The Short AnswerSoftware qualifies for Microsoft 365 GCC and GCC High based on where it runs. Applications that install into your own tenant and stay there operate within the accreditation you already hold. Applications hosted on a vendor’s own cloud have to earn separate authorization, usually FedRAMP or an agency ATO, before a government tenant will accept them. That divides the available market into three groups. Microsoft’s own services, SharePoint, Teams, Power Automate, Power BI and Dynamics, are accredited for GCC and GCC High directly. A small number of externally hosted vendors have completed FedRAMP authorization and can be approved on that basis, though the list is short and the pricing usually reflects the cost of getting there. The third group is tenant-native applications assembled from SharePoint and Power Platform components. These inherit the accreditation of the tenant they install into, because no customer data ever leaves it. SP Marketplace products fall into that third group. The applications are built natively on SharePoint, Microsoft Teams, Power Automate and Power BI, and they install into the customer’s own Microsoft 365 environment. Documents, records and the application itself sit on your tenant rather than a vendor cloud, so if your tenant is accredited, the application inside it operates within that accreditation. Some Power Platform features behave differently in sovereign environments, and SP Marketplace confirms feature-level parity against your specific tenant during scoping. The full product range available for GCC and GCC High:
SP Marketplace quotes GCC and GCC High pricing on request. Published prices on the pricing page apply to standard commercial tenancies only.  Microsoft App Icons falling downwards Why does externally hosted software struggle in GCC and GCC High?Microsoft 365 GCC is built for US government agencies, state and local government, and their contractors, with customer content stored in the United States and logically segregated from the commercial service. GCC High runs on a separate US sovereign cloud and is the environment Microsoft offers for organizations handling Department of Defense controlled unclassified information or subject to ITAR. Both require an eligibility validation process before an environment is established. The practical consequence for buyers is a much shorter shopping list. Third-party application availability inside these environments is restricted, and software written for commercial Microsoft 365 does not automatically carry across. The obstacle is where the software lives. A conventional ISV hosts its application on its own cloud infrastructure and connects to your tenant through an API. That model moves your data out of your accredited environment and into the vendor's. The vendor's infrastructure then has to be authorized as well, which means FedRAMP sponsorship, a StateRAMP or agency ATO, or an equivalent path. That process is slow and expensive, and a vendor who has not completed it cannot be approved for a GCC High tenant however strong the feature set is. The second obstacle is commercial. Building and maintaining a separate sovereign-cloud version of a hosted product costs money that only pays back at volume, so many ISVs decide the government market is too small to serve and never attempt it. How does tenant-native architecture change the compliance question?SP Marketplace builds tenant-native applications, which sidestep the hosting problem by never leaving the tenant. Your data stays where it already is. All documents, records and the application itself reside on your Microsoft 365 tenant. There is no vendor-hosted database, no external data store, no replication to a third-party cloud. No second security boundary gets created. Because nothing crosses out of your environment, SP does not introduce an additional attack surface or an additional accreditation scope. The compliance boundary you already operate is the only one in play. Governance is inherited, not rebuilt. Sign-on, group membership, conditional access and permissions all run through your existing Microsoft Entra ID. Access control follows the rules your security team already enforces, and offboarding a user removes their access to SP applications at the same moment it removes everything else. The Microsoft stack does the heavy lifting. SP applications are assembled from SharePoint, Teams, Power Automate and Power BI, components Microsoft already operates inside GCC and GCC High under the relevant accreditations. SP adds structure and workflow on top of accredited platform services rather than substituting its own. This is the advantage an external ISV cannot replicate. A SaaS vendor has to earn compliance separately. SP Marketplace inherits yours. What should you still check during scoping?Running inside the tenant removes the authorization barrier. It does not guarantee that every feature behaves identically in every environment. The core SharePoint layer stays consistent across commercial, GCC and GCC High. Some Power Platform features and connectors work differently in government clouds, and what is available to you can also depend on the licenses your organization holds. Anything that integrates with a service outside the tenant, electronic signature tools among them, needs checking on its own terms. Any vendor should be willing to confirm this against your specific environment before you commit to anything. SP Marketplace validates it during scoping, and the additional deployment and support requirements involved are why GCC and GCC High are quoted separately from commercial pricing. The full SP Marketplace product range for GCC and GCC High1. SP Policy ManagerSP Policy Manager. Policy and procedure management across the full lifecycle, from drafting through to electronic acknowledgment by employees and contractors.
