Guide
Microsoft 365 GCC & GCC High
Government cloud licensing, compliance frameworks, and which plans are available.
TL;DR
- • GCC = FedRAMP Moderate. US data residency. For federal, state, local, and tribal government.
- • GCC High = FedRAMP High + ITAR + DFARS 7012. Isolated US sovereign infrastructure. For DoD contractors and ITAR data.
- • Pricing is not public. Government contracts go through EA, CSP, or direct Microsoft agreements.
What Is GCC?
Government Community Cloud (GCC) is a Microsoft 365 environment designed for US government organizations and their contractors. It provides the same core productivity features as commercial Microsoft 365 but with additional compliance controls.
GCC meets FedRAMP Moderate impact level requirements and ensures all data resides within the United States. Microsoft personnel accessing GCC systems undergo background screening. It's designed for organizations that handle federal data but don't require the stricter isolation of GCC High.
Who qualifies for GCC?
- •US Federal government agencies
- •State, local, and tribal government entities
- •Contractors holding or processing government data
- •Federally Funded Research and Development Centers (FFRDCs)
What Is GCC High?
GCC High is a physically isolated Microsoft 365 environment built on US sovereign infrastructure operated by screened US persons only. It meets FedRAMP High requirements and supports ITAR and DFARS 7012 compliance.
Unlike GCC, which shares some underlying infrastructure with commercial, GCC High is completely separated - different datacenters, different Active Directory, and different network. This isolation is required for organizations handling ITAR-controlled defense articles, export-controlled CUI such as Controlled Technical Information (CTI), or data subject to DFARS 7012 flow-down clauses. Many organizations choose GCC High even before they handle ITAR data, anticipating future contracts. Migrating from GCC to GCC High later is a costly tenant migration best avoided.
When GCC High is required:
- •Processing ITAR-controlled technical data or defense articles
- •Handling any export-controlled CUI, including Controlled Technical Information (CTI)
- •DFARS 252.204-7012 flow-down compliance
- •Organizations anticipating future ITAR data to avoid costly GCC-to-GCC High migration
GCC vs GCC High vs Commercial
| Commercial | GCC | GCC High | |
|---|---|---|---|
| FedRAMP Level | N/A | Moderate | High |
| Data Residency | Global | US only | US sovereign |
| Infrastructure | Shared global | Segregated US | Isolated US |
| Personnel Screening | Standard | Background check | US persons only |
| ITAR | No | No | Yes |
| DFARS 7012 | No | No | Yes |
| CJIS | No | Yes | Yes |
| IRS 1075 | No | Yes | Yes |
| Public Pricing | Yes | No | No |
| Feature Parity | Full | Near-full | Reduced |
Available GCC Plans
8 dedicated government plans are available in GCC, plus 2 commercial plans that also support GCC deployment.
| Plan | Features | Type |
|---|---|---|
| Microsoft 365 F1 (GCC) | 50 | Frontline |
| Microsoft 365 F3 (GCC) | 98 | Frontline |
| Office 365 F3 (GCC) | 98 | Frontline |
| Office 365 Government G1 | 36 | Enterprise |
| Office 365 Government G3 | 45 | Enterprise |
| Office 365 Government G5 | 78 | Enterprise |
| Microsoft 365 Government G3 | 126 | Enterprise |
| Microsoft 365 Government G5 | 186 | Enterprise |
Additionally, M365 E3, M365 E5 are also available in GCC environments.
Available GCC High Plans
11 plans are available in GCC High, covering enterprise, frontline, and business segments.
| Plan | Features | Type |
|---|---|---|
| Microsoft 365 F1 (GCC High) | 50 | Frontline |
| Microsoft 365 F3 (GCC High) | 98 | Frontline |
| Office 365 F3 (GCC High) | 98 | Frontline |
| Office 365 Government G1 (GCC High) | 36 | Enterprise |
| Office 365 Government G3 (GCC High) | 45 | Enterprise |
| Microsoft 365 Business Premium (GCC High) | 99 | Business |
| Office 365 Government G5 (GCC High) | 78 | Enterprise |
| Microsoft 365 Government G3 (GCC High) | 126 | Enterprise |
| Microsoft 365 G5 Security Add-on (GCC High) | 46 | Add-On |
| Microsoft 365 G5 Compliance Add-on (GCC High) | 23 | Add-On |
| Microsoft 365 Government G5 (GCC High) | 186 | Enterprise |
Additionally, M365 E5 is also available in GCC High environments.
Feature Availability Differences
While GCC and GCC High plans have the same feature counts as their commercial equivalents in our database, real-world availability can differ. Microsoft maintains separate feature rollout timelines for government clouds:
GCC Feature Rollout
New features typically arrive in GCC within weeks to months after commercial. Most core productivity, security, and compliance features are available. Some third-party integrations and newer AI capabilities may lag.
GCC High Feature Rollout
GCC High has the longest rollout timeline due to additional compliance validation required for the isolated infrastructure. Some features available in commercial and GCC may not be available in GCC High. Always verify against Microsoft's current service description.
Pricing
Government pricing is not publicly listed. Microsoft 365 GCC and GCC High pricing requires a government Enterprise Agreement (EA), Cloud Solution Provider (CSP) partnership, or direct Microsoft contract. Pricing varies based on agency type, volume, and contract terms.
As a general rule: GCC pricing is close to commercial. GCC High carries a premium (typically 20-40% above commercial) due to the isolated infrastructure and stricter compliance requirements.
Compliance Frameworks Supported
FedRAMP
GCC meets Moderate; GCC High meets High. Required for cloud services processing federal data.
ITAR
GCC High only. International Traffic in Arms Regulations. Controls export of defense articles and services.
DFARS 252.204-7012
GCC High only. DoD flow-down clause requiring CUI protection per NIST 800-171 and incident reporting.
NIST SP 800-171
GCC High supports compliance with 110 security requirements for protecting CUI in nonfederal systems.
CJIS
Both GCC and GCC High. Criminal Justice Information Services security policy for law enforcement data.
IRS 1075
Both GCC and GCC High. Safeguards for Federal Tax Information (FTI) handled by state agencies.
How to Get GCC / GCC High
Verify eligibility
GCC requires validation as a government entity or contractor. GCC High requires additional ITAR/DFARS justification. Microsoft validates eligibility before provisioning.
Choose a licensing channel
Enterprise Agreement (EA) for large agencies, CSP for smaller organizations, or direct Microsoft for special circumstances. A government-authorized Microsoft partner can guide the procurement process.
Plan the migration
Moving from commercial to GCC or GCC High is a full tenant migration, not a simple license switch. Plan for DNS changes, data migration, re-authentication, and application reconfiguration. Budget 2-6 months depending on complexity.