CUI Safe AI

Comparisons

Microsoft 365 Copilot in GCC vs GCC High: which one for CUI?

Short answer

Microsoft points CUI holders to GCC High. GCC is FedRAMP Moderate, which matches the baseline DFARS 252.204-7012 names on paper. But Microsoft's own guidance sends organizations that handle CUI, or need DFARS or ITAR compliance, to GCC High. Ask your assessor before putting CUI in GCC.

Microsoft 365 Copilot in GCC High: Runs in Microsoft 365 GCC High, FedRAMP Certified Class D (High) since 2024-12-26. Microsoft 365 Copilot in DoD environment: The Microsoft 365 DoD environment is for DoD agencies and mission partners whose workloads must meet IL5.

Generated from our dataset. Sources last re-checked Oct 17, 2026.

Side by side

 Microsoft 365 Copilot in GCC (Moderate)Microsoft 365 Copilot in GCC HighMicrosoft 365 Copilot in DoD environmentMicrosoft 365 Copilot (commercial cloud)
Can I use it with CUI?UnclearYes, with conditionsYes, with conditionsOnly in a separate environment
FedRAMP statusAuthorizedAuthorizedUnclearNot listed
FedRAMP levelModerateHighNot separately listedNone
Marketplace detailMicrosoft 365 GCC, FedRAMP Certified Class C (Moderate)Runs in Microsoft 365 GCC High, FedRAMP Certified Class D (High) since 2024-12-26We found no separate Marketplace package for the Microsoft 365 DoD environmentThe government clouds are listed separately; commercial Microsoft 365 is not
DoD Impact LevelNot establishedNot stated for CopilotIL5 (environment)Not established
GSA OneGov dealYesYesYesNo
Conditions and notesMicrosoft describes GCC customers as federal civilian agencies, state and local governments and contractors.Feature gaps vs commercial include Word, Excel and PowerPoint Agents and Scheduled Prompts. The GSA OneGov Microsoft offer (federal and tribal buyers) applies to GCC, GCC High and DoD.Eligibility is limited to DoD and mission partners. We could not find a separate Marketplace package for the DoD environment, so we cite Microsoft's own documentation.Same product name, different boundary.
Primary sourcefedramp.govfedramp.govlearn.microsoft.comfedramp.gov
Last checkedOct 17, 2026Oct 17, 2026Oct 17, 2026Oct 17, 2026

Every row links to its primary source and full page. Statuses change; open the source before you decide. How we verify.

Related questions

Is GCC enough for CMMC Level 2?

Unclear. GCC is FedRAMP Moderate, which matches the baseline DFARS 252.204-7012 names on paper. But Microsoft's own guidance sends organizations that handle CUI, or need DFARS or ITAR compliance, to GCC High. Ask your assessor before putting CUI in GCC.

Who can use the Microsoft 365 DoD environment?

Eligibility is limited to DoD and mission partners. We could not find a separate Marketplace package for the DoD environment, so we cite Microsoft's own documentation.

Not legal advice. These answers describe what public authorization records and vendor documentation say, not whether your contract, data or configuration is compliant. Confirm with your contracting officer, assessor or counsel.

More questions

All questions