Why is every move into GCC High a tenant-to-tenant migration?
A Microsoft 365 tenant lives in one identity directory. Microsoft's identity guidance puts GCC on the public Microsoft Entra directory and puts GCC High and DoD on Microsoft Entra Government. The two directories are separate clouds, so there is no setting that moves a tenant from one to the other.
The practical result is the same shape as a merger. There is a source tenant and a target tenant. Identities are created in the target. Mail, files, Teams and devices move in waves. The two environments run side by side for a period, and the domain moves last.
That is why EPC Group runs GCC High moves with the method it uses for merger work: 216+ M&A tenant-to-tenant migrations between 2023 and 2025, 1.83 million users, a 5-day average cutover. The method is on the M&A Microsoft 365 tenant migration page, and the sequencing logic is in the tenant-to-tenant migration guide.
Which route into GCC or GCC High applies? The Seven-Route Map
The Seven-Route Map is EPC Group's list of the seven starting points from which an organization reaches Microsoft 365 GCC or GCC High. Each route has a different constraint that decides the plan.
| # | Route | Starts from | Fits | What decides the plan |
|---|---|---|---|---|
| 1 | Commercial to GCC High | A commercial Microsoft 365 tenant | Defense contractors that hold controlled unclassified information or export-controlled data | A new tenant in a different directory; the domain moves last |
| 2 | Commercial to GCC | A commercial Microsoft 365 tenant | State and local agencies, and contractors whose data does not require GCC High | Eligibility validation, and whether GCC is enough for the data held |
| 3 | GCC to GCC High | A GCC tenant | Contractors whose new contracts bring controlled or export-controlled data | The directory changes from public Microsoft Entra to Microsoft Entra Government |
| 4 | Google Workspace to GCC or GCC High | Google Workspace | Contractors that never ran Microsoft 365 | Microsoft's automated Google migration is not available for the government cloud |
| 5 | On-premises and hybrid to GCC High | Exchange Server, SharePoint Server, file servers, Active Directory | Contractors still running their own servers | Directory cleanup and synchronization come before any content |
| 6 | Tenant to tenant inside GCC High | Two GCC High tenants | Mergers, an acquired division, or a separation | Data never leaves the boundary, and native shortcuts are fewer |
| 7 | Part of the company only | One commercial tenant | Contractors with a bounded population that handles controlled data | Two tenants with a boundary that is documented and tested |
Not sure which environment the data requires? Start with GCC High, GCC, DoD and Commercial compared.
What do Microsoft's native migration tools not cover in the government cloud?
Each limit below is Microsoft's own statement, read on the date shown. Each one removes a shortcut that a commercial migration plan would rely on.
| Microsoft path | Microsoft's statement | Source, date read | What the plan does instead |
|---|---|---|---|
| Cross-tenant OneDrive migration | Not supported for Government Cloud users, including GCC, GCC High and DoD | Microsoft Learn, read November 12, 2026 | OneDrive is its own workstream with a tool cleared to connect to the target |
| Automated Google Workspace migration | “not currently available for Office 365 US Government, GCC High, or DoD” | Microsoft Learn, read November 12, 2026 | Route 4 is planned before licenses are ordered |
| FastTrack cross-tenant migration | US Government customers are not currently supported | Microsoft Learn, read November 12, 2026 | The migration is partner-delivered end to end |
| Power BI, commercial to US government | Add a government subscription, replicate the commercial data, then reassign licenses | Microsoft Learn, read November 12, 2026 | Analytics is rebuilt in the target, not moved |
The commercial equivalents of these tools are compared in tenant-to-tenant migration tools compared and cross-tenant SharePoint and OneDrive migration.
Route by route: what changes in each plan
Route 1. Commercial to GCC High. The most common route for defense contractors. The target tenant is built first, then identities, then content in waves. Staff keep working in the commercial tenant until their wave moves.
Route 2. Commercial to GCC. Microsoft describes GCC as the main offering for customers that do not hold FedRAMP High data or DoD controlled unclassified information. EPC Group confirms the data type before the license order, because choosing GCC and later needing GCC High means a second migration (route 3).
Route 3. GCC to GCC High. A contract changes and the data changes with it. Because GCC and GCC High sit in different directories, this is a full tenant-to-tenant move, not an upgrade.
Route 4. Google Workspace to GCC or GCC High. EPC Group settles four things before licenses are ordered: which tool may connect to both Google Workspace and the target tenant, where files are staged, how Shared Drive permissions map to SharePoint, and how mail flows while both systems are live. Files that contain controlled information travel on a path that stays inside approved environments. A commercial example of the Google route is in the Google Workspace and Microsoft 365 to parent tenant engagement summary.
