CRM in GCC and GCC High: Your Options Compared

Why do GCC and GCC High limit your CRM options?

CRM in GCC and GCC High runs one of five ways: manually on spreadsheets, Outlook and shared mailboxes, on Dynamics 365 in the government cloud, through a hosted third-party CRM, through an application that installs inside your own tenant, or built in-house on SharePoint and the Power Platform. What decides the choice is what gets attached to an opportunity record and where your compliance boundary sits.
​
The short answer: where proposals, statements of work or technical data carrying Controlled Unclassified Information attach to your opportunities, that content stays inside your accredited tenant. That requirement removes hosted CRM platforms from the shortlist and leaves you choosing between Dynamics 365, a tenant-native application, and a build of your own. The rest of this article sets out how each option behaves in GCC and GCC High, and ends with six questions that settle it.
Before comparing them, it is worth settling what the question is, because almost every published answer addresses a licensing question rather than a fit one.

Why do GCC and GCC High limit your CRM options?

​Connector availability narrows, external sharing with primes and teaming partners closes by default, and Copilot reaches these environments later and covers less ground. The constraint that decides the most is simpler than any of those: a product you shortlist may not install in your environment at all. Most CRM vendors publish no government cloud offering, and the few that do are authorized and priced for federal enterprise buyers. A 60 person defense supplier asking which CRM runs in GCC High finds a list short enough to read in a minute, with nothing on it sized for an organization that small.

A person behind a computer speaking to two customers , microsoft and SP Marketplace branding throughout

What does CRM mean in a government tenant?

Ask about CRM in GCC High and you get an availability answer: which Dynamics 365 modules are supported in each environment, which connectors are missing, how far behind the Microsoft 365 Copilot features run. That answers whether you can buy Microsoft's CRM in a government cloud. You can. Dynamics 365 Sales, Dynamics 365 Customer Service and Dynamics 365 Project Operations are available in both GCC and GCC High, alongside Dataverse, Power Apps and Power Automate. Both environments hold data in US data centers, with GCC High running on Azure Government under Microsoft Entra ID Gov.
​
The question defense suppliers are asking is a different one. A supplier with a business development team of four, a pipeline it can still name from memory, and a Microsoft 365 tenant it already pays for has Dynamics 365 available to it and sized for an organization several times larger. Published guidance does not address what that supplier should do instead.
This article covers that second question: tracking accounts, opportunities and customer communication inside GCC and GCC High without standing up a platform built for an enterprise sales operation.

What are Microsoft 365 GCC and GCC High?

GCC and GCC High are the government editions of Microsoft 365. GCC serves US government agencies and their contractors with US data residency under FedRAMP Moderate. GCC High runs on a separate US sovereign cloud under FedRAMP High and ITAR, and is where Microsoft points organizations handling Controlled Unclassified Information under Department of Defense contracts. Regulation decides which edition you land in, so the CRM fits the environment rather than the other way around.
​
Four things change for customer data specifically. Third-party connector availability is narrower in GCC High, and the value of a CRM platform comes from what it connects to. External sharing with primes and teaming partners is restricted by default and has to be opened deliberately. Marketplace availability differs, so a product you shortlist may not install in your environment at all. Microsoft 365 Copilot and AI capability arrives later and covers less ground than in a commercial tenant.
The organizations meeting these constraints for the first time are getting smaller. GCC High Business Premium launched in November 2025 at an estimated 45 percent of G5 cost, bringing 50 to 500 person defense suppliers into an environment that previously priced them out. Most arrive running a commercial CRM they now have to account for.

What are the options for CRM in GCC and GCC High?

​Five approaches are in common use. Judge each on two questions: does the customer record and everything attached to it stay inside your compliance boundary, and does the approach still function when the connectors you rely on are unavailable?

Managing customers on spreadsheets, Outlook and shared mailboxes

Positives: Nothing to buy, nothing to procure, no security review. The data sits inside your tenant already. Small business development teams run this way for years and close work doing it.
​
Negatives: Pipeline visibility depends on whoever maintains the file. Communication history lives in personal mailboxes and leaves with the person, and nothing shows you which opportunities have gone quiet. Proposal documents get emailed as attachments, copied to desktops and duplicated across mailboxes, which is the version control problem your document policy exists to prevent.

