impact analysis and a review of CUI flow before the change, an Operational Plan of Action during it, and an updated SSP after it. The annual affirmation under 32 CFR 170.22 then covers whatever the boundary has become. 

A Defensible Scope Is a Set of Documents 

The Scoping Guide asks for the same three things for every in-scope category: an asset inventory, treatment in the SSP, and a network diagram. Contractor Risk Managed and Specialized Assets add a description of the risk-based practices that manage them. 

The contract side matters as much. Offerors identify every CMMC Unique Identifier (UID) used to handle FCI or CUI, the UIDs “must represent the scope of the CMMC assessment,” and any system not represented by them “cannot be used to process, store, or transmit FCI or CUI during contract performance” (C-A5). 

The SSP is the anchor for all of it. Marking the SSP requirement (CA.L2-3.12.4) as Not Met produces “No CMMC Score” in SPRS (C-A10; 32 CFR 170.24). 

Common Questions About CMMC Level 2 Scoping 

Does a Level 2 self-assessment use the same scoping rules as a certification assessment? 

Yes. 32 CFR 170.19 governs scoping for both, and the Level 2 Scoping Guide applies to both. 

Is encrypted CUI out of scope? 

No. Encrypted CUI keeps the designation of its plain-text counterpart under 32 CFR Part 2002 (FAQ B-A8), and a cloud service storing it still has to meet the FedRAMP Moderate requirement (FAQ E-A2). 

Can devices that connect to a virtual desktop be out of scope? 

Yes, when the virtual desktop is configured server-side to pass only video, keyboard, and mouse data, blocks copying, saving, and printing CUI to the endpoint, and uses multifactor authentication separate from the client (Scoping Guide, Table 1; FAQ F-A1, F-A2). The configuration must be verified. 

Does our IT provider need its own CMMC certification? 

No. A provider supporting your environment is assessed as part of your scope against applicable requirements and does not need its own certification (FAQ E-A3, E-A4). 

Is every asset on our network in scope? 

No. The Scoping Guide states that a defined scope does not automatically include every asset across the enterprise. Assets left out need to meet the Out-of-Scope definition, including separation from CUI Assets. 

Does a Contractor Risk Managed Asset need to be separated from CUI Assets? 

No. Separation is required only for Out-of-Scope Assets. Contractor Risk Managed Assets must be documented in the SSP, and the assessor can check them. 

Pressure-Test the Boundary Before You Build Inside It 

Every requirement your organization implements, documents, and affirms sits inside the boundary drawn at the start. Our engineers can walk your CUI flow against the Scoping Guide and the asset map above before the build starts, so the scope your SSP describes is the one you can defend. 
 Pressure-test your CMMC scope → CMMC readiness  

If you traced one drawing from the email that delivered it to the place it lives today, how many systems would you name, and are all of them in your SSP? 

A CMMC enclave doesn’t lower your obligation. It lowers how much of your environment has to prove it. 

CMMC Level 2 applies to the systems that store, process, or transmit CUI, not to every system an organization runs. An enclave draws a hard boundary around those specific systems, so the assessment covers that boundary instead of the whole network. The controls stay identical either way. What changes is how many systems they get applied to. 

What Actually Shrinks, and What Doesn’t 

The 110 NIST SP 800-171 controls across 14 control families don’t change based on where CUI lives. An enclave doesn’t remove a single one of them. It changes the count of systems, users, and endpoints those controls get enforced on and assessed against. 

That’s the entire mechanism. Access control, encryption, and monitoring get enforced in one defined zone instead of across an entire organization, which makes the controls easier to prove and the assessment faster to complete. Reducing scope reduces cost and audit footprint. It doesn’t reduce what the requirement actually demands. 

The Boundary Has to Be Right Before Anything Gets Built 

This is the same sequencing mistake that shows up in GCC High migrations, and it shows up here for the same reason: the boundary gets treated as a detail to confirm later instead of the decision everything else depends on. 