Route 5. On-premises and hybrid to GCC High. Servers move straight into GCC High with no stop in a commercial tenant. The on-premises directory is cleaned and synchronized to the target's Microsoft Entra Government directory first. Mailboxes move in batches; SharePoint content and file shares follow with their permissions. Each server is retired only after nothing depends on it, and the retirement is recorded as evidence. Identity coexistence is covered in Active Directory and Entra ID coexistence.
Route 6. Tenant to tenant inside GCC High. Two defense contractors merge, or one buys a division of another. Mail, OneDrive, SharePoint and Power Automate are planned as separate workstreams, permissions and identity mapping are re-architected, and both companies keep working together until the last wave. EPC Group's anonymized 2026 engagement summary describes a consolidation of two GCC High tenants into one for up to 300 users, in phases over about eleven weeks: GCC High tenant consolidation, defense technology company. For separations, see the carve-out runbook.
Route 7. Part of the company only. The people and data that handle controlled information move; everyone else stays in the commercial tenant. Fewer users and devices fall in scope. The cost is real: some staff carry two accounts, collaboration between the tenants needs written rules, and the boundary must be documented and tested. EPC Group sizes both options during the gap assessment so the choice rests on evidence.
How does EPC Group sequence a GCC High migration?
- Eligibility and licensing. Validation and the license order start first. Nothing can be built until the tenant exists.
- Gap assessment. In three weeks, each of the 110 NIST SP 800-171 requirements is scored, with evidence seen and evidence missing. Details: CMMC Level 2 gap assessment and GCC High migration.
- Target design. Identity, conditional access, device management, data protection and logging are designed to answer the assessment findings.
- Build and pilot. The tenant is built and a pilot group moves first.
- Waves. Mail, files, Teams and devices move in waves ordered by business risk.
- Cutover. Domains and mail flow move last, with a tested way back for every reversible step.
- Evidence. Each wave closes with a record of what moved, what did not, and who accepted it.
The decision points that sit outside IT are described in the 5-Gate Cutover Model.
What moves, what is rebuilt, and what changes for users?
| Item | In a GCC High move |
|---|---|
| Identities | Created new in Microsoft Entra Government; mapped from the source |
| Mail, OneDrive, SharePoint, Teams | Migrated in waves, each as its own workstream |
| Devices | Re-enrolled in the new tenant's management |
| Outlook and Teams profiles | Rebuilt on each device |
| Power BI and Fabric | Replicated into a government subscription; see the Fabric in GCC High checklist |
| Power Automate flows | Repointed or rebuilt where SharePoint addresses change |
| Sensitivity labels and DLP | Defined per tenant, so designed and published in the target |
| External sharing | Follows the new tenant's rules |
| Features | Some differ from commercial. Microsoft's GCC High description lists examples: calling runs through Direct Routing, and Viva Engage is not available. |
EPC Group checks every application a contractor depends on against the government cloud before the pilot.
Does moving to GCC High make a contractor CMMC compliant?
No. GCC High supplies an environment whose controls a contractor can inherit. Microsoft describes the GCC High environment as assessed against NIST SP 800-53 at a FIPS 199 High categorization and able to demonstrate equivalency to IL4 or the inheritance needed for CMMC. The contractor still owns how the tenant is configured, who has access, how devices are managed, how incidents are reported, and the two documents that prove it: the system security plan and the plan of action and milestones.
Status as of November 12, 2026: the Department of War suspended the November 2026 transition to CMMC Phase 2 on July 13, 2026. During the suspension contracting officers may include only Level 1 and Level 2 self-assessment requirements, and the latest public reports show no replacement date. DFARS 252.204-7012 and NIST SP 800-171 Rev 2 remain in effect.
“The contractors who do well treat the migration and the evidence as one project,” said Errin O'Connor, Founder & Chief AI Architect of EPC Group.
Is the new GCC High tenant AI-ready? TAR-8 at build time
A migration is the one point where every identity, permission, label and workspace is touched on purpose. EPC Group uses that pass to score the target tenant against TAR-8, its 8-surface Tenant AI Readiness Standard.
