Microsoft 365 Business Apps for GCC and GCC High

What is the difference between GCC and GCC High?

GCC, the Government Community Cloud, serves US federal, state, local, tribal and territorial government entities, plus organizations handling government-regulated data such as criminal justice or federal tax information. Microsoft 365 GCC meets FedRAMP Moderate.

GCC High is hosted in Azure Government and built for the defense industrial base and for organizations handling export-controlled data or defense CUI. Microsoft designs the Office 365 GCC High service according to Department of Defense Security Requirements Guide Level 4 controls. Microsoft 365 GCC High is listed on the FedRAMP Marketplace as FedRAMP Certified at Class D (High), certified since December 26, 2024, with five authorizations recorded.

These are separate environments with separate tenants and separate service availability. A product that runs in one does not automatically run in the other, so be precise about which one you are asking about.

	Microsoft 365 GCC	Microsoft 365 GCC High
Hosted on	Segregated enclave of commercial Azure	Azure Government
FedRAMP status	Moderate	Certified, Class D (High)
DoD SRG	Not designed to IL4	Designed to Level 4 controls
Built for	Federal, state, local, tribal and territorial government, and regulated data holders	Defense industrial base, export-controlled data, defense CUI
Identity directory	Public directory	Microsoft Entra Government
Eligibility	Government entities and organizations handling government-regulated data	Organizations validated by Microsoft as handling export-controlled data or defense CUI
SP Marketplace apps	Compatible	Compatible, with documented feature differences

Sources: FedRAMP Marketplace and Microsoft Learn.

Why does adding software to an accredited tenant create a problem?

Agencies and contractors move to GCC or GCC High because the accreditation covers where data sits, who can reach it, and how access is logged. Every application added after that has to answer to the same boundary.

Most operational software is sold as Software as a Service. The vendor hosts the application and the data on their own cloud, so your records leave the boundary you were accredited for. That triggers a vendor security review, a documented data flow, and an authorization question that has to be answered before anyone can use the tool. Multiply that across policy, contracts, facilities, safety, IT service, CRM and the intranet, and the review burden becomes the reason nothing gets adopted.

What happens instead is familiar. Policy documents sit on shared drives with no acknowledgment trail. Contract renewal dates live in a spreadsheet owned by one person. Maintenance history is scattered through email. Safety incidents get logged in three different places. The work still happens, and the record an auditor or contracting officer asks for does not exist in one place.

How do SP Marketplace products work inside GCC and GCC High?

Each application is a configured SharePoint site collection. Installing one adds sites, lists, libraries, Power Automate flows and Power BI dashboards to your tenant, with permissions and security already set up. Nothing is installed on servers, and your security team reviews SharePoint configuration inside an environment they already own.
Four things follow, and they hold for every product.

I WANT TO KNOW MORE

The application installs into your tenant.

Deployment happens inside your own Microsoft 365 environment. If that tenant is GCC or GCC High, the application runs inside that accredited environment. Nothing is provisioned on a shared platform belonging to SP Marketplace.

It runs on native Microsoft components.

SharePoint, Microsoft Teams, Power Automate and Power BI do the work. The product is a configured set of sites, lists, libraries, flows and dashboards rather than separate software calling out to an external service.

It inherits the controls you already run.

Identity controls, data residency rules, conditional access policies and audit logging apply to the application because they apply to the tenant. Authentication runs through your existing directory with no separate credentials to issue or manage.

No third-party cloud service enters your environment.

There is no external hosting arrangement to assess and no external data flow to document. Your security team reviews a SharePoint configuration inside your own environment rather than a vendor's platform.

Which applications run in GCC and GCC High?

These products install into your own tenant, run on SharePoint, Teams, Power Automate and Power BI, and are customizable by power business users without developer involvement. Pick one or run several together; the data sits in the same environment either way.

SP Contract Tracker

Contract records, obligations, renewals and expirations. Contract documents, obligation and milestone records, renewal and expiration dates, and approval history stay in your tenant.

CONTRACTS

SP Policy Manager

Policy lifecycle, distribution and acknowledgment tracking. Policy documents, acknowledgment records, employee compliance status and Power BI compliance dashboards stay in your tenant.

POLICY

SP Facilities Manager

Work orders, assets and preventative maintenance. Work order history, asset and equipment records, maintenance schedules, and contractor and vendor details stay in your tenant.

FACILITIES

SP Safety

Incidents, observations, inspections and EHS compliance. Incident records, hazard observations, corrective actions, inspection findings and employee certification records stay in tenant.

SAFETY

SP Employee Hub

Intranet, document access and employee self-service. Internal communications, department documents and forms, employee directory information and service requests stay in your tenant.

