Microsoft does not publicly list pricing for GCC High the way it does for Microsoft 365 Commercial. Licenses are sold through Enterprise Agreements and authorized partners, which makes it difficult for defense contractors to plan budgets. As of July 1, 2026, Microsoft also raised prices on the government G-series plans so current numbers matter more than ever.

As an authorized Microsoft reseller, Secureframe has access to current list pricing for GCC High and all plans. We created this guide to give you a clear picture of what GCC High actually costs in 2026, which license fits which use case, and strategies to reduce your spend.

What's GCC High pricing at a glance?

There are four Microsoft 365 government licenses most defense contractors evaluate for GCC High, plus one optional add-on bundle.

The table below shows current list prices as of July 1, 2026, reflecting the government price increase that took effect that day. Prices are per user per month for an annual billing plan.

Actual prices may vary based on the reseller, Enterprise Agreement terms, commitment length, and more. For a full comparison of what each plan includes, see Microsoft's official GCC High plan comparison PDF.

Which GCC High license do you need for CMMC Level 2? F3 vs Business Premium vs G3 vs G5

For most users who handle Controlled Unclassified Information (CUI), the real choice is Business Premium, G3, or G5.

• F3 is strictly for frontline workers that need an inexpensive license to get Windows access only. It is not a standalone productivity and security stack for CMMC Level 2 and any user who handles CUI on an Azure Virtual Desktop needs a Business Premium, G3, or G5 license.
• Business Premium is the value license for organizations under 300 seats with CMMC Level 2 requirements.
• G3 is the enterprise default for organizations over 300 seats with CMMC Level 2 requirements.
• G5 bundles the full security and compliance stack and is often more affordable for organizations handling all types of CUI and trying to meet CMMC Level 2 (C3PAO) requirements than the headline pricing suggests.

What are the GCC High add-ons and do you need them for CMMC Level 2?

The Microsoft Defender for GCC-H and Microsoft Purview for GCC-H add-ons can be used with the Microsoft 365 G3 and Business Premium licenses to support customers in meeting CMMC Level 2 requirements, but they are not strictly required for all organizations.

The G3 and Business Premium base licenses include capabilities that map to the majority of the 110 NIST SP 800-171 Rev 2 controls behind CMMC Level 2. The add-ons extend those base licenses with advanced threat protection and data security capabilities. These capabilities are already included in the G5 license and therefore do not need to be purchased separately.

What does the Microsoft Defender Suite include?

The Microsoft Defender Suite adds endpoint detection and response and advanced threat protection capabilities.

This includes:

• Threat detection, investigation, and automated response across endpoints, identities, email, and cloud
• Advanced attack protection to stop ransomware, phishing, and credential compromise
• Endpoint protection with real-time threat prevention, endpoint detection and response (EDR), and vulnerability management
• Email and collaboration protection with anti-phishing, anti-malware, and safe links/attachments
• Identity threat detection with lateral movement and access risk protection
• Cloud app discovery, shadow IT control, and session-based access governance
• Enterprise IoT device security with continuous visibility and threat detection
• Vulnerability and attack surface management with prioritized remediation
• Incident correlation for faster triage and reduced analyst workload
• Automated policies and conditional access to contain compromised users or devices
• AI-driven security insights to prioritize risks and strengthen overall security posture

What does the Microsoft Purview Suite include?

The Microsoft Purview Suite adds advanced data security and compliance capabilities.

This includes:

• Automatic classification and sensitivity labeling
• Unified data loss prevention (DLP) across email, chat, cloud apps, and endpoints
• Insider-risk detection with privacy-aware analytics
• Advanced eDiscovery and audit for legal and compliance needs
• Data lifecycle, retention, and records management
• Governance tools to manage and protect sensitive data
• Compliance Manager with tasks and audit-ready evidence
• Visibility into data usage, movement, and risk

While these add-ons can make specific controls easier to implement and can strengthen your overall cybersecurity posture, they are not strictly required for CMMC Level 2.

When the Microsoft Defender and Purview add-ons were made available for use with Business Premium for GCC High on February 20, 2026, Microsoft updated this blog describing them as providing “the required security and compliance capabilities to support customers in meeting CMMC L2 requirements.” However, organizations including Secureframe have achieved CMMC Level 2 certification without them.