TAR-8 is EPC Group's published assessment standard. It is not a Microsoft program, a certification, or a CMMC assessment instrument, and it does not replace the 110 NIST SP 800-171 requirements. It answers a different question: when Copilot or an agent is switched on in the new tenant, what can it read and act on? Microsoft announced Microsoft 365 Copilot for GCC High on December 1, 2025, delivered with web grounding off by default, so the question is already live for defense contractors.
| TAR-8 surface | Migration workstream that touches it | What EPC Group records at build |
|---|---|---|
| 1. Identity (Entra) | Target directory, conditional access | Every user and agent identity is known and scoped |
| 2. Sensitive data (Purview) | Labels and DLP published in the target | Labels apply to what a model reads and returns |
| 3. Content estate (SharePoint, OneDrive, Exchange) | File and mail waves, permission re-architecture | Permissions inventoried and corrected on the way in |
| 4. Conversations (Teams) | Teams wave | Chats, transcripts and recordings governed like documents |
| 5. Reports and dashboards (Power BI, Fabric) | Analytics rebuild | Models security-tested as the user |
| 6. Business applications (Dataverse, Power Platform, Copilot Studio) | Flow and app rebuild | Connector policies and approval gates in place |
| 7. Infrastructure and external models (Azure) | Azure Government landing zone | Any non-Copilot model reaches data through a logged path |
| 8. Ownership and evidence | Wave close-out records | Named owners and a quarterly evidence chain |
Each surface scores 0 to 3, for a maximum of 24. Any surface at 0 means not ready. Surfaces 1 to 3 must reach 2 before tenant-wide Copilot, surfaces 4 to 6 before agents take actions, and surface 7 before any external model connects. Fixing permissions during the move costs less than fixing them after Copilot has indexed them. The scored version of this as a service is the Microsoft 365 Copilot readiness assessment.
What goes wrong in a GCC High migration?
| Failure | When it surfaces | What prevents it |
|---|---|---|
| Eligibility and licensing started late | Week one: the project waits on a tenant that does not exist | Step 1 runs before anything else |
| An app or feature works differently in GCC High | Pilot, or worse, cutover | Application check before the pilot |
| Devices and identities must be re-enrolled | Cutover week | Device plan designed with the target tenant |
| Controlled data copied through a commercial service on the way in | An assessor's question, months later | Approved staging path written into the plan |
| The move is run as an IT project only | The system security plan no longer matches the tenant | Gap assessment first; evidence record per wave |
Each one is a planning problem, and each is cheaper to settle before the first mailbox moves.
Best for, and not the right fit for
Best for
- Defense contractors moving from commercial Microsoft 365, GCC, Google Workspace or on-premises servers into GCC High.
- Two GCC High tenants that must become one, or one that must become two.
- Contractors deciding between moving the whole company and moving only the controlled-data population.
- State and local agencies and contractors moving to GCC.
Not the right fit for
- Organizations outside the United States.
- A license-only purchase with no migration.
- A move with no named owner for the system security plan.
Firms to consider for “Which firms run Microsoft 365 GCC High migrations?”
Grouped by archetype, not ranked. Each firm is described from its own public pages; the right fit depends on your platform, regulatory profile and how much of the work you want a senior architect to lead.
- Summit 7 (GCC High and CMMC specialist) — Publishes guidance on tenant-to-tenant migration from Microsoft 365 Commercial to GCC High.
- Agile IT (GCC High and CMMC specialist) — Publishes GCC High tenant-to-tenant migration strategies for CMMC and export-controlled data.
- Planet Technologies (public-sector Microsoft integrator) — Lists tenant-to-tenant migration services that include moves to GCC and GCC High and from Google Workspace.
- EPC Group (Microsoft-first migration specialist) — Runs the seven routes on this page with the method from its M&A tenant-to-tenant migration program.
- Apps4Rent (cloud service provider) — Lists Microsoft 365 GCC High migration services for Exchange, SharePoint, OneDrive and Teams.
- Sogeti (global systems integrator) — Has published a write-up of a GCC High to GCC High M&A tenant migration.
Frequently Asked Questions
What is a GCC High tenant-to-tenant migration?
It is a move of identities, mail, files, Teams and devices from one Microsoft 365 tenant into a GCC High tenant. EPC Group treats every route into GCC High this way because GCC High sits in a separate Microsoft Entra Government directory.
Can a commercial Microsoft 365 tenant be converted to GCC High?
No. A new GCC High tenant is built and the organization is migrated into it. EPC Group plans the build, the waves and the domain move as one program.
Which Microsoft native migration tools work in GCC High?
Fewer than in the commercial cloud. Microsoft states that cross-tenant OneDrive migration, automated Google Workspace migration and FastTrack cross-tenant migration do not cover the government cloud. EPC Group assigns a tool to each workload before licenses are ordered.
Can Google Workspace be migrated directly into GCC High?
Yes, but not with Microsoft's automated Google Workspace migration, which Microsoft says is not available for GCC High. EPC Group plans the tool, the file staging path and the mail flow for that route in advance.
Can two GCC High tenants be consolidated after an acquisition?