EMPLOYEE HUB

SP IT Helpdesk

Ticketing, IT assets, change and vendor management. Ticket data, IT asset records, change approval history, vendor contracts and license records stay in your tenant.

HELPDESK

SP CRM Core

Leads, accounts, opportunities and pipeline reporting. Lead and contact records, account data, opportunity pipeline, campaign activity and linked documents stay in your tenant.

CRM

How does this compare to SaaS alternatives?

	SP Marketplace	SaaS GRC platform	SaaS helpdesk	Dynamics 365
Where data sits	Your Microsoft 365 tenant	Vendor cloud	Vendor cloud	Microsoft cloud, separate service
New authorization boundary	None	Yes	Yes	Assess separately
Vendor security review	No new vendor cloud to assess	Required	Required	Microsoft documentation applies
Data if subscription ends	Stays in your tenant	Export or lose	Export or lose	Stays in Microsoft
Licensing model	By team size	Per user	Per agent	Per user
Customization	No-code, by business users	Vendor-controlled	Vendor-controlled	Developer or partner

The comparison that matters for an accredited tenant is where the data lives. Every row above follows from that one difference.

Frequently Asked Questions

What does "compatible with GCC High" actually mean?

The accreditation belongs to your tenant rather than to the application. SP Marketplace products are compatible with Microsoft 365 GCC and GCC High, meaning they run inside those environments and inherit their controls. Commercial Microsoft 365 does not carry GCC accreditation, so a product running in a Commercial tenant is running in a Commercial environment regardless of which application is installed. SP Marketplace does not hold a FedRAMP authorization and does not claim one. The products add no cloud service of their own, so the controls they run under are the controls Microsoft already holds for the services they are built from.

What does DFARS 252.204-7012 require of a cloud service?

The clause requires contractors handling covered defense information to use cloud services meeting "security requirements equivalent to those established by the Government for the Federal Risk and Authorization Management Program (FedRAMP) Moderate baseline." That obligation attaches to the cloud service holding the data. When your business applications run inside your own Microsoft 365 Government tenant, the cloud service holding the data is Microsoft 365. Microsoft 365 GCC is FedRAMP Moderate. Microsoft 365 GCC High is FedRAMP Certified at Class D (High). Adding an SP Marketplace application introduces no additional cloud service.

What evidence supports the claim that these products run in an accredited environment?

SharePoint, the foundation for all seven products, is available across GCC, GCC High and DoD. Power Automate US Government has been available in GCC High since September 2019, designed to meet DISA SRG IL4, with a Provisional Authority to Operate granted by DISA. It requires Microsoft Entra Government for identity rather than the public directory GCC uses. In the government environment, customer content is logically segregated from the commercial service, stored within the United States, and access is restricted to screened Microsoft personnel. SP Marketplace has built no-code business applications on the Microsoft 365 platform since 2012, now running in over 1,000 organizations, and publishes on Microsoft Marketplace under the SP Marketplace publisher identifier.

Do all features work the same way in GCC High?

No, and confirming that is part of deployment. Microsoft publishes feature differences between Commercial, GCC and GCC High across SharePoint and the Power Platform. Connector availability in Power Automate, service release timing, and certain Microsoft Graph capabilities vary by cloud. Three differences affect SP Marketplace products directly. Approve and reject buttons inside Outlook are unavailable in GCC High, so approvers act in the Approvals app in Teams, which keeps the audit record intact. Graph functionality within SharePoint Online is disabled in GCC High, which affects SP CRM Core. In both GCC and GCC High, the organization assets library is unavailable and web parts reaching external services such as YouTube will not behave as expected, which affects SP Employee Hub. Before deployment, the SP Marketplace team confirms feature availability and connector support against your specific environment.

How long does deployment take?

SP Policy Manager and SP Contract Tracker typically implement in two to four weeks, including setup, configuration and light admin training. Products ship with process flows, notification rules, permission groups and security configurations already defined. The Full Start deployment service takes a team through a full rollout using a project plan, online video training, worksheets and live sessions covering appearance, content, documents, processes and security. Every product is customizable by power business users without developer involvement.

What happens to our data if we stop the subscription?

It stays in your tenant. The applications hold their data in your own SharePoint sites, lists and libraries, so there is nothing to export from a vendor platform and nothing held hostage. Your data remains in your own environment if the subscription ends.

Do these applications require Dynamics 365?

No. SP CRM Core manages leads, accounts, contacts and opportunities inside SharePoint and Microsoft Teams with no separate CRM platform, and is licensed by team size rather than per user, so adding sales people does not add CRM licensing cost. None of the seven applications require Dynamics 365.

Microsoft 365 Business Apps for GCC and GCC High Tenants