An enclave can be virtual, physical, or hybrid, and which one fits depends entirely on how CUI actually moves through the organization, not on which option sounds simplest to stand up. Some organizations keep two accounts per person, a standard account and a separate enclave account for CUI. Others move affected users fully into the enclave so it becomes their only environment. Get the boundary wrong first, and the account model, the network segmentation, and the technology choice all inherit that mistake. 

Define the boundary before any build work starts. Everything downstream, the architecture, the deployment, the validation, only holds up if that first decision was right. 

Not Every Organization Should Build One 

An enclave fits organizations that handle a limited, specific amount of CUI, want a smaller audit footprint, and have only a handful of people who actually touch that data. 

It fits less well when CUI is embedded across most teams rather than contained to a few, when an organization would rather outsource compliance entirely than manage a boundary, or when the added licensing cost of moving a subset of users into a GCC High environment doesn’t make sense against the budget. A more restrictive security posture inside the enclave can also disrupt how those specific users work, which is a real tradeoff, not a footnote. 

When the fit isn’t there, full CMMC Level 2 compliance across the environment is the more direct path. See what that looks like before assuming an enclave is the default answer. 

The Certification Is the Advantage, Not the Enclave 

The advantage was never the enclave itself. It’s holding the certification. An enclave built on GCC High covers a significant share of the technical controls and reduces what an assessor has to review, which makes the certification more achievable and less expensive to pursue. The enclave is the path. The certification is what actually gates the contract. 

The DoW pause on Phase 2 implementation hasn’t changed any of this. The timeline moved. The underlying requirement to protect CUI, and the contract eligibility tied to it, did not. 

What It Takes to Build One Correctly 

Discovery and planning come first: identifying where CUI actually lives, how it moves, and who touches it, before any boundary gets drawn. Design follows, choosing virtual, physical, or hybrid architecture based on that discovery, not before it. Deployment builds the systems and applies the required controls against that specific scope. 

Validation tests the configuration against the defined boundary and closes gaps before an assessor finds them. Then operations takes over: monitoring, user training, and continuous evidence collection, because certification is the first step, not the finish line. Annual affirmation and re-assessment are required regardless of how clean the original build was. 

Which decision has your organization actually made, where CUI lives and what boundary that draws, and which one is still an assumption nobody’s tested yet? 

See the full enclave build process, cost guidance, and qualifying questions on Agile IT’s CMMC Enclave page. 

CMMC Enclave FAQs 

What is a CMMC enclave, and why would I need one? 

A CMMC enclave is a segmented IT environment used specifically for handling Controlled Unclassified Information. Instead of applying CMMC requirements to your entire infrastructure, an enclave limits the compliance boundary, making it faster, cheaper, and easier to meet CMMC 2.0 standards. 

Is an enclave required for CMMC certification? 

No, an enclave isn’t required, but it’s often the most efficient and cost-effective approach for organizations that only handle CUI in specific roles or departments. By using an enclave, you reduce the number of systems and users in scope for your audit. 

Can an enclave be hosted in the cloud? 

Yes. CMMC enclaves can be deployed on-premises, in a virtualized private cloud, or in a compliant public cloud environment such as Microsoft GCC High or Azure Government. The choice depends on your business needs and IT strategy. 

How long does it take to implement a CMMC enclave? 

The timeline depends on your current infrastructure, the complexity of your environment, and how much preparation has already been done. For many defense contractors, Agile IT can help plan, implement, and validate a CMMC enclave in a matter of weeks. 

What’s included in the Agile IT CMMC Enclave service? 

CUI data flow discovery and scoping, network segmentation and boundary design, deployment of compliant controls including access, encryption, and logging, user training and documentation, and ongoing support as part of a managed offering if needed. 

What makes Agile IT qualified to deliver CMMC enclaves? 

Agile IT is a four-time Microsoft Partner of the Year, one of the original six authorized AOS-G partners, and a CMMC Registered Provider Organization (RPO). 

How much does a CMMC enclave cost? 

Costs vary depending on infrastructure size, licensing, and scope. Implementing a focused enclave is usually appreciably more affordable than applying CMMC controls across an entire network. 

Microsoft built Business Premium for GCC High because most smaller contractors don’t need everything a G5 license includes. They need the specific controls CMMC Level 2 requires, and G5 is one way to get there, not the only one. 

What Business Premium for GCC High Actually Covers 

Microsoft announced Business Premium for GCC High as a purpose-built plan for organizations under 500 seats. It carries the familiar productivity stack plus foundational security: Microsoft Defender for Business, Intune, and Entra ID P1. 

On its own, that’s roughly the GCC High equivalent of a mid-tier commercial plan. It wasn’t designed to carry the full compliance load by itself. 

The Defender for GCC-H and Purview for GCC-H add-ons close that gap. Per Microsoft’s own announcement, when paired with Business Premium for GCC High, these add-ons provide the required security and compliance capabilities to support customers in meeting CMMC Level 2 requirements. That’s Microsoft’s own positioning, not a reseller’s interpretation of it. 

What G5 Still Covers That the Add-On Stack Doesn’t 

G5 includes the full Defender and Purview suites natively, along with Entra ID P2. The Business Premium plus add-on combination reaches near parity on the controls that matter for a baseline NIST SP 800-171 environment, but it isn’t identical to G5. 

Broader identity governance tooling, multi-geo data residency options, and some of the larger-scale administrative controls stay G5-exclusive. An organization running a single-site operation under 500 seats is unlikely to need most of that. An organization scaling past that ceiling, or running a more complex identity environment, will. 

The honest version of this comparison isn’t “Business Premium matches G5.” It’s “Business Premium plus the right add-ons covers what a smaller contractor’s CMMC Level 2 environment actually needs, and G5 covers that plus a layer of enterprise-scale capability most smaller contractors aren’t using yet.” 

Moving to G5 Later Isn’t a New Migration 

If an organization outgrows the 500-seat range, moving to G5 doesn’t mean standing up a new tenant. Microsoft’s own documentation on changing plans states that user data, including Exchange mailboxes and SharePoint content, is retained through the change. 

It isn’t a single click, either. Business Premium sits in a different license family than G5, so the move gets handled as a manual plan switch, not an automatic in-place upgrade. Licenses get purchased and reassigned per user. The data stays where it is. The licensing work still has to happen. 

Why This Matters Specifically for Smaller Contractors 

The 500-seat ceiling isn’t a limitation bolted on afterward. It’s the design target. Microsoft positioned this plan specifically for smaller organizations, the kind that need to meet the same federal requirements as a prime but don’t have a prime’s headcount or budget to do it: a forty-person precision parts shop, a regional engineering firm on a single defense contract, an IT team of two supporting three hundred users. 

That matters because the underlying requirement doesn’t scale down. DFARS 252.204-7012 and NIST SP 800-171 apply the same way to a 40-person machine shop as they do to a 4,000-person prime. The licensing path to meet them can scale down. The requirement can’t. 

A license that supports the requirement still isn’t the same as an environment configured to meet it. The add-ons have to be turned on, mapped to the actual controls they’re meant to cover, and verified, not just purchased. 

If your organization is under 500 seats and hasn’t compared what Business Premium for GCC High with the compliance add-ons would actually cover against your current environment, is that worth a conversation before your next renewal decides it for you? 

Business Premium for GCC High vs. G5 FAQs 

What’s included in Business Premium for GCC High by default? 

The core productivity stack plus foundational security: Microsoft Defender for Business, Intune, and Entra ID P1. It’s designed for organizations under 500 seats. 

Do the Defender and Purview GCC-H add-ons make Business Premium equivalent to G5? 

Not identical. The combination reaches near parity on the controls most smaller contractors need for a NIST SP 800-171 baseline, but G5 still includes broader identity governance and multi-geo capabilities most smaller organizations aren’t using. 

Is Business Premium for GCC High, with the add-ons, enough for CMMC Level 2? 

Per Microsoft’s own announcement, the Defender and Purview GCC-H add-ons paired with Business Premium for GCC High provide the security and compliance capabilities to support CMMC Level 2 requirements. Whether a specific environment actually meets the requirement still depends on how those add-ons are configured, not just whether they’re licensed. 

When does an organization actually need G5 instead? 

Once an organization grows past the 500-seat range, or needs enterprise-scale identity governance, multi-geo data residency, or administrative capabilities the add-on stack doesn’t reach, G5 becomes the more direct path. 

Does moving from Business Premium to G5 later require a new migration? 

No. Microsoft’s own documentation confirms user data, including mailboxes and SharePoint content, carries over through a plan change. It’s a manual license switch rather than an automatic upgrade, so licenses have to be reassigned, but the environment itself doesn’t get rebuilt.

A CMMC assessment confirms an environment on one day. The attestation that follows requires it to still be true eleven months later, backed by the weight of the False Claims Act. 

Documentation says one thing. The environment does another, not because anyone lied, but because systems change faster than the paperwork describing them. AgileThrive closes that distance on a set schedule, so the explanation is already documented before anyone asks for it. 

What AgileThrive Actually Covers 

AgileThrive is the Thrive piece of Agile IT’s three-part service family: Secure for deployment and licensing, Defend for managed cloud operations, Thrive for staying audit-ready once the environment is live and a contract depends on it. 

The work itself is specific, not a general retainer. It keeps the CUI boundary defined as systems and users change, and keeps the System Security Plan current with whatever that boundary actually looks like this quarter. Living policies and procedures get reviewed on set cadences, not drafted once and filed away. POA&M items and corrective actions move toward closure instead of accumulating. The periodic reviews CMMC Level 2 already requires happen on a documented schedule, rather than whenever someone remembers to run one. 

Not a Gap Assessment, and Not the Assessment Itself 

A gap assessment captures a single moment. AgileThrive is the ongoing structure that keeps scope, evidence, and documentation aligned with the environment between assessments, not a replacement for either. 

It doesn’t replace the C3PAO assessment. An organization still goes through that process on its own schedule. AgileThrive is what keeps the answer to “is this still true” from turning into a scramble in the weeks before that assessment comes back around. 

Who Owns What 

Agile IT owns documentation structure, evidence tracking, and review cadence within the agreed scope. The organization owns governance decisions and final sign-off on its own attestation. 

That division isn’t a formality. An accredited assessor validates evidence; they don’t guide it, generate it, or own it, and Agile IT is not a C3PAO. AgileThrive keeps the paperwork honest about the environment. It doesn’t decide what the environment should be, and it doesn’t stand in for the sign-off that has to come from inside the organization. 

How the Engagement Actually Runs 

Onboarding establishes current scope, documentation, and gaps against NIST SP 800-171 requirements. From there, open POA&M items move toward closure while documentation gets brought current, and a recurring review cycle takes over once scope, evidence, and governance actually match what the environment does. That cycle runs on a set schedule going forward, not on whoever happens to remember it’s due. 

Whose Evidence Trail Would Hold Up if Someone Asked for It Tomorrow? 

FAQ 

What actually changes between an assessment and an attestation? An assessment captures the environment at a single point in time. An attestation claims the picture from the last assessment is still accurate. Scope shifts, staff turns over, new systems come online, and policies written once sit untouched for a year. That distance is what surfaces when the next assessment, or the next attestation, asks the environment to explain itself. 

Does AgileThrive handle the periodic reviews CMMC Level 2 requires? Yes. Several CMMC Level 2 objectives require reviews that have to be performed and documented on a recurring schedule. AgileThrive runs those reviews on a set cadence, checking scope, risk, and documentation each time, with ownership explicit throughout. 

