GCC High was created to meet the needs of DoD and Federal contractors that needed to meet the stringent cybersecurity and compliance requirements of NIST 800-171, FedRAMP High, and ITAR, or who need to manage CUI/CDI. GCC High is technically a copy of the DoD cloud but exists in its own sovereign environment.

With GCC High, you begin to see a noticeable loss of feature parity with commercial environments. Things like Calling Plans and Compliance Manager aren’t available, and several tools like Microsoft Defender ATP, Cloud App Security and Intune are missing a few functions. The reasons for this are threefold.

First is the federal approval process. Each feature must be rigorously tested in the DoD and Microsoft GCC High clouds to assure compliance and security.
Secondly, for many of the applications, a dedicated staff that has passed Department of Defense IT-2 adjudication based on an Office of Personnel Management investigation is required for development and support.
Finally, some of Microsoft 365 applications will fail to meet compliance requirements by their very nature. Ironically, this happens most frequently with security and governance tools, since they require standing access to data in order to be effective. In some cases, when the tools are critical, such as Azure Sentinel, Cloud App Security, and Microsoft Defender the tools are almost completely rebuilt to meet these criteria. For other tools, like Yammer, they are simply left behind with no intent to bring them onto the roadmap.