Why it fits GCC and GCC High: Policy documentation is the paperwork backbone of almost every federal and defense compliance obligation. Assessors ask when a policy was approved, who approved it, and who acknowledged it. SP Policy Manager produces that evidence from inside the accredited tenant, so controlled documents describing your security practices never sit on a commercial vendor's servers. Organizations working to NIST SP 800-171 and DFARS 252.204-7012 keep policy artifacts and their audit trail within the same boundary as the CUI those policies govern. Best fit: Defense contractors and subcontractors with 50 to 5,000 employees, federal civilian agencies, and state and local bodies managing policy sets across multiple departments. 2. SP Safety (EHS)Environment, health and safety management covering hazards, incidents, inspections and regulatory compliance.
Why it fits GCC and GCC High: Defense manufacturing, shipyards, depots and federal facilities carry OSHA obligations alongside their security obligations. Incident records often name personnel, locations and processes that are sensitive on their own terms. Keeping EHS data on the accredited tenant means safety reporting does not become the weak link in an otherwise controlled environment. Best fit: Defense manufacturers and industrial contractors, federal facilities, state and local government operations teams. 3. SP IT Help DeskSP IT Help Desk. Centralized IT service management with ticketing, asset tracking and knowledge management.
Why it fits GCC and GCC High: Help desk tickets are an underestimated disclosure risk. They contain system names, network detail, error output, screenshots and occasionally credentials, and a commercial-cloud ticketing platform pulls all of it outside the boundary. Running the service desk inside the tenant keeps that operational detail where it belongs. Worth saying plainly: help desk is the one category in these environments where credible alternatives exist. SP competes on architecture and on consolidation with the rest of the suite rather than on being the only option available. Best fit: IT teams at defense contractors and government organizations that want service management inside the accreditation boundary, and organizations already running other SP modules. 4. SP Contract TrackerSP Contract Tracker Contract tracking built for Microsoft 365, covering key dates, obligations and compliance reporting.
Why it fits GCC and GCC High: Prime contracts and subcontracts in the defense supply chain carry flow-down clauses, and those obligations have to be tracked and evidenced. Contract documents frequently qualify as CUI or contain proprietary pricing that would be damaging in the wrong hands. A commercial contract lifecycle platform means uploading exactly that material to an unaccredited cloud. SP Contract Tracker keeps the repository and the reporting on your tenant. Best fit: Contract and compliance teams at defense contractors managing prime and subcontract obligations, and government procurement teams. 5. SP Facilities ManagerSP Facilities Manager Facilities and asset management including work orders, maintenance and asset tracking.
Why it fits GCC and GCC High: Facility layouts, access points, equipment inventories and maintenance schedules for a cleared or controlled site describe physical security posture. Organizations that would never place that information in a commercial SaaS platform can run full facilities operations inside the accredited tenant instead. Best fit: Defense contractors operating controlled or cleared facilities, federal and state government estates teams, and public sector facilities departments. 6. SP CRM CoreSales and account management for SharePoint and Teams.
Why it fits GCC and GCC High: This is the module already generating unprompted GCC and GCC High demand, with buyers finding it without any government-facing marketing behind it. The reason is straightforward. Government and defense contractors need pipeline management like any other business, and mainstream CRM platforms either lack a compliant offering or price it beyond reach for a 200-person contractor. SP CRM Core gives those teams account and opportunity management inside the environment they already pay for. Best fit: Business development and capture teams at defense contractors, and government-facing sales organizations that need CRM inside a compliant tenant. 7. SP CRM Core Small Business EditionA lighter configuration of SP CRM Core for smaller teams, priced and packaged for organizations below the standard 50-user batching model. Why it fits GCC and GCC High: Microsoft's November 2025 release of GCC High Business Premium brought sovereign-cloud licensing within reach of small contractors who previously could not justify it. Those organizations still need to manage a pipeline, and they need to do it without enterprise pricing. This edition covers that gap. Best fit: Small defense subcontractors and sub-tier suppliers, typically under 50 users, operating in GCC or GCC High. 8. SP Employee Hub (Intranet in a Box)SP Employee Hub (Intranet in a Box) An employee self-service portal and intranet bringing HR, IT, facilities and internal communications into one Microsoft 365 front door.
Why it fits GCC and GCC High: Onboarding is a recurring GCC High requirement, particularly for contractors bringing cleared personnel into projects with training, briefing and acknowledgment steps that all need recording. An intranet also carries internal communications and HR records that are far easier to govern when they sit under existing tenant retention and DLP policies rather than a separate platform. Best fit: Defense contractors formalizing onboarding and internal communications, government agencies replacing an ageing intranet, and organizations that want one portal fronting multiple SP modules. How should you evaluate any SharePoint app for GCC or GCC High?Five questions separate applications that will pass a security review from applications that will not. They apply to any vendor, including SP Marketplace. 1. Where does the data physically reside? If any customer data leaves the tenant, that destination has to be authorized at the level your contract requires. Ask for a data flow diagram rather than a marketing claim. 2. Does the application create a new security boundary? Anything that stores, processes or transmits data outside your environment extends your accreditation scope and your assessment burden. 3. What external dependencies exist? Third-party APIs, external identity providers, analytics services and OEM components can each introduce a connection that fails review. This is worth asking about explicitly, because it is the detail vendors most often omit. 4. Is it built on SharePoint Framework and Power Platform components already available in your environment? Applications assembled from services Microsoft already operates in the sovereign cloud port across with far less rework than applications built on external infrastructure. 5. What is the vendor's Microsoft certification and verification status? Publisher Verification, Publisher Attestation and Microsoft 365 App Certification are the signals government IT administrators check before approving an application. Ask where the vendor stands. Frequently asked questionsAre SP Marketplace products compliant with GCC High?
