EPC Group says it completed 50-plus GCC High migrations in 12 months

EPC Group, a Houston Microsoft consultancy, says it finished more than 50 Microsoft 365 GCC High migrations for defense contractors over the past year and is detailing the routes, limits and compliance steps involved. The firm is tying those moves to CMMC Level 2 evidence planning as contractors navigate a paused CMMC Phase II schedule but unchanged NIST and DFARS obligations.

Why it matters: - Defense contractors cannot treat Microsoft 365 GCC High as a simple cloud setting change. - A move can affect where controlled data lives, how identities are managed and what evidence a contractor must show for CMMC Level 2. - Microsoft’s own migration limits in the government cloud change the path for Google Workspace, OneDrive, FastTrack and Power BI moves.

What happened: - EPC Group reported more than 50 Microsoft 365 GCC High migrations completed in the past 12 months for defense contractors. - The Houston firm also laid out the routes it handles into Microsoft 365 GCC and GCC High from commercial Microsoft 365, Google Workspace, on-premises and hybrid estates, and tenant to tenant inside GCC High after mergers. - EPC Group said it pairs GCC High migrations with a three-week CMMC Level 2 gap assessment. - EPC Group said its migration records also include 216 Microsoft 365 tenant-to-tenant M&A migrations completed from 2023 to 2025, covering 1.83 million users with a five-day average cutover. - The firm said it has handled consolidation programs involving 19 or more legal entities in one target tenant. - The firm said US-persons delivery is contracted in writing on GCC High engagements.

The details: - Microsoft 365 Government is delivered in three environments: GCC, GCC High and DoD. - Microsoft stores customer content for these services at rest in datacenters located only in the United States. - GCC is for federal, state, local and tribal governments, plus contractors that hold or process data on behalf of the US Government. - Microsoft states GCC supports FedRAMP accreditation at a High impact level. - GCC High is for Department of Defense contractors that hold or process controlled unclassified information or are subject to the International Traffic in Arms Regulations. - Microsoft states GCC High is assessed against NIST SP 800-53 controls at a FIPS 199 High categorization and can demonstrate the inheritance needed for CMMC. - DoD is for the exclusive use of the US Department of Defense. - Microsoft’s guidance is that GCC is the main offering for customers that do not hold FedRAMP High data or DoD controlled unclassified information. - Contractors that hold DoD controlled unclassified information or export-controlled technical data generally need GCC High. - Microsoft states it will agree to ITAR contract language only for GCC High. - Neither GCC nor GCC High is bought like a commercial subscription. - Microsoft requires eligibility validation before an environment is established, sells licenses only through select partners and offers no trials of GCC High. - Microsoft says a non-government organization can bring ITAR data, controlled unclassified information and criminal justice information into the government cloud. - EPC Group’s comparison of Commercial, GCC, GCC High and DoD is available in the company’s comparison guide. - The Department of War suspended CMMC Phase II requirements on July 13, 2026. - The suspension did not remove duties under DFARS 252.204-7012 and NIST SP 800-171. - CMMC Level 2 is measured against the 110 security requirements of NIST SP 800-171. - EPC Group advises contractors to use the pause to get Level 2 evidence right and to decide where controlled data will live before an assessor asks. - GCC High gives a contractor an environment whose controls can be inherited, but the contractor still owns tenant configuration, access, device management, incident reporting and the evidence documents. - A GCC High tenant does not satisfy the 110 requirements by itself. - Many requirements depend on how the contractor configures and operates the tenant. - EPC Group ties each migration to a gap assessment and builds the tenant against the findings.

Between the lines: - The announcement is as much about compliance planning as it is about cloud migration volume. - EPC Group is positioning the migration as a security and evidence project, not just an IT cutover. - The firm’s emphasis on US-persons delivery, gap assessments and evidence packages reflects the extra scrutiny around defense work and controlled data. - Microsoft’s own tooling gaps mean contractors often need custom migration planning rather than a standard commercial-cloud playbook.

What Microsoft’s tools do not cover: - Microsoft’s cross-tenant OneDrive migration is not supported for the Government Cloud, including GCC, GCC High and DoD. - Microsoft’s Google Workspace migration is not currently available for Office 365 US Government, GCC High or DoD. - Microsoft’s FastTrack cross-tenant migration service does not currently support US Government customers. - Microsoft directs customers moving Power BI from commercial to the US government cloud to add a government subscription and replicate the commercial data into it.

How the routes work: - Commercial Microsoft 365 to GCC High is EPC Group’s most common route for defense contractors, and it requires a new tenant rather than a setting change. - Commercial Microsoft 365 to GCC fits state and local agencies and contractors whose data does not require GCC High. - GCC to GCC High fits contractors whose contracts now bring controlled unclassified information or export-controlled data. - Google Workspace to GCC or GCC High requires a route planned around Microsoft’s tool limits, the target tenant and how files and permissions will map. - On-premises and hybrid estates can move straight into GCC High from Exchange Server, SharePoint Server, file servers and Active Directory. - Tenant-to-tenant migration inside GCC High is used when two defense contractors merge or when one buys a division of another. - Part of a company can move to GCC High while the rest stays in a commercial tenant. - Separate tenants reduce the number of users and devices in scope, but they add coordination work and documentation requirements. - EPC Group says it sizes both options during the gap assessment so the decision is evidence-based.

What the migration sequence looks like: - Eligibility and licensing come first because the tenant must exist before the build starts. - The three-week gap assessment scores all 110 NIST SP 800-171 requirements and records the evidence seen, the evidence missing and the findings against the system security plan. - Target design covers identity, conditional access, device management, data protection and logging. - The GCC High tenant is built and then a pilot group moves first. - Mail, files, Teams and devices move in waves ordered by business risk. - Domains and mail flow move last, with a tested rollback path for every reversible step. - Each wave closes with a record of what moved, what did not and who accepted it. - A named senior architect leads each engagement. - EPC Group says engagements are fixed-fee and scoped after a one-hour call.

What changes for users: - Users sign in to a different Microsoft cloud after the move. - GCC High and DoD have portal addresses separate from the commercial service. - Devices are re-enrolled in the new tenant’s management. - Outlook and Teams profiles are rebuilt. - Sharing with outside organizations follows the new tenant’s rules. - Some features arrive later in the government clouds than in the commercial service. - EPC Group says it checks every application a contractor depends on before the pilot.

What can go wrong: - EPC Group’s architects say eligibility and licensing are often started too late. - Features and third-party apps may work in the commercial cloud but not in GCC High, or may work differently there. - Devices and identities may need to be re-enrolled during cutover week. - Controlled data can be copied through commercial services on the way in. - A migration planned only as an IT project can miss the system security plan link. - EPC Group says each problem is cheaper to solve before the first mailbox moves.

What’s next: - Contractors facing GCC High decisions are being urged to settle eligibility, licensing, data boundaries and evidence planning before migration work begins. - EPC Group says its method continues to combine migration delivery with compliance documentation, including the system security plan and plan of action and milestones. - For tenant-to-tenant GCC High work, the firm says it plans mail, OneDrive, SharePoint and Power Automate separately and keeps the two companies working together until the final wave. - EPC Group says one anonymized 2026 GCC High consolidation was planned over about eleven weeks for up to 300 users after an acquisition.

The bottom line: - For defense contractors, GCC High migration is not just about moving data. It is about building a tenant, process and evidence trail that can stand up to a CMMC Level 2 review.