Skip to main content

Microsoft Licensing Segments

Microsoft offers different licensing segments for different types of organizations. Each segment has its own pricing, compliance certifications, and eligibility requirements. Secureframe can sell licenses across all segments — request a quote and hear back within 1 business day.

For CMMC Level 2 and 3, we generally recommend GCC High since most organizations handle ITAR or export-controlled data. Learn more about GCC High →

CommercialSecureframe Discount: 4%

Standard commercial licensing for businesses of all sizes. No government validation required. Available with monthly or annual billing commitments.

Eligibility: Available to all commercial organizations worldwide.
Learn more on Microsoft Learn
EducationSecureframe Discount: 2%

Discounted pricing for qualified academic institutions including K-12 schools, colleges, and universities. Requires Microsoft academic validation.

Eligibility: Must be a Microsoft-verified academic institution. Apply at https://www.microsoft.com/en-us/education.
Learn more on Microsoft Learn
Charity / NonprofitSecureframe Discount: 2%

Discounted pricing for verified 501(c)(3) nonprofits and charitable organizations.

Eligibility: Requires verified 501(c)(3) status or equivalent nonprofit designation.
Learn more on Microsoft Learn
GCCSecureframe Discount: 2%

Microsoft Government Community Cloud (GCC) for US federal, state, local, and tribal government entities. Data residency within the United States. Built on the commercial Azure network with data logic segregation.

Eligibility: Available to US government entities. Requires government domain validation. Apply via Microsoft Government validation.
FedRAMP Moderate
Learn more on Microsoft Learn
GCC HighAnnual Billing OnlySecureframe Discount: 2%

Azure Government-hosted environment meeting DoD SRG Level 4. Physically separated cloud infrastructure in US data centers operated by US-person-only personnel with government-level background checks. Required for DFARS 7012, ITAR, EAR, and CMMC Level 2+ with CUI beyond Basic.

Eligibility: Requires Defense Counterintelligence and Security Agency (DCSA) sponsorship or verified defense contract. Must handle CUI, ITAR, or EAR data.
CMMCFedRAMP HighNIST 800-171DFARS 7012ITAR
Learn more on Microsoft Learn
Getting started: New GCC High accounts require Microsoft validation. Complete the Microsoft Government Validation Form →
SecretAnnual Billing OnlyEstimatedSecureframe Discount: 0%

Azure Government Secret for Impact Level 6 classified workloads. Operated by cleared US personnel in accredited Secret facilities. Connected to SIPRNet.

Eligibility: Requires Defense Counterintelligence and Security Agency (DCSA) sponsorship, active Secret clearance, and IL6 ATO. Contact Secureframe for availability and pricing.
CMMCFedRAMP HighNIST 800-171DFARS 7012ITARDoD SRG IL6
Learn more on Microsoft Learn
Top SecretAnnual Billing OnlyEstimatedSecureframe Discount: 0%

Azure Government Top Secret for the most sensitive classified data. Air-gapped infrastructure with TS/SCI-level controls.

Eligibility: Requires active TS/SCI clearance and IL6+ authorization. Contact Secureframe for availability and pricing.
CMMCFedRAMP HighNIST 800-171DFARS 7012ITARDoD SRG IL6+
Learn more on Microsoft Learn

Frequently Asked Questions

What is the difference between GCC and GCC High?
GCC sits on Microsoft's commercial Azure network with data residency in the US. GCC High runs on Azure Government — a physically separated cloud with US-person-only support. GCC meets FedRAMP Moderate; GCC High meets FedRAMP High, DFARS 7012, ITAR, and CMMC Level 2+ requirements. GCC High costs approximately 60-70% more than commercial pricing.
Who qualifies for GCC High?
Defense contractors handling CUI (Controlled Unclassified Information), ITAR, or EAR data. Requires DCSA (Defense Counterintelligence and Security Agency) sponsorship or a verified defense contract. Organizations pursuing CMMC Level 2 or 3 certification should use GCC High if they handle anything beyond CUI Basic.
Do I need GCC High for CMMC Level 2?
For CMMC Level 2 and 3, we generally recommend GCC High since most organizations handle ITAR or export-controlled data, not just CUI Basic. GCC alone is suitable for CMMC Level 1 and some Level 2 scenarios (CUI Basic only), but GCC High is mandatory for DFARS 7012 with ITAR/EAR data.
How do I get approved for GCC High?
New GCC High accounts require Microsoft Government validation. Complete the intake form at usgovintake.embark.microsoft.com. You will need to verify your organization handles government-controlled data. The process typically takes 1-2 weeks.
How much does GCC High cost compared to Commercial?
GCC High typically costs 60-70% more than commercial Microsoft 365. For example, M365 E3 is $36/mo commercial vs approximately $60/mo GCC High. Microsoft 365 Business Premium for GCC High launched in November 2025 at $36/mo for organizations with up to 300 seats.
What is Microsoft 365 Business Premium for GCC High?
Launched November 2025, Business Premium for GCC High offers a lower-cost entry point ($36/user/month) for small defense contractors needing CMMC Level 2 compliance. It includes Office apps, Intune, Entra ID, Defender for Business, and Purview — up to 300 seats.
Why does GCC High cost more than GCC?
GCC High runs on Azure Government, a physically separated infrastructure with US-person-only personnel, government-level background checks, dedicated data centers, and continuous FedRAMP High monitoring. These operational requirements significantly increase costs.
Is there a free trial for GCC High?
Microsoft does not offer standard free trials for GCC High. Contact Secureframe to discuss evaluation options for your organization.
What is the difference between GCC High and DoD?
GCC High is for defense contractors and government partners. DoD tenants are for the Department of Defense itself. Both meet similar compliance requirements (IL4/IL5), but DoD environments are managed directly by the Department of Defense.
How do I buy GCC High licenses through Secureframe?
Secureframe is a Microsoft reseller. Submit a quote request from our marketplace and receive pricing within 1 business day. We handle the procurement through our authorized distribution partners and provide free technical support for setup.
What is VLSC?
VLSC stands for Volume Licensing Service Center. It is Microsoft's portal where customers download, install, and activate software purchased through volume licensing agreements. After purchasing licenses through Secureframe, you will receive instructions from Microsoft to access VLSC.
Are features different in GCC vs GCC High?
Yes. GCC High features may lag behind commercial releases by weeks or months. Some features available in commercial Microsoft 365 may have limited functionality or not be available in GCC High. Microsoft publishes a detailed service description for GCC High and DoD.

Secureframe is a Microsoft reseller offering all licensing segments with competitive pricing.

Request a Quote