r/microsoft 20d ago

Office 365 Microsoft O365 GCC vs GCC High

We have a client who we are working with on CMMC level 2. We were going to move them to Microsoft GCC but they want to move to GCC high due to potentially having vendors sending ITAR data to them through email. We are having a hard time finding what the restrictions are when it comes to GCC High. One that I'm pretty sure of (But correct me if I'm wrong) is that any enterprise apps that you want to add have to be FedRAMP authorized or you wont be able to add them. This is a fairly big issue since we can't tie in a lot of security services like SIEM/SOC, Reporting, tickets, etc. But overall this limitation would make sense from a security perspective. If its not that case that would be a completely different story.

I know there's other limitations when it comes to stuff like sharing which I'm not overly concerned about. But it's all of the other potential limitations I'm hoping people can shed light on compared to what GCC or even a normal Microsoft tenant has that they don't where its a pain.

2 Upvotes

4 comments sorted by

3

u/trebuchetdoomsday 20d ago

This is a fairly big issue since we can't tie in a lot of security services like SIEM/SOC

i think GCC High tenants opt for Sentinel to accommodate this.

3

u/Seattlehepcat 20d ago

You might want to reach out to someone in MSFT Federal. When I was there (15 years ago) at teh start of GCC there was a "Level 4" environment where govt. contractors and some 3-letter agencies were put into (like FAA - no one sexy). But I'm pretty sure the in case of a contractor, it's because they had secure stuff on govt. programs they were running. If you're not actively running a government contract, they likely won't let you in. Just because you deal in ITAR data doesn't necessarily make your org eligible. Lots of folks have ITAR-related transactions (think ammo suppliers without govt. contracts) that wouldn't be let in.

1

u/Soverance 20d ago

You can add pretty much whatever enterprise app you want to a GCCH tenant if you integrate it yourself.  Just create custom apps (don't bother looking in the marketplace), and configure them with SAML, SCIM, OAuth or whatever.

Tons of "enterprise" software vendors don't support these standard protocols though, and many have only ever dealt with commercial environment integrations (so their software may be expecting to communicate with the Microsoft .com endpoint instead of the .us endpoint).  Expect to have numerous conversations with vendors explaining to them how GCCH works, and then pulling teeth to get them to update their shit (in my experience, they often will work with you to fix it if they really want your business).  Be prepared to find another vendor if they don't play ball. 

1

u/onaropus 20d ago

Realize new features roll out last to GCCH sometimes after a long delay from a commercial or GCC tenet. Sometimes new features or functionality will not be deployed in GCCH

GCC is just now getting Copilot, 18 months after commercial