What are the steps to migrate to Microsoft 365 GCC High?
A Microsoft 365 GCC High migration has five phases: validate your eligibility with Microsoft, buy licenses through an authorized channel, build and secure a new GCC High tenant, migrate mail, files and Teams data, then cut over users and DNS. It is a move to a separate environment, and Microsoft states that cross-cloud tenant-to-tenant mailbox migration is not supported.
1. Eligibility and validation
Microsoft offers GCC High to the Department of Defense and to contractors holding DoD CUI or data subject to ITAR. Nongovernment organizations must prove they hold qualifying data, such as CUI or ITAR, through Microsoft's government validation process before an environment is established. There are no GCC High trials.
Decide scope before you apply: the whole company, or an enclave for only the people who handle CUI.
2. Licensing through an authorized channel
Microsoft's how-to-buy page lists GCC High sales channels as an Enterprise Agreement through a licensing solution partner or an AOS-G partner, and names the authorized partners. GCC High is sold under its own SKUs, separate from commercial Microsoft 365. Confirm with Microsoft or a listed partner which channel fits your seat count before budgeting, and plan for add-ons such as telephony separately.
Build a license inventory first: who needs a full license, who actually touches CUI, and which add-ons, such as phone or advanced security features, your company relies on today.
3. Tenant setup and hardening
Microsoft recommends reviewing GCC High's default security settings before changing them. Build identity, Conditional Access, device management, logging and sensitivity labels before any data arrives, and record each setting for your SSP alongside Microsoft's customer responsibility documentation.
- Users in GCC High can share files only with other GCC High organizations.
- Viva Engage for enterprise is not available.
- Teams phone and audio conferencing are delivered through Direct Routing.
- GCC High support is outside the service accreditation boundary, so do not share CUI with support staff.
4. Data migration
Plan tooling early. Microsoft's cross-tenant mailbox migration documentation says cross-cloud tenant-to-tenant migration, such as worldwide to government cloud, is not supported. Its cross-tenant OneDrive migration tool does not currently support GCC or GCC High, and Migration Manager supports only file share migration for the government cloud.
That usually means a migration tool that explicitly supports GCC High targets. Confirm which data types it moves, including mailboxes, SharePoint, OneDrive and Teams content, and run a pilot group first.
Migrate in waves after the pilot, and freeze changes to large SharePoint sites during the final pass so people do not edit the same files in two places.
5. Cutover and cleanup
- Schedule cutover, then move your domain and mail records to the new tenant
- Re-enroll devices and reconnect apps that used the old tenant
- Run a final delta sync and verify mail flow and file access
- Remove CUI from the commercial tenant, then retire it
- Update the SSP with the new boundary and evidence
Common follow-up questions
Can I upgrade my existing Microsoft 365 tenant to GCC High?
No. GCC High is a separate environment with its own tenant. You set up a new GCC High tenant after Microsoft validates your eligibility, then migrate data into it. Microsoft does not support an in-place conversion from the commercial cloud.
Does the July 2026 CMMC suspension mean I can skip GCC High?
Not by itself. The suspension changed how compliance is verified, not cloud requirements. DFARS 252.204-7012 still requires a cloud provider holding covered defense information to meet FedRAMP Moderate-equivalent security and the clause's incident-reporting terms.
How long does a GCC High migration take?
Microsoft does not publish a standard duration. Timing depends on how quickly eligibility is validated, how much data moves, whether you migrate the whole company or an enclave, and how much tenant configuration and user retraining is needed.
LAN Service Group migrates small and mid-size defense contractors to Microsoft 365 GCC High and administers the tenant and SharePoint afterward, with its ISSO-led CMMC practice documenting the environment in the SSP.
Talk to LAN Service Group (888) 281-7243