By William Price, Certified CMMC Assessor (CCA) — A³ Vallum CMMC Advisory

This is the question that lands almost every week. A small contractor, already in Microsoft 365 Commercial, hears about CMMC and starts pricing GCC High. The license cost is sometimes 4x. So, the contractor wants to know if they can stay on commercial and pass a Level 2 assessment. The marketing material from one Microsoft partner says yes, the marketing material from another says absolutely not, and the rule itself sits in three different places.

Here is the rule with the citations, so the tenant decision lands on the data and the contracts — not on a marketing page.

No. Microsoft 365 Commercial is not appropriate for storing CUI. DFARS 252.204-7012(b)(2)(ii)(D) requires any external cloud service handling covered defense information to meet the FedRAMP Moderate baseline (or equivalent), and the Microsoft 365 productivity services in Commercial — Exchange Online, SharePoint Online, OneDrive for Business, and Teams — are not FedRAMP Moderate authorized. M365 Commercial is appropriate for FCI under CMMC Level 1; it is not appropriate for CUI under Level 2. Microsoft 365 GCC is FedRAMP High authorized and can hold CUI that is not export-controlled. Microsoft 365 GCC High is the only Microsoft tenant authorized to hold ITAR technical data and CUI subject to U.S.-persons access restrictions. Most CMMC Level 2 contractors land in GCC High the moment ITAR or export-control constraints enter the picture. The hybrid pattern — Commercial for general business, GCC High for the CUI — is the cleanest answer for contractors with both kinds of work.

A note on Azure Commercial vs. Microsoft 365 Commercial

This is the place most contractors get confused, and it is the source of the “but Microsoft has a FedRAMP High authorization” objection that occasionally surfaces in conversations.

Azure Commercial — the underlying IaaS for Microsoft 365 Commercial — does have a FedRAMP High authorization on the FedRAMP Marketplace. But it only covers a defined set of Azure infrastructure services.

Microsoft 365 Commercial (the productivity suite) is a different product family. The services contractors actually rely on day-to-day (Exchange Online, SharePoint Online, OneDrive for Business, Teams) are not FedRAMP authorized when consumed from a commercial M365 tenant. The FedRAMP authorization for those workloads lives in the GCC and GCC High tenant families.

Microsoft’s own public sector team lays this out in Understanding Compliance Between Commercial, Government, DoD & Secret Offerings – the authoritative Microsoft reference on which tenant maps to which compliance regime.

So when someone tells you “Microsoft Commercial is FedRAMP High,” the truthful response is: parts of Azure Commercial are; the M365 productivity services your users live in are not. For CMMC Level 2, the M365 services are the ones the assessor will look at.

What the rule actually requires

Three regulatory regimes converge on this decision. Read them together.

DFARS 252.204-7012(b)(2)(ii)(D) requires that any external cloud service handling covered defense information meet the FedRAMP Moderate baseline or equivalent. The DoD CIO’s December 21, 2023 memo on FedRAMP Moderate Equivalency lays out what “equivalent” actually means in practice.

NIST SP 800-171 Rev. 2 control 3.13.11 requires FIPS-validated cryptography for protecting the confidentiality of CUI. This pulls in the question of whether the cloud service’s encryption modules are FIPS-validated under the CMVP.

The CMMC Scoping Guide – Level 2 classifies any cloud service that processes, stores, or transmits CUI as a CUI Asset. Which means its protections become part of your assessment.

Then there are the export-control regimes that often land on top of CMMC for defense contractors:

ITAR (22 CFR Parts 120–130) restricts technical data to U.S. persons and prohibits export to foreign nationals or foreign locations without a license. ITAR has nothing to do with CMMC directly. But it controls who can touch the data and where the data can sit, which has everything to do with which Microsoft tenant you can use.

EAR (15 CFR Parts 730–774) has parallel restrictions, with a more nuanced “deemed export” framework. Many CMMC contractors are subject to EAR, ITAR, or both.

The DFARS clause sets the FedRAMP floor. The export-control regimes set the access and residency floor. CMMC requires you to demonstrate both.

The Microsoft tenants for CMMC

Microsoft offers three M365 tenant families that matter for CMMC.

