Do I need Microsoft 365 Commercial, GCC, or GCC High?

Updated September 29, 2026

A reseller has quoted you GCC High for all 40 seats, and the migration plan runs a quarter. Before you sign, answer one question: what will the tenant actually hold?

If you only hold FCI, stay on Commercial. If you hold technical drawings or anything export-controlled, buy GCC High. GCC fits the CUI in between: contract data that isn't technical or export-controlled.

Two terms carry the whole decision. FCI (Federal Contract Information) is the ordinary non-public paperwork of a government contract: purchase orders, delivery schedules, pricing. CUI (Controlled Unclassified Information) is information the government marks as sensitive, and for a small supplier it's usually drawings, specs, and technical data. FCI puts you at CMMC Level 1, with 15 basic safeguards. CUI puts you at Level 2, with 110 requirements, and it's the reason this question costs real money. If you don't know yet which one you hold, settle that first. Every answer below depends on it.

Most small machine shops hold drawings, which puts them in GCC High. The drawing test further down settles it for your files.

The three clouds, in plain terms

Microsoft sells Microsoft 365 (Outlook, Teams, SharePoint, OneDrive) in three versions that look almost identical on screen. The differences are underneath.

Commercial is what nearly every business runs. Microsoft positions it for Level 1 and says so in its own CMMC guidance. Microsoft and CMMC

GCC (Government Community Cloud) is a fenced-off section of Microsoft's regular cloud for government agencies and the contractors who work for them. It holds a FedRAMP High authorization, which is the government's security approval for cloud services. Microsoft staff who could reach your files must be US citizens who passed a background check. But GCC shares Microsoft's commercial sign-in system (Entra ID) with the rest of the world, and its support desk comes with no promise about where the person answering your ticket sits or what passport they hold. GCC service description

GCC High is a separate cloud built on Azure Government, physically isolated from the commercial one. Microsoft built it for "contractors holding or processing DoD controlled unclassified information (CUI) or subject to International Traffic in Arms Regulations (ITAR)." It's the only one of the three where Microsoft commits to ITAR. GCC High service description

Sources for the table: Microsoft 365 Government how to buy and Microsoft: compliance across Commercial, GCC, and GCC High.

Why Commercial stops at CUI

DFARS 252.204-7012 is the contract clause that governs CUI. Paragraph (b)(2)(ii)(D) says any cloud service that stores CUI must meet the FedRAMP Moderate baseline, or its equivalent, and must follow paragraphs (c) through (g): report incidents within 72 hours, hand over malware, preserve images for 90 days, give DoD forensic access, and help with damage assessment. DFARS 252.204-7012

Microsoft marks Commercial "No" for 7012. It also says any customer trying to prove FedRAMP equivalency on Commercial "will struggle," because its accreditation package covers GCC, not the commercial service. So when CUI lands in a Commercial mailbox, it's sitting in a cloud its own vendor won't stand behind for the clause your contract names.

The cost shows up in two places. An assessor who finds CUI in Commercial Exchange will ask for the cloud's 7012 evidence, and there isn't any. And a Level 2 score you post in SPRS (the DoD system where contractors post their security score) says you meet 7012. If CUI is sitting in Commercial when you post it, that's the kind of statement False Claims Act cases are built on.

GCC is enough more often than you've been told

For years the standard advice was "CUI means GCC High." Microsoft's position has moved. It now commits to the 7012 flow-down in GCC, paragraphs (c) through (g), backed by an auditor's attestation letter. It makes the same commitment for GCC High and Azure Government, and explicitly not for Microsoft 365 Commercial. Microsoft: compliance across Commercial, GCC, and GCC High (May 2026)

Microsoft still recommends GCC High for Level 2 and Level 3, and its own FAQ tells companies with several business units to put all of them there. The same blog admits it has customers who "chose GCC (versus GCC High), in cases where they have CUI-Basic that does not require explicit commitments to protect CUI-Specified and ITAR/EAR export-controlled data." That sentence is the honest version of the rule.

