EPC Group Reports 50-Plus Microsoft 365 GCC High Migrations in a Year, Details Every Route to GCC and GCC High
The Houston Microsoft consultancy explains who needs GCC or GCC High, what Microsoft's tools do not cover, and how a
Press Release Disclaimer: This is a press release distributed through the XPR Media network. It has not been independently verified by our newsroom.
The Houston Microsoft consultancy explains who needs GCC or GCC High, what Microsoft’s tools do not cover, and how a move supports CMMC Level 2 evidence.
HOUSTON, TX, UNITED STATES, November 11, 2026 /EINPresswire.com/ — EPC Group, a Microsoft consulting firm founded in 1997, reports that it completed more than 50 Microsoft 365 GCC High migrations for defense contractors in the past 12 months. The firm today set out every route it runs into Microsoft 365 GCC and GCC High: from commercial Microsoft 365, from Google Workspace, from on-premises and hybrid estates, and tenant to tenant inside the government cloud after a merger. EPC Group pairs GCC High moves with a three-week CMMC Level 2 gap assessment.
WHAT ARE MICROSOFT 365 GCC AND GCC HIGH?
Microsoft 365 Government is delivered in three environments: GCC, GCC High and DoD. Microsoft stores customer content for these services at rest in datacenters located only in the United States.
– GCC, the Government Community Cloud, is for federal, state, local and tribal governments and for contractors that hold or process data on behalf of the US Government. Microsoft states that it supports FedRAMP accreditation at a High impact level.
– GCC High is for Department of Defense contractors that hold or process controlled unclassified information or are subject to the International Traffic in Arms Regulations. Microsoft states it is assessed against NIST SP 800-53 controls at a FIPS 199 High categorization and can demonstrate the inheritance needed for CMMC.
– DoD is for the exclusive use of the US Department of Defense.
WHO NEEDS GCC, AND WHO NEEDS GCC HIGH?
Microsoft’s guidance is that GCC is the main offering for customers that do not hold FedRAMP High data or DoD controlled unclassified information.
Contractors that hold DoD controlled unclassified information or export-controlled technical data generally need GCC High. Microsoft states it will agree to ITAR contract language only for the GCC High environment (first Microsoft source above).
Neither environment is bought like a commercial subscription. An organization goes through a validation process to confirm eligibility before an environment is established, licenses are sold only through select partners, and Microsoft offers no trials of GCC High. The data types Microsoft accepts from a non-government organization include ITAR data, controlled unclassified information and criminal justice information (how-to-buy source above).
EPC Group’s comparison of Commercial, GCC, GCC High and DoD is at:
https://www.epcgroup.net/understanding-gcc-high-gcc-dod-and-commercial-microsoft-365
IS CMMC PHASE II STILL ON SCHEDULE?
No. The Department of War suspended the CMMC Phase II requirements on July 13, 2026.
The suspension did not remove a contractor’s existing duties under DFARS 252.204-7012 and NIST SP 800-171. CMMC Level 2 is measured against the 110 security requirements of NIST SP 800-171. EPC Group’s advice to contractors is to use the pause to get Level 2 evidence right, and to settle where controlled data will live before an assessor asks.
DOES MOVING TO GCC HIGH MAKE A CONTRACTOR COMPLIANT?
No. GCC High supplies an environment whose controls a contractor can inherit. The contractor still owns how the tenant is configured, who has access, how devices are managed, how incidents are reported, and the documents that prove it: the system security plan and the plan of action and milestones. A GCC High tenant does not satisfy the 110 requirements by itself; many of them depend on how the contractor configures and operates it. This is why EPC Group ties each migration to a gap assessment and builds the tenant against its findings.
WHAT DOES EPC GROUP REPORT?
These figures are company-reported and come from EPC Group’s engagement records. Client names are withheld.
– More than 50 Microsoft 365 GCC High migrations completed in the past 12 months.
