GCC High Migration
GCC High vs GCC, GCC High Pricing, Requirements and Licensing Cost
GCC High G3 lists at about $65 per user per month, 67 percent over commercial E3. For 500 seats that is $157,200 a year more. We source the migration partner and the licensing, and negotiate both.
Price My GCC High MigrationFree GCC High Migration Review: send seats, scope and timeline before you ask any partner for a quote.
A GCC High migration moves a company's Microsoft 365 email, files, Teams and identities into Microsoft's separate US government cloud for defense contractors that handle ITAR data or DoD Controlled Unclassified Information (CUI). After Microsoft's July 1, 2026 price update, Microsoft 365 G3 in GCC High lists at $65.20 per user per month, against $47.70 for G3 in GCC and $39.00 for commercial Microsoft 365 E3, so a 500-seat company pays about $157,200 a year more in licensing than on commercial E3 (MCA calculation from the prices below). There is no in-place upgrade: GCC High is a new tenant, opened only after Microsoft validates your eligibility, and everything moves into it. The alternative is to move only the CUI users, in a CMMC enclave. We source and negotiate the migration partner and the licensing; the provider you choose pays us, so it costs you nothing.
Sources: GCC and GCC High list prices from Secureframe's GCC High pricing guide (a Microsoft licensing reseller), July 1, 2026 update; commercial prices from Microsoft licensing news. Enterprise Agreement and partner pricing can differ from list. Percentages are MCA calculations. Prices checked October 2026. Free to cite with a link to this page.
Send your seat count, how many users touch ITAR or CUI, your current tenant and data volume, and your contract timeline. You'll hear back within 24 hours. From there, we give you a first read on what the move should cost for a company your size and which partner types fit. Send it before you request quotes: once you ask a partner for pricing directly, that partner will not register an advisor.
GCC High vs GCC vs DoD: What Each Environment Is For
Microsoft runs three US government versions of Microsoft 365. The Office 365 US Government service description sets out who may buy each and what Microsoft commits to.
| GCC | GCC High | DoD | |
|---|---|---|---|
| Built for | Federal, state, local and tribal governments and their contractors | Contractors holding DoD CUI or subject to ITAR | The Department of Defense only |
| Security baseline | FedRAMP High | NIST SP 800-53 at FIPS 199 High; designed to DoD IL4 controls | DoD SRG Impact Level 5 |
| ITAR contract language | No | Yes, the only Microsoft 365 environment where Microsoft agrees to it | Not offered to contractors |
| Data location | Stored at rest in US datacenters | Stored at rest in US datacenters | Stored at rest in US datacenters |
| How you buy | EA, AOS-G, MPSA, web direct or CSP | EA through a licensing solution provider, or an AOS-G partner | EA |
| Trials | One-month trial for eligible government customers | None | None |
| G3 list price | $47.70 per user per month | $65.20 per user per month | Not sold to contractors |
Sources: Microsoft US Government, GCC High and DoD and how to buy service descriptions; IL4 design from Microsoft's DFARS offering page; prices from Secureframe.
Who Needs GCC High?
Companies with ITAR data
Export-controlled technical data is the clearest case. Microsoft will only agree to ITAR contract language for GCC High, and validation may ask for your registration with the State Department.
Contractors holding DoD CUI
Microsoft built GCC High for contractors holding or processing DoD CUI. Under DFARS 252.204-7012, any cloud holding covered defense information must meet the FedRAMP Moderate baseline or equivalent, with 72-hour incident reporting.
Companies preparing for CMMC Level 2
CMMC does not name a cloud, but the CUI environment is assessed against 110 requirements, and GCC High is the Microsoft environment built for contractors holding DoD CUI. See CMMC enclave cost.
Whether GCC is enough for a particular contractor's CUI, with no ITAR involved, is a scoping question for your assessor and counsel, and the answer changes what you buy. Settle it before licensing, because moving between government clouds later is another migration.
GCC High Requirements: Eligibility and Validation
Prove eligibility
Microsoft requires proof that you handle government-regulated data, such as ITAR registration with the State Department, a DoD contract carrying DFARS clauses, or sponsorship by a government entity (Microsoft).
Submit the validation form
Your partner or Microsoft account team submits Microsoft's government cloud validation form. One reseller's listing puts Microsoft's response at 3 to 7 business days (Secureframe).
Buy through the right channel
Above 500 seats, an Enterprise Agreement through a licensing solution provider; below 500, an AOS-G partner (Microsoft). GCC High licensing is billed annually.
Revalidate at renewal
Microsoft requires eligibility to be revalidated when the contract renews, so keep the evidence current.
