Protecting Controlled Unclassified Information is complicated. Having the wrong Microsoft licensing can derail your CMMC efforts and leave users, information, and your environment at risk. Agile IT has been navigating that complexity since the AOS-G program began, making sure customers receive the right licensing for their environment.
For organizations subject to International Traffic in Arms Regulations (ITAR), Microsoft 365 GCC High is the only Microsoft solution that qualifies. For those pursuing CMMC, it’s often where the compliance conversation leads.
The AOS-G program was created to address these needs, supporting federal, defense, and aerospace contractors that must meet enhanced cybersecurity control requirements. It’s the framework that governs how those organizations access GCC High.
As an AOS-G partner, our mission is to make sure our customers don’t just get what they want, they get what they need.
The AOS-G program is the only way for organizations with fewer than 500 seats to purchase GCC High licensing. It runs through a modified Enterprise Agreement, which works differently from commercial licensing in several important ways covered in detail below.
Commercial Microsoft environments share infrastructure across a broader user base. They don’t meet the data residency, access control, or compliance requirements that federal contracts and regulated workloads demand. Government licensing exists to close that gap.
GCC High is a compliant Microsoft cloud environment designed to meet ITAR, DFARS, and CMMC requirements. Azure Government is a physically isolated cloud environment operated exclusively by screened U.S. personnel, built to meet federal compliance requirements including FedRAMP High and DoD Impact Level 4 and 5. Both are purpose-built for organizations operating under federal compliance obligations and many DIB contractors need both. Azure Government subscriptions are available for a variety of use cases, including long-term logging for security and audit purposes.
Getting the licensing right across both is where mistakes carry significant financial implications.
GCC High
GCC High is a compliant Microsoft cloud environment designed to meet ITAR, DFARS, and CMMC requirements
Azure Goverment
Azure Goverment is a physically isolated cloud environment operated exclusively by screened U.S. personnel, built to meet federal compliance requirements including FedRAMP High and DoD Impact Level 4 and 5
Both are purpose built for organizations operating under federal compliance obligations and many DIB contractors need both. Azure Government subsciptions are available for a variety of use cases, including long term logging for security and audit purposes.
Getting the licensing right across both is where mistakes carry significant financial implications.
Licenses Available
Microsoft 365 GCC High does not have an equivalent to commercial Microsoft 365 Business licensing. These licenses are insufficient to meet NIST 800-171 controls, so they are not offered. Microsoft 365 Frontline and Enterprise licenses are available and supported.
Cost
Given the additional security and compliance services provided by Microsoft, GCC High licensing is approximately 70% more costly than comparable commercial licensing.
Agreement Term
Microsoft 365 GCC High is licensed via a modified Enterprise Agreement and therefore licenses must be purchased for one year at a time. During that year, licenses can be added and reassigned, but they cannot be removed.
We’ve helped thousands of organizations license, implement, and migrate to the cloud. Our blogs are excellent guides to help you understand the Microsoft sovereign clouds and how to reach compliance in Microsoft 365 GCC High and Azure Government.
Defense contractors, government agencies, and regulated organizations operating under defined compliance requirements (especially those handling CUI).
CMMC (Level 1 and Level 2), along with FedRAMP and ITAR-aligned requirements tied to Microsoft cloud environments.
Once CUI handling, audit defensibility, identity segregation, or regulatory logging expectations enter scope, commercial tenants often lack the structural alignment required. That’s where GCC High comes in, so the CUI you process is secure enough to hold contracts with the Department of War (DoW), Primes, or Sub Primes. CUI needs to be able to flow within your organization, as well as from your organization to another, securely.
Organizations supporting federal contracts or processing CUI frequently require GCC High to meet compliance expectations. Scope determines necessity, not preference.
Findings translate into structured remediation, architectural adjustments, and operational alignment, not just documentation.
Microsoft-Certified Expertise
Agile IT brings Microsoft-certified expertise to every GCC High licensing engagement and migration, applying proven methodologies to deliver compliant and secure outcomes.
