Microsoft sells Microsoft 365 in three cloud environments: Commercial, Government Community Cloud (GCC), and GCC High. They look almost identical to an end user, but they differ sharply in where data lives, who can touch it, and which regulatory commitments Microsoft will put in a contract. For a construction general contractor, an engineering firm, or a mining operator that has just been handed a defense subcontract with compliance flow-downs, picking the wrong environment is expensive in both directions. This guide defines each tier, compares them side by side, and walks through the real decision: does your specific data actually require GCC High, or will a lower tier meet the requirement.
What Is GCC High?
Microsoft 365 GCC High is a physically and logically separate version of Microsoft 365 that runs in Microsoft's Azure Government cloud. It is designed for the Defense Industrial Base and cabinet-level agencies that handle highly sensitive data. Three properties define it: data is stored exclusively on servers in the continental US (CONUS), access and support are restricted to screened US citizens, and the tenant is separated from Microsoft's commercial infrastructure. Critically, GCC High is the only Microsoft 365 environment where Microsoft will commit to ITAR contract language. That contractual commitment, more than any single technical control, is what forces the GCC High decision for contractors handling export-controlled data.
Who Must Use GCC High: The Eligibility Checklist
You do not choose GCC High because it sounds safer; you choose it because a specific obligation in your contract requires it. Work through this checklist. If any item applies, GCC High is the Microsoft 365 environment built for your situation:
- ITAR or EAR export-controlled technical data. If you receive, create, or store technical data controlled under the International Traffic in Arms Regulations or the Export Administration Regulations, GCC High is the only Microsoft 365 tier where Microsoft commits to ITAR contract language and restricts access to screened US persons.
- DFARS 252.204-7012 flow-down covering CUI. The clause requires cloud services that meet the FedRAMP Moderate baseline or equivalent. Standard GCC can satisfy this for basic CUI, but if your CUI is export-controlled or your prime requires US-only handling, the requirement effectively lands on GCC High.
- CMMC 2.0 Level 2 or higher with CUI in scope. CMMC itself names no cloud, but Microsoft's own guidance points defense contractors handling CUI toward GCC High for Level 2 and Level 3 assessments, especially when any CUI-Specified category (like export-controlled data) is present.
- FedRAMP High requirements. If your contract, prime, or agency customer requires services assessed at the FedRAMP High baseline, GCC High is the Microsoft 365 environment operated in Azure Government at that level. Commercial and GCC top out at FedRAMP Moderate for CUI purposes.
- US-persons-only access clauses. Some subcontracts require that only US citizens on US soil can access project data, independent of any named framework. Only GCC High guarantees screened US-citizen support and operations personnel.
If none of these apply, you likely do not need GCC High, and paying its premium buys you nothing an assessor will credit. The comparison below shows what each tier actually delivers.
Commercial vs GCC vs GCC High: Side-by-Side
| Factor | Commercial | GCC | GCC High |
|---|---|---|---|
| Built for | All businesses | US state, local, federal civilian, and CUI Basic | Defense Industrial Base, ITAR/EAR data |
| Data residency | Commingled global infrastructure | US-stored, but on Azure Commercial infrastructure | Exclusively CONUS, isolated from commercial |
| Personnel access | Global Microsoft support | US-based, but some global shared services | Screened US citizens only |
| FedRAMP level | FedRAMP Moderate for many services; not authorized for CUI | FedRAMP Moderate | FedRAMP High |
| DFARS 7012 / CMMC L2 for CUI | No (CMMC Level 1 / FCI only) | Yes, for basic (non-export-controlled) CUI | Yes, including CMMC L2 and L3 |
| ITAR / EAR export-controlled data | No | No | Yes (Microsoft commits to ITAR language) |
| Feature availability | Full feature set, newest features first | Most features; some arrive later than Commercial | Core workloads solid; new features (Copilot, some Teams capabilities) arrive on a delayed schedule, and some consumer-connected features never ship |
| Typical price vs Commercial | Baseline | ~15 to 30% higher | ~50 to 70% higher |
| How you buy it | Direct or any partner | Approved government/CSP partner | Approved licensing partner only, with validation |
The Three Environments Explained
Commercial is the everyday Microsoft 365 the vast majority of businesses run. Data sits on commingled global infrastructure and Microsoft does not offer it as FedRAMP-authorized for CUI. It is the right tier for a business that handles only Federal Contract Information (FCI) and is targeting CMMC Level 1, or that has no defense obligations at all.
GCC keeps customer data in the US and is FedRAMP Moderate authorized, so it can support DFARS 252.204-7012 and CMMC Level 2 for CUI Basic. The catch is that GCC still runs on Azure Commercial infrastructure and relies on some global shared services (such as parts of Entra ID) that may process data outside CONUS. That makes GCC suitable for many CUI categories but not for CUI-Specified categories like export-controlled data.
GCC High is the strict tier: exclusive CONUS residency, screened US-citizen access, isolation from commercial tenants, FedRAMP High, and the ITAR contractual commitment. Microsoft recommends GCC High for protecting CUI to CMMC Level 2 and Level 3 requirements when export control or US-only access is in play.
