Three frameworks, one decision: the tenant follows the data
FedRAMP, the DoD impact levels and CMMC answer different questions. FedRAMP authorizes a cloud service for federal use. The DoD Cloud Computing Security Requirements Guide adds impact levels, IL2, IL4 and IL5, for Defense workloads. CMMC certifies the contractor rather than the cloud: it sets three levels, with Level 2 based on practices aligned with NIST SP 800-171 and Level 3 adding NIST SP 800-172 (Microsoft Learn, Cybersecurity Maturity Model Certification (CMMC), accessed 2026-10-20). Microsoft is explicit that CMMC compliance depends on customer configuration, implementation and operational controls, and that its clouds supply capabilities that support those requirements rather than the certification itself (Microsoft Learn, Microsoft and the Cybersecurity Maturity Model Certification (CMMC), accessed 2026-10-20). In practice, one question settles most program designs: what data does the organization hold? Criminal justice or federal tax data, CUI basic, CUI Specified and ITAR technical data each point to a different Microsoft environment. EPC Group's Microsoft 365 consulting and Azure consulting practices start every federal engagement with that inventory.
Which Microsoft clouds carry which authorizations
Microsoft documents the Microsoft 365 side as a ladder. Microsoft 365 for Enterprise supports CMMC Level 1 requirements and FedRAMP High for some services. Microsoft 365 GCC carries FedRAMP High, DFARS and DISA CC SRG Impact Level 2. Microsoft 365 GCC High supports CMMC Level 2 and Level 3 requirements when configured appropriately, and carries FedRAMP High, DFARS, CC SRG Impact Level 4 and ITAR (Microsoft Learn, Microsoft and the Cybersecurity Maturity Model Certification (CMMC), accessed 2026-10-20). The GCC High and DoD service description adds that both environments are assessed using NIST SP 800-53 controls at a FIPS 199 High categorization, that Office 365 DoD carries SRG controls for information up to Impact Level 5, and that only Department of Defense entities may purchase it (Microsoft Learn, Office 365 GCC High and DoD, accessed 2026-10-20). GCC and GCC High hold ATOs from US agencies listed on the FedRAMP Marketplace, and Office 365 U.S. Government Defense holds a P-ATO from DISA (Microsoft Learn, Federal Risk and Authorization Management Program (FedRAMP), accessed 2026-10-20).
On the Azure side, Microsoft maintains a FedRAMP High P-ATO from the Joint Authorization Board and DoD IL2, IL4 and IL5 provisional authorizations for the Azure Government regions US Gov Arizona, US Gov Texas and US Gov Virginia, plus a separate IL5 PA for US DoD Central and US DoD East, which are reserved for the Department of Defense (Microsoft Learn, Department of Defense (DoD) Impact Level 5 (IL5), accessed 2026-10-20). Microsoft recommends US Gov regions for new IL5 deployments (Microsoft Learn, Department of Defense (DoD) in Azure Government, accessed 2026-10-20), but authorization is per service, not per region: Microsoft publishes a table of which Azure, Dynamics 365, Microsoft 365 and Power Platform services are in scope for FedRAMP High, IL2, IL4, IL5 and IL6 (Microsoft Learn, Azure, Dynamics 365, Microsoft 365, and Power Platform services compliance scope, accessed 2026-10-20). EPC Group checks every service in the design against that table before it goes into an architecture diagram.
IL5 on Azure Government: what configuration adds
IL5 in the US Gov regions is not automatic. Microsoft's isolation guidance says that all IL5 virtual machines and virtual machine scale sets should be isolated by the mission owner with Azure Dedicated Host or isolated virtual machine types, and that IL5 data can be logically separated by cryptographic means, using customer-managed keys held in Azure Key Vault on FIPS 140 validated hardware security modules. It also states that the customer is responsible for designing and deploying applications to meet DoD IL5 requirements, including keeping sensitive information out of Azure resource names (Microsoft Learn, Isolation guidelines for Impact Level 5 workloads, accessed 2026-10-20). For control evidence, Microsoft provides Azure Policy regulatory compliance built-in initiatives for FedRAMP High, DoD IL4 and DoD IL5 in Azure Government, while noting that Azure Policy is only a partial view of overall compliance status (Microsoft Learn, Department of Defense (DoD) Impact Level 5 (IL5), accessed 2026-10-20). EPC Group deploys those initiatives in the landing zone and maps each finding to an owner.