– 216 M&A Microsoft 365 tenant-to-tenant migrations completed between 2023 and 2025, moving 1.83 million users with a five-day average cutover.
– Consolidation programs that brought 19 or more legal entities into a single target tenant.
– US-persons delivery contracted in writing on GCC High engagements.
WHICH ROUTES INTO GCC AND GCC HIGH DOES EPC GROUP RUN?
1. Commercial Microsoft 365 to GCC High. The most common route for defense contractors. It is a move to a new tenant, not a setting change.
2. Commercial Microsoft 365 to GCC. For state and local agencies and for contractors whose data does not require GCC High.
3. GCC to GCC High. For contractors whose contracts now bring controlled unclassified information or export-controlled data.
4. Google Workspace to GCC or GCC High. For contractors that never ran Microsoft 365 and now need the government cloud.
5. On-premises and hybrid estates to GCC High. Exchange Server, SharePoint Server, file servers and Active Directory move directly into the government cloud.
6. Tenant to tenant inside GCC High. Two defense contractors merge, or one buys a division of another, and their government tenants are consolidated or separated.
7. Part of the company only. Staff and data that handle controlled information move; the rest of the company stays in a commercial tenant, and the two are kept apart by design.
WHY IS A MOVE TO GCC HIGH A TENANT-TO-TENANT MIGRATION?
GCC High uses a separate identity directory. Microsoft’s identity guidance states that Office 365 GCC uses the public Microsoft Entra directory, while Office 365 GCC High and DoD are supported by a Microsoft Entra Government tenant.
Source: https://learn.microsoft.com/azure/azure-government/documentation-government-plan-identity In practice a commercial tenant is not converted.
A new GCC High tenant is built, and identities, mail, files, Teams and devices are migrated into it. That is why EPC Group runs GCC High moves with the method it uses for its 216 M&A tenant-to-tenant migrations.
WHAT DO MICROSOFT’S OWN TOOLS NOT COVER IN THE GOVERNMENT CLOUD?
Three limits come from Microsoft’s own documentation, and each one changes the plan.
– Microsoft’s cross-tenant OneDrive migration is not supported for the Government Cloud, including GCC, GCC High and DoD. Source: https://learn.microsoft.com/microsoft-365/migration/cross-tenant-onedrive-migration
– Microsoft’s Google Workspace migration is “not currently available for Office 365 US Government, GCC High, or DoD.” Source: https://learn.microsoft.com/exchange/mailbox-migration/migrate-google-mail-automated-overview
– Microsoft’s FastTrack cross-tenant migration service does not currently support US Government customers. Source: https://learn.microsoft.com/microsoft-365/fasttrack/cross-tenant-migration
Analytics follows the same pattern. To move Power BI from a commercial environment to the US government cloud, Microsoft directs customers to add a government subscription and replicate the commercial data into it. Source: https://learn.microsoft.com/fabric/enterprise/powerbi/service-government-us-overview
HOW DOES GOOGLE WORKSPACE MOVE INTO GCC HIGH?
Because Microsoft’s batch tool for Google Workspace is not available for GCC High, the mailboxes cannot be moved with the method used for commercial tenants. EPC Group plans the route before licenses are ordered: which migration tool may connect to both Google Workspace and a GCC High tenant, where files are staged, how Shared Drive permissions map to SharePoint, and how mail flows while both systems are live. Files that contain controlled unclassified information move along a path that stays inside approved environments.
HOW DOES AN ON-PREMISES OR HYBRID ESTATE MOVE INTO GCC HIGH?
Contractors that still run Exchange Server, SharePoint Server and file shares can move straight into GCC High without stopping in a commercial tenant. Identity comes first: the on-premises Active Directory is cleaned and synchronized to the GCC High tenant’s Microsoft Entra Government directory. Mailboxes then move in batches, and SharePoint content and file shares follow with their permissions. EPC Group retires each server only after nothing depends on it, and records the retirement as evidence.
