Key Points
- Microsoft 365 GCC, GCC High, and DoD differ in intended use, compliance standards, and eligibility, so choosing the wrong tier risks contract disqualification.
- CMMC Level 2 applies to organizations that handle CUI and to the MSPs that support them, thereby placing MSP tools and processes within the compliance boundary.
- The three tiers differ in support personnel, cloud access, and app compatibility, and a commercial tenant must be migrated to GCC High because it cannot be upgraded.
- GCC supports NIST 800-171 and CMMC compliance, but backup and remote support tools must meet the same standards, and NinjaOne for Government is FedRAMP Moderate Authorized.
Microsoft 365 Government Community Cloud (GCC) environments provide a set of managed online services that comply with data residency requirements for US government and Department of Defense (DoD) contractors and other entities that deal with regulated data. These environments span three tiers: GCC, GCC High, and DoD. Each tier delivers Microsoft 365 (formerly Office 365) services such as Exchange and Outlook for email, Teams, OneDrive, and SharePoint for collaboration, and the Microsoft Office suite, including Word, Excel, and PowerPoint.
This guide aims to help IT administrators and managed service providers (MSPs) understand the different Microsoft 365 GCC environments so that they can be better prepared when planning and implementing the IT infrastructure for US public sector entities and federal contractors.
Why choosing the right Microsoft 365 GCC environment matters
All three tiers are hosted in data centers located in the US. GCC High and DoD environments are physically and logically isolated from other public cloud platforms in the Microsoft 365 ecosystem and limit support to screened US personnel. Each tier supports a different set of US data residency and security standards, including FedRAMP, ITAR, NIST 800-171, DFARS, and CJIS.
Compliance with these frameworks is a requirement for many public sector entities or federal contractors that manage Controlled Unclassified Information (CUI), federal contract information (FCI), and other regulated data. This requirement applies to organizations such as:
- US Federal, State, Local, or Tribal entities
- Solution providers (including MSPs) serving any of these entities
- Customers who handle government-controlled data
The GCC, GCC High, and DoD environments available in Microsoft 365 Government Community Cloud differ in their physical infrastructure and security requirements, which leads each to reach different compliance standards, and can lead to some functionality and compatibility differences. All require identity verification and eligibility screening to ensure that all GCC tenants meet the requirements for one of the above categories.
As with all legal and compliance-related matters, you should consult the authoritative source of regulations, as well as legal and domain experts in your industry, to ensure that you fully understand the unique requirements for your organization and properly implement the required processes and technologies.
For MSPs, this is especially critical: if your services interact with systems storing or processing CUI, your tools, access, and processes are considered part of the compliance boundary.
Overview of GCC, GCC High, and DoD environments
Before you apply for and begin deploying Microsoft 365 GCC services, your licensing, compliance, and identity infrastructure should be carefully planned, as well as any migration tasks. This is to ensure that all data security requirements are met, with all compliance requirements clearly identified and addressed.
| Environment | Intended use case | Compliance standards met | Data residency | Hosting model |
| GCC | US state/local government, education, and public agencies | FedRAMP Moderate, CJIS, IRS 1075 | US-only | Commercial infrastructure (US-based) |
| GCC High | DoD contractors, CUI/ITAR data handlers | FedRAMP High, DFARS, NIST 800-171, ITAR | US-only | Physically and logically isolated (US personnel only) |
| DoD | US Department of Defense | DoD IL5, NIPRNet | US-only | DoD-owned infrastructure |
Choosing the correct GCC environment for your use case will help you avoid data handling violations that may lead to contract disqualification or legal ramifications. Which GCC environment you can apply for will depend on your eligibility:
| Environment | Eligibility and licensing |
| GCC | Available to public sector entities and their contractors |
| GCC High | Requires Microsoft validation via sponsorship or contract with DoD/defense programs |
| DoD | Access is restricted to actual Department of Defense organizations |
CMMC Level 2 requirements for MSPs
Cybersecurity Maturity Model Certification (CMMC) Level 2 applies to organizations and their MSPs that handle CUI.
