Microsoft 365 GCC runs in a separate environment from your commercial tenant, with its own eligibility approval, licensing, and feature set. Moving means getting validated, building a new tenant, migrating your users and data into it, and planning around features that work differently. The new tenant gives you a compliant foundation for CMMC, but the configuration and documentation on top of it are still yours to complete.
If your company handles Controlled Unclassified Information (CUI) under a government contract, Microsoft 365 Government Community Cloud (GCC) is often the right place to keep it. GCC meets the relevant Federal Risk and Authorization Management Program (FedRAMP) Moderate baseline and Defense Federal Acquisition Regulation Supplement (DFARS) 252.204-7012 requirements for most CUI, without the added cost and complexity of GCC High.
The first decision is which of the two you need. You apply for one environment, and your new tenant is built around it. Choosing the wrong one means going through another migration later, so it pays to settle this before you apply.
The type of data you hold usually decides it. If your contracts involve export-controlled data covered by the International Traffic in Arms Regulations (ITAR) or the Export Administration Regulations (EAR), you need GCC High. The same is true if your contract or your prime contractor specifically requires GCC High. If you handle CUI with no export-controlled data and nothing in your contract points to GCC High, GCC is usually the fit.
Once you know which one you need, the move itself takes more planning than most people expect, though all of it can be scoped ahead of time. In this article, you’ll learn what the eligibility process requires, how to choose between an enclave and a full migration, how the migration unfolds once you’re approved, which features work differently in GCC, and what a GCC tenant does and does not give you toward Cybersecurity Maturity Model Certification (CMMC) compliance.
Step 1: Eligibility
GCC is not available for direct purchase the way commercial Microsoft 365 is. Government entities and organizations that handle regulated government data can generally qualify, but first you need to complete a validation process. You submit Microsoft’s eligibility form along with proof that your organization handles regulated data such as CUI, which usually comes from your government contracts. Once Microsoft confirms you’re eligible, you buy licenses through your Microsoft account team or a qualified licensing partner.
Your application is for either GCC or GCC High, so confirm it matches the environment your data and contract require before you submit it. Documentation review and verification take real time, so start well before you need the environment live, ideally long before any contract deadline.
Step 2: Provisioning a Brand New Tenant
Once eligibility is confirmed, Microsoft provisions a new GCC tenant, and your existing commercial one stays as it is. There is no in-place conversion. This is usually where the idea of a simple settings change falls apart, because user accounts, mail flow, and document libraries all have to be planned as a move.
Choosing Between an Enclave and a Full Migration
Because you are building a new tenant, you also decide who moves into it.
A full migration moves your entire company into GCC. All of your users and their data live in the new environment, and the commercial tenant is typically shut down once the move is complete.
An enclave moves only the people and data that handle CUI. That smaller group, usually the teams working directly on government contracts, works in GCC while everyone else stays in your commercial Microsoft 365 tenant. The goal is to draw a tight boundary around CUI so the compliance work applies to that boundary instead of the whole business.
Both approaches come with trade-offs. An enclave can mean fewer government licenses and a smaller environment to secure and document. It also means some employees work in two environments, and collaboration between the tenants takes more planning. The boundary only holds if CUI stays inside it, and a forwarded email or a file saved in the wrong place can put CUI in a system that was never meant to hold it.
A full migration costs more in licensing and moves more data. In return, everyone works in one environment, and there is no line for CUI to cross by accident. For companies where CUI touches most teams, it is often the simpler setup to maintain over time.
The right choice comes down to how widely CUI moves through your business, so map that flow before you commit to either model.
Step 3: The Migration
Moving from one tenant to another involves the following work:
- Start with a full inventory of users, groups, applications, Conditional Access policies, and custom configurations so you know what you are moving before you begin.
- Verify your domain on the new GCC tenant before any workloads move.
- Migrate mailboxes, and expect this to take longer than a similar commercial move. GCC environments enforce stricter throttling and concurrency limits than commercial tenants, so plan your migration windows accordingly.
- Migrate SharePoint and OneDrive content after testing on a small scale, since complex content can migrate with some formatting differences.
- Time the DNS cutover carefully to avoid disrupting mail flow.
Step 4: Features That Work Differently in GCC
GCC data is stored within the United States and access is restricted to screened Microsoft personnel, but GCC still shares some underlying infrastructure with commercial Azure. It does not carry the same level of isolation as GCC High. In practice, that trade-off shows up as a few functional differences to plan around:
- Some Teams voice and telephony capabilities work differently or are not available, depending on configuration.
- AI features have expanded in GCC but still trail commercial releases. Microsoft 365 Copilot reached general availability in GCC in December 2024, but new Power Platform and Copilot capabilities typically roll out to GCC after they ship in commercial Microsoft 365, and a handful of AI Builder capabilities, such as document automation, are not available in GCC at all.
- Not every third-party app or integration is approved for GCC. Inventory what you rely on today and check compatibility before migrating so a gap does not surprise you afterward.
What GCC Does Not Give You Automatically
Provisioning a GCC tenant gives you a compliant infrastructure baseline. The compliance work on top of it is still yours.
You need to map your configuration to your specific CMMC controls, document your System Security Plan (SSP) and Plan of Action and Milestones (POA&M), and keep the evidence an assessor will eventually want to see.
Settle These Before You Migrate
Most of what makes a GCC migration go smoothly happens before any data moves.
Knowing whether you need GCC or GCC High shapes everything that follows. So does deciding between an enclave and a full migration, and checking which features and apps will carry over. Settle those questions first, and the timeline you commit to becomes much easier to trust.
If you’re trying to figure out whether GCC is the right environment for your contract, or what a migration would involve for your organization, book a free 30-minute call. We’ll look at what your contracts require and tell you whether GCC or GCC High fits.
FAQ
How Long Does a GCC Migration Take?
It varies by organization size and complexity. Eligibility review alone takes time, and the migration itself, covering mailboxes, SharePoint, and OneDrive, runs slower than a comparable commercial-to-commercial move due to stricter throttling in the GCC environment. Budget more time than you would for a same-tier commercial migration.
Can I Just Upgrade My Commercial Tenant to GCC?
No. There is no in-place conversion. GCC is a separate tenant, so migrating means moving your users and data into new infrastructure.
Does GCC Cost More Than Commercial Microsoft 365?
Generally yes, though less than GCC High. Exact pricing depends on your licensing tier and organization size. Treat any figure you see as a planning estimate, and confirm current pricing with a licensing partner.
Will Every Feature I Use Now Work the Same in GCC?
Not necessarily. Some Teams voice capabilities work differently, and while Microsoft 365 Copilot is available in GCC, newer AI capabilities often roll out there after commercial release, and a few features are not available in GCC at all. Not every third-party integration is approved for the environment either. Inventory what you currently use before migrating.
Does Moving to GCC Mean We Are CMMC Compliant?
No. GCC gives you infrastructure that supports the required controls, but compliance also requires configuration, documentation such as the SSP and POA&M, and ongoing evidence, none of which comes automatically with the tenant itself.
This is general guidance based on current public compliance and Microsoft documentation, not legal or licensing advice. Timelines, costs, and feature availability vary by organization and change over time. Confirm current specifics with Microsoft or your licensing partner before budgeting a migration.
About the Author: scott
Commercial Microsoft 365 falls short of CMMC requirements for protecting CUI. Here’s how to tell whether GCC or GCC High is the right fit for your contract.
FCI and CUI carry very different obligations. Which one your company handles decides your CMMC level and how much compliance work you’re signing up for.
A GCC migration means building a new Microsoft 365 environment from scratch and moving your business into it. Here's what the process involves and what tends to catch people off guard.
The Department of War suspended the CMMC third party assessment requirement in July 2026, and self assessment and DFARS obligations remain in force. Here is what changed and what contractors still need to do.
CMMC compliance comes down to five phases that take you from your first gap assessment to a third party audit. A sixth phase of ongoing maintenance keeps you compliant once you get there.
Boeing has been messaging its supply chain about CMMC readiness, on a schedule separate from the government’s. Here’s what that means in practice.
Phishing emails used to give themselves away through bad spelling. AI has closed that gap, so your team needs a better way to tell what is real.
Most compromised business websites were never singled out. An automated tool found an outdated plugin and took it from there. Here's how to tell if your site carries that same risk, and what a fix actually looks like.
A cloud outage does not need a hacker behind it to shut down your business for a few hours. A short continuity plan is what keeps your team working and your customers informed until service returns.
Zero Trust is no longer just for large enterprises. For small businesses, it offers a practical way to limit access, reduce risk, and protect critical data as cloud tools, remote work, and modern threats change how security needs to work.
STAY IN THE LOOP
Subscribe to our free newsletter.
