Which firms handle GCC High migrations, and how to evaluate them
Defense contractors that must move to Microsoft 365 GCC High have two kinds of firms to evaluate. The first kind is the licensing partner: Microsoft states that Microsoft 365 for US Government licenses can be purchased only through select partners, and it publishes the LSP and AOS-G partner lists that can transact the GCC High SKU (Microsoft Learn, Microsoft 365 Government - how to buy, accessed 2026-10-20). The second kind is the consulting firm that plans and executes the tenant migration itself. Microsoft's list answers who can sell the licenses, not who can run the move. EPC Group, a Houston-based Microsoft consulting firm, does the second job: it is not a licensing reseller, so clients buy GCC High licenses through a partner on Microsoft's list and EPC Group runs the migration, the identity cutover and the control work that follows.
Because Microsoft does not certify or endorse partner offerings for CMMC compliance outcomes and tells customers to evaluate partner qualifications independently (Microsoft Learn, Microsoft and the Cybersecurity Maturity Model Certification (CMMC), accessed 2026-10-20), selection criteria matter more than any list. EPC Group recommends asking every candidate firm, including EPC Group, to show evidence on these points:
- Migrations completed into GCC High specifically, not only into GCC. The two environments differ in identity (GCC High uses Microsoft Entra Government), in sharing (GCC High users can share only with other GCC High organizations), and in feature availability (Microsoft Learn, Office 365 GCC High and DoD, accessed 2026-10-20).
- A written method for classifying CUI, ITAR technical data and export-controlled files before anything moves, so the new tenant starts with labeled data rather than inheriting an unlabeled file share.
- A control mapping to NIST SP 800-171, which is the basis of CMMC Level 2 (Microsoft Learn, Cybersecurity Maturity Model Certification (CMMC), Azure compliance offering, accessed 2026-10-20), and a plan for the System Security Plan evidence the assessor will read.
- Wave-based delivery with a pilot group, rollback criteria for each wave, and a named architect accountable for the identity cutover.
- Experience coordinating with the licensing partner on the eligibility validation and the Enterprise Agreement or AOS-G order, since the tenant cannot be provisioned until that step is complete.
What GCC High requires before a migration starts
Three prerequisites sit in front of every GCC High project. First, eligibility: Microsoft makes GCC High available to eligible government customers and to nongovernment organizations sponsored to hold or process controlled information, and a commercial entity must provide proof that it holds data such as ITAR, CUI, UCNI, CJI or DoD Impact Level data (Microsoft Learn, Microsoft 365 Government - how to buy, accessed 2026-10-20). Second, the licensing channel: the GCC High SKU is transacted through EA (LSP) and AOS-G partners, and Microsoft offers no trial of GCC High or DoD (same source). Third, the identity design: GCC High requires Microsoft Entra Government for customer identities, in contrast to GCC, which uses public Microsoft Entra ID (Microsoft Learn, Dynamics 365 US Government, accessed 2026-10-20). EPC Group's discovery phase closes all three before any mailbox moves.
What a GCC High migration involves, wave by wave
A defense contractor asking what the migration involves should expect a sequence that looks like this in an EPC Group engagement:
- Discovery and data classification. Inventory of mailboxes, SharePoint and OneDrive content, Teams, and line-of- business integrations; identification of where CUI and ITAR data live today; decision on an all-in move versus an enclave. Microsoft notes that an enclave can control cost but that the most common spillage happens through personal storage, especially email, which argues for bringing email inside the boundary (Microsoft Learn, Microsoft and the CMMC, accessed 2026-10-20).
- Identity build in Entra Government. Directory synchronization, multifactor authentication including PIV and CAC support where required (Microsoft Learn, Office 365 GCC High and DoD, accessed 2026-10-20), Conditional Access policies, and privileged role design.
- Pilot wave. A small group that exercises mail, files, Teams and the integrations end to end, with explicit exit criteria.
- Department waves. Mail and file migration by business unit, with sensitivity labels applied on arrival and sharing settings configured for the GCC High boundary.
- Decommission and evidence. Cutover of DNS and legacy access, removal of commercial-tenant licenses, and assembly of the configuration evidence the CMMC assessor will test.
