Licensing — Microsoft Government Cloud
Microsoft Government Cloud
GCC vs. GCC High, eligibility validation, and how buying actually works, before you commit budget to the wrong environment.
Validate our eligibility| Factor | Commercial | GCC | GCC High |
|---|---|---|---|
| Eligibility check required | No | Yes | Yes |
| Suitable for CUI | No | No | Yes |
| Meets ITAR data residency | No | No | Yes |
| Typical use case | General business | FCI, public sector | CUI, export-controlled data |
How buying actually works
Eligibility validation
Microsoft verifies your organization qualifies for GCC or GCC High before any license can be issued.
CSP quote and order
Licensing is purchased through an authorized Cloud Solution Provider, not the commercial self-service portal.
Tenant provisioning
A dedicated government-community tenant is stood up, separate from any existing commercial tenant.
Migration and cutover
Mail, files, and identities move into the new tenant on a schedule that fits how your team actually works.
All three run in the same government-community cloud family; the difference is how much of the Microsoft 365 stack you need.
GCC Business Premium
Email, Teams, and endpoint management for smaller contractors handling FCI only.
GCC E3 / E5
Full Microsoft 365 stack for larger public-sector-adjacent organizations, still commercial-equivalent compliance.
GCC High E3 / E5
The tier required once CUI or ITAR data is in scope, with the DoD-aligned compliance baseline.
Authorized government cloud licensing partner
Eligibility validated before you commit to a tier
Migration planned around how your team actually works
Same team that builds your Secure Enclave and CMMC program
Do we need GCC High, or is GCC enough?
If you store, process, or transmit CUI or ITAR-controlled technical data, you need GCC High. If you only handle FCI or need FedRAMP-moderate alignment, GCC is usually sufficient. We validate this against your actual data, not a guess.
Can we buy GCC High directly from Microsoft?
No. GCC High requires an authorized Cloud Solution Provider and an eligibility screening process; it isn't available through the commercial self-service portal.
How long does eligibility validation take?
Typically 1 to 3 weeks, depending on how quickly your organization's documentation (SAM registration, NAICS codes, entity structure) is available.
Do we lose anything moving from commercial to GCC High?
A small number of third-party integrations and preview features lag behind the commercial cloud. We flag any that affect your specific stack during the eligibility and planning phase.
