GCC High migration: identity and device migration

Migrating into or out of Microsoft 365 GCC High is not a standard tenant-to-tenant project.

The government cloud introduces different identity boundaries, security requirements and infrastructure considerations. But your users still need the same thing at the end of the migration: access to their familiar Windows workstation, applications and settings, without unnecessary downtime or disruption. 

PowerSyncPro supports identity migration and device migration across commercial Microsoft 365, GCC and GCC High. With PowerSyncPro DirSync and Migration Agent, businesses can synchronise identities, build the mappings required for profile re-permissioning, and migrate Windows workstations without reimaging them. 

Before looking at how the migration works, it's worth understanding why GCC High exists and when an organisation may need to use it. 

 

What is GCC High? 

GCC High stands for Microsoft 365 Government Community Cloud High. It's a separate Microsoft government cloud environment specifically designed for organisations that handle sensitive US government information, including certain export-controlled technical data. 

Under the International Traffic in Arms Regulations (ITAR), and the Export Administration Regulations (EAR), allowing a non-US person to access controlled technical information can count as an export. That remains the case even if no one physically crosses a border, and no file is transferred. 

For example, if a UK national signs in to a US-based system and views controlled technical drawings, access to that information may constitute an export to the UK. 

This is precisely why Microsoft GCC High operates as a separate sovereign environment. It gives qualifying organisations a cloud platform designed for workloads with stricter requirements around where information is stored and who can access the supporting infrastructure. 

 

Microsoft GCC vs GCC High: what is the difference? 

Microsoft GCC and GCC High are both government cloud environments, but they are not interchangeable. 

Standard Microsoft 365 GCC keeps customer content within US data centres, but it operates on Microsoft's commercial Azure infrastructure. GCC High is physically and logically separated from the commercial cloud, runs on Azure Government and has its own Microsoft Entra ID environment. 

This distinction becomes particularly important for organisations handling technical data covered by the United States Munitions List or EAR-controlled information that requires US data sovereignty and screened US-person access to the supporting infrastructure. 

In practical terms: 

Microsoft 365 GCC

Microsoft GCC is designed for eligible US government organisations and contractors that require a government-focused Microsoft 365 environment. 

It can support a range of regulatory and contractual requirements, but it does not provide the same sovereign-cloud operating model as GCC High. 

Microsoft 365 GCC High

Microsoft GCC  High is intended for organisations with more restrictive government, defence, and export-control requirements.

It operates within Azure Government and is separated from the commercial Microsoft cloud. This makes it relevant when an organisation needs tighter controls around data location, administrative access and the people who can operate the underlying service. 

Microsoft identifies Microsoft 365 GCC High and Azure Government as platforms that can help organisations in the Defense Industrial Base support their CMMC and compliance programmes. However, compliance depends on the customer’s configuration, implementation and operational controls, as well as assessment by appropriately qualified organisations. 

Azure GCC vs GCC High 

“Azure GCC” and “GCC High” are sometimes used as though they refer to the same platform, but the terminology can be misleading. 

GCC and GCC High are Microsoft 365 government cloud environments. Azure Government is Microsoft’s separate cloud platform for hosting infrastructure, applications, virtual machines and other Azure workloads for eligible government customers and partners. 

Microsoft 365 GCC High runs on Azure Government infrastructure, but GCC High and Azure Government are not simply two names for the same service. 

For migration planning, it is therefore important to distinguish between: 

• Microsoft 365 GCC or Office 365 GCC, where users access services such as Exchange Online, SharePoint, Teams and OneDrive.

•  Microsoft 365 GCC High, which provides an isolated Microsoft 365 environment for more restrictive government and defence scenarios. 

• Azure Government, where organisations can host infrastructure, applications and supporting services within the government cloud boundary. 
  
  

Is GCC High required for CMMC compliance? 

GCC High is not, by itself, a universal CMMC requirement. 

CMMC assesses how an organisation implements the required cybersecurity practices and protects Federal Contract Information or Controlled Unclassified Information. It does not provide a standalone certification for a cloud platform. Compliance depends on the customer’s technical controls, processes, documentation, policies and implementation. 

Depending on the scope of the environment and the information being handled, an organisation may be able to meet applicable requirements using standard GCC or, in some carefully scoped cases, commercial Microsoft 365 with the necessary controls in place. 

For example, a logistics subcontractor that handles schedules and invoices but does not receive export-controlled technical data may not automatically need GCC High simply because it operates within the defence supply chain. 

The decision changes when an organisation handles technical information covered by the United States Munitions List or EAR-controlled data that requires US sovereignty. In those circumstances, the organisation may need a platform where the relevant infrastructure and support operations are restricted to screened US persons. 

Other terms and requirements may also affect the decision, including C3PAO assessment, CUI and CUI Specified, ITAR, EAR, DFARS 252.204-7012, FedRAMP, and of course, the applicable contract and security classification guidance. 

Rather than selecting a cloud environment based on CMMC alone, organisations should review the requirements in their contracts and, where applicable, their DD Form 254. These documents help determine whether information must reside within a particular government cloud boundary. 

 

Why GCC High migration requires specialist planning 

A GCC High migration introduces a clear separation between the source and target environments. 

