How to Get Microsoft Validation for GCC High

Beginning your move from Microsoft 365 Commercial to GCC High starts with the validation process, a fairly straight-forward three step process

• Step 1: Requesting Validation – Go to Microsoft Government General Validation page to request validation as a Category 3 entity.
• Step 2: Providing Documentation - Provide a signed contract or sponsor letter to prove eligibility.
• Step 3: Licensing GCC High - Work with an AOS-G Partner like Agile IT to submit a GCC High licensing request.

Although it may seem a simple process, we have had to step in to help many of our clients navigate the finer nuances of validation. Below is more in-depth guidance to help you navigate getting validated by Microsoft as a Category 3 entity.

The GCC High Validation Process

If you think you need GCC High, go start the validation process right now! It is not a long process, but the 3-7 business days can seem like forever if it is done wrong, and it stalls your efforts to meet compliance requirements. When applying for GCC High, it is important that you receive validation at a category 3 entity. Category 2 entities are only allowed into Azure Government, not Microsoft 365 Government Community Cloud.

Begin by filling out the general validation form here at Microsoft Government General Validation.

Unless you are a government organization, make sure you select “Customers handling government-controlled data”. You may think you are a solution provider, but that only applies to non-government solutions providers such as CSPs (Cloud Solution Providers). Trust us, your validation will be declined if you select “solution provider serving US federal, state, local or tribal government entities” and you will have to start the entire process over from scratch.

Documentation Needed for GCC High Validation

• A signed contract (inked or certified electronic) indicating the regulated data requirement as part of the delivery (direct or indirect). Please note, the data owner entity name must be visible.
• A sponsor letter specifying the regulated data requirements and the duration of the requirement, which has been signed within the last 12 months. This must be from a valid US Government entity or previously approved Category 3 entity holding the same data type, on the sponsor entity letterhead, signed by sponsor (inked or certified electronic), and specify the controlled data type (CUI, ITAR, CJIS, UCNI, etc.**).
• A Valid CAGE Code or SAM registration with DUNS. Your SAMS registration MUST be for “All Awards” and you will not receive validation if the purpose is only for Federal Assistance Awards.

Types of Controlled Information Acceptable for Microsoft GCC High Validation

• ITAR: International Traffic in Arms Regulations
• CUI: Controlled Unclassified Information (including all the CUI sub-categories)
• DoD UCNI: Dept of Defense Unclassified Controlled Nuclear Information
• DoE UCNI: Dept of Energy Unclassified Controlled Nuclear Information
• CJI / CJIS: Criminal Justice Information
• DoD IL: Dept of Defense, Impact Level
• NERC: North American Electric Reliability Corporation
• CDI: Covered Defense Information
• IRS 1075 Information - Safeguards for Protecting Federal Tax Returns and Return Information

At this time, they will also request any additional clarifications, such as phone number or address issues.

Important Considerations When Applying for GCC High Validation:

• The contract you submit must include the controlled data type you will be handling. Once RFIs and RFPs start including CMMC (Cybersecurity Maturity Model Certification) level requirements, these will also be accepted.
• If your government contracts are managed through a subsidiary, you MUST apply using the business name that manages the contracts, you cannot gain GCC High validation unless your company name is on the contracts you submit to the eligibility team.
• If you are a multi-national organization, YOU MUST use a US address when applying.
• DO NOT apply for an Azure Government Trial unless you really need it. If you already have an Azure Government tenant, be sure to inform your Microsoft AOS-G partner as early as possible. GCC High uses Azure Gov for hosting your Azure Active Directory, and if you have an existing Azure Gov tenant, this must be proclaimed during licensing to assure that your tenants are connected. Failure to do so can add unnecessary complexity to your implementation.

What GCC High Validation Looks like:

Within a few days of submitting your documentation, you will get confirmation from Microsoft either requesting different documentation or letting you know you have been validated:

GCC High Sponsorship Letter

Note that if you are using the sponsor letter to apply for Category 3 Validation, the letter must come from a recognized federal agency or an organization that is already validated as a level 3 entity. If you have multiple contractors, we suggest going for the largest one available; Raytheon is going to be much easier to clear than John’s House of Aerospace Washers.

Sample Sponsorship Letter

Help with GCC High Validation

We are here to help! As one of the top Microsoft AOS-G partners, we not only have the experience to help guide you through the process, but we also have the relationships at Microsoft to help remove roadblocks and clarify any potential issues you may face. For more information, contact Agile IT today!