Migrating from Commercial Microsoft 365 to GCC High
Last updated: October 2026
Moving from commercial Microsoft 365 to GCC High is not a simple move. It is a full tenant rebuild with a parallel data migration, because GCC High is a separate environment with its own identity, endpoints, and data boundary. Most small and mid-sized defense contractors should plan on three to five months to cutover, plus 30 to 60 days before the old tenant can be shut down.
The conversation usually starts the same way. A prime asks for your SPRS score or CMMC status, someone reviews where CUI actually lives, and it becomes clear that email and SharePoint in your commercial tenant are full of it. If you are still deciding which environment you need, start with our GCC High vs GCC vs Commercial comparison.
Why there is no simple path
Moving between two commercial tenants has some native Microsoft tooling. Moving from commercial to GCC High does not, because it crosses a trust boundary into a separate cloud.
That means every part of the migration is a deliberate, documented step:
- Identities are re-provisioned in the new tenant.
- Data is exported and imported with third-party tools.
- Settings, policies, and site structure are rebuilt, not copied.
- Every third-party integration is checked for GCC High availability.
All of this happens while your people keep working, usually through a period where both tenants run side by side.
The four phases at a glance
| Phase | Typical time | What gets done |
|---|---|---|
| 1. Pre-migration assessment | 4 to 6 weeks | Inventory of users, data, apps and integrations; GCC High eligibility validation started |
| 2. GCC High tenant build | 4 to 8 weeks | Identity, security baselines, labels, DLP and site structure built and tested |
| 3. Data migration | 4 to 12 weeks | Mail, SharePoint, OneDrive and Teams content moved with encrypted tooling |
| 4. Cutover and decommission | 1 weekend, then 30 to 60 days | Users switch over; CUI removed from the commercial tenant; old tenant shut down |
Phase 1: Pre-migration assessment (4 to 6 weeks)
Start by mapping your commercial tenant in detail. Inventory users and licenses, SharePoint sites and their sizes, Teams channels, mailbox sizes, and your current email security settings.
Audit every connected app
HR tools, CRM connectors, project management apps, and security products that work with commercial Microsoft 365 may not exist in GCC High. Each one needs a GCC High version, a replacement, or a different integration plan before you migrate.
Start eligibility early
Microsoft validates your eligibility before a GCC High tenant is provisioned. Start that process during the assessment so it does not hold up the build.
Phase 2: GCC High tenant build (4 to 8 weeks)
Stand up the GCC High tenant alongside your production commercial tenant. Configure:
- Identity, either cloud-only or hybrid with Microsoft Entra Connect
- Security baselines and Conditional Access policies
- Sensitivity labels and data loss prevention (DLP) policies
- SharePoint site structure and Teams governance
The new tenant is both the destination for your data and a test environment. Run user acceptance testing on real workflows and integrations here before you commit to cutover. It saves a lot of rework.
Phase 3: Data migration (4 to 12 weeks, depending on volume)
Mail, SharePoint, and OneDrive data move with third-party tools that support commercial-to-GCC High migrations, such as BitTitan MigrationWiz, Quest On Demand Migration, and ShareGate.
Email can sync in the background while people keep using their commercial mailboxes. The tool copies new items in passes until cutover.
SharePoint, OneDrive, and Teams
These need more careful sequencing because files change every day. Teams content in particular depends on both SharePoint and Exchange, so test it in a pilot first.
Protect CUI in transit
CUI cannot be exposed while it moves. Use encrypted migration tooling, and limit migration accounts and credentials to authorized U.S. persons on the project.
Phase 4: Cutover and decommission
Cutover is usually a weekend event. Before it, users get their new GCC High sign-in details, and devices are updated, often pushed through Intune. During it, DNS records are switched so mail flows to GCC High.
Keep the old tenant for 30 to 60 days
The commercial tenant stays in place after cutover so you can catch missed data and fix issues. Plan for overlapping license costs during this window. Paying for both tenants for a period is normal and should be in the budget from day one.
