Microsoft GCC vs. GCC High: what it means for choosing a PPM platform

Ask three people in a federal IT department to explain the difference between GCC and GCC High and you'll often get three different answers. It's an easy mix-up. Both sit inside Microsoft's US government cloud, and both promise a more restrictive, more isolated environment than commercial Microsoft 365. People use “the government cloud” as a catch-all for either one. But they serve different populations and different compliance regimes.

If you're evaluating software to run inside one of them, that difference can produce very different shortlists of vendors who actually qualify. Here's what separates them, and why it matters before you sign a contract for a project or portfolio management platform.

What is Microsoft GCC?

GCC, or Government Community Cloud, is Microsoft 365 built on infrastructure physically and logically separated from commercial cloud, with personnel restricted to screened US persons. It's designed for federal civilian agencies, state and local government, and educational institutions that handle sensitive but unclassified government data.

If your organization needs to meet FedRAMP Moderate or DFARS baseline requirements without the added restrictions of defense-specific data, GCC is the tier built for that.

What is GCC High?

GCC High goes further. It's built for organizations handling Controlled Unclassified Information (CUI) and International Traffic in Arms Regulations (ITAR) data, primarily contractors in the defense supply chain. It adds stricter screening for support personnel, tighter data residency controls, and alignment with DoD Impact Level 4 and 5 requirements. Most defense contractors are required to move to GCC High as a condition of their contracts, particularly under the Cybersecurity Maturity Model Certification (CMMC) framework.

While GCC High serves that supply chain, it doesn’t serve the Department of Defense itself. DoD runs its own separate, further-restricted cloud environment above GCC High, reserved for internal use only.

The practical differences

The two environments are also logically separate from each other, not just from commercial Microsoft 365. If a new contract brings CUI into scope, moving from GCC to GCC High means migrating to a new tenant, with real planning and testing involved.

Why this matters when you're choosing a PPM platform

Most project and portfolio management software runs on the vendor's own infrastructure, which is fine in commercial Microsoft 365. But when it comes to GCC or GCC High environments, where the whole point is that data doesn't leave a controlled boundary, it disqualifies those platforms immediately.

A platform might say they’re “available for government customers” but that doesn’t necessarily mean they have passed an accreditation review, or deployed anything inside a GCC High tenant.

Ask before you sign: does the platform run inside your tenant, in your government cloud environment, or does your data have to leave it to reach the vendor's platform?

Get that answer during evaluation, not after your business case is already built around a tool that can't actually go live.

Where Altus fits for GCC and GCC High

Altus runs entirely on the Microsoft Power Platform, deployed inside your own Microsoft 365 tenant, with all data held in Microsoft Dataverse. That includes native support for GCC High authentication, Microsoft Graph Government APIs, and Dataverse Government environments, so there's no separate Altus infrastructure sitting outside the tenant boundary for either environment to worry about.

It's why Altus is one of the very few PPM platforms available to US government and defense-supply-chain organizations without exceptions or workarounds, whether the requirement is standard GCC or the stricter GCC High tier.