Does CMMC Level 2 Require GCC High?
No, not by itself. CMMC is a controls-and-assessment framework and it names no cloud. What actually drives the decision is DFARS 252.204-7012 combined with the type of CUI you handle. If your CUI is basic and not export-controlled, standard GCC can support CMMC Level 2, provided your prime contractor confirms in writing that GCC is acceptable for your data. The moment ITAR, EAR, or a US-only access requirement enters the picture, GCC High becomes the only Microsoft 365 environment that qualifies, because it is the only one where Microsoft commits to ITAR language and guarantees screened US-person access. The practical rule: read the contract and classify your data first, then pick the cloud, never the other way around.
Which One Do Construction, Engineering, and Mining Contractors Need?
These verticals rarely start out thinking of themselves as defense contractors, then a flow-down clause changes everything. A construction firm building on a military installation, an engineering firm producing export-controlled designs, or a mining or materials supplier feeding a defense program can all inherit CUI obligations through a subcontract. The pattern we see: if you receive drawings, specifications, or technical data marked export-controlled (ITAR/EAR), plan for GCC High. If you handle CUI that is sensitive but not export-controlled, get your prime to confirm whether GCC is acceptable before you pay the GCC High premium. If you only touch FCI, Commercial with strong configuration is usually enough for CMMC Level 1. When in doubt, the flow-down clause and a data-classification exercise settle it, not a sales pitch.
What GCC High Costs and How to Buy It
GCC High licenses typically cost 50 to 70 percent more than the equivalent Commercial licenses, while standard GCC runs roughly 15 to 30 percent more. GCC High is sold only through approved Microsoft licensing partners rather than purchased directly. Provisioning involves an eligibility validation that can take weeks, because Microsoft verifies your organization qualifies (DoD contractor status, ITAR registration, or a documented CUI requirement). Budget for the migration itself as well: moving mailboxes, files, and identities from a Commercial tenant into GCC High is a project, not a license swap, and there is no in-place upgrade path between the clouds. For the underlying Microsoft 365 apps and plans that carry across all three tiers, see our guide to Microsoft 365 apps, tools, and benefits.
GCC High Pricing in 2026: Approximate Per-Seat Ranges
Microsoft does not publish a public GCC High price list. Licenses are quoted by approved licensing partners, and the quote varies with seat count, term, and partner. The ranges below are approximate budgeting figures based on the typical 1.4x to 1.7x premium over published Commercial list pricing. Treat them as planning numbers, not quotes: all GCC High pricing is approximate, contact a licensing partner (or talk to us) for a real quote.
| Plan | Commercial list (published) | GCC High (approximate range) |
|---|---|---|
| Microsoft 365 E3 | $36/user/month | ~$50 to $60/user/month |
| Microsoft 365 E5 | $57/user/month | ~$80 to $95/user/month |
| Microsoft 365 F3 (frontline) | $8/user/month | ~$12 to $15/user/month |
| Microsoft 365 Business Premium | $22/user/month | Not offered in GCC High; map to E3 plus security add-ons |
Two budgeting realities catch small contractors off guard. First, GCC High offers only Enterprise (E1/E3/E5) and Frontline (F3) plans, so a 25-person subcontractor comfortable on Business Premium is re-quoted onto E3-class licensing, which raises the per-seat delta beyond the headline multiplier. Second, the license is not the whole cost: budget for the one-time migration project, ongoing compliance configuration, and device management. On that last point, endpoint enrollment and configuration baselines ride on Intune, and the plan tier matters for CMMC controls; our Intune Plan 1 vs Plan 2 comparison breaks down which tier covers what.
The Migration Path: From Eligibility to Managed Operation
Getting into GCC High is a gated, multi-step process, not a checkout page. Plan it as four stages:
- Eligibility validation. Microsoft verifies that your organization qualifies before a tenant can be provisioned. Evidence is typically an active DoD contract or subcontract with the relevant flow-downs, ITAR registration, or a documented CUI requirement. Validation commonly takes one to several weeks.
- Tenant procurement. GCC High is sold only through approved channels: an AOS-G licensing partner for small and mid-size organizations, or an Enterprise Agreement for large seat counts. Your partner submits the validation, provisions the tenant in Azure Government, and quotes licensing.
- Migration. There is no in-place upgrade between clouds, so mailboxes, OneDrive and SharePoint files, Teams data, and identities move tenant-to-tenant with migration tooling. Expect cutover planning, a communication plan, and re-enrollment of devices.
- Managed operation. The tenant then has to stay compliant: Conditional Access, Intune baselines, audit logging, DLP for CUI, and the documentation an assessor will ask for. This is ongoing work, not a one-time setup.
This is the stage where most small defense subcontractors need a partner. Unió Digital helps Arizona defense contractors and subcontractors work through eligibility validation, procurement, migration, and the managed operation that follows, as part of our small business IT services and managed Microsoft services. GCC High eligibility assessment and migration planning are a named offering within our Microsoft consulting services, and every engagement starts with requirements before anyone buys licenses. If a flow-down just landed on your desk, contact us before you buy licensing in the wrong cloud.