Because CMMC Level 2 is based on NIST 800-171, MSPs supporting these environments must demonstrate:
- Strong access control (MFA, least privilege)
- Continuous monitoring and logging
- Incident response capabilities
- Vulnerability and patch management
- Secure backup and recovery processes
If an MSP handles CUI, it is expected to meet the same level of controls as the organization they support.
Key differences for IT teams and MSPs
For IT teams and MSPs, the differences between the GCC, GCC High, and DoD Environments have practical implications for planning and implementation, with differences in the availability of support staff, cloud access, and third-party app compatibility.
| Feature | GCC | GCC High | DoD |
| Support personnel | May include global Microsoft support staff | US citizens only | US DoD personnel only |
| Cloud access | Commercial Azure | Azure Government (US sovereign) | Azure Government for DoD |
| App compatibility | Broad third-party ecosystem | Limited; apps generally need FedRAMP High authorization | Extremely limited |
| Multi-tenant access | Broad support for integrations | Restricted federation and API access | Highly restricted |
For MSPs, reselling and managing tenants in GCC requires a government-qualified status, as well as adherence to personnel screening requirements, including employing only US citizens, and performing background checks.
Why your MSP can make or break CMMC compliance
Your MSP becomes a part of your audited environment. Their existence can make or break CMMC compliance. Common risks that you might need to mitigate include:
- Failure to meet audit requirements due to MSP gaps
- Lack of logging, documentation, or access controls
- Unsecured remote tools exposing CUI
Organizations pursuing CMMC Level 2 must ensure their MSP can demonstrate compliance.
GCC High deployment considerations
When preparing for your Microsoft 365 GCC High deployment, you should consider any data migration that needs to occur: you cannot upgrade a commercial Microsoft 365 tenant directly to GCC High, so data must be migrated. You should also ensure that you are aware of the limitations of how your identity management will function, as Microsoft Entra ID (formerly Azure AD) in GCC High may limit certain SSO/federation interactions. Third-party app integrations, APIs, and webhooks may also be affected.
How GCC supports NIST 800-171 and CMMC compliance
Microsoft 365 GCC environments provide the infrastructure foundation for compliance, including data residency, access restrictions, and secure cloud hosting.
However, GCC alone does not ensure compliance. Organizations and MSPs must still:
- Implement required security controls
- Maintain policies and procedures
- Provide audit evidence and documentation
In other words, GCC supports compliance, but operational execution (often handled by MSPs) determines success.
Microsoft 365 GCC and AWS GovCloud interoperability
AWS GovCloud also addresses US data sovereignty requirements, providing a secondary solution that is compliant with many of the same compliance standards as Microsoft 365 GCC levels. Both platforms are often used in tandem: for example, when one service provides functionality the other does not, or as a backup destination when compliance parity is required.
When implementing a cross-cloud architecture, data sovereignty and compliance must be maintained with the use of encryption, identity management, and ensuring that traffic is not routed through commercial regions that do not meet security standards.
Backups, security, and support: maintaining compliance across your entire IT infrastructure
Full compliance requires your entire IT operation to meet legally mandated standards. Backup and logging tools, remote support, security integrations, and other third-party tools must meet the same standards as the GCC tier you choose.
NinjaOne provides a full suite of IT management and support tools that meet an increasing number of US federal regulations, including FedRAMP. This includes SaaS Backup that can back up your Microsoft 365 GCC tenants, and remote monitoring and management (RMM), endpoint security, and automation tools to assist IT teams and MSPs in serving US public-sector companies. NinjaOne for Government is FedRAMP Moderate Authorized, and the NinjaOne platform unifies endpoint management, autonomous patching, backup, and remote access for IT teams and MSPs that serve US public sector organizations.
NinjaOne SaaS Backup protects Microsoft 365 data in Exchange Online, OneDrive, SharePoint, and Teams.
