GCC High Migration Cost: there is no list price

Why GCC High shows up on almost every CMMC budget

Microsoft 365 GCC High is a separate Microsoft cloud with a contractual posture that supports CUI processing under DFARS 252.204-7012. Microsoft's service description records that Office 365 staff hold no standing access to GCC High production, and that anyone requesting temporary elevated access to customer content must first clear US citizenship verification plus employment, criminal, education and fingerprint checks and the OFAC, BIS and DDTC screening lists. Worth knowing before you plan around it: Microsoft also states that GCC High support itself sits outside the service accreditation boundary and carries no FedRAMP, DoD SRG, ITAR, IRS 1075 or CJIS data-handling assurance, so support tickets are not a channel for CUI. It is not the only path to Level 2 (you can build a properly hardened on-premises stack, or use AWS GovCloud, or hybrid), but it has become the default for sub-500-employee defense contractors because the alternatives are slower to stand up and harder to evidence in front of a C3PAO.

The scope-reduction story is the reason. If all CUI processing happens inside one M365 tenant, the assessment boundary shrinks dramatically: one identity provider (Entra ID GCC High), one productivity suite (Exchange, SharePoint, OneDrive, Teams), one device management plane (Intune GCC High), and one security telemetry pipeline (Defender + Purview). A C3PAO can audit that scope efficiently. Compare that with a sprawl of commercial SaaS each holding bits of CUI, and the assessment fee alone can double, never mind the remediation cost. The CMMC Accreditation Body scoping guidance at cyberab.org rewards tight, well-documented boundaries.

The trade-off is the licence premium and the migration project. Because GCC High is a separate cloud, you cannot migrate mailboxes and SharePoint content with the usual Microsoft tooling. Every workload is provisioned fresh, then content is copied across with a third-party migration tool such as BitTitan MigrationWiz, AvePoint Fly, or Quest On Demand Migration. Partner labour to operate those tools, plus discovery, planning and cutover support, is the one-time cost, and it is quoted per engagement rather than from a rate card.

Microsoft maintains the eligibility and feature comparison in the GCC High and DoD service description and updates it through the year. Confirm the feature set against that source before committing a budget, because the gaps (no PSTN Calling or Conferencing, no Viva Engage for enterprise, external sharing limited to other GCC High organisations) are the things that generate unplanned spend elsewhere.

The licence structure, and what each tier is actually for

No prices below, because Microsoft publishes none for GCC High. What matters for a CMMC budget is which tier carries the controls you have to evidence, and which seats can sit on something cheaper. Take this table into a quote and make the reseller price each line against your own seat split.

Plan contents from the Microsoft 365 GCC High and DoD service description. Microsoft publishes no GCC High price list, and purchase requires eligibility validation through Volume Licensing, so the per-user figure is whatever your agreement says. Ask your reseller to quote each tier separately rather than a blended per-seat average, so you can see what moving a seat between tiers saves.

One-time migration project: price it in hours

No migration partner publishes a rate card, so a dollar table here would be a guess at somebody else's private price. What a partner quote is actually made of is hours, and hours are something you can reason about and compare. The table below is our own effort model by project size, broken out by the work that has to happen: discovery, tenant provisioning, identity, content migration, security configuration, and cutover. Multiply by the blended hourly rate in your partner's quote.

Our own effort model, not a partner rate card. Mailbox and SharePoint hours scale with data volume rather than headcount, so an unusually heavy mailbox estate pushes those two rows up independently. Use the totals to test whether a quote has been scoped or guessed, and ask the partner to restate their price as hours by line item if it arrives as a single number.

Building your own three-year total

Two inputs, both of which only you have: the per-user price in your own quote, and your partner's hourly rate. The arithmetic is then:

Whatever that lands at, it is one line in the wider Level 2 budget rather than the whole thing. See the Level 2 cost page for how the licence and migration spend sits against remediation and the assessment itself.

How to reduce GCC High cost without breaking compliance

The leverage points, in rough order of impact: split the population so only CUI-handling users sit on GCC High and everyone else stays on commercial M365, use F3 frontline plans for shop-floor users who only need limited Teams plus a small mailbox, run on G3 plus the EMS E5 add-on rather than full G5 if you do not need Power BI Pro, negotiate against a multi-year commit, and stage the migration in waves so partner labour scales with each wave rather than arriving as one bill. The first of those is by far the biggest, because it removes seats from the premium tier entirely rather than shaving the rate on them.

The saving from splitting the population is just arithmetic you can do yourself: a 100-person contractor with 30 CUI handlers buys 30 GCC High seats instead of 100, so the premium applies to under a third of the estate. For organisations with a hard separation between R&D (CUI) and corporate (non-CUI), separating tenants is cleaner still, because you can pin DLP and Conditional Access policy at the tenant level without conflict.

One thing not to cut: Defender for Endpoint coverage on every CUI-handling device. AV alone is not sufficient under NIST SP 800-171; you need behavioural EDR with telemetry retention. If you remove Defender to save licence, you have to buy an equivalent EDR separately and feed it into your SIEM, and most third-party EDRs are also priced per endpoint per month, so the saving evaporates. See the EDR cost guide for comparable per-endpoint pricing.

When GCC High is the wrong answer

GCC High is overkill for Level 1 (Federal Contract Information only, no CUI). The 15 basic safeguarding requirements in FAR 52.204-21 are adequately handled in commercial M365 with standard MFA, Defender, and Conditional Access, and the GCC High premium buys you nothing you can point a Level 1 self-assessment at. It also costs you capability: no PSTN Calling or Conferencing, no Viva Engage for enterprise, and external sharing restricted to other GCC High organisations. If you are Level 1 only, stay on commercial and put the licence delta into hardening (MFA, baseline policies, logging). See the Level 1 cost page for the appropriate scope.

GCC High is also the wrong answer if your CUI is not in productivity apps at all. Engineering CAD files for a controlled weapons system are unlikely to live in Exchange or SharePoint. They live in a PDM (PTC Windchill, Siemens Teamcenter) or an engineering file server. Putting M365 on GCC High does not protect that data; you still need a separate enclave for the PDM. Budget GCC High for the productivity workload, then budget enclave compute and storage separately. The enclave scoping cost page covers that part of the picture.