Yes. SP Marketplace products run inside the customer's own Microsoft 365 tenant, so they operate within your existing GCC High accreditation boundary rather than requiring separate authorization. No customer data leaves the tenant. Individual features that depend on Power Platform connectors are confirmed against your environment during scoping.
Which SP Marketplace products are available for GCC and GCC High?
Which SP Marketplace products are available for GCC and GCC High?
The full range: SP Policy Manager, SP Safety, SP IT Help Desk, SP Contract Tracker, SP Facilities Manager, SP CRM Core, SP CRM Core Small Business Edition and SP Employee Hub. Some optional add-ons that connect to external services, DocuSign integration among them, are assessed case by case.
Does SP Marketplace need FedRAMP authorization?
Because SP applications run inside the customer's tenant and do not host or process data on external infrastructure, the FedRAMP authorization that applies is Microsoft's, covering the Microsoft 365 environment the application sits in. SP Marketplace can walk through the architecture in detail with your security team.
Do SP products help with CMMC Level 2 compliance?
They support several practice families. Policy documentation, acknowledgment records, incident tracking and controlled document handling all map to CMMC Level 2 requirements, and running them inside the accredited tenant means the evidence itself stays within the CUI boundary. No software makes an organization CMMC compliant on its own; CMMC assesses your whole environment and your practices. What SP provides is the documented, auditable process record assessors ask to see.
What happened to the CMMC Phase 2 deadline?
On July 13, 2026 the Department of War suspended the CMMC Phase 2 certification deadline, originally set for November 10, 2026, pending a 60-day review that cited compliance costs on smaller contractors. The suspension pauses the third-party certification requirement. It does not remove the underlying obligations: Phase 1 self-assessments, DFARS 252.204-7012 and NIST SP 800-171 all remain in force. Organizations handling CUI still need documented policies, incident tracking and controlled document management, whatever form the certification framework takes when it returns.
Can SP Marketplace products run in a CJIS environment?
SP applications inherit the controls of the tenant they are installed in, which includes tenants configured for CJIS requirements. Law enforcement organizations should confirm specific control mappings with SP Marketplace during scoping.
How much do SP Marketplace products cost in GCC or GCC High?
Prices published on the SP Marketplace pricing page apply to standard commercial Microsoft 365 tenancies. GCC and GCC High are quoted separately, reflecting the additional deployment and support requirements in sovereign environments. Contact SP Marketplace for a formal quotation.
Do SP products require code changes to run in GCC High?
The applications are built from SharePoint, Teams, Power Automate and Power BI components that Microsoft operates across all three environments, so the rebuild an externally hosted product would need does not apply. Configuration differences do come up, because Power Platform connectors and features vary between commercial and sovereign clouds. SP confirms what applies to your environment during scoping and adjusts the deployment accordingly.
Are SP Marketplace products available on Microsoft AppSource?
Yes. SP Marketplace applications are listed on Microsoft AppSource, including SP Policy Manager, SP Safety and SP Facilities, and can be reviewed there before purchase.
Does SP Marketplace work with Microsoft 365 Copilot?
SP data is stored in SharePoint lists and libraries inside your tenant, which is where Copilot already looks. Content stays subject to your permissions model, so Copilot surfaces SP records to the users entitled to see them and to nobody else.
Getting GCC and GCC High pricingSP Marketplace quotes GCC and GCC High separately from commercial pricing. Multi-solution discounts apply when two or more products are ordered together, and pricing is available in USD, CAD, AUD, NZD, Euro and GBP.
Contact SP Marketplace for a formal quotation covering your environment, your user count and the modules you need. Deployment is delivered through FullStart, the mandatory first-year implementation service. SP Marketplace also publishes a government solutions overview.
0 Comments
Leave a Reply. |
AuthorGraeme Campbell Archives
August 2026
Categories |
RSS Feed
SP Marketplace Workplace Solutions on Microsoft (Office) 365 are redefining how work is done in over 1000 organizations around the world. See what it can do for you.
|
Social Channels
|
Microsoft 365® is a registered trademark of Microsoft