CMMC Level 2, CUI and ITAR: when GCC High is the answer
The DFARS clause that underpins CMMC Level 2 requires contractor systems that handle covered defense information to meet NIST SP 800-171, and requires any external cloud provider that stores, processes or transmits that information to meet security requirements equivalent to the FedRAMP Moderate baseline (Microsoft Learn, Defense Federal Acquisition Regulation Supplement (DFARS), accessed 2026-10-20). That sets a floor, not a tenant name. The tenant decision turns on the type of CUI. Microsoft states that GCC is not suitable to hold CUI Specified, such as ITAR or nuclear data, because that data requires the US sovereignty only GCC High offers (Microsoft Learn, Microsoft and the Cybersecurity Maturity Model Certification (CMMC), accessed 2026-10-20), and that it agrees to ITAR contract language only for GCC High (Microsoft Learn, Office 365 Government, accessed 2026-10-20). A contractor with export- controlled technical data is therefore a GCC High customer; a contractor with only basic CUI has a real choice to make with its assessor and contracting officer.
Eligibility sits in front of every Government tenant. Office 365 Government is available to US federal, state, local, tribal and territorial government entities and to other entities that handle government-regulated data, subject to validation that can require proof of State Department registration for ITAR data or sponsorship by a government entity, and eligibility is revalidated at contract renewal (Microsoft Learn, Office 365 Government, accessed 2026-10-20). GCC High and DoD are available through Volume Licensing after validation, with no trials (Microsoft Learn, Office 365 GCC High and DoD, accessed 2026-10-20). Identity work belongs in the same plan: Microsoft lists 13 CMMC Level 2 domains with identity-related practices, from Access Control to System and Information Integrity (Microsoft Learn, Configure Microsoft Entra ID to meet CMMC Level 2, accessed 2026-10-20).
Scoping contractors, enclaves and authorization support
Microsoft's own FAQ covers the two scoping decisions EPC Group sees in most defense programs. First, CMMC can apply to a supplier with no direct DoD contract, because a prime that must comply flows the requirements down. Second, an enclave can control cost, but the most common spillage happens through personal storage, especially email, so an enclave that leaves mail in a commercial cloud puts more scope outside the accreditation boundary; for organizations with several business units, Microsoft recommends one GCC High environment for all of them, and it advises allocating at least three months for the migration phase (Microsoft Learn, Microsoft and the Cybersecurity Maturity Model Certification (CMMC), accessed 2026-10-20). For agencies, Microsoft makes FedRAMP artifacts available for review when an agency issues its Authority to Operate (Microsoft Learn, Office 365 GCC, accessed 2026-10-20). EPC Group assembles the customer-responsibility evidence that sits beside those artifacts, and its CMMC and GCC High services team carries the control mapping through to the System Security Plan.
Documented work
ANON-CASES: EPC Group engagement data in the government sector covers federal and state agencies and mid-size and large defense contractors holding CUI and ITAR data, with scope spanning eligibility coordination, GCC High tenant builds, Azure Government landing zones and control evidence for assessors, delivered by the firm's Microsoft 365 consulting and Azure consulting practices. Client names are not published here. Engagements are described by industry and organization size only, and no outcome figures are quoted that cannot be traced to a signed deliverable. EPC Group is a Microsoft Solutions Partner with all six Solutions Partner Designations as of October 2026.
Primary sources
- Microsoft and the Cybersecurity Maturity Model Certification (CMMC) — Microsoft Learn, accessed 2026-10-20
- Office 365 Government — Microsoft Learn, accessed 2026-10-20
- Office 365 GCC High and DoD — Microsoft Learn, accessed 2026-10-20
- Office 365 GCC — Microsoft Learn, accessed 2026-10-20
- Federal Risk and Authorization Management Program (FedRAMP) — Microsoft Learn, accessed 2026-10-20
- Department of Defense (DoD) Impact Level 5 (IL5) — Microsoft Learn, accessed 2026-10-20
- Isolation guidelines for Impact Level 5 workloads — Microsoft Learn, accessed 2026-10-20
- Department of Defense (DoD) in Azure Government — Microsoft Learn, accessed 2026-10-20
- Azure, Dynamics 365, Microsoft 365, and Power Platform services compliance scope — Microsoft Learn, accessed 2026-10-20
- Cybersecurity Maturity Model Certification (CMMC) — Microsoft Learn, accessed 2026-10-20
- Defense Federal Acquisition Regulation Supplement (DFARS) — Microsoft Learn, accessed 2026-10-20
- Configure Microsoft Entra ID to meet CMMC Level 2 — Microsoft Learn, accessed 2026-10-20
Frequently Asked Questions
Which Microsoft clouds hold FedRAMP High and DoD IL4/IL5 authorizations?