What GCC can't hold is what Microsoft calls CUI Specified, such as ITAR data. That data requires US sovereignty, meaning US persons on US soil, and Microsoft says only GCC High offers it. Microsoft and CMMC

What GCC High covers, by Microsoft's own count

Microsoft's Product Placemat for CMMC (version 2.0 Preview, published October 2024, at aka.ms/cmmc/productplacemat) grades all 110 Level 2 requirements for GCC High: Microsoft does 52, you share 57, and 1 is yours alone. It publishes no count for GCC or for Commercial Microsoft 365, so treat any GCC figure you're shown with suspicion. The 52 inherited rows cover only Microsoft's side of each requirement, its data centers, staff, and disks, and only when the tenant is licensed and configured the way the placemat assumes. The count follows the data decision, not the other way round: drawings and ITAR data go to GCC High, other CUI to GCC. What the 52 really cover, and the rows you still own.

Read the drawing, not the brochure

Here's the test we run before anyone buys a license. It takes 20 minutes and a stack of paper.

Pull five controlled documents you received this year: a drawing, a spec, a statement of work, whatever came from the prime. On the first page or cover of each, find the CUI designation block. It's a small box, usually bottom right, with lines for "Controlled by," "CUI Category," a distribution statement or dissemination control, and a point of contact. Directly under it, look for an export-control warning. DoDI 5200.48 · DTIC: marking documents

Then sort them:

1. The category says EXPT, or an export-control warning sits under the block: GCC High. That's export-controlled data. Stop debating.
2. The category says CTI (Controlled Technical Information) and there's no export warning: the hard case. Read the next section.
3. Any other category: GCC.
4. No block at all, but the contract says you'll receive CUI: ask the prime which categories are coming, in writing, before you buy anything.

One more check trumps the stack: if your subcontract says GCC High, buy GCC High. Arguing with the clause will cost you more than the licenses.

The hard case: drawings marked CTI

Most drawings a machine shop receives are CTI. The National Archives lists CTI as CUI Specified, and the authority it names is DFARS 7012 itself. NARA: Controlled Technical Information That's the argument for GCC: Microsoft commits to 7012 there, so the rule CTI points to is covered.

The argument against is Microsoft's own compliance blog, which says "many of the CUI-Specified categories to include Defense, Export Controlled, Nuclear, etc. undoubtedly require the US Sovereign cloud and are not appropriate for storage within GCC." CTI sits in the Defense group.

One thing first: no CMMC rule names a Microsoft product. The requirement is FedRAMP Moderate or equivalent for any cloud holding CUI, and some shops meet it by keeping drawings out of Microsoft 365 entirely, in a separate secure file service. If the drawings will live in Microsoft 365, though, our position is this: if CTI drawings are most of your CUI, buy GCC High, for the people who handle them. You'll be defending GCC to an assessor and a prime while Microsoft's own blog argues the other side, and the price gap narrowed when Microsoft added a small-business license to GCC High (more below). GCC fits a company whose CUI is mostly contract and program information rather than technical data, or one that has the prime's written agreement that GCC is acceptable.

Where we'd push back on the quote

If you found export-controlled markings, or the prime wrote GCC High into your subcontract, sign the quote. If you found nothing but non-technical CUI, GCC is the defensible answer and usually the cheaper one. Either way, question the seat count. GCC High for 40 seats is reasonable for a company expecting export-controlled work across every department next year. It's an expensive choice for a shop where six people open drawings and everyone else ships boxes.

GCC High also doesn't grant anyone export authorization. You still decide which employees may see ITAR data, and a foreign national on your team is an export question no license answers.

Buying it: eligibility, partners, and the small-business license

Neither government cloud is a checkout button. You first submit Microsoft's eligibility form, with proof that you hold one of the qualifying data types (CUI and ITAR are both on the list). Then you order through a partner who's allowed to sell it. How to buy

That second step catches people. Your usual reseller can probably sell GCC, which is available through the CSP partner program. GCC High is sold only through an Enterprise Agreement (the large-reseller route, 500 seats and up) or one of Microsoft's AOS-G partners (under 500 seats). If your reseller isn't on that list, it can't sell you GCC High, whatever the quote says. There are no GCC High trials.

The license question changed in late 2025. On November 3, 2025, Microsoft launched Microsoft 365 Business Premium for GCC High, "designed for organizations with fewer than 500 seats." On February 20, 2026, it added Defender and Purview add-ons for that license and said the combination provides "the required security and compliance capabilities" for CMMC. For a 20-person shop, that's usually the right starting quote. Microsoft: Business Premium for GCC High

We don't print prices here, because partners set them and they move. Get written quotes from two AOS-G partners for the same seat count, one for Business Premium with the add-ons and one for the G3 or G5 plans, and compare line by line.