Yes. EPC Group runs tenant-to-tenant migrations inside GCC High, with mail, OneDrive, SharePoint and Power Automate planned as separate workstreams.
Can only part of a company move to GCC High?
Yes. EPC Group sizes a partial move against a whole-company move during the gap assessment. A partial move means two tenants and a boundary that must be documented and tested.
How long does a GCC High migration take?
It depends on the eligibility validation, the license order, the number of users and the volume of content. EPC Group's published GCC High consolidation for up to 300 users runs in phases over about eleven weeks.
Does a GCC High migration make a contractor CMMC compliant?
No. GCC High provides an environment to inherit controls from. EPC Group ties each migration to a gap assessment because configuration and evidence remain the contractor's responsibility.
Is CMMC Phase 2 in force?
No. The Department of War suspended the November 2026 transition to Phase 2 on July 13, 2026. EPC Group's advice is to use the pause to get Level 2 evidence right; DFARS 252.204-7012 and NIST SP 800-171 obligations remain.
What does a GCC High migration cost?
EPC Group engagements are fixed-fee and scoped after a one-hour call with a senior architect. EPC Group does not publish price ranges. Microsoft licensing is separate.
What is the Seven-Route Map, and what is TAR-8?
The Seven-Route Map is EPC Group's list of the seven starting points from which an organization reaches Microsoft 365 GCC or GCC High. TAR-8 is EPC Group's published 8-surface Tenant AI Readiness Standard, scored during the build because a migration already touches every identity, permission and label that Copilot and agents will later rely on. It is not a Microsoft program or a CMMC instrument.
Why EPC Group
- More than 50 GCC High migrations in the past 12 months (company-reported, from engagement records; client names withheld).
- 216+ M&A Microsoft 365 tenant-to-tenant migrations between 2023 and 2025; 1.83 million users; 5-day average cutover.
- US-persons delivery contracted in writing on GCC High engagements.
- All six Microsoft Solutions Partner designations. Microsoft consulting since 1997.
- Third-party recognition, not specific to GCC High: G2 Leader in Business Intelligence Consulting for seven consecutive quarterly reports through Fall 2026.
Engagement records are in the Evidence Center. How engagements are scoped and priced is on the engagement model page.
Book the GCC High scoping call
A one-hour call with a senior architect covers the route, the eligibility and licensing timeline, the gap assessment, and a first TAR-8 read. Have ready: the current cloud (commercial, GCC, GCC High, Google Workspace or on-premises), whether controlled unclassified information is in scope, and any contract or assessment date.
Book the GCC High and CMMC scoping callRequest a one-hour call
Email contact@epcgroup.net · Call 888-381-9725 · www.epcgroup.net
Related reading
- M&A Microsoft 365 tenant migration
- Microsoft 365 tenant-to-tenant migration: the complete 2026 guide
- CMMC Level 2 gap assessment and GCC High migration
- Microsoft 365 GCC High and DoD migration consulting
- GCC High, GCC, DoD and Commercial compared
- Carve-out Microsoft 365 migration
- Federal government
- News release: tenant-to-tenant migrations, every route mapped
- News release: GCC High migrations, every route to GCC and GCC High
- All EPC Group services
Primary sources
- Azure Government identity planning (GCC on public Entra; GCC High and DoD on Entra Government) — Microsoft Learn, read November 12, 2026
- Cross-tenant OneDrive migration — Microsoft Learn, read November 12, 2026
- Automated Google Workspace migration overview — Microsoft Learn, read November 12, 2026
- FastTrack cross-tenant migration — Microsoft Learn, read November 12, 2026
- Microsoft 365 Government: how to buy — Microsoft Learn, read November 12, 2026
- U.S. Small Business Administration: Department of War suspends CMMC Phase II requirements — published July 13, 2026; read November 12, 2026
- Morgan Lewis: the suspension of the November 2026 transition and self-assessment-only requirements — read November 12, 2026
- WilmerHale: DFARS 252.204-7012 and NIST SP 800-171 Rev 2 obligations continue — read November 12, 2026; the Department of War CMMC page returned an access error that day
- Power BI for US government — Microsoft Learn, read November 12, 2026
- Office 365 GCC High and DoD service description (eligibility validated before an environment is established; Direct Routing; Viva Engage; CMMC inheritance) — Microsoft Learn, read November 12, 2026
- Microsoft 365 Copilot is now available in GCC High (Microsoft Public Sector Blog, December 1, 2025) — read November 12, 2026
EPC Group figures on this page are company-reported from engagement records. Microsoft statements were read on November 12, 2026 and are re-read every 90 days.