Whether your organization needs these Microsoft add-ons for CMMC Level 2 depends on several factors, including:

• which requirements are applicable based on your CMMC scope
• how you implement each control
• which tools are in your tech stack beyond the Microsoft license
• what your System Security Plan (SSP) documents

Our NIST 800-171 configuration guide for GCC High links to a series of blogs that map each control family to specific capabilities across Microsoft Purview, Defender, Entra ID, Intune, and other tools that help satisfy it, so you can better understand which controls the base license already covers.

Here is how the per-user monthly cost compares for each Level 2 path, rounded to the nearest dollar:

• Business Premium: Base license $36 + add-on $24 = $60
• G3: Base license $65 + add-on $24 = $90
• G5: Base license with advanced threat protection and data security and compliance capabilities already included = $98

For this reason, G5 can be more cost-effective for organizations with CMMC Level 2 requirements than headline prices suggest.

GCC High vs GCC pricing: Why is GCC High more expensive than GCC?

GCC High can be roughly 30% more expensive than Microsoft 365 GCC, depending on the license tier. The GCC High and GCC figures below reflect the July 1, 2026 pricing update, and are listed per user per month for an annual billing plan.

GCC High costs more than GCC because it is:

• FedRAMP Class D Certified (previously referred to as FedRAMP High Authorized)
• Built on Azure Government, a physically separated infrastructure from Azure Commercial
• In dedicated U.S. data centers with U.S. support personnel
• Designed for organizations that handle sensitive government data subject to the International Traffic in Arms Regulations (ITAR), the Export Administration Regulations (EAR), the Defense Federal Acquisition Regulation Supplement (DFARS), and other requirements, and explicitly recommended by Microsoft for CMMC Levels 2 and 3.

GCC is another government cloud offering that's intended for US Government requirements. However, GCC is a data enclave built on Azure Commercial. Meaning, some shared services may involve data processing or support staff outside the continental U.S. and therefore not meet the strict data residency and data sovereignty controls required for all types of CUI, like export-controlled data. So while GCC can support DFARS 252.204-7012 and CMMC Level 2 requirements for CUI Basic, it is not suitable for most organizations that handle CUI or are subject to ITAR, EAR, CMMC Level 2 (C3PAO) or CMMC Level 3 requirements.

GCC High vs Commercial pricing: Why is GCC High more expensive than Commercial?

GCC High can be roughly 60% more expensive than Microsoft 365 Commercial, depending on the license tier. Below are list prices for the Business Premium and enterprise licensing plans (G3 and G5 are for GCC High, E3 and E5 are for Commercial).

GCC High has a much higher premium over M365 Commercial licenses (nearly double that of GCC). That's because Microsoft 365 Commercial is built entirely on Azure Commercial, not as a data enclave on it. So there's no dedicated U.S. data centers, no U.S.-only personnel with government-level background checks supporting it, and no FedRAMP Certification, which brings licensing costs down significantly. But it also brings the compliance bar down too.

While it can be used to demonstrate CMMC Level 1 compliance, M365 Commercial was not purpose-built for U.S. government regulations and is not suitable for DFARS 7012, ITAR, EAR, CMMC Level 2, or Level 3.

Is GCC High affordable for small contractors?

Microsoft launched Microsoft 365 Business Premium for GCC High on November 3, 2025, one week before CMMC Phase 1 took effect. It was created as an affordable entry point for GCC High for small contractors.

Because of its launch date and purpose, its base price did not change in the July 1, 2026 pricing update.

Key details of Business Premium for GCC High

• Base price: ~$36 per user per month
• Price with Defender and Purview add-on: ~$60 per user per month
• Seat limit: up to 300 users
• Includes: Premium Office applications, Teams, secure cloud storage, business email, Microsoft Defender for Business and Office 365 Plan 1
• Who it is for: Small and mid-sized defense contractors that need GCC High to meet CMMC requirements but cannot afford enterprise licensing
• Not available in GCC

Important caveat: as with other government plans, Business Premium provides a secure environment but does not make you CMMC compliant automatically. You still need proper configuration and documentation, and may need support from an RPO or consultant.

For a full breakdown of what Business Premium includes, see our GCC High Business Premium guide. Ready to get started? Purchase Microsoft 365 Business Premium for GCC High through our Marketplace.

What are real-world cost examples for GCC High?

Below are cost estimates for how a 50-person defense contractor might license GCC High to meet CMMC requirements. Each example shows the base license cost, then the optional Defender and Purview add-on as a separate line, since the add-on is not required for Level 2. Keep in mind that licensing is only one part of your total cost. For the full picture, see our CMMC certification cost breakdown.

