✓ Available — Generally Available in GCC High
~ Partial — Available with limitations or feature gaps
✗ Not Available — Not in GCC High as of this publication
Critical Endpoint Differences
Every integration, app registration, and API call must target GCC High endpoints — not commercial. Using commercial endpoints in a GCC High tenant fails silently or routes data incorrectly.
Service
Commercial Endpoint
GCC High Endpoint
Microsoft Graphgraph.microsoft.comgraph.microsoft.us
Azure AD / Entra Loginlogin.microsoftonline.comlogin.microsoftonline.us
Microsoft Intune (MDM)manage.microsoft.commanage.microsoft.us
Exchange Onlineoutlook.office365.comoutlook.office365.us
SharePoint*.sharepoint.com*.sharepoint.us
Teamsteams.microsoft.comgov.teams.microsoft.us
Azure Resource Managermanagement.azure.commanagement.usgovcloudapi.net
Azure OpenAI*.openai.azure.com*.openai.azure.us
AI & Machine Learning
| Service | NAICS/Use | GCC High | Notes / CMMC Relevance |
|---|
| Azure OpenAI Service | AI/LLM | ✓ Available | GPT-4o, GPT-4, GPT-3.5 available. Some newer models may lag commercial by weeks. Primary AI workload platform for GCC High. CMMC boundary documentation required in SSP. Endpoint: *.openai.azure.us |
| Azure AI Search (Cognitive Search) | RAG/Vector | ✓ Available | Full feature parity including vector search. Primary RAG retrieval layer in GCC High deployments. |
| Azure Machine Learning | MLOps | ✓ Available | Available in Azure Government. Some AutoML and Designer features may have parity gaps. Verify specific capabilities needed. |
| Azure Bot Service | Chatbot | ✓ Available | Full Bot Framework support. Used in production GovCon AI deployments. |
| Azure Cognitive Services (Vision, Speech, Language) | AI APIs | ~ Partial | Core services available; some specialized models and preview features not yet in GCC High. Verify each service individually against Microsoft's service availability matrix. |
| Azure Document Intelligence (Form Recognizer) | Document AI | ~ Partial | Core prebuilt and custom models available. Some features lag commercial by one release cycle. |
| Microsoft Copilot for M365 | AI Assistant | ~ In Progress | Rollout to GCC High underway in 2026. Feature availability expanding progressively. Verify current GA status on Roadmap Tracker. |
| Security Copilot | SecOps AI | ✗ Not Available | Commercial only as of May 2026. No committed GCC High date. Do not include in GCC High architecture plans without current verification. |
| Copilot Studio (Power Virtual Agents) | Bot Builder | ✗ Not Available | Commercial only. Use Azure Bot Service + Bot Framework SDK for GCC High chatbot development. |
| Azure AI Foundry (formerly AI Studio) | AI Dev Portal | ~ Partial | Some capabilities available via Azure portal; full AI Foundry portal experience lags commercial. Verify current state before project scoping. |
Identity & Access Management
| Service | License Tier | GCC High | Notes / CMMC Relevance |
|---|
| Entra ID (Azure AD) P1 | Business Premium / G3 | ✓ Available | Conditional Access, MFA, SSPR, group-based access. Covers most CMMC L2 IA controls. |
| Entra ID (Azure AD) P2 | G5 | ✓ Available | Adds PIM (Privileged Identity Management), Identity Protection, Access Reviews. Critical for CMMC L2 audit evidence on AC.2.006 and IA.3.083. |
| Entra External ID (B2B) | Included | ~ Partial | Guest access works but with restrictions. External guests from commercial tenants require explicit federation configuration. CMMC scoping implications for external collaborators. |
| Entra External ID (B2C) | Separate | ✗ Not Available | B2C is not available in GCC High. Customer-facing identity scenarios must use alternative approaches. Do not architect B2C dependencies for GCC High workloads. |
| Entra Verified ID | Preview | ✗ Not Available | Verifiable credentials feature not available in GCC High as of May 2026. |
| Microsoft Intune | G3/G5/Addon | ✓ Available | Full MDM/MAM capabilities. Uses manage.microsoft.us endpoint. Required for CMMC CM control family on managed devices. Apple ADE/ABM integration supported. |
Compute, Containers & Serverless
| Service | Type | GCC High | Notes |
|---|
| Azure Virtual Machines | IaaS | ✓ Available | Full VM series available. Azure Government regions: USGov Virginia, USGov Arizona, USGov Texas. |
| Azure Kubernetes Service (AKS) | Container Orchestration | ✓ Available | Full AKS feature parity. Preferred container platform for GCC High workloads. |
| Azure App Service | PaaS Web/API | ✓ Available | Web apps, API apps, WebJobs. Full feature support. |
