Can You Use Commercial Microsoft 365 for CMMC?

Article Summary: Commercial Microsoft 365 (M365) falls short of Cybersecurity Maturity Model Certification (CMMC) Level 2 requirements for protecting Controlled Unclassified Information (CUI), mainly around where data lives and who can access it. The fix isn’t automatically “move to GCC High.” Microsoft offers two government-focused environments, Government Community Cloud (GCC) and GCC High, and which one you need depends on the type of DoD data you handle and what your contract says.

If your company handles CUI under a government contract, there’s a good chance someone on your team has already asked: “Can’t we just use the Microsoft 365 we already have?” It’s a fair question. Commercial M365 is capable, familiar, and already paid for.

Technically, you can try. But Microsoft doesn’t support the government cloud requirements for CUI on commercial M365, so it’s very unlikely to hold up in a CMMC assessment. It’s worth knowing why before you commit to an environment.

Why commercial Microsoft 365 falls short

Commercial M365 falls short in two areas:

• Data residency and personnel access. Commercial M365 data can be stored and supported by Microsoft personnel anywhere in the world. Government cloud environments restrict administrative access to screened U.S. persons and keep CUI within the United States.
• Compliance authorization. Commercial M365 isn’t authorized to the government compliance baseline that CMMC and Defense Federal Acquisition Regulation Supplement (DFARS) 252.204-7012 require for handling CUI. Both GCC and GCC High are built to close that gap, but they address different levels of risk.

GCC vs. GCC High: the part worth getting right

A common assumption is that any CMMC work means jumping straight to GCC High. That’s not accurate, and it’s an expensive assumption to get wrong. If you only handle Federal Contract Information (FCI) at CMMC Level 1, commercial M365 can work.

For CUI, GCC is often enough. Microsoft 365 GCC natively supports most CMMC Level 2 practices and controls and satisfies DFARS 252.204-7012 for most types of CUI. If your contract doesn’t involve export-controlled technical data, GCC may fully cover you, at meaningfully lower licensing cost than GCC High.

Export control changes that. If the CUI you handle includes technical data controlled under the International Traffic in Arms Regulations (ITAR) or the Export Administration Regulations (EAR), GCC High is the environment built for it. Its separation from commercial Azure runs deeper than configuration. It restricts access to a continental U.S., U.S.-persons-only boundary. GCC High is also the right call when your contract explicitly requires the full set of DFARS 252.204-7012(c) through (g) provisions.

Either way, the deciding factor is the type of CUI you handle and what your contract says, not company size or which option sounds more secure. Read your contract’s data-handling clauses before licensing anything, or have someone read them with you.

Where things stand right now

CMMC Level 2 self-assessment requirements are already appearing in government contracts and flowing down through prime contractors. The Department of War had  suspended third-party Level 2 assessments on July 13, 2026.

What hasn’t changed: DFARS 252.204-7012 and National Institute of Standards and Technology (NIST) Special Publication (SP) 800-171 still apply if you handle CUI, and CMMC Phase 1 self-assessment requirements remain in place. Scoping your environment now means you won’t be scrambling later if the third-party assessment requirement returns.

Two questions to answer first

The environment you need comes down to two questions: what kind of CUI are you handling, and what does your contract say? Get both answers first. Otherwise you risk paying for more protection than you need, or finding out you needed more once an assessment is underway.

If you’re trying to figure out whether your current Microsoft environment meets CMMC requirements, or which government environment your contract calls for, Atekro can help. Let’s take a look together, no obligation.

FAQ

Does CMMC require GCC High?
Not directly. CMMC doesn’t name a specific cloud environment. What decides your environment is the type of CUI you handle and the contract clauses tied to it, particularly DFARS 252.204-7012. Many contractors can meet CMMC Level 2 on GCC. GCC High becomes necessary when export-controlled data under ITAR or EAR is involved.

What’s the difference between GCC and GCC High?
Both keep data in the United States and restrict administrative access. GCC High goes further. It isolates itself from commercial Azure at the infrastructure level, limits access to a continental U.S., U.S.-persons-only boundary, and supports the full range of DFARS 252.204-7012(c) through (g) provisions that some contracts require.

Can I keep part of my business on commercial Microsoft 365?
Often, yes. An enclave moves only the users and systems that touch CUI into GCC or GCC High, and the rest of the organization stays on commercial M365.

How long does a GCC or GCC High migration take?
It depends on your size, how much data you’re moving, and how many third-party apps need a government-cloud version. Plan it as a project with its own timeline rather than a quick switch.

What happens now that CMMC Phase II has been suspended?
The July 2026 suspension paused mandatory third-party CMMC Level 2 and Level 3 assessments while the Department of War reviewed the program. It didn’t change the requirement to protect CUI under DFARS 252.204-7012 and NIST SP 800-171, and Phase 1 self-assessment requirements remain in place. Preparing your environment now avoids a scramble if third-party assessments return.

Note: This is general guidance based on current public compliance documentation, not legal advice. Confirm environment requirements and CMMC assessment timelines against your specific contract language before making a licensing decision.