Exchange Online Protection GCC High

The Microsoft SKU for Exchange Online Protection GCCH Sub Per User is DST-00001.

Exchange Online Protection GCC High lists at $1.50/mo MSRP in GCC High. Contact Secureframe for a quote.

Secureframe is an authorized Microsoft reseller. Submit a quote request and receive your custom quote within 1 business day.

Eligibility is open to US federal, state, local, tribal, and territorial government entities and to other organizations that handle government-regulated data. Qualifying data types include CUI, ITAR/EAR-controlled technical data, DFARS 252.204-7012 covered defense information, and FBI CJIS law enforcement data. Microsoft validates each tenant via its US Gov intake before provisioning, and depending on data type may request proof of US Department of State ITAR registration or sponsorship by a government entity. DCSA sponsorship (which governs classified / IL6 environments) and an active defense contract are common misconceptions; neither is required for GCC High. Sources: Microsoft's Office 365 US Government service description and Secureframe's Microsoft GCC High guide.

Start Microsoft's US Gov eligibility request at usgovintake.embark.microsoft.com and supply supporting documents. Typical attachments include a federal contract, CAGE code or SAM.gov registration, US Department of State ITAR registration, or a government sponsor letter. Microsoft's validation team responds in 3–7 business days; full approval generally takes 10 days to 3–4 weeks, and revalidation is required at contract renewal. See our step-by-step GCC High migration guide.

GCC High meets DoD SRG Impact Level 4 (IL4) equivalency and is assessed against NIST SP 800-53 controls at FIPS 199 High Categorization. Office 365 DoD, a separate environment available only to the Department of Defense, targets IL5. Read our DFARS 7012 vs CMMC comparison for a side-by-side breakdown.

Exchange Online Protection GCC High runs in Microsoft's GCC High environment, which supports CMMC Level 2 programs for organizations handling CUI: it is FedRAMP High authorized and Microsoft accepts the DFARS 252.204-7012 contract terms. Microsoft covers the controls it operates, and your organization still implements and documents the NIST SP 800-171 controls you own. CMMC Level 2 requires a third-party C3PAO assessment every three years. Read our CMMC certification levels guide.