GCC High Pricing and GCC High Licensing Cost
Microsoft's government service descriptions do not list GCC High prices; licensing partners and resellers do. These are list prices per user per month on annual billing after the July 1, 2026 update. Microsoft said government prices would move in line with commercial ones, with increases above 10 percent phased in over several years (Microsoft).
| License | GCC High | GCC | Commercial | GCC High per year |
|---|---|---|---|---|
| Microsoft 365 F3frontline workers | $13.20 | $10.70 | $10.00 | $158.40 |
| Business Premiumup to 300 users | $35.80 | Not listed | $22.00 | $429.60 |
| Microsoft 365 G3commercial equivalent: E3 | $65.20 | $47.70 | $39.00 | $782.40 |
| Microsoft 365 G5commercial equivalent: E5 | $97.50 | $75.00 | $60.00 | $1,170.00 |
| Defender and Purview add-onsecurity and compliance on G3 | $24.40 | $24.40 | Not listed | $292.80 |
Sources: GCC High and GCC from Secureframe's pricing guide; commercial from Microsoft. Per-year figures are list price x 12 (MCA calculation). Individual reseller listings vary by SKU: the same reseller lists one G3 GCC High SKU at $66.10.
GCC High Cost for a 200 to 1,000 User Company
Licensing is the line that can be priced from public numbers. At G3, the difference between commercial and GCC High grows in a straight line with seats:
| Seats | Commercial E3 per year | GCC G3 per year | GCC High G3 per year | GCC High over E3 |
|---|---|---|---|---|
| 200 | $93,600 | $114,480 | $156,480 | $62,880 |
| 500 | $234,000 | $286,200 | $391,200 | $157,200 |
| 1,000 | $468,000 | $572,400 | $782,400 | $314,400 |
MCA calculation: seats x list price per user per month x 12. Inputs: $39.00 (E3), $47.70 (GCC G3), $65.20 (GCC High G3). Example: 500 x $65.20 x 12 = $391,200. Adding the Defender and Purview add-on at $24.40 adds $292.80 per user per year.
What the migration itself costs
Migration services are priced by quote, and the main drivers are the same for every partner. A fixed-scope four-week migration package listed on Microsoft Marketplace publishes no price and states that it excludes security configuration for CMMC, which is the part a defense contractor most needs. Read every proposal for what it leaves out.
Data volume and sources
Mailboxes, OneDrive, SharePoint, Teams history and any file servers, measured in terabytes and item counts.
Identity and devices
New accounts in a new tenant, device re-enrollment and conditional access built from scratch.
Security configuration for CMMC
Hardening the tenant to the 110 requirements and producing evidence. Often a separate scope or a separate provider.
Third-party apps
Every app connected to Microsoft 365 must support the GCC High endpoints. Some features arrive later in GCC High than in commercial; check the service description.
Advice and sourcing that cost you nothing
We are an independent advisor. We source GCC High migration partners, licensing partners and the managed security around the tenant, and negotiate the price and terms. We do not perform the migration, and we are not a C3PAO or an RPO.
No cost to you
The provider you choose pays us, so the advice and the negotiation cost you nothing. We disclose that up front.
One requirement, the whole market
You describe the migration once. We take it to the migration partners and licensing partners that fit, instead of you sitting through separate sales cycles and demos.
Price leverage
We know what GCC High licensing lists at for a company your size, from $156,480 a year at 200 seats to $782,400 at 1,000 on G3, and we negotiate the rate, the term and what the migration scope includes.
Independence
We are not tied to one partner or one licensing channel. If a full migration is the wrong answer and an enclave fits better, we will say so.
Timing
Once you ask a partner for pricing directly, that partner will not register an advisor, and you negotiate alone. Send us the requirement first.
GCC High Migration Timeline
Scope: whole company or enclave
Who handles ITAR or CUI, which licenses they need, and whether everyone moves or only those users.
Choose the partners
Migration partner, licensing channel and the security services around the tenant, priced across the market.
Validation
Microsoft's eligibility check, 3 to 7 business days by one reseller's listing.
Tenant provisioning
Microsoft stands up the new tenant, up to 30 days per Microsoft's service level as reported by Secureframe.
Configure, migrate, cut over
Security configuration, data and identity migration, cutover and retiring the old tenant. Set by data volume and scope.
Validation and provisioning come before any data moves. Start them while the partner is being chosen, not after, and plan the cutover around your contract dates.
The Enclave Alternative to a Full Migration
A full GCC High migration puts every user in scope and on GCC High pricing. An enclave puts only the people who handle CUI or ITAR data in a GCC High tenant and leaves everyone else on commercial Microsoft 365. For a 1,000-person contractor with 150 CUI users, that is $47,160 a year in added G3 licensing instead of $314,400 (MCA calculation: users x $26.20 difference x 12), and a much smaller Level 2 assessment. The trade-off is discipline: CUI has to stay inside the boundary in daily work. We compare both on our CMMC enclave page, with DoD's own Level 2 assessment cost estimates.
Send the seat count and how many people touch CUI or ITAR data. We will tell you which route the numbers favor and take that requirement to the market. If it isn't a fit, we will say so.
Choosing a Microsoft 365 GCC High Migration Partner
Licensing channel
Whether the partner can transact GCC High through an Enterprise Agreement (500 seats and up) or as an AOS-G partner (under 500), and handle validation.
What the scope includes
Mail, files, Teams, identities, devices, third-party apps and security configuration, each named in the statement of work.
