Blog Post

Public Sector Blog
34 MIN READ

Understanding Compliance Between Commercial, Government, DoD & Secret Offerings - July 2025 Update

RichardWakeman's avatar
RichardWakeman
Icon for Microsoft rankMicrosoft
Sep 23, 2024
This article is the second of a series in the Microsoft Tech Community Public Sector Blog and touches on several key principles for compliance, including data residency versus data sovereignty.  For ...
Updated Jul 25, 2025
Version 11.0
azure
azure gov
cmmc
cui
cybersecurity
defense
dfars
federal
gcc high
itar
RichardWakeman's avatar
RichardWakeman
Icon for Microsoft rankMicrosoft
Jun 03, 2025

Wills Ogus​ since M365 Commercial is not FedRAMP Moderate, you will want to consider GCC (not High).

RichardWakeman's avatar
RichardWakeman
Icon for Microsoft rankMicrosoft
Jun 11, 2025

Microsoft Multi Tenant is in fact M365 GCC (Not High).  It is not M365 Commercial.  You should not store, process, nor transmit CUI in M365 Commercial as it is not FedRAMP.  The authorization for GCC is at the Moderate impact level but has 'Equivalency' at the High impact level.