Who it suits. A team of three or four tracking a pipeline one person can still hold in their head. The method holds until it outgrows that.

Running Dynamics 365 in GCC or GCC High

Positives: Microsoft's own CRM, available in both environments, with Dynamics 365 Sales, Customer Service and Project Operations supported alongside Dataverse and the Power Platform. Depth of function is the strongest of any option here, and Microsoft settles the compliance position rather than leaving you to argue it.

Negatives: Dataverse licensing sits on top of your Microsoft 365 subscription, and implementation needs a partner. AI capability is partial in GCC and narrower again in GCC High, and new features arrive later than in commercial tenants. For a business development function of five people, configuration effort and ongoing administration cost more than the license.
​
Who it suits. Organizations with a dedicated sales operations function, multi-entity forecasting requirements and the budget for an implementation partner.

Buying a hosted third-party CRM

Positives: The most mature feature sets in the category, refined across two decades of commercial selling, with the polish and the integrations that come from operating at that scale.

Negatives: These run on vendor infrastructure, so your account records, opportunity documents and customer correspondence sit outside your accredited environment and your security team inherits a vendor assessment. Most publish no government cloud offering, and the few that do are authorized and priced for federal enterprise buyers. Where a commercial CRM is already in place, the migration is the moment its position becomes untenable.
​
Who it suits. Commercial organizations with no sovereignty requirement. For a GCC High tenant handling CUI, the architecture is the obstacle rather than the roadmap, so resolve it early rather than waiting on it.

Deploying a tenant-native CRM application

Positives: These install into the tenant you already own and run on services your accreditation already covers, so the security review looks at your configuration rather than a new external dependency. Account and opportunity documents stay in SharePoint under the permissions you already apply to them. You get pipeline structure, follow-up automation and reporting without introducing a second place for regulated content to live.

Negatives: You depend on a vendor's development roadmap rather than your own. The fit is poor for organizations whose document management sits outside Microsoft. Feature and connector availability needs confirming against your specific environment, because government clouds differ from commercial.
​
Who it suits. Organizations already standardized on Microsoft 365 and SharePoint that want customer data governed by controls they have already accredited. SP CRM Core sits in this category, covered in more detail below.

Building your own on SharePoint and the Power Platform

Reading the previous option, an obvious question follows: if it runs on SharePoint lists, Power Automate and Power BI, why not assemble it in-house? Organizations with Power Platform capability ask this and they are right to.

Positives: The build matches your pursuit process exactly, stays entirely inside your tenant and uses licenses you already hold. A SharePoint list of accounts and opportunities is a legitimate starting point and costs nothing.

Negatives: Pipeline stages, follow-up logic, activity history, document association, reminder scheduling and reporting are separate components, and each one needs maintaining once Microsoft changes something underneath it. Government clouds receive those changes on a different schedule from commercial, so you absorb the rework yourself with no vendor testing it first.

The part that decides it. Someone owns this permanently. When that person moves on, an undocumented internal application holds your entire pipeline history, and the internal development queue ranks it below billable work. The comparison worth running is license cost against the salaried hours to build it plus the hours to keep it running every year after.

Who it suits. Organizations with a funded Power Platform team, a pursuit process no product matches, and a plan for who maintains it in 2030.

​A rough decision rule: with a pipeline one person can still track and nothing regulated attached to it, spreadsheets are defensible. Once proposal documents carrying CUI attach to opportunity records, the choice narrows to building inside the tenant or buying inside it.

How does SP CRM Core approach CRM in GCC and GCC High?

How does SP CRM Core approach CRM in GCC and GCC High?