Microsoft lists Microsoft 365 GCC with FedRAMP High, DFARS and DISA CC SRG Impact Level 2; GCC High with FedRAMP High, DFARS, Impact Level 4 and ITAR; and Azure Government with FedRAMP High, DFARS 7012, IL4/5, ITAR and EAR (Microsoft Learn, Microsoft and the Cybersecurity Maturity Model Certification (CMMC), accessed 2026-10-20). Office 365 DoD carries SRG controls up to Impact Level 5 and is sold only to DoD entities (Microsoft Learn, Office 365 GCC High and DoD, accessed 2026-10-20). Azure Government regions hold a FedRAMP High P-ATO plus DoD IL2, IL4 and IL5 provisional authorizations (Microsoft Learn, Department of Defense (DoD) Impact Level 5 (IL5), accessed 2026-10-20).
Does CMMC Level 2 require GCC High?
Not by name. Under DFARS, a cloud provider that stores or processes covered defense information must meet security requirements equivalent to the FedRAMP Moderate baseline (Microsoft Learn, Defense Federal Acquisition Regulation Supplement (DFARS), accessed 2026-10-20). Microsoft states that GCC High supports CMMC Level 2 and Level 3 requirements when configured appropriately, and that GCC is not suitable for CUI Specified such as ITAR or nuclear data (Microsoft Learn, Microsoft and the Cybersecurity Maturity Model Certification (CMMC), accessed 2026-10-20). EPC Group therefore decides from the data the contractor holds: CUI Specified or ITAR points to GCC High, and the contract clauses settle the rest.
How do CUI and ITAR change the tenant decision?
ITAR is the clearest line: Microsoft agrees to ITAR contract language only for the GCC High environment (Microsoft Learn, Office 365 Government, accessed 2026-10-20), and it states that CUI Specified, such as ITAR and nuclear data, requires the US sovereignty only GCC High offers (Microsoft Learn, Microsoft and the Cybersecurity Maturity Model Certification (CMMC), accessed 2026-10-20). Eligibility also changes: commercial entities must pass validation showing they handle regulated data, which can require proof of State Department registration for ITAR, and eligibility is revalidated at renewal (Microsoft Learn, Office 365 Government, accessed 2026-10-20). Criminal justice or federal tax data alone can fit GCC.
What does a federal migration or ATO support engagement include?
EPC Group scopes four workstreams: eligibility and licensing-channel coordination, tenant and Azure Government landing-zone build, data migration in waves, and authorization evidence. On the evidence side, Microsoft makes FedRAMP artifacts available so agencies can review them when issuing an Authority to Operate (Microsoft Learn, Office 365 GCC, accessed 2026-10-20), and an agency can use the DISA P-ATO for Office 365 U.S. Government Defense to generate its own ATO (Microsoft Learn, Federal Risk and Authorization Management Program (FedRAMP), accessed 2026-10-20). Microsoft advises allocating at least three months for a commercial-to-government migration phase (Microsoft Learn, Microsoft and the Cybersecurity Maturity Model Certification (CMMC), accessed 2026-10-20).
How are contractors and subcontractors scoped?
Scope follows the data. Microsoft notes that CMMC can apply to a company that does not hold a DoD contract itself, because a prime that must comply flows the requirements down to its suppliers (Microsoft Learn, Microsoft and the Cybersecurity Maturity Model Certification (CMMC), accessed 2026-10-20). DFARS applies to contractors whose systems process, store or transmit covered defense information (Microsoft Learn, Defense Federal Acquisition Regulation Supplement (DFARS), accessed 2026-10-20). EPC Group maps every system and user that touches CUI, decides between an enclave and an all-in move, and documents the boundary so each tier of the supply chain knows which controls it owns.
Talk to a senior architect
If your organization is deciding between GCC, GCC High and Azure Government, or preparing for a CMMC Level 2 assessment, a 30-minute discovery call with a senior EPC Group architect covers the data inventory, the eligibility step and a first-pass environment map. See the Microsoft 365 consulting service hub for engagement structures.
Email contact@epcgroup.net or call 888-381-9725.
a Microsoft Gold Partner (2000 until Microsoft retired the program in 2022) — today holding all six Microsoft Solutions Partner Designations.