Microsoft 365 F3 GCC High

The Microsoft SKU for M365 F3 GCCH Sub Per User is AAA-99952.

Microsoft 365 F3 GCC High MSRP pricing varies by segment. Commercial pricing starts at $13.20/mo. Education and nonprofit pricing starts lower. Contact Secureframe for a quote.

Yes, Microsoft 365 F3 GCC High is available in Microsoft GCC High for organizations handling CUI and ITAR data.

Secureframe is an authorized Microsoft reseller. Submit a quote request and receive your custom quote within 1 business day.

Eligibility is open to US federal, state, local, tribal, and territorial government entities and to other organizations that handle government-regulated data. Qualifying data types include CUI, ITAR/EAR-controlled technical data, DFARS 252.204-7012 covered defense information, and FBI CJIS law enforcement data. Microsoft validates each tenant via its US Gov intake before provisioning, and depending on data type may request proof of US Department of State ITAR registration or sponsorship by a government entity. DCSA sponsorship (which governs classified / IL6 environments) and an active defense contract are common misconceptions; neither is required for GCC High. Sources: Microsoft's Office 365 US Government service description and Secureframe's Microsoft GCC High guide.

Start Microsoft's US Gov eligibility request at usgovintake.embark.microsoft.com and supply supporting documents. Typical attachments include a federal contract, CAGE code or SAM.gov registration, US Department of State ITAR registration, or a government sponsor letter. Microsoft's validation team responds in 3–7 business days; full approval generally takes 10 days to 3–4 weeks, and revalidation is required at contract renewal. See our step-by-step GCC High migration guide.

GCC High meets DoD SRG Impact Level 4 (IL4) equivalency and is assessed against NIST SP 800-53 controls at FIPS 199 High Categorization. Office 365 DoD, a separate environment available only to the Department of Defense, targets IL5. Both environments support CMMC Level 2/3 inheritance and DFARS 252.204-7012 alignment. Read our DFARS 7012 vs CMMC comparison for a side-by-side breakdown.

Microsoft 365 F3 GCC High supports CMMC Level 2 and CMMC Level 3 compliance by delivering the full set of NIST SP 800-171 Rev 2 controls and DFARS 252.204-7012 alignment. CMMC Level 2 requires a third-party C3PAO assessment every three years for organizations handling CUI; CMMC Level 3 layers in NIST SP 800-172 enhanced controls for programs handling the most sensitive defense information. Microsoft positions GCC High as providing the "necessary inheritance for CMMC," and it is the only Microsoft 365 environment with full ITAR contract language alongside DoD IL4 accreditation. Read our CMMC certification levels guide.