Microsoft 365 Commercial. The standard tenant everyone knows about. The productivity services here are not FedRAMP Moderate. Appropriate for FCI under CMMC Level 1. Not appropriate for CUI under CMMC Level 2.

Microsoft 365 GCC. Government Community Cloud. Separate tenant family, FedRAMP High authorized for the core productivity services, U.S.-only data residency. It is designed for federal customers and contractors. It can hold CUI that is not export-controlled. Does not support ITAR.

Microsoft 365 GCC High. A separate tenant in the U.S. Sovereign cloud, FedRAMP High authorized, supports DFARS 252.204-7012, supports ITAR. Operated by U.S. persons. The default landing spot for CMMC Level 2 contractors with mixed CUI categories.

When M365 Commercial is the right call (Level 1 / FCI)

If your contracts only flow down FCI (the 15 safeguards under FAR 52.204-21) Microsoft 365 Commercial is a legitimate and widely-used choice. The Level 1 self-assessment does not require FedRAMP Moderate cloud services. The Commercial tenant, with reasonable hygiene (MFA, Conditional Access, basic DLP, managed devices), can pass a Level 1 self-assessment year after year.

What does not work is using the same Commercial tenant for CUI work just because your team is already there. The moment a CUI-marked document lands in a SharePoint site in M365 Commercial, you have a DFARS 7012 problem and a CMMC Level 2 problem.

Why M365 Commercial is not viable for CUI

The disqualifiers stack up fast. Any one of them closes the door on Commercial. For most defense contractors, all of them apply.

1. The productivity services are not FedRAMP Moderate. Exchange Online, SharePoint Online, OneDrive for Business, and Teams in the M365 Commercial tenant do not carry FedRAMP Moderate authorization. DFARS 252.204-7012(b)(2)(ii)(D) is the floor. Commercial does not meet it for these services.

2. ITAR is the big red line. ITAR requires data residency in the U.S. and access only by U.S. persons. Microsoft has not authorized Commercial for ITAR. Microsoft has authorized GCC High for ITAR. The moment an ITAR technical drawing crosses the door, Commercial is off the table.

3. The commercial tier is operated globally. Microsoft’s Commercial cloud has support and operations personnel outside the U.S. GCC High is operated by U.S. persons in U.S. facilities. For CUI subject to U.S.-persons constraints — which is most CUI defense contractors touch — this alone disqualifies Commercial.

4. Export-controlled CUI compounds the problem. EAR 600-series and 9X515-series technical data carry effectively the same access constraints as ITAR. Contracts that invoke these regimes push the tenant decision to GCC High by force.

5. Prime flow-down is usually explicit. Some primes may low down GCC High requirements in the subcontract clause. Once that is signed, the architecture decision is made for you.

6. The CUI category may close the door directly. The CUI Registry includes categories — particularly under SP-EXPT and SP-DCRIT — that effectively impose the same U.S.-persons constraint.

None of this is a marketing position. It is the regulatory floor under the DFARS clause, combined with the export-control regimes that ride on top, applied to the actual FedRAMP authorization status of the M365 productivity services Microsoft sells in the Commercial tenant.

DIBFI for tenant decisions

DIBFI builds the tenant-decision workflow, the FedRAMP-mapping evidence, and the export-control determination directly into the readiness platform — so the architecture decision happens with citations, not with marketing pages. Built for MSPs and consultants supporting CMMC clients.

See how →

The “we don’t have ITAR” trap

The most common trap we see at small manufacturers and engineering shops is a confident “we don’t have ITAR” that turns out to be wrong six months later.

The contractor stands up GCC for what they believe is non-ITAR CUI. Investments in licensing, Conditional Access, DLP, training. Then a new contract or a program revision pushes a drawing under U.S. Munitions List Category XII or technical data under USML Category XV across the threshold. Then, the architecture has to change and data has to be migrated. The cost of moving is now greater than the cost of having gone to GCC High in the first place.

If your business is anywhere in precision-machining, aerospace, electronics, or RF, “we don’t have ITAR” should be tested against your contract portfolio, your customer technical-data exchanges, any potential future contracts, and your business development pipeline. Check with your prime or contract officer about an export-control determination before you commit to a tenant strategy.