Remove all CUI before you decommission
Every piece of CUI must be removed from the commercial tenant before it is shut down. Abandoning a tenant with CUI still in email or SharePoint is not acceptable. Document how the data was removed and keep that record with your media sanitization evidence for your System Security Plan (SSP).
What drives the cost of a GCC High migration
No two migrations are priced the same. These are the factors that move a quote up or down:
- Number of users. Every user needs a GCC High license, a new identity, and a migrated mailbox and OneDrive.
- Data volume. Large mailboxes, big SharePoint libraries, and years of Teams content take longer to move and verify.
- Integrations. Each third-party app that has no GCC High version needs a replacement or a new integration design.
- Identity setup. A hybrid setup with on-premises Active Directory and Entra Connect takes more planning than cloud-only identity.
- Devices. Laptops and phones joined to the commercial tenant must be re-enrolled in GCC High, usually through Intune.
- Compliance build. Sensitivity labels, DLP, Conditional Access, and the documentation for your SSP are part of the work, not an extra.
- Overlap period. You will pay for both tenants for 30 to 60 days after cutover. Budget for it from the start.
The fastest way to a real number is a short assessment of your tenant. Get a migration quote and we will scope it with you.
Common mistakes to avoid
Starting eligibility too late
Microsoft validates eligibility before it provisions a GCC High tenant. If you wait until the build phase to start, the whole schedule slips.
Forgetting the domain move
Your email domain can only be verified in one tenant at a time. Plan when it comes out of the commercial tenant and goes into GCC High as part of the cutover weekend.
Treating devices as an afterthought
Devices do not move on their own. Plan device re-enrollment, sign-in changes, and Outlook and Teams profile updates before cutover day, not after.
Finding integration gaps after cutover
An HR or CRM connector that silently stops working after go-live erodes trust fast. Test every integration in the new tenant during Phase 2.
Skipping the pilot
Move a small group first, such as IT and a few power users. A pilot catches problems with Teams content, permissions, and mail flow while they are still easy to fix.
Decommissioning too early
Shutting down the commercial tenant before every piece of CUI is confirmed removed creates a compliance gap. Verify, document, then decommission.
Pre-migration checklist
Use this list with your IT lead before you commit to a timeline.
| Item | Why it matters | Ready? |
|---|---|---|
| GCC High eligibility validation started | Microsoft must approve your organization before the tenant is provisioned | ☐ |
| Full inventory of users, mailboxes, sites, and Teams | Sets the scope, timeline, and cost of the migration | ☐ |
| Every connected app checked for GCC High support | Prevents integrations from breaking at cutover | ☐ |
| Locations of CUI mapped | Shows what must be protected in transit and removed afterward | ☐ |
| Identity approach chosen (cloud-only or hybrid) | Drives how accounts are created and synced in GCC High | ☐ |
| Device re-enrollment plan in place | Laptops and phones must join the new tenant | ☐ |
| Budget includes 30 to 60 days of overlapping licenses | Avoids a surprise bill during the parallel period | ☐ |
| Pilot group and cutover weekend selected | Catches problems early and limits user impact | ☐ |
| CUI removal and sanitization records planned | Required before the commercial tenant is decommissioned | ☐ |
Managing the change for your people
GCC High feels different to users, even with good notice. The sign-in address changes, some integrations behave differently or are missing, and Copilot and other AI features may be more limited or arrive later.
Three things make the difference between a smooth switch and a flood of help desk tickets:
- Clear communication before cutover, with what changes and when
- Short training on the new sign-in and any changed tools
- Extra help desk coverage for the first week after cutover
How VSO helps
VSO plans and runs GCC High migrations for defense contractors, from the first assessment through cutover and ongoing management. We pair the migration with your compliance work, so the new tenant supports your CMMC readiness from day one. Learn more about our cloud services, or contact us to plan your migration.
