Microsoft Released G7 License for Microsoft 365 for Government: What Contractors Need to Know

On October 1, 2026, Microsoft 365 G7 became available in Government Community Cloud (GCC). This Frontier Suite for government combines Microsoft 365 G5 with Microsoft 365 Copilot, Microsoft Entra Suite, and Agent 365 to help agencies adopt and scale AI securely. However, this licensing tier is not yet available in Microsoft 365 GCC High or DoD and many of its AI, security, and compliance capabilities are still missing in GCC as they wait on government authorization.

For defense contractors, that last point matters most. Many organizations that handle Controlled Unclassified Information (CUI) run on GCC High, where G7 can't be purchased today. And even in GCC, several of the agent audit, data loss prevention, and labeling features that map most directly to NIST SP 800-171 requirements haven't arrived yet. This article covers what G7 includes, where and when it's available, the limitations worth understanding before a renewal conversation, and how to prepare.

What is Microsoft 365 G7?

Microsoft 365 G7 is the government version of Microsoft 365 E7, the "Frontier Suite" Microsoft made generally available to commercial customers on May 1, 2026.

G7 stacks Microsoft's AI and agent governance tools on top of the existing G5 license, so organizations get productivity, collaboration, AI, agents, security, identity, compliance, and governance capabilities under one SKU.

Here’s the four basic layers that make up the new G7:

Note: You can see exactly which add-ons are available in which license in the Microsoft 365 GCC PDF Plan Comparison and the Microsoft 365 GCC High PDF Plan Comparison.

In practice, Agent 365 is the piece that's genuinely new for government tenants. G5, Copilot, and Entra Suite have each been available in some form before, but G7 is the first government SKU that bundles them with a dedicated agent management layer.

How does G7 compare to Microsoft 365 E7?

First, let’s discuss how they might compare in terms of pricing. E7 lists at $99 per user per month before discounts in the commercial cloud. While Microsoft does not publicly list pricing for GCC or GCC High licenses, Secureframe is a Microsoft reseller with access to current list pricing so based on this pricing guide, we know that GCC licenses run about 22 to 25% higher than their Commercial counterparts. That means the G7 license in GCC could reasonably land around $120 to $125 per user per month.

The bigger difference is feature parity. While G7 includes the same core components as commercial E7, it does not have the same feature set. Government clouds have historically received Microsoft features later than commercial tenants, and some features never arrive at all because they depend on services that can't run inside the government boundary. G7 follows that same pattern, which is why it's worth comparing what's actually available in GCC rather than what's available with E7 in Commercial.

That’s 74% parity today. Of the 9 missing features, 8 are marked “coming soon” and 1 Copilot feature in E7 (Microsoft Security Copilot) doesn’t appear in the G7 chart at all.

We’ll explain why this lack of total parity between enterprise and government licenses in more detail below.

Note: You can see exactly which features are available (or “coming soon” in which license in the Microsoft 365 GCC PDF Plan Comparison and the Microsoft 365 Enterprise PDF Plan Comparison.

What are the limitations of Microsoft 365 G7?

Feature availability in government licenses tends to trail enterprise licenses. As with G5 and other government plans, G7 capabilities are rolling out in phases as each workload clears its authorization milestones for GCC. Because the parts arrive on an authorization schedule, organizations should question whether the up-front cost is justified by what actually works at launch once a new license like G7 becomes purchasable since the version you buy may differ meaningfully from what Commercial customers have.

For example, Agent 365 is the centerpiece of this new frontier suite, but the GCC version (G7) is missing many of the integrations that matter most for CUI environments. According to Microsoft's Agent 365 service description, of the 26 listed capabilities available in Commercial, only 12 are available in GCC.The core registry, governance actions, and Entra identity controls are live. Most Microsoft Purview and Defender capabilities are not.

That gap maps directly onto several NIST SP 800-171 requirements that assessors look at when AI agents can reach CUI:

None of this means agents can't be used responsibly in a CUI environment. It does mean that, for now, a G7 license alone won't give you agent-level audit trails or data loss prevention, so those requirements will likely need to be met through other tooling, compensating controls, or by limiting what agents can reach. Whatever approach you take should be documented in your System Security Plan (SSP).