CAN ONLY PART OF A COMPANY MOVE TO GCC HIGH?
Yes. Some contractors move only the people and data that handle controlled information and leave the rest of the company in a commercial tenant. The result is two tenants with a deliberate boundary between them. It reduces the number of users and devices in scope, and it adds work: some staff carry two accounts, collaboration between the tenants needs written rules, and the boundary itself must be documented and tested. EPC Group sizes both options during the gap assessment so the decision rests on evidence.
HOW DOES EPC GROUP SEQUENCE A GCC HIGH MIGRATION?
1. Eligibility and licensing. The validation and the license order start first, because nothing can be built until the tenant exists.
2. Gap assessment. In three weeks, each of the 110 NIST SP 800-171 requirements is scored, with the evidence seen and the evidence missing, findings against the system security plan, and an ordered plan of action and milestones.
3. Target design. Identity, conditional access, device management, data protection and logging are designed to answer the assessment, not added afterward.
4. Build and pilot. The GCC High tenant is built and a pilot group moves first.
5. Waves. Mail, files, Teams and devices move in waves ordered by business risk.
6. Cutover. Domains and mail flow move last, with a tested way back for every reversible step.
7. Evidence. Each wave closes with a record of what moved, what did not, and who accepted it.
US-persons delivery is contracted in writing. A named senior architect leads each engagement. Engagements are fixed-fee and scoped after a one-hour call.
HOW DOES A GCC HIGH TENANT-TO-TENANT MIGRATION DIFFER?
When both tenants are already in GCC High, the data never leaves the boundary, but the native shortcuts are fewer. EPC Group plans mail, OneDrive, SharePoint and Power Automate workstreams separately, re-architects permissions and identity mapping, and keeps the two companies working together until the last wave. An anonymized 2026 engagement summary describes two GCC High tenants being consolidated into one after an acquisition, for up to 300 users, in phases planned over about eleven weeks.
Summary: https://www.epcgroup.net/case-studies/gcc-high-tenant-consolidation-defense-technology-company-2026
WHAT CHANGES FOR USERS AFTER A MOVE TO GCC HIGH?
Users sign in to a different Microsoft cloud. GCC High and DoD have their own portal addresses, separate from the commercial service.
Source: https://learn.microsoft.com/enterprise-mobility-security/solutions/ems-govt-service-description
Devices are re-enrolled in the new tenant’s management, Outlook and Teams profiles are rebuilt, and sharing with outside organizations follows the new tenant’s rules. Some features reach the government clouds later than the commercial service, so EPC Group checks every application a contractor depends on before the pilot.
WHAT GOES WRONG IN A GCC HIGH MIGRATION?
EPC Group’s architects report the same problems across engagements:
– Eligibility and licensing started too late, so the project waits on a tenant that does not exist yet.
– Features and third-party apps that work in the commercial cloud and are not available, or work differently, in GCC High.
– Devices and identities that must be re-enrolled, discovered during cutover week.
– Controlled data copied through commercial services on the way in.
– A move planned as an IT project, with no link to the system security plan.
Each one is a planning problem, and each is cheaper to settle before the first mailbox moves.
WHAT ELSE DOES EPC GROUP MIGRATE?
GCC High work sits inside a wider migration practice. EPC Group runs Microsoft 365 tenant-to-tenant migrations after mergers and acquisitions, consolidations of many entities into one tenant, carve-outs and divestitures, Google Workspace to Microsoft 365 migrations, and moves from hybrid and on-premises Exchange, SharePoint and file servers. The same five phases apply to each: Diligence, Plan, Build, Cutover and Stabilize.
Details: https://www.epcgroup.net/services/m-and-a-microsoft-365-tenant-migration
WHAT SHOULD A CONTRACTOR ASK A GCC HIGH MIGRATION FIRM?