Accounts, contacts, leads and opportunities are held in SharePoint, with the sales funnel configured to your own stages rather than a fixed model. Campaign and lead capture feed the same records, so the history of a pursuit stays with the account instead of scattering across mailboxes.
Documents attach to the account and opportunity in SharePoint document libraries, so proposals, statements of work and pricing sit under the permissions, retention rules and audit logging your tenant already applies. Outlook and Microsoft Teams communication links to the customer record, giving the next person to pick up the pursuit the context the last one had.
Automated tasks and follow-up reminders chase engagements that have gone quiet, and Power BI dashboards report pipeline, forecast and activity. The application runs inside Microsoft Teams, so there is no separate sign-on and no second system for the team to remember to update.

Is SP CRM Core compatible with GCC and GCC High?

Yes, and it is deployed in these environments today. SP CRM Core installs directly into your own Microsoft 365 tenant and runs on native components including SharePoint, Microsoft Teams, Power Automate and Power BI. If your tenant is GCC or GCC High, the application runs inside that accredited environment and inherits your existing identity controls, data residency rules, conditional access policies and audit logging.
​
There is no SP Marketplace cloud, no external database and no vendor-hosted portal, so no third-party service enters your environment and your customer data stays where the rest of your Microsoft 365 content already sits. SP CRM Core runs independently of Dynamics 365 and requires no Dataverse licensing. GCC and GCC High carry documented feature differences from commercial across SharePoint and the Power Platform, so our team confirms feature availability and connector support against your specific environment before deployment.

How do you choose between these approaches?

Six questions narrow it quickly. Answer them in order.

1. How many active pursuits do you track, and how many people touch them?
2. What gets attached to an opportunity record: proposals, statements of work, technical data?
3. Does any of that attached material carry CUI or export-controlled markings?
4. Where would each approach store those documents, and who else can reach them?
5. Which connectors does the approach depend on, and are they available in your environment?
6. Who maintains it in two years, and what happens when that person leaves?
A yes to question three rules out anything storing documents outside your tenant, whatever its feature list looks like.

​ Questions five and six then separate building from buying.

Worth asking during your migration
Every GCC High migration includes an application inventory. Ask whether your current CRM has a documented path into the new environment before the migration plan is signed. Tools without one become replacement projects competing for the same budget and the same quarter as the migration itself.

Does the CMMC suspension change any of this?

​No. On 13 July 2026 the Department of War suspended the CMMC Phase 2 certification deadline, originally 10 November 2026, pending a 60 day review that cited compliance costs on smaller contractors.
What paused is third-party certification. Phase 1 self-assessments, DFARS 252.204-7012 and NIST SP 800-171 all remain in force, and each governs CUI wherever it sits, including inside a document attached to an opportunity record. The suspension changed the pace of migration rather than the obligation behind it, which gives organizations more room to choose tooling properly instead of less reason to bother.

Frequently asked questions

Does SP CRM Core require Dynamics 365 or Dataverse?

No. SP CRM Core is a separate application built on SharePoint, Microsoft Teams and the Power Platform. It runs on the Microsoft 365 licensing you already hold and needs no Dynamics 365 subscription or Dataverse capacity.

Is CRM data subject to CUI and ITAR rules?

The records themselves are low sensitivity. The documents attached to them are not. Where a proposal or technical package carrying CUI is stored against a customer record, the same handling obligations apply as anywhere else in your environment.

Can we run SP CRM Core alongside Dynamics 365?

Yes. They are independent applications, and organizations run Dynamics 365 for one function while a department that needs something lighter runs SP CRM Core in the same tenant.

Does Microsoft 365 Copilot work with CRM data in GCC High?

Copilot availability is partial in GCC and narrower again in GCC High, and features reach government clouds later than commercial tenants. Because SP CRM Core holds its data in SharePoint rather than a separate database, the records sit in the same content estate Copilot reads from as that support expands in your environment.

How is GCC and GCC High pricing handled?

Separately from commercial pricing, based on your user numbers and environment. Contact us for a formal quotation.
​

Start with what is attached to the record

Every option here stores a contact list. Fewer of them tell you where the proposal attached to that opportunity is sitting tonight, who can reach it and which version is current. That question narrows the shortlist faster than any feature comparison.
​
See GCC and GCC High pricing or take a closer look at SP CRM Core.