Protecting Controlled Unclassified Information is complicated. Having the wrong Microsoft licensing can derail your CMMC efforts. Agile IT has licensed customers into GCC High since the AOS-G program began, matching the license to what their environment actually requires.
For organizations subject to International Traffic in Arms Regulations (ITAR), Microsoft 365 GCC High is the only Microsoft cloud that qualifies. For those pursuing CMMC, it’s often where the compliance conversation leads.
The AOS-G program was created to address these needs, supporting federal, defense, and aerospace contractors that must meet enhanced cybersecurity control requirements. It’s the framework that governs how those organizations access GCC High.
As an AOS-G partner, our mission is making sure customers get what they need, not just what they asked for.
The AOS-G program is the only way for organizations with fewer than 500 seats to purchase GCC High licensing. It runs through a modified Enterprise Agreement, which works differently from commercial licensing in several important ways covered in detail below.
Commercial Microsoft environments share infrastructure across a broader user base. They don’t meet the data residency, access control, or compliance requirements that federal contracts and regulated workloads demand. Government licensing exists to close that gap.
GCC High is a compliant Microsoft cloud environment designed to meet ITAR, DFARS, and CMMC requirements. Azure Government is a physically isolated cloud environment operated exclusively by screened U.S. personnel, built to meet federal compliance requirements including FedRAMP High and DoD Impact Level 4 and 5. Both are purpose-built for organizations operating under federal compliance obligations. Many DIB contractors need both. Azure Government subscriptions are available for a variety of use cases, including long-term logging for security and audit purposes.
Getting the licensing right across both is where mistakes carry significant financial implications.
GCC High
GCC High is a compliant Microsoft cloud environment designed to meet ITAR, DFARS, and CMMC requirements
Azure Government
Azure Government is a physically isolated cloud environment operated exclusively by screened U.S. personnel, built to meet federal compliance requirements including FedRAMP High and DoD Impact Level 4 and 5
Licenses Available
Microsoft 365 GCC High does not have an equivalent to commercial Microsoft 365 Business licensing. These licenses are insufficient to meet NIST 800-171 controls, so they are not offered. Microsoft 365 Frontline and Enterprise licenses are available and supported.
Cost
Given the additional security and compliance services provided by Microsoft, GCC High licensing costs meaningfully more than comparable commercial licensing, the added security and compliance infrastructure has a cost.
Agreement Term
Microsoft 365 GCC High is licensed via a modified Enterprise Agreement and therefore licenses must be purchased for one year at a time. During that year, licenses can be added and reassigned, but they cannot be removed.
We’ve helped thousands of organizations license, implement, and migrate to the cloud. Our blogs are excellent guides to help you understand the Microsoft sovereign clouds and how to reach compliance in Microsoft 365 GCC High and Azure Government.
Defense contractors, government agencies, and regulated organizations operating under defined compliance requirements (especially those handling CUI).
CMMC (Level 1 and Level 2), along with FedRAMP and ITAR-aligned requirements tied to Microsoft cloud environments.
Once CUI handling, audit defensibility, identity segregation, or regulatory logging expectations enter scope, commercial tenants often lack the structural alignment required. That’s where GCC High comes in, so the CUI you process is secure enough to hold contracts with the Department of War (DoW), Primes, or Sub Primes. CUI needs to be able to flow within your organization, as well as from your organization to another, securely.
Organizations supporting federal contracts or processing CUI frequently require GCC High to meet compliance expectations. Scope determines necessity, not preference.
Findings translate into structured remediation, architectural adjustments, and operational alignment, not just documentation.
Microsoft-Certified Expertise
Agile IT holds Microsoft’s GCC High-specific certifications, not just general Microsoft 365 credentials, so licensing decisions are made by people who’ve configured this environment before, not learned it on your tenant.
Collaborative Approach
Agile IT works closely with your team to understand your specific requirements and deliver solutions that fit your environment during the Microsoft 365 GCC High migration.
