Commercial vs. GCC vs. GCC High: Which Microsoft Cloud Do You Need? 

Y’all. If I had a dollar every time someone asked me “can’t we just use GCC?” I could retire, buy a boat, and name it Sub-Paragraphs (c) through (g).  (I would not do this, my dad says it’s better to have friends with boats than to own a boat yourself.) 

This question comes up constantly, and it makes sense. Microsoft has a LOT of clouds. The names sound similar, the licensing is confusing, and every MSP in the DIB seems to have a different opinion. The good news is that Richard Wakeman at Microsoft keeps a long, very thorough post called Understanding Compliance Between Commercial, Government, DoD & Secret Offerings. He’s kept it updated for years, and it’s basically the source of truth on this. If you haven’t read it, go bookmark it now. I’ll wait. 

…OK, it’s long. I GOTCHU. Here’s the Maggie version, and we’re skipping the DoD and Secret clouds, because if you need those, you already know. 

The Three Clouds 

Commercial is regular Microsoft 365. It’s global, it gets new features first, and support comes from wherever in the world someone is awake. It’s great for most businesses. It was not built for US government requirements, and it probably doesn’t work for you if you’re reading this. 

GCC (Government Community Cloud) keeps your data stored in the US (data residency) and has screened US persons handling customer content. But it still shares a lot of plumbing with Commercial, including directory and authentication services that can process data outside the US.  It’s built on top of Azure Commercial, which is worldwide. 

GCC High is the sovereign cloud. It’s a separate environment, operated by screened US persons in US locations, and it’s the one where Microsoft commits to keeping data processing in the US and in US hands. That’s data sovereignty, and it’s a whole different thing from residency.  GCC High leverages Azure Government.  This is important. 

Residency vs. Sovereignty (aka the part everyone skims and shouldn’t) 

This is the crux of the whole thing, so I’m giving it its own section. 

• Data residency = where your data lives 

• Data sovereignty = who can touch it, where it’s processed, and under whose rules 

GCC gives you residency. GCC High gives you sovereignty. When you’re dealing with export-controlled information (ITAR/EAR) or the more sensitive categories of CUI, residency alone doesn’t cut it. As Richard puts it, CUI effectively requires data sovereignty. (Mic drop, Richard.) 

So what do the regulations say? 

Let’s go through the ones we care about. 

DFARS 252.204-7012: If you handle Covered Defense Information, your cloud provider has to meet FedRAMP Moderate (or equivalent) and flow down the incident reporting, forensics, and media preservation requirements, which is sub-paragraphs (c)–(g). Microsoft does not support DFARS 7012 for Commercial M365 productivity services. GCC and GCC High both do. 

ITAR/EAR: Commercial, no. GCC, no. GCC High, yes. That’s the whole list. GCC High was literally created to give contractors a US commitment for export controls. If you have ITAR data and you’re in GCC, I love you, but we need to talk. 

CUI: Here it gets murky. GCC may be fine for some CUI Basic. But CUI Specified categories like Controlled Technical Information, export-controlled data, and defense-related CUI are where GCC stops being a safe bet. GCC High covers all of it. 

CMMC: For Level 1 (FCI only), any of the three works. For Level 2 and up, where CUI comes in, Microsoft recommends GCC High. GCC is a “caveated yes,” and Commercial isn’t recommended. 

Now, the caveat to the caveat: GCC High isn’t the only road to Level 2. Solutions like PreVeil add an encrypted layer for your CUI (email and files) that sits alongside your existing Microsoft 365, which means you can meet CMMC Level 2 while staying in GCC. For some orgs, especially smaller ones where only a handful of people touch CUI, that can be a smart, cost-effective move. It’s a different architecture with its own tradeoffs, so scope it carefully, but it’s a legit option. 

“But GCC High is expensive and annoying” 

Yes. I’m not going to pretend otherwise. It costs more, some features show up later than in Commercial (because government clouds have to pass compliance gates first), and a few third-party integrations take extra work. 

But here’s the thing: moving between clouds is painful. GCC High is a separate environment, so migrating into it later means real time, real money, and real disruption. If you’re in the DIB and CUI is anywhere in your future, whether that’s a new contract, a new prime, or a new flow-down clause, picking the right cloud now is way cheaper than fixing it in the middle of a CMMC assessment (lol you will not be able to fix it mid-assessment, your assessment is getting paused until you completely redo your CMMC scope). 

And be honest with yourself about what data you have. A lot of companies say “oh, we don’t really have CUI” and then… they do. It’s in an email thread from 2019. It’s in a SharePoint folder named “Misc.” We’ve seen it. Many times. 

The Maggie Cheat Sheet 

Why this matters 

CMMC is here, and “we’ll figure it out later” is no longer a strategy. The cloud you choose becomes the foundation for your whole compliance program. It affects your SSP, your shared responsibility matrix, your assessment scope, and how much of your life you’ll lose explaining your architecture to an assessor. A bad foundation doesn’t get better by adding more policies on top of it. 

Microsoft has been very clear about where it stands. Richard’s post lays it out better than anyone, and I’d encourage every IT lead and compliance owner in the DIB to read the full thing, especially the sections on export controls and CUI. 

And if you read it and your brain feels like soup, that’s normal, and it’s exactly what we do all day at Agile IT. We’ve been moving defense contractors into GCC High for years, and we’re happy to help you figure out which cloud fits your data, your contracts, and your budget. 

LFG.