Microsoft 365 Copilot

The Microsoft SKU for M365 Copilot GCon Sub Add-on is EP2-24659.

Microsoft 365 Copilot pricing varies by segment. Commercial pricing starts at $378.00/mo. Request a custom quote from Secureframe for your exact segment and volume.

Yes, Microsoft 365 Copilot is available in Microsoft GCC High for organizations handling CUI and ITAR data.

Secureframe is an authorized Microsoft reseller. Submit a quote request and receive your custom quote within 1 business day.

Yes. Secureframe is an authorized Microsoft reseller and can sell Microsoft 365 Copilot across every Microsoft license segment: Commercial, Education, Nonprofit, GCC, and GCC High. Quotes are delivered within 1 business day and include compliance guidance. Request a quote on our marketplace.

Microsoft 365 Copilot in GCC High is the Azure Government variant of the product, running on infrastructure physically separated from Microsoft's commercial cloud and operated by screened US personnel. The environment is assessed against NIST SP 800-53 controls at FIPS 199 High Categorization and demonstrates DoD SRG Impact Level 4 (IL4) equivalency, enabling CMMC, DFARS 252.204-7012, and ITAR compliance for US government and defense-industrial-base customers. For a deeper breakdown, read Secureframe's Microsoft GCC High guide.

Eligibility is open to US federal, state, local, tribal, and territorial government entities and to other organizations that handle government-regulated data. Qualifying data types include CUI, ITAR/EAR-controlled technical data, DFARS 252.204-7012 covered defense information, and FBI CJIS law enforcement data. Microsoft validates each tenant via its US Gov intake before provisioning, and depending on data type may request proof of US Department of State ITAR registration or sponsorship by a government entity. DCSA sponsorship (which governs classified / IL6 environments) and an active defense contract are common misconceptions; neither is required for GCC High. Sources: Microsoft's Office 365 US Government service description and Secureframe's Microsoft GCC High guide.

Start Microsoft's US Gov eligibility request at usgovintake.embark.microsoft.com and supply supporting documents. Typical attachments include a federal contract, CAGE code or SAM.gov registration, US Department of State ITAR registration, or a government sponsor letter. Microsoft's validation team responds in 3–7 business days; full approval generally takes 10 days to 3–4 weeks, and revalidation is required at contract renewal. See our step-by-step GCC High migration guide.

Not always. GCC High is Microsoft's recommended environment for organizations handling CUI Specified (including ITAR/EAR export-controlled data) or pursuing CMMC Level 2 or Level 3. Microsoft will only agree to ITAR contract language for the GCC High environment. Organizations handling only CUI Basic may remain on commercial or GCC tenants depending on contract requirements. GCC High is not strictly mandated by CMMC, but most CMMC L2 assessors expect it when CUI flows through Microsoft 365. Read our full CUI explainer.

GCC High meets DoD SRG Impact Level 4 (IL4) equivalency and is assessed against NIST SP 800-53 controls at FIPS 199 High Categorization. Office 365 DoD, a separate environment available only to the Department of Defense, targets IL5. Both environments support CMMC Level 2/3 inheritance and DFARS 252.204-7012 alignment. Read our DFARS 7012 vs CMMC comparison for a side-by-side breakdown.

No. Microsoft's official guidance states that "Office 365 Government - GCC High is only available in the United States," and customer content is stored at rest exclusively in US-based datacenters. Non-US government customers use regional sovereign clouds, for example Office 365 operated by 21Vianet in China, or Microsoft Cloud for Sovereignty in the EU. If you're weighing GCC vs GCC High, read our GCC vs GCC High comparison.

GCC High typically carries a 25–50% premium over commercial pricing to fund Azure Government's physically separated infrastructure, US-person-only operations, and continuous FedRAMP High plus DoD IL4 monitoring. Microsoft personnel with any access to customer content pass screening that includes US citizenship verification, 7-year employment and criminal history checks, OFAC, BIS, and DDTC list screening, plus FBI fingerprint checks. See our detailed GCC High pricing breakdown.

Microsoft 365 Copilot in GCC High supports CMMC Level 2 and CMMC Level 3 compliance by delivering the full set of NIST SP 800-171 Rev 2 controls and DFARS 252.204-7012 alignment. CMMC Level 2 requires a third-party C3PAO assessment every three years for organizations handling CUI; CMMC Level 3 layers in NIST SP 800-172 enhanced controls for programs handling the most sensitive defense information. Microsoft positions GCC High as providing the "necessary inheritance for CMMC," and it is the only Microsoft 365 environment with full ITAR contract language alongside DoD IL4 accreditation. Read our CMMC certification levels guide.

Yes. Microsoft 365 Copilot in GCC High runs on Azure Government infrastructure that holds FedRAMP High authorization, the baseline required for federal systems processing high-impact unclassified data. The commercial and GCC variants of Microsoft 365 Copilot operate at FedRAMP Moderate. FedRAMP High is functionally equivalent to DoD Impact Level 4 (IL4) and is required by most CMMC Level 2 and Level 3 scopes. The FedRAMP authorization covers the underlying infrastructure; customers remain responsible for workload configuration under the shared-responsibility model. Read Secureframe's GCC High overview.

Yes. Microsoft's partner-center eligibility criteria explicitly list Department of Defense Unclassified Controlled Nuclear Information (DoD UCNI), Department of Energy UCNI, and FBI Criminal Justice Information (CJI/CJIS) as qualifying data types for GCC High, alongside ITAR/EAR, CUI, DFARS 252.204-7012 covered defense information, and DoD Impact Level data. Microsoft's service description positions GCC High as meeting FedRAMP High and DoD SRG IL4 equivalency across these data categories. Read our detailed CUI primer.

Yes. Microsoft's partner-center eligibility criteria explicitly include Federally Funded Research and Development Centers (FFRDCs), regional and interstate government entities, tribal and territorial governments, and state/local entities alongside federal agencies. International entities are not eligible; GCC High is available only in the United States. Eligibility questions can be directed to Microsoft US Government Cloud Eligibility at usgcce@microsoft.com. Read our full eligibility walkthrough.