Evidence for your assessment
Whether the partner hands over configuration documentation you can use in your system security plan.
Who runs it after cutover
Ongoing tenant management, monitoring and response. Often a managed security services contract, or a SOC or MDR service sized to the tenant.
The same requirement often includes more than the tenant: servers holding CUI that need Azure Government or a dedicated environment (compliance colocation, private cloud or hybrid cloud), protected backup and disaster recovery, and network work such as SASE, managed firewall or MPLS replacement. Broader moves are covered under cloud migration consulting.
GCC High Migration Mistakes to Avoid
Licensing everyone by default
At 1,000 seats the G3 premium is $314,400 a year. Check whether an enclave covers the people who handle CUI first.
Choosing GCC to save money, then needing GCC High
Moving between government clouds is a second migration. Settle the ITAR and CUI question before you license.
Buying a migration without security configuration
A tenant that has been moved is not a tenant that meets the 110 requirements. Make sure someone owns that scope.
Starting validation late
No data moves until Microsoft validates eligibility and provisions the tenant.
Asking partners for quotes one by one
Each direct request starts a separate sales cycle and closes off advisor registration with that partner. Describe the requirement once.
How We Source a GCC High Migration
Larger programs, such as moving CUI servers out of a server room alongside the tenant, can run as a paid IT infrastructure consulting or data center consulting engagement starting in the mid five figures, with cost comparisons drawn from our data center cost, colocation pricing guide and cloud repatriation work. Read more about Metro Colo Advisory.
GCC High: Frequently Asked Questions
What is GCC High?
Microsoft's US government cloud version of Microsoft 365 for defense contractors that hold DoD CUI or are subject to ITAR. It is a separate cloud from commercial Microsoft 365 and from GCC, assessed against NIST SP 800-53 at a FIPS 199 High categorization.
What is the difference between GCC and GCC High?
GCC serves government agencies and their contractors on a FedRAMP High baseline and can be bought through more channels, including CSP. GCC High is built for DoD CUI and ITAR, is the only Microsoft 365 environment where Microsoft agrees to ITAR contract language, is sold only through an EA or AOS-G partner, and lists about 37 percent higher at G3.
How much does GCC High cost per user?
After the July 1, 2026 update, reseller list prices are $65.20 per user per month for G3, $97.50 for G5, $35.80 for Business Premium and $13.20 for F3, all on annual billing. Enterprise Agreement and partner pricing can differ.
How much more is GCC High than commercial Microsoft 365?
About 67 percent at the E3 and G3 level: $65.20 against $39.00 per user per month. For 500 seats that is $157,200 a year more; for 1,000 seats, $314,400.
Who needs GCC High?
Contractors with ITAR data, and defense contractors holding DoD CUI that want Microsoft's environment built for it. Whether GCC is enough for a particular company's CUI is a scoping decision for your assessor and counsel.
What are the GCC High requirements?
Proof of eligibility, such as ITAR registration, a DoD contract with DFARS clauses or government sponsorship; Microsoft's validation; purchase through an Enterprise Agreement above 500 seats or an AOS-G partner below; annual billing; and revalidation at renewal.
How long does a GCC High migration take?
Validation and tenant provisioning come first: one reseller lists Microsoft validation at 3 to 7 business days and provisioning at up to 30 days. The migration itself depends on data volume, apps and security scope, and is set in the partner's statement of work.
Can I upgrade from GCC or commercial to GCC High in place?
No. GCC High is a separate tenant with its own sign-in and service addresses, so mail, files and identities are migrated into it.
Is there a GCC High free trial?
No. Microsoft offers no trials of GCC High or DoD; a one-month trial exists for GCC only, for eligible government customers.
Do I need GCC High for CMMC Level 2?
CMMC does not require a named product, but the cloud holding your CUI must meet FedRAMP Moderate or equivalent under DFARS 7012, and the environment is assessed against 110 requirements. The alternative is to put only CUI users in GCC High through an enclave.
Does Metro Colo Advisory perform GCC High migrations?
No. We source and negotiate the migration partner, the licensing and the managed services around the tenant. We are not a C3PAO or RPO, and the provider you choose pays us, so it costs you nothing.
Should I contact migration partners directly?
Send the requirement to an advisor first if you want one. Once you ask a partner for pricing directly, that partner will not register an advisor, and you negotiate alone.
Price Your GCC High Migration Before You Request Quotes
Send the seat count, how many users handle ITAR or CUI, your current tenant and data volume, and your contract dates. You'll hear back within 24 hours. The provider you choose pays us, so it costs you nothing. If a full migration isn't a fit, we will say so.
One requirement, the whole market, negotiated before you sign. Send it before any partner quotes you directly.
Defense compliance: CMMC enclave and Level 2 cost and compliance colocation.
Security services: managed security services, SOC as a service, MDR vs EDR and managed firewall services.
Cloud and recovery: cloud migration consulting, backup as a service and DRaaS.
Testing and deals: penetration testing cost and cybersecurity due diligence.
