GCC vs GCC High vs DoD
Microsoft runs separate government clouds for US public sector and defense work. They look similar but are certified for different data, and moving between them later is hard. Getting this right up front matters.
Why there are three
US government work carries data rules that ordinary commercial cloud is not certified to meet. Microsoft answers that with dedicated environments. They share the Microsoft 365 apps you know, but differ in where data lives, who can access it, and which compliance frameworks they are accredited against.
The important thing to understand early: these are separate clouds, not settings you toggle. Choosing wrong and migrating later means a real project, not a support ticket.
What each cloud is for
| Cloud | Built for | Certified around |
|---|---|---|
| GCC | State, local, tribal, and federal agencies and their partners | FedRAMP High, CJIS, IRS 1075 |
| GCC High | Defense contractors and organizations handling CUI or ITAR data | DFARS, ITAR, NIST 800-171, DoD SRG IL4 |
| DoD | The US Department of Defense only | DoD SRG IL5 |
Compliance frameworks and impact levels are set by the US government and Microsoft and can change. Confirm current accreditations for your obligations.
GCC in plain terms
GCC, the Government Community Cloud, is the entry point for public-sector organizations. It provides government-focused compliance, including support for criminal justice (CJIS) and tax (IRS 1075) data, on infrastructure segmented for government customers. Many state and local agencies, and federal organizations without defense-specific data, belong here.
GCC High and DoD in plain terms
GCC High is a physically and logically separate cloud, operated by screened US personnel, accredited to DoD Impact Level 4 and aligned to ITAR and DFARS. If you are a defense contractor handling Controlled Unclassified Information or export-controlled data, this is usually where you must be.
DoD is exclusive to the Department of Defense and accredited to Impact Level 5. Private organizations do not buy into the DoD cloud; contractors use GCC High instead.
How to choose
Work from your strictest obligation. If a contract requires ITAR handling or CUI under DFARS, you need GCC High. If you are a public agency with CJIS or IRS 1075 data but no defense-export requirement, GCC is likely the right and less costly fit. If you have no government data requirement at all, you may not need a government cloud. Because switching clouds later is a full migration, confirm the requirement in writing before you buy.
Answer four questions and get your exact licenseFree. No sign-up. Real prices and when to upgrade.Common questions
What is the difference between GCC and GCC High?
GCC is for state, local, and federal organizations needing FedRAMP High and CJIS-level assurance. GCC High is a separate, isolated cloud accredited to DoD Impact Level 4 and aligned to ITAR and DFARS, for defense contractors and organizations handling CUI or export-controlled data.
Who can use the DoD cloud?
The DoD environment is reserved for the US Department of Defense and is accredited to Impact Level 5. Defense contractors use GCC High rather than the DoD cloud.
Do I need GCC High for CUI?
If you handle Controlled Unclassified Information under DFARS, or ITAR export-controlled data, GCC High is usually required. Confirm the exact requirement in your contract, because it drives the choice.
Can I move from GCC to GCC High later?
You can, but it is a full migration between separate clouds, not a settings change, and it is costly and disruptive. That is why it is important to choose based on your strictest data requirement up front.