GCC High is a copy of Microsoft 365 Department of Defense (DOD), which was built for the Department of Defense only and not for contractors or outside personnel. Because of this, GCC High was created for cleared personnel, agencies, and other DOD contractors. It was developed to ensure compliance with federal regulations and cybersecurity, including CMMC, FedRAMP, CJIS Policy, ITAR, NIST 800-171, and DFARS 7012. GCC High resides in the Azure Government cloud and is supported only by a U.S.-based, restricted support team. Overall, Microsoft GCC High provides a secure and compliant environment for organizations that handle sensitive data.
You can learn more about it in our post on GCC High Requirements.
A full migration to Microsoft 365 Government Cloud Community High (GCC High) often involves moving from another non-compliant cloud environment. Moving to GCC High can have some challenges.
Download Azure Cost Management Guide
Download the complete guide to Azure Cost Optimizations and learn about tips, tricks, and tools that will help you monitor, manage, and save money in the cloud.
Here are some considerations for planning a proper migration.
- Whether you are migrating from one tenant to another tenant or on-premises to a GCC High tenant – choosing the right tool is critical. R3 currently utilizes AvePoint to migrate Exchange Online, Teams, SharePoint, and OneDrive.
- There is no migration path to migrate MFA. The only option is to have users reconfigure their MFA settings in the new tenant.
- This is the time to go through the mailboxes and distribution lists and remove any that are not being used.
- When the domain is cutover to the new tenant, staff will be logged out of their existing 365 account and then will need to login using their GCC High credentials to activate their new Office If they are using anything else, you will need to make sure they are on the latest Microsoft Office suite. Modern authentication only works with Office 2013 or later and Microsoft Purview Information Protection requires users to have the latest version of Office.
- When moving into a GCC High environment, it is good to know what is not available in comparison with the Commercial tenants.
- Sharing information with external users can add several layers of security and compliance complexity. You will need to thoroughly review and edit you System Security Plan and implement several technical policies to accommodate this access. Especially when working with CUI.
- Microsoft Purview Information Protection can be used to protect your data like CUI.
- Know your data: Classify and identify sensitive data across your environment, and use insights from this information to inform and monitor your
- Protect your data: Use sensitivity labels to make the sensitivity level of items visible to admins and users, and apply protection actions that include encryption, access restrictions, and visual markings.
- Prevent data loss: Apply consistent policies to detect risky user behavior and prevent accidental oversharing of sensitive information.
An alternative option to a full migration would be a dedicated secure enclave in a GCC High tenant. The above points still apply. Benefits of this include:
- Can be scoped to select users
- Secure Email with a new email domain
- Secure SharePoint and OneDrive
- Restricting access to only a Virtual Desktop Infrastructure (VDI) allowing employees to work in a fully secured workspace within GCC High without the need to perform compliance hardening on PCs.
For IT leaders looking to elevate their government or defense-related organization’s data security to the highest compliance levels, Microsoft GCC High Migration Services presents the impeccable solution. If you’re in the process of planning your GCC High migration strategy, consider reaching out to R3 for support. Our team has experience with a multitude of different GCC High migrations and have seen it all.
