The Complete Guide to Microsoft GCC and GCC High

Five steps: know your contractual requirements, get validated and licensed, secure your environment against those requirements, migrate identities and data, and keep it compliant. This page covers the overview. The guide covers the rest.

What's Inside The Guide

Step 1: Requirements:
Quick Answer:
GCC and GCC High are Microsoft’s two government cloud tiers. GCC meets FedRAMP High and DFARS; GCC High adds DoD/DoW Security Requirements Guidelines, ITAR, and EAR, with a separately screened operating environment.

Compliance requirements vary by department, agency, and data type. The full guide walks through where the GCC/GCC High naming comes from, what CMMC and ITAR require today, and how to tell which environment meets the requirements in your contract.

Step 2: Prepare & Validation
Quick Answer:
Before you buy, Microsoft requires validation through its Government Community Cloud Eligibility Intake Form. Licensing then runs through a Microsoft partner for GCC (CSP or AOS-G) or GCC High (AOS-G)

Getting access to GCC or GCC High isn’t a normal purchase. It starts with Microsoft validating your organization’s eligibility, then routes through a specific licensing path depending on which environment you need.

Step 3 and 4: Onboarding & Migration
Quick Answer:
Migrating to GCC High means planning for higher licensing costs, stricter identity controls, and data residency requirements before touching a single user.

Once you’re validated and licensed, the work shifts to the environment itself: what to migrate, how to scope it to your CMMC level, and which security capabilities come with the license suite you choose.

Step 5: Managed Services that keep it compliant
Quick Answer:
An MSP supporting a GCC High environment doesn’t need its own CMMC certification, but if it touches CUI-in-scope systems, it has to be assessed as part of your audit, or already hold the right CMMC level itself.

Ongoing compliance is a governance problem, not a one-time project. The full guide breaks down what to check before choosing an MSP for a GCC High environment.

Credentials

Microsoft named Agile IT a Security and Compliance Partner of the Year, one of four earned Microsoft Partner of the Year awards across Security & Compliance, Modern Workplace Transformation, and Cloud Partner of the Year. Agile IT is also a Microsoft AOS-G partner and a Cyber AB Registered Practitioner Organization.

The full guide covers all five steps in the detail your team, or your assessor, will actually need: licensing mechanics, the validation walkthrough, the full migration considerations, and the managed-services checklist.

Start the Conversation

Tell us where you are and what you’re working toward.

We will respond within one buisness day.

GCC High Frequently Asked Questions

What is the difference between GCC and GCC High?

GCC (GCC) meets FedRAMP High and DFARS on Microsoft’s commercial government platform. GCC High adds DoD Security Requirements Guidelines and ITAR compliance, with a separately screened operating environment for data, access, and support staff. GCC resides on the Azure Commercial network (U.S. data residency, global networking), while GCC High resides on the Azure Government network (U.S. sovereignty for data and networking).

Do I need GCC High for CMMC?

It depends on what else applies to your contract. CMMC Level 2’s actual requirement for CUI storage is FedRAMP Moderate equivalency; GCC and GCC High both meet that natively. GCC High becomes necessary when ITAR, EAR, or DoD Security Requirements Guidelines are also in play, not from CMMC alone

What's the difference between a Direct and Indirect Microsoft licensing partner?

A Direct licensing partner, like Agile IT, is invoiced by Microsoft directly for a customer’s licenses. An Indirect partner routes through a third-party distributor, which adds another organization’s staff into your compliance boundary; ask for a custom Conditional Access policy prohibiting foreign principals if you go that route.

How do I get validated for Microsoft GCC or GCC High?

Through Microsoft’s Government Community Cloud Eligibility Intake Form. The category you select on page one determines whether you’re validating for GCC or GCC High, and which supporting information Microsoft asks for next. If you’re planning to leverage GCC through the Cloud Solutions Provider (CSP) program, you’ll want to ask your Microsoft licensing partner to go through this validation process on your behalf or in a screen-share session with you.

Does an MSP need to be CMMC certified to support a GCC High environment?

Not necessarily. CMMC defines two categories of providers: Cloud Services Providers (CSPs) and External Service Providers (ESPs). Your CSPs need to be FedRAMP Moderate Authorized or equivalent. Your ESPs will be in scope and assessed against relevant assessment objectives.

Does GCC High meet ITAR requirements?

Yes. Microsoft’s own service description states that Office 365 GCC High and DoD environments deliver compliance with International Traffic in Arms Regulations, alongside DoD Security Requirements Guidelines and DFARS.

The Five Steps Are the Same for Everyone. Which Environment You Need Isn’t.

The guide gives you the general picture: validation, licensing, migration, and managed services. A call with one of our specialists gives you the specific one, for your contracts and your environment.