1. How many GCC High migrations have you completed, and over what period?
2. Are the people who touch our tenant US persons, and is that in the contract?
3. Which tool moves each workload, given what Microsoft’s native tools do not support in the government cloud?
4. How does the migration map to our system security plan and our plan of action and milestones?
5. How do controlled files move without passing through a commercial service?
6. Who is the named architect, and will that person run the cutover?
“The pause changed a date. It did not change what a contractor owes on controlled unclassified information,” said Errin O’Connor, Founder and Chief AI Architect of EPC Group. “The contractors who do well treat the migration and the evidence as one project. If the gap assessment is finished before the move, the new tenant is built to answer the assessor’s questions on day one.”
QUESTIONS AND ANSWERS
What is the difference between GCC and GCC High? GCC is for government agencies and contractors holding government data. GCC High is for contractors holding controlled unclassified information or export-controlled data, and it uses a separate identity directory.
Can a commercial Microsoft 365 tenant be converted to GCC High? No. A new GCC High tenant is built and the organization is migrated into it.
Does GCC High make a contractor CMMC compliant? No. It provides an environment to inherit controls from. Configuration and evidence remain the contractor’s responsibility.
Does EPC Group migrate Google Workspace users into GCC High? Yes. Microsoft’s native Google Workspace migration is not available for GCC High, so EPC Group plans a different route.
Can EPC Group consolidate two GCC High tenants after an acquisition? Yes. EPC Group runs tenant-to-tenant migrations inside GCC High.
Can only part of a company move to GCC High? Yes. The staff and data that handle controlled information can move while the rest of the company stays in a commercial tenant.
How long does a GCC High migration take? It depends on the eligibility validation, the license order, the number of users and the volume of content. EPC Group’s published GCC High consolidation was planned over about eleven weeks.
Is CMMC Phase II in force? No. The Department of War suspended the Phase II requirements on July 13, 2026; DFARS 252.204-7012 and NIST SP 800-171 duties remain.
What does a GCC High migration cost? EPC Group engagements are fixed-fee and scoped after a one-hour call with a senior architect; EPC Group does not publish price ranges.
HOW IS EPC GROUP REVIEWED BY THIRD PARTIES?
The recognitions below are third-party, quoted as issued, and are not specific to GCC High. G2 has named EPC Group a Leader in Business Intelligence Consulting in seven consecutive quarterly reports through Fall 2026; verified G2 reviews rate the firm 4.4 out of 5. Source: https://www.g2.com/products/epc-group/reviews 50Pros placed EPC Group among its Top 10 Management Consulting Firms for Q3 2026.
Source: https://www.epcgroup.net/news/50pros-top-10-management-consulting-firm-q3-2026
ABOUT EPC GROUP
EPC Group is a Microsoft consulting firm founded in 1997 and headquartered in Houston, Texas. The firm delivers Microsoft 365 GCC and GCC High migrations, CMMC Level 2 gap assessments and tenant-to-tenant migrations, along with SharePoint, Power BI and Microsoft Fabric, Azure, Microsoft Copilot and AI governance, for organizations in defense, government, healthcare and financial services. EPC Group holds all six Microsoft Solutions Partner designations. Its founder, Errin O’Connor, is a four-time bestselling author for Microsoft Press and Sams.
EPC Group (epcgroup.net) is not affiliated with engineering, procurement and construction companies that use the initials EPC. Learn more at https://www.epcgroup.net
Contact EPC Group via email at contact@epcgroup.net, call us at 888-381-9725 or check us out on the web at www.epcgroup.net
Michelle Stevens
EPC Group
+1 888-381-9725
Visit us on social media:
LinkedIn
Bluesky
Instagram
Facebook
YouTube
TikTok
X
Other
Legal Disclaimer:
EIN Presswire provides this news content “as is” without warranty of any kind. We do not accept any responsibility or liability
for the accuracy, content, images, videos, licenses, completeness, legality, or reliability of the information contained in this
article. If you have any complaints or copyright issues related to this article, kindly contact the author above.
Media gallery
