Guide

Microsoft 365 GCC & GCC High

Government cloud licensing, compliance frameworks, and which plans are available.

TL;DR

  • GCC = FedRAMP Moderate. US data residency. For federal, state, local, and tribal government.
  • GCC High = FedRAMP High + ITAR + DFARS 7012. Isolated US sovereign infrastructure. For DoD contractors and ITAR data.
  • Pricing is not public. Government contracts go through EA, CSP, or direct Microsoft agreements.

What Is GCC?

Government Community Cloud (GCC) is a Microsoft 365 environment designed for US government organizations and their contractors. It provides the same core productivity features as commercial Microsoft 365 but with additional compliance controls.

GCC meets FedRAMP Moderate impact level requirements and ensures all data resides within the United States. Microsoft personnel accessing GCC systems undergo background screening. It's designed for organizations that handle federal data but don't require the stricter isolation of GCC High.

Who qualifies for GCC?

  • US Federal government agencies
  • State, local, and tribal government entities
  • Contractors holding or processing government data
  • Federally Funded Research and Development Centers (FFRDCs)

What Is GCC High?

GCC High is a physically isolated Microsoft 365 environment built on US sovereign infrastructure operated by screened US persons only. It meets FedRAMP High requirements and supports ITAR and DFARS 7012 compliance.

Unlike GCC, which shares some underlying infrastructure with commercial, GCC High is completely separated - different datacenters, different Active Directory, and different network. This isolation is required for organizations handling ITAR-controlled defense articles, export-controlled CUI such as Controlled Technical Information (CTI), or data subject to DFARS 7012 flow-down clauses. Many organizations choose GCC High even before they handle ITAR data, anticipating future contracts. Migrating from GCC to GCC High later is a costly tenant migration best avoided.

When GCC High is required:

  • Processing ITAR-controlled technical data or defense articles
  • Handling any export-controlled CUI, including Controlled Technical Information (CTI)
  • DFARS 252.204-7012 flow-down compliance
  • Organizations anticipating future ITAR data to avoid costly GCC-to-GCC High migration

GCC vs GCC High vs Commercial

CommercialGCCGCC High
FedRAMP LevelN/AModerateHigh
Data ResidencyGlobalUS onlyUS sovereign
InfrastructureShared globalSegregated USIsolated US
Personnel ScreeningStandardBackground checkUS persons only
ITARNoNoYes
DFARS 7012NoNoYes
CJISNoYesYes
IRS 1075NoYesYes
Public PricingYesNoNo
Feature ParityFullNear-fullReduced

Available GCC Plans

8 dedicated government plans are available in GCC, plus 2 commercial plans that also support GCC deployment.

Additionally, M365 E3, M365 E5 are also available in GCC environments.

Available GCC High Plans

11 plans are available in GCC High, covering enterprise, frontline, and business segments.

Additionally, M365 E5 is also available in GCC High environments.

Feature Availability Differences

While GCC and GCC High plans have the same feature counts as their commercial equivalents in our database, real-world availability can differ. Microsoft maintains separate feature rollout timelines for government clouds:

GCC Feature Rollout

New features typically arrive in GCC within weeks to months after commercial. Most core productivity, security, and compliance features are available. Some third-party integrations and newer AI capabilities may lag.

GCC High Feature Rollout

GCC High has the longest rollout timeline due to additional compliance validation required for the isolated infrastructure. Some features available in commercial and GCC may not be available in GCC High. Always verify against Microsoft's current service description.

Pricing

Government pricing is not publicly listed. Microsoft 365 GCC and GCC High pricing requires a government Enterprise Agreement (EA), Cloud Solution Provider (CSP) partnership, or direct Microsoft contract. Pricing varies based on agency type, volume, and contract terms.

As a general rule: GCC pricing is close to commercial. GCC High carries a premium (typically 20-40% above commercial) due to the isolated infrastructure and stricter compliance requirements.

Compliance Frameworks Supported

FedRAMP

GCC meets Moderate; GCC High meets High. Required for cloud services processing federal data.

ITAR

GCC High only. International Traffic in Arms Regulations. Controls export of defense articles and services.

DFARS 252.204-7012

GCC High only. DoD flow-down clause requiring CUI protection per NIST 800-171 and incident reporting.

NIST SP 800-171

GCC High supports compliance with 110 security requirements for protecting CUI in nonfederal systems.

CJIS

Both GCC and GCC High. Criminal Justice Information Services security policy for law enforcement data.

IRS 1075

Both GCC and GCC High. Safeguards for Federal Tax Information (FTI) handled by state agencies.

How to Get GCC / GCC High

1

Verify eligibility

GCC requires validation as a government entity or contractor. GCC High requires additional ITAR/DFARS justification. Microsoft validates eligibility before provisioning.

2

Choose a licensing channel

Enterprise Agreement (EA) for large agencies, CSP for smaller organizations, or direct Microsoft for special circumstances. A government-authorized Microsoft partner can guide the procurement process.

3

Plan the migration

Moving from commercial to GCC or GCC High is a full tenant migration, not a simple license switch. Plan for DNS changes, data migration, re-authentication, and application reconfiguration. Budget 2-6 months depending on complexity.

Frequently Asked Questions

What is Microsoft 365 GCC?
Microsoft 365 GCC (Government Community Cloud) is a cloud environment that meets FedRAMP Moderate requirements and is designed for US federal, state, local, and tribal government organizations. Data resides exclusively in the United States. GCC uses the same underlying infrastructure as commercial Microsoft 365 but with additional compliance controls and screening requirements for Microsoft personnel.
What is the difference between GCC and GCC High?
GCC meets FedRAMP Moderate and is suitable for CUI that is not export-controlled. GCC High meets FedRAMP High, ITAR, and DFARS 7012 requirements. GCC High runs on physically isolated infrastructure in US sovereign datacenters with stricter personnel screening. Use GCC when handling CUI that is not export-controlled; use GCC High when handling any ITAR or export-controlled data, including CUI categories like Controlled Technical Information (CTI).
How much does Microsoft 365 GCC cost?
Microsoft does not publicly list GCC or GCC High pricing. Government pricing is negotiated through Enterprise Agreements (EA), CSP partners, or direct Microsoft government contracts. GCC pricing is generally close to commercial pricing. GCC High carries a premium due to the isolated infrastructure and stricter compliance requirements. Contact a Microsoft government licensing partner for specific quotes.
Which licenses are available in GCC High?
GCC High offers Office 365 G1/G3/G5, Microsoft 365 G3/G5, M365 F1/F3, Office 365 F3, Microsoft 365 Business Premium, and M365 G5 Security and Compliance add-ons. The commercial M365 E5 license is also flagged as available in GCC High. Feature availability in GCC High may differ slightly from commercial. Some newer features roll out to commercial first before reaching GCC High.
Do I need GCC or GCC High for CMMC?
GCC is sufficient if you handle CUI that is not export-controlled (i.e., no ITAR data). GCC High is required if you handle any information subject to ITAR or export controls, including CUI categories like Controlled Technical Information (CTI). Many organizations choose GCC High even when they don't currently handle ITAR data because they anticipate handling it in the future. Migrating from GCC to GCC High later is a costly tenant migration, so starting in GCC High avoids paying for that move twice.
Are all Microsoft 365 features available in GCC?
Most features are available in GCC, but there can be delays in feature rollout. Microsoft publishes a service description document that details feature parity between commercial, GCC, and GCC High. Some features like certain Copilot capabilities, Power Platform connectors, and third-party integrations may have limited or no availability in government clouds. GCC High has the most restricted feature set due to its isolated infrastructure.

Related Resources