Example 1: 50-person contractor, full migration to GCC High G3

A full migration is the most expensive option and is not always necessary. It tends to make sense when most of your revenue is defense-related, most employees routinely touch CUI, or you handle export-controlled ITAR or EAR data that requires stricter infrastructure requirements and access controls.

Example 2: 50-person contractor using Business Premium (GCC High)

On the base license, Business Premium saves nearly $18,000/year compared with G3 in this scenario. The trade-off is seat count and fewer advanced enterprise features. Evaluate whether the seat limit and missing capabilities matter for your specific CMMC scope before committing.

Example 3: 50-person contractor using the enclave approach (10 CUI users)

The enclave approach saves roughly $12,000/year compared with a full 50-user GCC High G3 migration in this scenario, before any optional add-on. With the add-on to the GCC High G3 licenses, it saves nearly double at $25,000/year. Savings when using the enclave approach over enterprise scale significantly with company size.

How to reduce GCC High licensing costs

GCC High costs can be a sticker shock, particularly for small businesses. Here are proven strategies to save so you can use the only Microsoft-recommended cloud environment for CMMC Level 2 or higher without breaking the bank.

1. Use the enclave approach

Only employees who directly handle CUI need GCC High licenses. Isolate CUI into a defined boundary and keep everyone else on commercial Microsoft 365. This can reduce license costs by 50 to 80% depending on what share of your users actually touch CUI.

2. Consider GCC if your contracts allow it

GCC High is not always required for CMMC compliance. If your contracts do not reference ITAR, EAR, or DFARS 252.204-7012, GCC may be sufficient and saves about $17/user/month on G3 and $23/user/month on G5.

See our GCC vs GCC High guide and confirm with your contracting officer before deciding.

3. Choose Business Premium for organizations under 300 seats

At approximately $36/user/month versus $65 for G3 and $98 for G5, Business Premium can offer meaningful savings for eligible organizations, depending on the CMMC level and whether you add the optional add-on.

See our Business Premium guide and confirm eligibility.

4. Decide whether you actually need the Defender and Purview add-on

Since the add-on is not strictly required for all Level 2 contractors, start by mapping which controls your base license already covers, then decide whether the advanced capabilities are worth the extra $24.40/user/month.

If you do want them, compare G3 plus the add-on ($89.60) against G5 ($97.50). The gap is only about $8/user/month, and G5 includes more.

5. Negotiate your Enterprise Agreement

GCC High pricing is negotiable, especially for multi-year commitments or large seat counts. Evaluate multiple AOS-G partners to compare quotes before signing. As an authorized GCC High reseller, Secureframe is committed to competitive pricing.

How to purchase GCC High licenses

GCC High licenses are not available through Microsoft's standard online portal. The process depends on your organization's size.

• Organizations under 300 seats: Work with a Microsoft AOS-G (Agreement for Online Services - Government) authorized partner. These partners are specifically approved by Microsoft to sell GCC High. Not all Microsoft partners qualify.
• Organizations with 300 or more seats: Purchase through an LSP (Licensing Solution Provider) via a standard Enterprise Agreement, or through an AOS-G partner.

The purchasing process

• Eligibility verification: Fill out Microsoft’s U.S. Government Cloud intake form to verify eligibility for GCC High (or GCC).
• Partner engagement: Select an AOS-G partner to purchase licenses. With Secureframe, you can purchase licenses and add-ons in-app.
• Tenant provisioning: Microsoft provisions a new GCC High tenant for your organization. This can take up to 30 days per Microsoft SLA.

How did Microsoft 365 GCC High licenses increase on July 1, 2026?

Microsoft raised list prices for government licenses across GCC and GCC High effective July 1, 2026, with the exception of Business Premium. The increase is now in effect for new purchases. Existing customers move to the new pricing at their next renewal after July 1.

Because Business Premium did not increase, it is an even more cost-effective option relative to the enterprise G-series SKUs. For suites where a government increase exceeds 10%, Microsoft phases it over multiple years at no more than 10% per year to comply with federal regulations, so some SKUs may reach their full list price in a later year.

Since GCC High is a significant investment, you want to make sure it is driving real compliance outcomes and revenue.

Secureframe Defense can help. It automatically provisions a Microsoft GCC High environment and virtual desktops to securely access that CUI environment. It also maps your live configuration to NIST SP 800-171 controls, automates evidence collection, keeps your SSP aligned with your actual environment as it changes over time for continuous compliance, and more.

See how Secureframe Defense works with GCC High to simplify CMMC end to end by visiting secureframe.com/cmmc or talking to an expert.