Continued Guidance
Customers have access to Agile IT’s Licensing Specialist throughout their agreement for help in choosing the most economical solution for their users’ needs.
Dedicated Project Management
Having a dedicated project manager aligned to your organization’s goals and timelines minimizes risk and delays, keeping the engagement on track from start to finish.
2,000+
Accounts Migrated
Thousands of organizations have chosen Agile IT for our experience and expertise in Microsoft cloud migrations.
4x
Microsoft Partner of the Year
Honored four times as Microsoft Partner of the Year in Security and Compliance, Cloud Transformation (twice), and Modern Workplace Transformation.
Founders
An Original Authorized AOS-G Partner
Agile IT was among the first six Microsoft partners authorized to sell GCC High licensing and has been doing it ever since.
Dedicated
Project Management
A dedicated project manager aligned to your organization’s goals and timelines minimizes risk and delays from start to finish.
You come in with what you know about your environment and your contracts. Agile IT brings the licensing expertise to make sense of it. The strategy session is where that conversation starts.
Tell us where you are and what you’re working toward.
CMMC doesn’t ask whether your backups restore. Most organizations read that as good news. It isn’t relief. It’s a gap in the checklist, not a gap in the risk. What CMMC Actually Checks, and What It Doesn’t NIST SP 800-171 requires protecting the confidentiality of backup CUI at storage locations,
A CMMC assessment confirms an environment on one day. The attestation that follows requires it to still be true eleven months later, backed by the weight of the False Claims Act. Documentation says one thing. The environment does another, not because anyone lied, but because systems change faster than the
Every organization we migrate into GCC High already has backups running before we touch the tenant. Almost none of them have confirmed where those backups land. That gap isn’t hypothetical. DFARS 252.204-7012 requires covered contractor information systems to implement NIST SP 800-171. Control 3.8.9 states it plainly: protect the confidentiality
Y’all. If I had a dollar every time someone asked me “can’t we just use GCC?” I could retire, buy a boat, and name it Sub-Paragraphs (c) through (g). (I would not do this, my dad says it’s better to have friends with boats than to own a boat yourself.)
Azure Government and commercial Azure aren’t different tiers of the same thing. They’re different answers to different questions. The question commercial Azure answers is: does this environment meet the security baseline the government requires. The question Azure Government answers is: does this environment also restrict who can touch it, and
Is Russia in charge now? What on earth does the DoW mean by “CMMC Phase II is paused”? July 13, 2026 – a day that will live in infamy Jk, it won’t really. This is a blip in a program roll out that has had many blips over the years.
CMMC doesn’t ask whether your backups restore. Most organizations read that as good news. It isn’t relief. It’s a gap in the checklist, not a gap in the risk. What CMMC Actually Checks, and What It Doesn’t NIST SP 800-171 requires protecting the confidentiality of backup CUI at storage locations,
A CMMC assessment confirms an environment on one day. The attestation that follows requires it to still be true eleven months later, backed by the weight of the False Claims Act. Documentation says one thing. The environment does another, not because anyone lied, but because systems change faster than the
Every organization we migrate into GCC High already has backups running before we touch the tenant. Almost none of them have confirmed where those backups land. That gap isn’t hypothetical. DFARS 252.204-7012 requires covered contractor information systems to implement NIST SP 800-171. Control 3.8.9 states it plainly: protect the confidentiality
Y’all. If I had a dollar every time someone asked me “can’t we just use GCC?” I could retire, buy a boat, and name it Sub-Paragraphs (c) through (g). (I would not do this, my dad says it’s better to have friends with boats than to own a boat yourself.)
Azure Government and commercial Azure aren’t different tiers of the same thing. They’re different answers to different questions. The question commercial Azure answers is: does this environment meet the security baseline the government requires. The question Azure Government answers is: does this environment also restrict who can touch it, and
Is Russia in charge now? What on earth does the DoW mean by “CMMC Phase II is paused”? July 13, 2026 – a day that will live in infamy Jk, it won’t really. This is a blip in a program roll out that has had many blips over the years.
