Microsoft Licensing Segments

GCC sits on Microsoft's commercial Azure network with data residency in the US. GCC High runs on Azure Government, a physically separated cloud with US-person-only support. GCC meets FedRAMP Moderate; GCC High meets FedRAMP High, DFARS 7012, ITAR, and CMMC Level 2+ requirements. GCC High costs approximately 60-70% more than commercial pricing.

Eligibility is open to US federal, state, local, tribal, and territorial government entities and to other organizations that handle government-regulated data, including CUI, ITAR/EAR-controlled technical data, DFARS 252.204-7012 covered defense information, or FBI CJIS law enforcement data. Microsoft validates each tenant via its US Gov intake before provisioning, and depending on data type may request proof of US Department of State ITAR registration or sponsorship by a government entity. DCSA sponsorship (which governs classified / IL6 environments) and an active defense contract are common misconceptions, neither is required for GCC High. Sources: https://learn.microsoft.com/en-us/office365/servicedescriptions/office-365-platform-service-description/office-365-us-government/office-365-us-government, https://secureframe.com/blog/microsoft-gcc-high

GCC High is Microsoft's recommended environment for CMMC Level 2 and Level 3, the service description positions it as providing "necessary inheritance for CMMC," and Microsoft will only agree to ITAR contract language for the GCC High environment. GCC alone is suitable for CMMC Level 1 and some Level 2 scenarios (CUI Basic only). GCC High is not strictly mandated by CMMC, but it is the most defensible path when CUI Specified or ITAR/EAR data flows through Microsoft 365. More: https://secureframe.com/blog/is-gcc-high-required-cmmc

Start Microsoft's US Gov eligibility request at usgovintake.embark.microsoft.com and supply supporting documents, typically a federal contract, CAGE code or SAM.gov registration, US Department of State ITAR registration, or a government sponsor letter. Microsoft's validation team responds in 3–7 business days; full approval generally takes 10 days to 3–4 weeks, and revalidation is required at contract renewal. Step-by-step: https://secureframe.com/blog/gcc-high-migration-guide

GCC High typically costs 60-70% more than commercial Microsoft 365. For example, M365 E3 is $36/mo commercial vs approximately $60/mo GCC High. Microsoft 365 Business Premium for GCC High launched in November 2025 at $36/mo for organizations with up to 300 seats.

Launched November 2025, Business Premium for GCC High offers a lower-cost entry point ($36/user/month) for small defense contractors needing CMMC Level 2 compliance. It includes Office apps, Intune, Entra ID, Defender for Business, and Purview, up to 300 seats.

GCC High runs on Azure Government, a physically separated infrastructure with US-person-only personnel, government-level background checks, dedicated data centers, and continuous FedRAMP High monitoring. These operational requirements significantly increase costs.

Microsoft does not offer standard free trials for GCC High. Contact Secureframe to discuss evaluation options for your organization.

GCC High is for defense contractors and government partners. DoD tenants are for the Department of Defense itself. Both meet similar compliance requirements (IL4/IL5), but DoD environments are managed directly by the Department of Defense.

Secureframe is a Microsoft reseller. Submit a quote request from our marketplace and receive pricing within 1 business day. We handle the procurement through our authorized distribution partners and provide free technical support for setup.

VLSC stands for Volume Licensing Service Center. It is Microsoft's portal where customers download, install, and activate software purchased through volume licensing agreements. After purchasing licenses through Secureframe, you will receive instructions from Microsoft to access VLSC.

Yes. GCC High features may lag behind commercial releases by weeks or months. Some features available in commercial Microsoft 365 may have limited functionality or not be available in GCC High. Microsoft publishes a detailed service description for GCC High and DoD.