| Azure Functions | Serverless | ✓ Available | All runtime stacks supported. Consumption and Premium plans available. |
| Azure Container Apps | Container PaaS | ✓ Available | Available in Azure Government. Verify specific region availability. |
| Azure Container Instances (ACI) | Container IaaS | ✓ Available | Available. Simpler alternative to AKS for single-container workloads. |
| Azure Static Web Apps | Static Hosting | ~ Partial | Available in Azure Government with some feature limitations vs. commercial. |
Developer Tools & DevOps
| Service | Type | GCC High | Notes / CMMC Relevance |
|---|
| Azure DevOps | DevOps Platform | ✗ NOT AVAILABLE | Major gap. Azure DevOps is not natively available in GCC High tenant. This surprises many teams. Do not architect CI/CD pipelines dependent on Azure DevOps for GCC High environments. Alternative: GitHub Enterprise (EMU) with Entra ID GCC High SSO integration |
| GitHub Enterprise (EMU) | Source Control / DevOps | ✓ Available | GitHub Enterprise with Enterprise Managed Users supports SAML SSO integration with GCC High Entra ID. Recommended CI/CD and source control path for GCC High CMMC environments. CMMC CM.2.061, CM.2.062. |
| Azure API Management | API Gateway | ✓ Available | Full APIM capability in Azure Government. Useful for managing Azure OpenAI access in GCC High. |
| Azure DevTest Labs | Dev Environments | ✓ Available | Available in Azure Government. |
| Visual Studio App Center | Mobile DevOps | ✗ Not Available | Commercial only. Use GitHub Actions for mobile CI/CD in GCC High context. |
Storage & Databases
| Service | Type | GCC High | Notes / CMMC Relevance |
|---|
| Azure Blob Storage | Object Storage | ✓ Available | Full feature parity. CMMC boundary documentation required if CUI data stored. FIPS 140-2 encryption at rest. |
| Azure Files | File Shares | ✓ Available | SMB and NFS shares available. Common replacement for on-prem file servers in GCC High migrations. |
| Azure Cosmos DB | NoSQL | ✓ Available | Full API support (Core SQL, MongoDB, Gremlin, Table). Used in production GCC High AI deployments (LeoBot architecture). |
| Azure SQL Database | Relational | ✓ Available | Full PaaS SQL including elastic pools, serverless tier, and Hyperscale. |
| Azure PostgreSQL Flexible Server | Relational | ✓ Available | Available in Azure Government. |
| Azure MySQL Flexible Server | Relational | ✓ Available | Available in Azure Government. |
| Azure Data Lake Storage Gen2 | Analytics Storage | ✓ Available | Available. Hierarchical namespace feature supported. |
Networking & Security
| Service | Type | GCC High | Notes / CMMC Relevance |
|---|
| Azure Virtual Network (VNet) | Networking | ✓ Available | Full VNet capability including peering, service endpoints, and private endpoints. SC control family. |
| Azure VPN Gateway | VPN | ✓ Available | Site-to-site, point-to-site, and VNet-to-VNet. FIPS 140-2 compliant cipher suites. |
| Azure ExpressRoute | Private Connectivity | ✓ Available | Available to Azure Government regions. Required for highest-assurance network connectivity to GCC High. |
| Azure Firewall | Network Security | ✓ Available | Azure Firewall and Firewall Manager available in Azure Government. |
| Azure DDoS Protection | DDoS | ✓ Available | Basic and Standard tiers available. |
| Azure Private Endpoint | Private Access | ✓ Available | Critical for CMMC SC boundary — use private endpoints to keep AI/data services off public internet within GCC High. |
| Azure CDN | Content Delivery | ✗ Not Available | Azure CDN is not available in GCC High. Static content delivery requires alternative approaches (Azure Blob static website, GitHub Pages for public content). |
| Azure Front Door | Global Load Balancer | ~ Partial | Available with limitations in Azure Government. Verify specific capability needs. |
| Azure Key Vault | Secrets Management | ✓ Available | Full HSM and software key vault. FIPS 140-2 Level 2 (HSM Level 3). Critical for CMMC SC.3.177 encryption key management. |
| Microsoft Defender for Cloud | CSPM/CWPP | ✓ Available | Full cloud security posture management. Maps directly to CMMC CA and RA control families. |
| Microsoft Sentinel | SIEM | ✓ Available | Full SIEM/SOAR capability. Included in G5. Primary CMMC AU control family evidence platform for GCC High. |
Microsoft 365 Productivity & Compliance
| Service | License | GCC High | Notes / CMMC Relevance |
|---|
| Exchange Online | All tiers | ✓ Available | Full email, calendar, contacts. 50 GB (Business Premium) or 100 GB (G3/G5) mailboxes. ITAR-compliant email. |
