Microsoft 365 Government - GCC deployments

Office 365 Government plans are monthly subscriptions and can be licensed to an unlimited number of users.

• The Office 365 GCC environment provides compliance with Federal requirements for cloud services, including FedRAMP High, and requirements for criminal justice and federal tax information systems (CJI and FTI data types).
• The Office 365 GCC High and DoD environments deliver compliance with Department of Defense Security Requirements Guidelines, Defense Federal Acquisition Regulations Supplement (DFARS), and International Traffic in Arms Regulations (ITAR).

In addition to the features and capabilities of Office 365, the organizations that use Office 365 Government benefit from the following features unique to Office 365 Government:

• Your organization's customer content is logically segregated from customer content in Microsoft's commercial Office 365 Services.
• Your organization's customer content is stored within the United States.
• Access to your organization's customer content is restricted to screened Microsoft personnel.
• Office 365 Government complies with certifications and accreditations that are required for US Public Sector customers.

Office 365 Government is available to (1) US federal, state, local, tribal, and territorial government entities, and (2) other entities that handle data that is subject to government regulations and requirements and where use of Office 365 Government is appropriate to meet these requirements, subject to validation of eligibility. Validation of eligibility by Microsoft will include confirmation of handling data subject to International Traffic in Arms Regulations (ITAR), law enforcement data subject to the FBI's Criminal Justice Information Services (CJIS) Policy, or other government-regulated or controlled data. Validation may require proof of registration with the U.S. Department of State for ITAR data or sponsorship by a government entity with specific requirements for the handling of data. The Office 365 DoD environment is for the exclusive use of the United States Department of Defense.

While eligibility criteria are consistent across Office 365 Government offerings, Microsoft will only agree to DFARS and ITAR contract language for the GCC High environment.

Entities with questions about eligibility for Office 365 Government should consult their account team.

Upon renewal of a customer's contract for Office 365 Government, revalidation of eligibility is required.

Office 365 Government services are provided from datacenters physically located in the United States. The following customer content is stored at rest in datacenters physically located only in the U.S.A.:

• Exchange Online mailbox content (email bodies, calendar entries, and the content of e-mail attachments)
• SharePoint Online site content and the files stored within that site
• Skype for Business archived conversations, uploaded documents, and whiteboarding sessions
• Microsoft Teams persistent chat threads

If your users are located within the U.S.A. while using Office for the web (formerly known as Office Web Apps) or if you adopt the use of Active Directory Federation Services (AD FS) 2.0 and set up policies to help ensure your users connect to the services through single sign-on, any customer content that is temporarily cached in Office for the web will be located in the U.S.A.

The Site usage page for SharePoint sites is available for government plans, though per compliance, there are some features of this page that are only available to commercial customers. 

With typical use, Skype for Business does not store customer content, but if such storage occurs, it will be stored in datacenters in the U.S.A.

Office 365 provides the ability to integrate third-party applications into SharePoint Online sites, Skype for Business, Office applications included in Microsoft 365 Apps for enterprise (such as Word, Excel, PowerPoint, and Outlook), and Outlook Web App. In addition, Office 365 supports integration with third-party service providers. These third-party applications and services might involve storing, transmitting, and processing your organization's customer data on third-party systems that are outside of the Office 365 infrastructure and therefore are not covered by the Office 365 compliance and data protection commitments. It is recommended that you review the privacy and compliance statements provided by the third parties when assessing the appropriate use of these services for your organization.

Access to Office 365 Government customer content by Microsoft administrators is restricted to screened personnel. For screening levels details, refer to the service description page for each respective environment (GCC or GCC High and DoD).