A pragmatic decision framework

For a small or mid-market contractor, the questions we work through with clients:

  1. What is the highest data category that flows down in your contracts — FCI only, or CUI? If FCI only → Commercial is on the table. If CUI → Commercial is off the table for the CUI workload.
  2. Is any CUI in scope ITAR or EAR-controlled to U.S. persons? If yes → GCC High.
  3. Is your prime or contracting officer specifying a tenant? If yes → follow the specification.
  4. If the CUI is not export-controlled and no flow-down dictates GCC High, is GCC viable on cost and feature coverage? GCC is sometimes the right answer; check it before defaulting to GCC High.
  5. Can your senior official sign the annual affirmation in good faith on the architecture you’ve chosen? Ambiguity at this stage means GCC High is the right call.

Run that and the tenant decision usually surfaces itself. If any answer pushes you off Commercial for CUI work, do the math on GCC High licensing now including migration cost from your current Commercial environment.

The hybrid pattern

We get the hybrid question on many discovery calls. Can we keep Commercial for everything except CUI, and use GCC High only for CUI workflows? Yes. It is the architecture most often used for small/mid-market companies.

The split:

Commercial M365 for general business email, internal collaboration, finance, HR, marketing (anything that is not CUI).

GCC High for CUI email, CUI document storage, CUI Teams collaboration, CUI engineering work.

A clear, enforced boundary between the two – separate tenants, separate identities, conditional-access fences, no shared SharePoint sites, DLP that blocks CUI from leaving GCC High into Commercial.

Clear training so users know which tenant to use for which work.

This works. The cost is doubled administrative burden. There are two tenants, two identity providers, two MDM postures, and it can sometimes be a discipline tax on users. For a contractor with significant non-CUI business and a real but bounded CUI workflow, it is the cleanest answer.

The CUI still lives in GCC High. Commercial just keeps its existing scope and stays out of the boundary. For more on what passes inside the GCC High tenant, see CUI in Microsoft Teams, SharePoint, and OneDrive: Scoping Guide for GCC High.

Common mistakes

1. Confusing Azure Commercial with M365 Commercial. Azure Commercial has services FedRAMP High authorized. The M365 productivity services in Commercial do not have FedRAMP Moderate authorization. Don’t let an MSP slide between the two product families in a sales conversation.

2. “We’re already in Commercial and we have CUI – let’s just lock it down.” Architecture controls do not override the FedRAMP authorization status of the underlying service. The DFARS clause is on the service, not on the configuration. There is no Conditional Access policy that retroactively makes Exchange Online in M365 Commercial FedRAMP Moderate.

3. ITAR shows up six months in. The certification history now includes a period where CUI was handled in a non-authorized environment. That is a CUI mishandling event under DFARS 252.204-7012(c).

4. The tenant is sprawling. Even in a clean Level 1 / FCI Commercial environment, a tenant with 47 SharePoint sites, mixed vendor data, third-party Teams apps, and a Power Automate flow that pushes data to non-authorized Salesforce makes the boundary impossible to draw cleanly. Tenant hygiene matters even when you are not in scope for CUI.

5. No FIPS evidence in GCC High. The contractor relies on Microsoft’s general statement that data is encrypted, without producing the CMVP certificate for the specific module in the path. The fix is procedural – pull the certificate, file it. Even in GCC High, the evidence is yours to produce.

6. Annual affirmation signed without testing the boundary. The senior official signs based on documentation that is six months old. The architecture has drifted.

Frequently Asked Questions

Can I store CUI in Microsoft 365 Commercial? No. The productivity services in M365 Commercial — Exchange Online, SharePoint Online, OneDrive for Business, Teams — are not FedRAMP Moderate authorized. DFARS 252.204-7012(b)(2)(ii)(D) requires FedRAMP Moderate or equivalent for any external cloud service handling covered defense information. Commercial does not clear that bar for these services.