Which defense contractors can use G7 today?

Whether G7 is an option today depends on which Microsoft cloud your CUI lives in, and that decision is driven by your contracts and data types, not by CMMC itself. CMMC doesn't require GCC High. What matters is that any cloud service storing, processing, or transmitting covered defense information meets the FedRAMP Moderate baseline or its equivalent under DFARS 252.204-7012.

In general terms:

• Contractors handling only Federal Contract Information (FCI) must meet CMMC Level 1 and have the option of using E7 in Commercial (although not recommended, this cloud is sufficient for FCI) or G7 in GCC. Read how CMMC is supported in Microsoft 365 Commercial vs GCC vs GCC High.
• Contractors handling CUI Basic may find GCC sufficient, depending on their contracts and risk tolerance. They have several license options, including G7.
• Contractors handling CUI Specified, such as ITAR or EAR export-controlled data, must choose GCC High for its data residency and data sovereignty controls. That means they have to wait until G7 is generally available.

Microsoft has not announced a firm date for G7 in GCC High, but a Microsoft announcement about what’s next in Microsoft 365 Copilot for Government suggests that it could arrive this fall or over the next few months.

Either way, it’s important to remember that license availability is only one input into your CMMC scoping and infrastructure decisions.

Should defense contractors buy Microsoft 365 G7 now?

For most defense contractors, the prudent move right now is to evaluate G7 rather than buy it. GCC High customers can't purchase it yet, and GCC customers would be paying for a suite where several of the most CMMC-relevant controls related to AI agents and tools haven't shipped.

That said, the right answer depends on your situation. G7 may be worth a closer look if:

• You're already on GCC and already planning to license G5, Copilot, and Entra Suite separately
• You have Copilot Studio agents in production and need a central registry to inventory and govern them
• Microsoft offers a discount at renewal that makes G7 cheaper than your current stack, and you can get feature timelines in writing

It's likely worth waiting if:

• Your CUI lives in GCC High or the DoD cloud
• You'd be buying primarily for AI features that are still on the government roadmap
• You'd be relying on Agent 365 for audit logging or data loss prevention to satisfy NIST SP 800-171 requirements

How to prepare for Microsoft 365 G7 if you're on GCC High

GCC High customers can use the time before G7 arrives to get their AI governance foundation in place, so that adopting G7 later is a configuration exercise rather than a scramble. Much of this work also supports your existing NIST SP 800-171 compliance obligations, whether or not you ever buy G7.

• Inventory the agents you already have. Copilot Studio and Agent Builder are already available in GCC and GCC High. Identify every agent in your tenant, who owns it, and which SharePoint sites, Teams channels, and mailboxes it can access.
• Decide whether agents can touch CUI at all. Map agent access against your CUI boundary. If an agent can reach a library containing CUI, that access path needs the same scrutiny you'd apply to a user account.
• Document AI in your SSP. Record Copilot and any agents as in-boundary components, note which requirements they affect, and update your customer responsibility matrix to reflect what Microsoft covers and what you do. The CMMC shared responsibility model is a useful starting point.
• Close the audit and labeling gaps another way. Until agent-aware Purview audit, DLP, and label inheritance reach your cloud, use existing sensitivity labels, DLP policies for users, and access restrictions to limit what agents can reach.
• Publish an AI acceptable use policy. Name approved and prohibited AI tools, explain how CUI should and shouldn't be used with them, and train staff accordingly.
• Revisit your license mix. Many of G7's components are available separately today. Microsoft 365 Copilot is available in GCC High as an add-on, alongside G5 and G3. Comparing what you'd pay for the pieces now against G7 later can help you avoid paying twice.

Looking for Microsoft 365 licenses today? As Microsoft reseller, Secureframe offers competitive pricing on Microsoft 365 GCC High licenses, including Business Premium, G3, and G5 and add-ons. Browse licenses on the Marketplace.