How to Decide
Work the decision in this order. First, classify your data: FCI only, CUI Basic, or CUI-Specified (export-controlled). Second, read the exact compliance language in your contract or flow-down. Third, confirm with your prime what environment they will accept in writing, because their acceptance is what an assessor relies on. Only then choose the tier. Getting the sequence right avoids the two expensive mistakes: paying the GCC High premium when GCC would have satisfied the requirement, or landing a contract you cannot legally service because you provisioned Commercial. For the broader managed Microsoft and compliance picture, see our managed Microsoft services, our project-based Microsoft consulting services, and our primer on IT compliance for business. If you are also weighing platforms entirely, our Microsoft 365 vs Google Workspace comparison covers the non-defense decision.
Frequently Asked Questions
Do I need GCC High for CMMC 2.0?
Not automatically. CMMC 2.0 names no cloud. GCC High is required when you handle export-controlled CUI (ITAR or EAR) or your contract mandates US-only access. For basic, non-export-controlled CUI, standard GCC can support DFARS 252.204-7012 and CMMC 2.0 Level 2 if your prime contractor confirms in writing that GCC is acceptable for your data.
What is the difference between GCC and GCC High?
GCC keeps data in the US and is FedRAMP Moderate, but it runs on Azure Commercial infrastructure and uses some global shared services, so it fits CUI Basic but not export-controlled data. GCC High runs in Azure Government with exclusive CONUS data residency, screened US-citizen access, FedRAMP High, and the ITAR contractual commitment, making it the tier for export-controlled CUI and CMMC Level 2 or 3.
Can I meet CMMC Level 2 on Commercial Microsoft 365?
Only if you handle no CUI. Commercial Microsoft 365 is not FedRAMP-authorized for CUI and does not meet DFARS 252.204-7012, so it is a fit for CMMC Level 1 (Federal Contract Information only). Any contract that involves CUI generally requires GCC or GCC High depending on whether the data is export-controlled.
How much does GCC High cost per user?
GCC High licenses typically run roughly 50 to 70 percent more than equivalent Commercial licenses. As approximate 2026 budgeting ranges: Microsoft 365 E3 in GCC High runs about $50 to $60 per user per month and E5 about $80 to $95, versus published Commercial list prices of $36 and $57. Microsoft does not publish a GCC High price list, so treat these as planning numbers and get a real quote from an approved licensing partner.
Can small subcontractors buy GCC High?
Yes. There is no organization-size floor on eligibility; a small subcontractor with a qualifying requirement (a DoD subcontract with the relevant flow-downs, ITAR registration, or a documented CUI obligation) can be validated and licensed through an AOS-G partner. Note that GCC High has no Business plans, so small organizations license Enterprise plans like E3, which raises the per-seat cost compared to Business Premium.
Does Copilot work in GCC High?
Microsoft has been bringing Microsoft 365 Copilot to the government clouds on a delayed schedule relative to Commercial, and feature parity in GCC High trails the Commercial release. If Copilot or a specific AI capability is a requirement, verify its current availability in GCC High with your licensing partner before you commit, rather than assuming Commercial feature announcements apply.
How long does a GCC High migration take?
For a small or mid-size contractor, plan for one to three months end to end: eligibility validation commonly takes one to several weeks, tenant provisioning and licensing add more, and the tenant-to-tenant migration of mail, files, Teams, and devices is a project of its own. Larger or more complex environments run longer. Starting validation as soon as a qualifying contract is in sight protects the timeline.
What is AOS-G?
AOS-G (Agreement for Online Services for Government) is the licensing vehicle approved partners use to sell GCC High to small and mid-size organizations that do not have an Enterprise Agreement. Your AOS-G partner handles eligibility validation with Microsoft, provisions the tenant, and sells the licenses; you cannot buy GCC High directly from Microsoft's website.
Is Microsoft 365 Business Premium available in GCC High?
No. GCC High offers Enterprise plans (E1, E3, E5) and the F3 frontline plan only. Organizations running Business Premium in Commercial typically map to E3 plus security add-ons in GCC High, which is one reason the real-world cost delta for small businesses often exceeds the headline license premium.
Can I migrate from Commercial to GCC High later?
There is no in-place upgrade between Commercial, GCC, and GCC High. Moving to GCC High is a tenant-to-tenant migration of mailboxes, files, and identities, so it should be planned as a project. If you know a defense contract is coming, provisioning the correct tier up front avoids a disruptive migration under deadline pressure.
Sources & References
- Microsoft US Government cloud service descriptions: Microsoft Learn, Microsoft 365 US Government
- GCC vs GCC High for defense contractors: Secureframe, What Is Microsoft 365 GCC High?
- DFARS 252.204-7012: DFARS 252.204-7012, Safeguarding Covered Defense Information
- CMMC program: DoD CIO, Cybersecurity Maturity Model Certification (CMMC)
Facing a CMMC or CUI Flow-Down?
Unió Digital helps Arizona construction, engineering, and mining firms classify their data, read the requirement, and stand up the right Microsoft 365 tier. Talk to an operator-led MSP before you buy the wrong cloud.
Explore Managed Microsoft Services