What if I’m only Level 1? Level 1 — the FAR 52.204-21 fifteen safeguards — is for FCI, not CUI. Microsoft 365 Commercial is widely used and appropriate at Level 1. The FedRAMP Moderate floor only applies once CUI enters the picture under DFARS 7012 and CMMC Level 2.

Isn’t Microsoft Commercial FedRAMP High? Parts of Azure Commercial — the IaaS — are FedRAMP High authorized. Microsoft 365 Commercial — the productivity suite people actually use — is not. The two are different product families on the FedRAMP Marketplace. The M365 productivity services that hold FedRAMP High authorization live in the GCC and GCC High tenants.

Can I use Microsoft 365 GCC instead of GCC High? Sometimes. GCC is FedRAMP High authorized and is a real option for CUI that is not export-controlled. It is generally cheaper than GCC High. Once ITAR or U.S.-persons constraints enter, GCC High is the only Microsoft option.

My MSP says Commercial is fine for CUI. Should I trust them? Push back. Ask the MSP to show you the FedRAMP Moderate authorization for the specific M365 productivity services your CUI workflow touches, in writing, from the FedRAMP Marketplace. If the answer is a marketing page or a hand wave at “Microsoft is FedRAMP authorized,” the answer is no. See Red Flags When Vetting a CMMC MSP.

What about Google Workspace, Zoho, or other commercial productivity suites? Same rule. The service must be FedRAMP Moderate or equivalent for CUI. Google Workspace has Assured Workloads and a U.S. government tier. Standard Google Workspace does not satisfy DFARS for CUI. Zoho’s FedRAMP authorization status is narrower than most contractors realize. Verify before relying.

If I move to GCC High, do I have to move all of my email, or just the CUI parts? The parts that handle CUI. The hybrid pattern — Commercial for general business, GCC High for CUI — is common and survivable. The discipline that makes it work is the boundary. Clear, documented, enforced.

How long does a GCC High migration take for a small contractor? 90 to 180 days for a small contractor. 6 to 12 months for a mid-market contractor. The earlier you start, the less it costs.

Closing thought

The contractors who get the tenant decision right are the ones who treat it as a data and contract question first – export-control determination, FedRAMP-authorization mapping, prime flow-down review – and a licensing-cost question second. The contractors who reverse the order pay for it twice. Once when they over-invest in Commercial for a workload it cannot legally hold. A second time when they migrate to GCC High at six months’ notice with a CUI mishandling note already in the file. So before you sign the next license renewal, ask yourself “has anyone in your organization actually pulled the export-control determination on your contract portfolio, or is “we don’t have ITAR” a comfortable assumption?

A³ Vallum runs tenant-decision and architecture engagements for CMMC contractors. If you are between Commercial and GCC High and you want a citation-grounded read before you commit, reach out for a CCA’s read on the tenant that fits your data and your contracts.

About DIBFI for MSPs and consultants

DIBFI is a multi-tenant CMMC readiness platform built for MSPs and consultants. White-label by design, with SSP builders, CRMs, evidence lockers, tenant-decision workflows, and “Ask an Assessor” guidance built in. Manage scope, evidence, POA&Ms, and assessment readiness across your entire client portfolio in one place.

Learn more →

Sources

  • DFARS clause 252.204-7012 — Safeguarding Covered Defense Information
  • NIST SP 800-171 Revision 2 — security requirements (SC.L2-3.13.11 FIPS-validated cryptography)
  • NIST SP 800-171A — assessment objectives
  • CMMC Assessment Scope – Level 2, v2.13 (September 2024), DoD CIO (DoD-CIO-00006)
  • FedRAMP Marketplace — Microsoft Azure Commercial listing (Azure IaaS High authorization, distinct from M365 Commercial)
  • Microsoft Public Sector Blog — Understanding Compliance Between Commercial, Government, DoD & Secret Offerings
  • NIST CMVP — Cryptographic Module Validation Program active validation list
  • ITAR — 22 CFR Parts 120–130
  • EAR — 15 CFR Parts 730–774
  • Microsoft Compliance offerings — FedRAMP authorization scope by tenant family, Microsoft Learn
  • DoD CIO Memo, December 21, 2023, “FedRAMP Moderate Equivalency for Cloud Service Providers”