Collaborative Approach
Agile IT works closely with your team to understand your specific requirements and deliver solutions that fit your environment during the Microsoft 365 GCC High migration.
Continued Guidance
Customers have access to Agile IT’s Licensing Specialist throughout their agreement for help in choosing the most economical solution for their users’ needs.
Dedicated Project Management
Having a dedicated project manager aligned to your business goals and timelines minimizes risk and delays, keeping the engagement on track from start to finish.
2,000+
Accounts Migrated
Thousands of organizations have chosen Agile IT for our experience and expertise in Microsoft cloud migrations.
4x
Microsoft Partner of the Year
Honored four times as Microsoft Partner of the Year in Security and Compliance, Cloud Transformation (twice), and Modern Workplace Transformation.
Founders
An Original Authorized AOS-G Partner
Agile IT was among the first six Microsoft partners authorized to sell GCC High licensing and has been doing it ever since.
Dedicated
Project Management
A dedicated project manager aligned to your business goals and timelines minimizes risk and delays from start to finish.
You come in with what you know about your environment and your contracts. Agile IT brings the licensing expertise to make sense of it. The strategy session is where that conversation starts.
Tell us where you are and what you’re working toward.
GCC High Licensing and G3 vs. G5 Start With CMMC Scope Microsoft licensing is the last decision in the chain, and it is the one most organizations make first. The contract, the data, and the Cybersecurity Maturity Model Certification (CMMC) Assessment Scope decide the Microsoft cloud and the licensing tier inside
Most CUI scope decisions get made in one meeting, by whoever is in the room, and documented afterward to match. That boundary holds until a C3PAO asks who justified it. The designating agency decides what qualifies. Data flow decides what’s in scope. The Microsoft environment follows both, not the reverse.
Assessment failures rarely start with missing controls. They start with decisions no one wrote down. CMMC Level 2 assessments that stall inside a Microsoft environment tend to start from the same baseline, not a shortage of controls. Conditional access is enforced, audit logging is active, and identity governance is running
Phase II certification is paused. DFARS 252.204-7012, 7019, and 7020 are not. Self-assessments, SPRS scores, and 72-hour incident reporting remain contractually binding, and with no assessor in the room, the accuracy of your score matters more, not less.
CMMC Level 1 and Level 2 don’t follow the same logic, and treating them as steps on the same ladder is where scoping goes wrong. This guide breaks down what triggers each level, how the assessments differ, and the decisions defense contractors need to make before either one gets scheduled.
Learn how defense contractors can perform secure tenant-to-tenant migrations while protecting CUI and meeting DFARS and CMMC requirements.
GCC High Licensing and G3 vs. G5 Start With CMMC Scope Microsoft licensing is the last decision in the chain, and it is the one most organizations make first. The contract, the data, and the Cybersecurity Maturity Model Certification (CMMC) Assessment Scope decide the Microsoft cloud and the licensing tier inside
Most CUI scope decisions get made in one meeting, by whoever is in the room, and documented afterward to match. That boundary holds until a C3PAO asks who justified it. The designating agency decides what qualifies. Data flow decides what’s in scope. The Microsoft environment follows both, not the reverse.
Assessment failures rarely start with missing controls. They start with decisions no one wrote down. CMMC Level 2 assessments that stall inside a Microsoft environment tend to start from the same baseline, not a shortage of controls. Conditional access is enforced, audit logging is active, and identity governance is running
Phase II certification is paused. DFARS 252.204-7012, 7019, and 7020 are not. Self-assessments, SPRS scores, and 72-hour incident reporting remain contractually binding, and with no assessor in the room, the accuracy of your score matters more, not less.
CMMC Level 1 and Level 2 don’t follow the same logic, and treating them as steps on the same ladder is where scoping goes wrong. This guide breaks down what triggers each level, how the assessments differ, and the decisions defense contractors need to make before either one gets scheduled.
Learn how defense contractors can perform secure tenant-to-tenant migrations while protecting CUI and meeting DFARS and CMMC requirements.
The strategy session is where that work begins.