What the three months actually cover

Microsoft tells customers to allow at least three months for a move to a government cloud. Microsoft and CMMC Most of that time goes to things a quote doesn't mention.

GCC High is a new tenant in a separate cloud. Every mailbox, OneDrive, SharePoint site, and Teams channel gets copied across, and every laptop gets enrolled again in the new tenant's device management. Plan a cutover weekend and a week of "where did my calendar go" questions.

Sharing works differently afterward. Microsoft says GCC High users can share SharePoint and OneDrive files only with other GCC High organizations. Teams chats and guest access with a commercial company work only after both companies turn on cross-cloud settings in Entra and set up access with each other. Entra B2B across clouds Call your three biggest customers and suppliers before cutover and ask whether they're on GCC High or willing to do that setup. The ones who aren't will get files some other way, and you want to choose that way yourself.

A few things for whoever runs the move:

• The license covers Microsoft's services only. Your backup tool, antivirus, email filter, and help-desk system each need their own FedRAMP Moderate basis if they touch CUI, and so do marketplace add-ons that read your files. What "equivalent" means
• Microsoft says its support staff sit outside the accreditation boundary in both GCC and GCC High. Never paste CUI into a support ticket or screenshot.
• Decide the tenant layout on paper before building it. What belongs in a Microsoft 365 CUI boundary walks one drawing through a tenant and names the two SharePoint settings that close most leaks.

Can you put only the engineers in GCC High?

Yes. It's called an enclave, and it can cost far less than moving the whole company. Before you commit, try to break it with a normal Tuesday:

• The estimator gets a controlled attachment in his Commercial mailbox. Can he forward it?
• A Commercial admin gets a password-reset call from an engineer. Can she do it?
• Where does the enclave's backup land?
• Can your supplier receive files from the enclave, or will engineers email them from Commercial?

Microsoft's own guidance says the most common spillage in an enclave setup runs through email. If your engineers would shuttle files between tenants every day, the enclave is small on paper and large in practice. Enclave vs. whole company

Write the decision down

Three months is a long time to find out you picked the wrong cloud, and "our consultant said GCC High" isn't a reason an assessor accepts. Paste this into your security plan and fill it in:

Cloud decision, [date]. We receive CUI from [primes or contracts]. The documents we checked carry [categories found, such as CTI with an export-control warning]. We chose [GCC High or GCC] for [number] users because [the markings or the clause that decided it]. We rejected [the other option] because [reason]. Services that touch CUI outside Microsoft: [backup, antivirus, email filter, each with its FedRAMP basis]. Approved by [name, title].

Garde1 records this decision once, during onboarding, when it asks where CUI lives and who touches it. It records each cloud service's FedRAMP basis, flags stale or missing evidence, and writes your SSP (System Security Plan, the document that describes your protected environment) from the same answers.

Common questions

Does CMMC require GCC High? No. No CMMC rule names a Microsoft product. DFARS 7012 requires any cloud holding CUI to meet FedRAMP Moderate or equivalent and the incident terms in (c) through (g), and GCC meets that. ITAR data, a prime's subcontract, or your own CTI decision is what sends you to GCC High.

Can I use Microsoft 365 Commercial for CMMC Level 2? Not for the CUI itself. You can keep Commercial for the business if the CUI lives somewhere else, such as a GCC High enclave or a virtual desktop, and never touches a Commercial mailbox or OneDrive. That arrangement lives or dies on the Tuesday test above.

Does buying GCC High make me compliant? No. Microsoft says CMMC compliance "depends on customer configuration, implementation, and operational controls." The license covers the cloud. The 110 requirements cover your settings, your laptops, your people, and your records.

Is Business Premium enough for Level 2? In GCC High, Microsoft says Business Premium plus its Defender and Purview add-ons provides the capabilities CMMC needs, for organizations under 500 seats. You still have to turn those capabilities on and keep proof that they're on.

How long does a GCC High migration take? Microsoft says to allow at least three months. Add time up front for the eligibility check and for finding a partner who's allowed to sell it.

We run Google Workspace. Do we have to switch? No. Workspace can hold CUI on Enterprise Plus with Assured Controls Plus. Google Workspace for CMMC Level 2 covers that route.