| SharePoint Online | All tiers | ✓ Available | Full document management. Use for CMMC document library and SSP hosting. CDN not available — affects page performance. |
| Microsoft Teams | All tiers | ✓ Available | Full collaboration. gov.teams.microsoft.us endpoint. External federation requires configuration. Teams Phone available via Direct Routing. See licensing guide for phone limitations. |
| OneDrive for Business | All tiers | ✓ Available | Full OneDrive capability. iCloud on supervised iOS devices must be disabled — OneDrive is the CUI-compliant file sync alternative. |
| Microsoft 365 Apps (Office) | All tiers | ✓ Available | Word, Excel, PowerPoint, Outlook desktop apps fully available. |
| Microsoft Purview (Compliance) | G3/G5 | ✓ Available | DLP, sensitivity labels, eDiscovery Standard (G3), eDiscovery Premium + Insider Risk (G5). Core CMMC MP and CA evidence platform. |
| Microsoft Purview Compliance Manager | G3/G5 | ✓ Available | CMMC assessment template maps M365 controls directly. Start here for CMMC L2 assessment. |
| Power Automate (GCC High) | All tiers | ~ Partial | Core workflow automation available. Some connectors available in commercial are absent in GCC High. Verify each connector before workflow design. manage.microsoft.us authentication. |
| Power Apps | Addon | ~ Partial | Available with feature gaps vs. commercial. Some advanced connectors and AI Builder features not yet in GCC High. |
| Power BI | Addon | ~ Partial | Power BI Pro and Premium available in GCC High. Some advanced features (e.g., certain AI visuals) lag commercial. |
| Microsoft Stream | G3/G5 | ✓ Available | SharePoint-based Stream available. The defensible choice for CUI-adjacent video in GovCon — not commercial video platforms. |
| Microsoft Viva | Addon | ~ Partial | Some Viva modules available; others commercial-only. Verify individual module availability. |
| Microsoft Copilot for M365 | Addon | ~ In Progress | Progressive rollout to GCC High throughout 2026. Check Roadmap Tracker for current status. |
Integration & Messaging
| Service | Type | GCC High | Notes |
|---|
| Azure Logic Apps | Workflow Automation | ✓ Available | Standard and Consumption tiers available. Government cloud connectors differ from commercial — verify connector availability. |
| Azure Service Bus | Messaging | ✓ Available | Full messaging capability including topics, subscriptions, and queues. |
| Azure Event Grid | Event Routing | ✓ Available | Available in Azure Government. |
| Azure Event Hubs | Data Streaming | ✓ Available | Available including Kafka endpoint support. |
| Azure API Management | API Gateway | ✓ Available | Full APIM capability. Common pattern: APIM in front of Azure OpenAI for rate limiting, logging, and access control in GCC High. |
Management & Governance
| Service | Type | GCC High | Notes / CMMC Relevance |
|---|
| Azure Monitor / Log Analytics | Monitoring | ✓ Available | Full monitoring including Application Insights. Central audit log aggregation for CMMC AU controls. |
| Azure Policy | Governance | ✓ Available | Full policy engine. Use to enforce CMMC-compliant configurations across Azure Government subscriptions. CM control family. |
| Azure Blueprints | Environment Setup | ✓ Available | Available in Azure Government. Useful for repeatable CMMC-baseline environment deployment. |
| Azure Cost Management | FinOps | ✓ Available | Full cost visibility and budgeting for Azure Government subscriptions. |
| Azure Advisor | Recommendations | ✓ Available | Available with some recommendation categories not yet in Government cloud. |
| Microsoft Defender for Endpoint | EDR | ✓ Available | Full EDR including P2 (included in G5 or as addon). Feeds into Sentinel. CMMC SI and IR control families. |
| Microsoft Defender for Identity | Identity Threat | ✓ Available | Included in G5. Monitors AD for identity-based attacks. CMMC IA and AU. |
| Microsoft Defender Vulnerability Management | Vuln Mgmt | ✓ Available | Integrated vulnerability management. CMMC RA.2.141, RA.2.142. |
How to Stay Current
This parity map is maintained based on Microsoft documentation and production GCC High deployments. For real-time feature availability, use the GCC High Roadmap Tracker (updated daily). For Microsoft's authoritative service description, see the GCC High and DoD service description. If you're making architecture or licensing decisions based on specific service availability, schedule a review before committing.