GCC High runs within Azure Government and has its own Microsoft Entra ID environment. As a result, an identity migration may need to cross boundaries between: 

• On-premises Active Directory

• Commercial Microsoft Entra ID

• Microsoft 365 GCC

• Microsoft 365 GCC High

• Separate GCC or GCC High tenants 

The same boundary affects Windows workstation migration. A device may need to leave its existing directory, join a GCC High Entra tenant, retain its existing Windows profile and reconnect its Microsoft 365 applications to the correct government cloud services. 

The objective is not simply to move an account or rejoin a device. It is to preserve the connection between the user’s source identity, target identity and existing Windows profile. 

 

Where does PowerSyncPro run, and who can access it? 

When using migration software within a sensitive environment, two of the most important questions are: 

• Where does the service run?

• Who has access to it?

With PowerSyncPro, you decide where to host the platform.

PowerSyncPro DirSync and Migration Agent are IaaS softwares. You can deploy the PowerSyncPro server within your on-premises environment or on a Windows server in an appropriate cloud environment. 

Declaration Software, the company behind PowerSyncPro, does not access your deployed server. The software does not need to send data back to PowerSyncPro as part of its normal operation; PowerSyncPro provides the licence key for your deployment. You also control what information, if any, you choose to share through a support request. 

For organisations that want migration support, a PowerSyncPro partner can help manage the service and deliver the project within the customer’s security and governance requirements.

Find additional information in the PowerSyncPro Trust Centre or explore the PowerSyncPro partner network. 

 

PowerSyncPro support for Microsoft GCC High migration 

PowerSyncPro has supported GCC and GCC High since version 3.3, as both source and target environments for DirSync and Migration Agent. 

This means the government cloud does not always have to be the destination. PowerSyncPro can support organisations that are: 

• Moving from commercial Microsoft 365 into GCC or GCC High

• Migrating from GCC to GCC High

• Moving between GCC or GCC High tenants

• Onboarding users and devices into a government cloud

• Offboarding users and devices from a government cloud

• Migrating from on-premises Active Directory to GCC High

• Separating identities and devices during a divestiture

• Supporting coexistence during a phased migration 

The customer retains control of where the PowerSyncPro infrastructure is deployed and how it connects to the relevant directories.

 

Maintain identity coexistence with PowerSyncPro DirSync 

Identity is the foundation of a successful GCC High migration. 

PowerSyncPro DirSync synchronises users, groups and contacts across supported Active Directory, commercial Microsoft Entra ID, GCC and GCC High environments. It can also synchronise passwords between Active Directory environments. 

This provides identity coexistence while source and target environments remain live. 

Microsoft’s native cross-cloud synchronisation has limitations for some migration scenarios. For example, it does not synchronise groups across different cloud types. PowerSyncPro DirSync provides broader synchronisation capabilities for organisations that need to maintain users, groups and contacts across these boundaries. 

Keeping identities aligned can also help organisations maintain a unified Global Address List while both environments are operational. 

Depending on the migration strategy, teams can use this coexistence period to: 

• Move departments or user groups in phases

• Run pilot and validation waves

• Maintain collaboration during a longer transformation

• Prepare identities ahead of a single weekend cutover

• Support users who remain in different environments temporarily

This gives the project team more flexibility than an all-or-nothing approach.

 

Build the identity mapping required for device migration 

PowerSyncPro DirSync includes a matching sync profile (free with Migration Agent,) which compares source and target directory attributes using the organisation’s chosen matching criteria. It then creates a Translation Table that maps each source identity to the corresponding target identity. 

For a GCC High migration, this produces the SID-to-SID relationship between a user’s existing account and their new government cloud identity, or vice versa. 

PowerSyncPro also handles the differing SID authority values used across commercial and government cloud environments: 

• A commercial cloud SID uses the S-1-12-1 authority.

• GCC cloud SIDs use authority values from S-1-12-3 to S-1-12-8.
  

Accurate SID matching is one of the most important parts of the Windows workstation migration. Without the correct relationship between source and target accounts, the migration process cannot reliably assign the existing local Windows profile to the user’s new identity. 

 

Migrate Windows workstations without reimaging 

Once the Translation Table has established the relationship between the source and target identities, PowerSyncPro Migration Agent uses that mapping to re-permission the local Windows profile. 

This allows the user to keep their existing: 

• Desktop

• Windows profile 

• Application settings 
• Familiar working environment 

During a supported migration, the device can be disconnected from its source directory and joined to the GCC High Microsoft Entra tenant. 

The join can use a bulk enrolment token. A provisioning package, or PPKG, can also be used where the chosen approach requires it, including scenarios involving a TPM-based join. 

Migration Agent can additionally reset supported Microsoft 365 applications where required so they can reconnect to the appropriate target environment. 

The result is a device migration that does not require a Windows reimage or Fresh Start. Users can return to the same local profile after signing in with their target credentials. 

 

Choose how and when the device migration runs 

PowerSyncPro Migration Agent can be deployed through the organisation’s chosen software-delivery mechanism.

Depending on the migration methodology, organisations can allow users to start the migration at a convenient time. This can be valuable for remote teams or migration programmes that need to accommodate working patterns across different locations and time zones. 

Alternatively, the project team can make the migration mandatory and control when it begins. 

This flexibility allows organisations to choose between approaches such as: