GCC High (Government Community Cloud High) is Microsoft’s U.S. sovereign version of Microsoft 365 for the Department of Defense and contractors that handle DoD controlled unclassified information (CUI) or ITAR-regulated data. It runs on Azure Government, limits access to screened U.S. personnel, and delivers Teams phone calling only through Direct Routing, which Intuity UC provides.
Who is GCC High for?
Microsoft built GCC High for the U.S. Department of Defense and for contractors holding or processing DoD CUI or subject to ITAR. Organizations must pass a Microsoft eligibility validation before a tenant is created. There are no trials.
In practice, that means defense industrial base (DIB) companies, their subcontractors, and federal agencies that work with export-controlled technical data.
What makes GCC High different?
Three things separate GCC High from commercial Microsoft 365:
- Sovereign infrastructure. GCC High runs on Azure Government, a U.S.-only cloud that is separate from Microsoft’s commercial cloud.
- Screened access. Microsoft staff have no standing access to GCC High production. Anyone requesting access to customer content must first pass U.S. citizenship verification, a seven-year background check and FBI fingerprinting.
- High-baseline assessment. Microsoft assesses GCC High against NIST SP 800-53 controls at a FIPS 199 High categorization and states it can demonstrate equivalency to DoD Impact Level 4 or the inheritance needed for CMMC.
GCC High vs. commercial Microsoft 365 vs. DoD
| Commercial Microsoft 365 | GCC High | DoD | |
|---|---|---|---|
| Who can buy | Any organization | DoD contractors and agencies with DoD CUI or ITAR data, after validation | DoD entities only |
| Cloud | Microsoft commercial cloud | Azure Government, U.S. only | Azure Government, U.S. only |
| Security baseline | Commercial | NIST SP 800-53 at FIPS 199 High; IL4 equivalency | DoD SRG Impact Level 5 |
| Microsoft staff access | Standard | Screened U.S. citizens, no standing access | Screened, plus DoD IT-2 adjudication |
| Teams phone (PSTN) options | Calling Plans, Operator Connect, Direct Routing | Direct Routing | Direct Routing |
Does GCC High include phone calling?
GCC High includes Teams, but not a phone carrier. Microsoft delivers Teams Phone System and Audio Conferencing in GCC High through Direct Routing, which connects Teams to a carrier through a certified session border controller (SBC).
That makes the calling provider part of your compliance boundary. If email and files move into GCC High but phone calls, voicemail and call recordings stay with a commercial carrier, voice becomes the gap an assessor finds.
Intuity UC delivers GCC High calling for Microsoft Teams from an SBC hosted in Intuity UC’s own Azure GCC High instance. Operations and 24/7 support are U.S.-based, and the service is engineered by cleared federal engineers and mapped to FedRAMP, DFARS 252.204-7012, NIST SP 800-171 and CMMC 2.0. See how Teams calling works in GCC High.
Is GCC High required for CMMC?
Not always. CMMC does not name a cloud. DFARS 252.204-7012 requires any cloud provider that stores, processes or transmits covered defense information to meet security equivalent to the FedRAMP Moderate baseline and to follow the clause’s incident-reporting rules, including reporting within 72 hours.
Contractors with ITAR or other export-controlled CUI usually choose GCC High, because that is where Microsoft makes the U.S.-sovereign commitments those rules require. For the phone side, see whether CMMC applies to your phone system.
Frequently asked questions
What does GCC High stand for?
Government Community Cloud High. It is Microsoft’s U.S. sovereign Microsoft 365 environment for the Department of Defense and contractors handling DoD CUI or ITAR data.
Who is eligible for GCC High?
The DoD and organizations that hold or process DoD controlled unclassified information or are subject to ITAR. Microsoft validates eligibility before creating a tenant.
Is GCC High FedRAMP High?
Microsoft assesses GCC High using NIST SP 800-53 controls at a FIPS 199 High categorization, the same baseline FedRAMP High uses.
Can you make phone calls from Teams in GCC High?
Yes. Microsoft delivers Teams Phone System and Audio Conferencing in GCC High through Direct Routing with a certified SBC. Intuity UC provides this as a managed GCC High calling service.
Is GCC High required for CMMC Level 2?
Not always. DFARS 252.204-7012 requires FedRAMP Moderate-equivalent cloud security for covered defense information. Contractors with ITAR or export-controlled CUI typically use GCC High.
Sources:
Microsoft: Office 365 GCC High and DoD service description ·
DFARS 252.204-7012 ·
Microsoft Tech Community: history of the US Sovereign Cloud