How does AgileThrive relate to Agile IT’s other services? AgileThrive is the Thrive piece of a three-part service family. Secure covers deployment and licensing. Defend covers managed cloud operations. Thrive keeps the environment audit-ready once it’s live and a contract depends on it. 

What happens first in an AgileThrive engagement? Onboarding. It establishes current scope, documentation, and gaps against NIST SP 800-171 requirements before anything else moves.

Pressure-Test Your Evidence Trail → https://agileit.com/agile-thrive/ 

Azure Government and commercial Azure aren’t different tiers of the same thing. They’re different answers to different questions. 

The question commercial Azure answers is: does this environment meet the security baseline the government requires. The question Azure Government answers is: does this environment also restrict who can touch it, and where it physically runs. Conflating the two is what sends organizations into this decision asking the wrong question. 

The Compliance Boundary Is Closer Than Most Organizations Assume 

Both environments hold a FedRAMP High Provisional Authorization to Operate from the Joint Authorization Board. Microsoft states this directly: “Both Azure and Azure Government maintain FedRAMP High P-ATOs issued by the JAB,” on top of more than 400 Moderate and High ATOs issued by individual federal agencies for in-scope services. Commercial Azure’s P-ATO covers its United States public regions specifically. Regions outside the US aren’t in that scope. 

Personnel, Not Certification, Is the Real Dividing Line 

Microsoft draws the actual line between the two environments around who can access the data, not which controls are certified. Azure Government “provides additional customer assurances through controls that limit potential access to systems processing customer data to screened US persons.” Personnel with that access undergo a Tier 3 Investigation and citizenship verification. Commercial Azure staff still pass Microsoft’s standard background checks. They don’t clear that additional bar. 

Region Is a Physical Fact, Not a Configuration Setting 

Azure Government runs from three dedicated regions: US Gov Arizona, US Gov Texas, and US Gov Virginia. The isolation is physical, not logical only: separate hardware, biometric access controls, and no direct peering with the public internet or Microsoft’s corporate network. Azure Government reaches the internet only by routing through the commercial Azure network’s transport capability. Commercial Azure’s regions carry none of those restrictions. 

The Question That Actually Decides This 

DFARS 252.204-7012(b)(2)(ii)(D) sets the real trigger. It applies “if the Contractor intends to use an external cloud service provider to store, process, or transmit any covered defense information,” and it requires that provider to meet security equivalent to the FedRAMP Moderate baseline. Nothing in that clause names Azure Government by name. 

A workload that is provably outside the CUI boundary, one that never stores, processes, or transmits covered defense information, doesn’t trigger the clause at all. Commercial Azure is defensible there, on the strength of scope, not on the strength of the platform. Since commercial Azure’s US regions already hold FedRAMP High, a level above the Moderate baseline the clause requires, a workload that does fall inside the boundary can, in principle, still meet that specific requirement on commercial Azure. 

What commercial Azure doesn’t give that workload is the personnel and physical restriction Azure Government was built around. Whether that gap matters depends on what else is riding on the contract: a prime’s flow-down requirement, a program office’s own architecture standard, or a decision the organization made and can defend on its own terms. The FedRAMP clause alone doesn’t require it. Something else usually does. 

The Misconception That Costs the Most 

Organizations tend to bring one assumption into this decision before any of the above gets discussed: that Azure Government is the requirement, rather than one way of satisfying a requirement that is really about scope and access control. That assumption skips the actual question, which is whether the workload sits inside the CUI boundary in the first place, and if it does, what specifically is asking for screened-personnel access on top of the FedRAMP baseline. 

Over-scoping into Azure Government for a workload that was never in the boundary spends budget a defensible architecture didn’t need to spend. Under-scoping a workload that is in the boundary, and assuming commercial Azure alone closes the question, leaves a gap the next assessment finds. 

Which Question Is This Workload Actually Answering? 

Is this workload storing, processing, or transmitting covered defense information, or has it been treated that way without anyone checking?