Azure Government Services Under the Scope of FedRAMP High

The short answer

FedRAMP High is an authorization of Microsoft's cloud services, not of your workload. Microsoft Learn states that both Azure (the commercial cloud) and Azure Government hold a FedRAMP High Provisional Authorization to Operate (P-ATO) issued by the FedRAMP Joint Authorization Board (JAB), and that in-scope services also carry agency-issued Moderate and High ATOs. What the High baseline covers is defined by two things you have to read together: the region your resources live in and the service-by-service audit-scope table Microsoft publishes. Everything above that line — your configuration, your data classification, your own NIST SP 800-53 customer-responsible controls — is your agency's authorization to earn.

Azure or Azure Government: which one do you need?

Microsoft's position is that FedRAMP High on the Azure public cloud meets the needs of many US government customers. Azure Government exists for the cases where that is not enough. It provides additional assurances through controls that limit potential access to systems processing customer data to screened US persons, and it carries authorizations the commercial cloud does not: Department of Defense Cloud Computing Security Requirements Guide Impact Level 4 and Impact Level 5 provisional authorizations from DISA, in addition to IL2. Azure commercial carries FedRAMP High and DoD IL2.

The practical test is the data. Controlled Unclassified Information with a DoD IL4 or IL5 handling requirement, data covered by ITAR, EAR, CJIS or IRS Publication 1075 obligations, or any contract that names screened US persons as a condition, points to Azure Government. A civilian agency system categorized High under FIPS 199 with no DoD or export-control overlay can often be authorized on commercial Azure inside the US regions.

Regions: the boundary that people get wrong

For commercial Azure, Microsoft states that all Azure public regions in the United States are in scope for the FedRAMP High P-ATO. Regions outside the United States are not formally authorized by the JAB, even though Microsoft says the same NIST SP 800-53 control implementations operate there. For Azure Government, the FedRAMP High P-ATO covers the US Gov Arizona, US Gov Texas and US Gov Virginia regions. A workload that fails over, replicates or backs up into a region outside those lists has left the authorized boundary, whatever the subscription type says.

Services: read the audit-scope table before you design

Authorization is per service, and Microsoft maintains the list in its services compliance scope article (the Azure Government table was last updated February 2026 at the time of writing). Core infrastructure — Virtual Machines, Virtual Machine Scale Sets, Virtual Network, VPN Gateway, Web Application Firewall, Virtual WAN — is in scope for FedRAMP High in both clouds. Three footnotes in that table matter for architecture: Microsoft Entra ID's authorization extends to Entra External ID; Azure Databricks' FedRAMP High authorization applies only to limited regions and requires contacting Microsoft or Databricks to configure; and for edge devices such as Azure Data Box, Azure Stack Edge and Azure Local the authorization covers the online software and datacenter components only — the customer is wholly responsible for the authorization package covering the physical devices.

The design rule EPC Group applies in government engagements is simple: no service enters the architecture until its row in the scope table says yes for the target cloud and impact level. "It is available in the region" is not the same statement.

DoD impact levels, in one paragraph

Azure Government's IL5 authorization in the US Gov regions is a workload-isolation (IL5WI) authorization: Microsoft states that services require extra configuration to meet the IL5 compute and storage isolation requirements, documented in its Isolation guidelines for Impact Level 5 workloads. The US DoD Central and US DoD East regions have their own IL5 audit scope. IL6 belongs to Azure Government Secret, which also holds a JSIG PL3 ATO; Azure Government Top Secret holds an ICD 503 ATO. If your program needs IL6 or above, the conversation starts with your Microsoft account representative, not a portal.

Microsoft 365 beside Azure Government

Most High-baseline agencies run productivity in Microsoft 365 as well, and Microsoft lists the FedRAMP-scoped environments separately: Office 365 U.S. Government, U.S. Government High (GCC High) and U.S. Government Defense; Microsoft Intune; Power BI as a standalone service or inside an Office 365 plan; Windows 365 U.S. Government; and Dynamics 365 U.S. Government. Microsoft notes that Azure Communication Services obtained its FedRAMP High accreditation as part of the Microsoft 365 GCC High offering because it runs on the same infrastructure as Teams. Pairing Azure Government with GCC High is the pattern EPC Group deploys for a High-baseline tenant; the GCC-vs-GCC High decision is covered in its own guide linked below.

How an agency proves it: the documents and the policy view

Attestation documents are not on the public web. Microsoft directs agencies to the FedRAMP Marketplace to request the Azure and Azure Government packages — a .gov or .mil email address is required — and to the Service Trust Portal for the Azure Commercial System Security Plan (a subscription or trial account is needed to sign in). Continuous-monitoring reports and the Plan of Action and Milestones are released under NDA from a restricted Service Trust Portal section with access arranged through the account team.

For the agency's own side of the ledger, Microsoft ships Azure Policy regulatory-compliance built-in initiatives for FedRAMP High and FedRAMP Moderate, in separate versions for Azure and for Azure Government. Each FedRAMP control maps to one or more policy definitions and the compliance dashboard aggregates the result. Microsoft's own caveat is worth repeating verbatim in any SSP you write: compliance in Azure Policy is only a partial view of your overall compliance status. It measures what policy can see; it does not replace your control implementation statements.

FISMA, FedRAMP and the word "compliant"

Vendors who say they are "FISMA compliant" usually mean they implement NIST SP 800-53 controls. Microsoft's FAQ states that the FISMA process, though not the underlying standards, was replaced by FedRAMP in 2011 for cloud services, and that FedRAMP is mandatory for federal agency cloud deployments at the low, moderate and high impact levels. Companies whose products or services are used by the federal government may be required to obtain an ATO as well — which is why a Microsoft partner building on Azure Government inherits the platform authorization but still owns the system-level one.

Where EPC Group fits

EPC Group is a Houston Microsoft consulting firm founded in 1997. In government engagements the firm's work sits above the platform line: scoping the system boundary against the audit-scope tables, selecting Azure Government or commercial Azure from the data obligations rather than from habit, implementing the customer-responsible controls, wiring the Azure Policy initiatives and Purview into a single evidence trail, and preparing the SSP sections an authorizing official will read. Related EPC Group guides: GCC vs GCC High for Microsoft 365, the Azure Government and GCC High migration methodology, FedRAMP High Copilot deployment and the government industry page.