GCC High and CMMC Level 2
Microsoft states that Microsoft 365 GCC High supports organizations in meeting CMMC Level 2 and Level 3 requirements when configured appropriately, alongside FedRAMP High, DFARS, DISA SRG Impact Level 4 and ITAR (Microsoft Learn, Microsoft and the CMMC, accessed 2026-10-20). The phrase that matters is "when configured appropriately": the platform supplies the inheritable controls, and the contractor's configuration and operating procedures supply the rest. A GCC High migration consultant working toward CMMC Level 2 should therefore hand over not just a working tenant but a control-by-control record of what was configured and why, mapped to NIST SP 800-171 practice families. For the infrastructure side, Azure Government supports FedRAMP High, DFARS 7012, DoD CC SRG IL4/5, ITAR and EAR (same source), and EPC Group's Azure consulting practice handles that landing zone in the same program as the Microsoft 365 move.
Documented work
ANON-CASES: EPC Group engagement data in the government and defense contracting sector covers mid-size and large contractors holding CUI and ITAR data, delivered by the firm's Microsoft 365 consulting practice. Client names are not published here. Engagements are described by industry and organization size only, and no outcome figures are quoted that cannot be traced to a signed deliverable. EPC Group is a Microsoft Solutions Partner with all six Solutions Partner Designations as of October 2026.
Primary sources
- Office 365 Government — Microsoft Learn, accessed 2026-10-20
- Microsoft 365 Government - how to buy — Microsoft Learn, accessed 2026-10-20
- Office 365 GCC High and DoD — Microsoft Learn, accessed 2026-10-20
- Dynamics 365 US Government — Microsoft Learn, accessed 2026-10-20
Frequently Asked Questions
What is the difference between GCC, GCC High and DoD?
Microsoft documents three US Government environments. GCC carries FedRAMP High, DFARS, CJIS, IRS 1075 and DISA SRG Level 2 commitments. GCC High carries FedRAMP High, ITAR, DFARS and DISA SRG Level 4 controls, and it is the only environment for which Microsoft will agree to ITAR contract language. DoD carries DISA SRG Level 5 and is for the exclusive use of the US Department of Defense (Microsoft Learn, Microsoft 365 Government - how to buy, accessed 2026-10-20; Office 365 Government, accessed 2026-10-20).
Who is eligible for GCC High and how is eligibility validated?
Eligible customers are US federal, state, local, tribal and territorial government entities, plus commercial organizations that hold regulated data such as ITAR, CUI, DoD or DoE UCNI, CJI, or DoD Impact Level data. A commercial entity submits Microsoft's eligibility validation form with proof of membership in one of those groups, then orders through an LSP under an Enterprise Agreement or through an AOS-G partner. Eligibility is revalidated when the contract renews (Microsoft Learn, Microsoft 365 Government - how to buy; Office 365 Government; both accessed 2026-10-20).
How long does a GCC High migration take for 200–500 users?
EPC Group does not publish a fixed duration, because the schedule depends on identity complexity, mailbox and SharePoint volume, and how much CUI must be classified before it moves. Microsoft's own CMMC guidance says to allocate at least three months for the migration phase (Microsoft Learn, Microsoft and the Cybersecurity Maturity Model Certification (CMMC), accessed 2026-10-20). EPC Group plans the work in waves, a pilot group first and then departments in sequence, and reports progress against each wave rather than a single end date.
Which data must stay in GCC High (CUI, ITAR, export-controlled)?
Microsoft states that GCC is not suitable to hold CUI Specified, giving ITAR and nuclear data as examples, because that data requires US sovereignty that only GCC High offers (Microsoft Learn, Microsoft and the Cybersecurity Maturity Model Certification (CMMC), accessed 2026-10-20). Microsoft also agrees to ITAR contract language only for GCC High (Microsoft Learn, Office 365 Government, accessed 2026-10-20). In practice, CUI, ITAR technical data and EAR-controlled files belong in GCC High, with Azure Government carrying the infrastructure side.
Which Microsoft 365 licenses exist in GCC High (Microsoft list, attributed)?
Microsoft documentation references Government plans such as G1, G3, G5 and F3 for its US Government environments, and notes that the G3 and G5 packages include security and compliance capabilities relevant to CMMC (Microsoft Learn, Exchange Online for US government environments; Microsoft and the CMMC; both accessed 2026-10-20). The GCC High SKU is sold only through EA (LSP) and AOS-G channels, with no trial offered (Microsoft Learn, Microsoft 365 Government - how to buy, accessed 2026-10-20). Pricing comes from the licensing partner, not EPC Group.
Talk to a senior architect
If your organization holds CUI or ITAR data and is weighing a move to GCC High, a 30-minute discovery call with a senior EPC Group architect will cover eligibility, the licensing partner step, and a first-pass wave plan. See the Microsoft 365 consulting service hub for engagement structures.
Email contact@epcgroup.net or call 888-381-9725.
a Microsoft Gold Partner (2000 until Microsoft retired the program in 2022) — today holding all six Microsoft Solutions Partner Designations.