5 Things Microsoft's DIB Security Architect Wants Defense Contractors to Know About CMMC in the Cloud
Choosing a Microsoft cloud is one of the first and most expensive decisions a defense contractor makes on the path to CMMC, DFARS 7012, or NIST 800-171 compliance. On November 10, 2026, Richard Wakeman, Chief Security Architect for Aerospace and Defense at Microsoft, spent an hour walking small and mid-sized contractors through that decision in a webinar hosted by Secureframe.
Wakeman has been moving Defense Industrial Base (DIB) companies onto Microsoft's government clouds since 2007. Below are the five points he returned to most, plus four audience questions that come up often across the DIB.
- Watch the recording: Getting CMMC Right in Microsoft
- Read the full recap with all 15 audience questions: Getting CMMC Right in Microsoft: Webinar Recap and Q&A
1. CUI doesn't belong in Microsoft 365 Commercial
Wakeman was direct on this point: "You cannot use the Office productivity suite in Commercial and get CMMC Level 2 certified."
The reason is DFARS 252.204-7012, which requires any cloud provider holding Controlled Unclassified Information (CUI) to be FedRAMP Moderate or equivalent. The Commercial version of Exchange, SharePoint, OneDrive and Teams carries no FedRAMP authorization. Commercial can store data at rest in the US, but its support staff and network are global, so it offers data residency without data sovereignty.
Commercial remains an option for contractors that handle only Federal Contract Information (FCI) at Level 1.
2. Most contractors who work with the DoW end up on GCC High
Microsoft offers two government options. GCC is a region within the Commercial cloud and can hold CUI Basic. GCC High runs on Azure Government, a separate sovereign cloud built for export-controlled data (ITAR and EAR) and CUI Specified.
Among the several hundred contractors Wakeman has worked with, he sees "a 90/10 split" in favor of GCC High. Many of them hold no ITAR data today. They choose GCC High because a future contract could bring it, and there is no upgrade path between the two clouds. He described moving from GCC to GCC High later as "a very painful migration."
The roughly 10% who stay on GCC tend to be healthcare and professional services firms whose CUI Specified stays in their customers' environments. Secureframe's GCC High vs GCC comparison breaks down the differences between the two.
3. A GCC High license is not a CMMC certificate
"If you buy GCC High, you're not magically going to be CMMC compliant," Wakeman said.
Microsoft is responsible for the data centers and physical security. The contractor still configures about 86 technical controls in tools like Intune, Defender for Endpoint and Sentinel, and still owns the policies, training and documentation behind all 110 NIST SP 800-171 requirements. Contractors that outsource parts of CMMC to a managed service provider add a third party to that split, which is why a written shared responsibility model matters at assessment time.
4. An enclave is a way to start, not always the place to stay
Many small contractors begin with a CUI enclave: a separate GCC High tenant for the handful of people who touch CUI, often reached through a virtual desktop. It is usually the fastest route to Level 2 and gives assessors a clear scoping boundary.
The tradeoff is spillage. Employees still live in their Commercial accounts day to day, and CUI sent to a Commercial mailbox by mistake becomes a 72-hour reporting event under DFARS 7012.
Wakeman's advice is to draw the line around a business unit or subsidiary so that people who work side by side are not split across tenants. Over time, most companies he works with move whole units into GCC High.
5. Business Premium lowers the cost of entry for small businesses
Cost is one of the main reasons small businesses hesitate on GCC High, along with time and in-house expertise. Microsoft 365 Business Premium is now available in GCC High for organizations with up to 500 users, at roughly 40 to 45% of the price of G5. "We fought really hard to get those Business Premium SKUs into GCC High," Wakeman said. For current per-user prices across Business Premium, G3 and G5, see Secureframe's GCC High pricing and licensing guide.
For more on what CMMC typically costs a small contractor, see the true cost of CMMC and how CMMC affects small businesses.
Audience questions
Does Microsoft offer a low-cost, always-compliant enclave for small businesses?
No, and neither does any other cloud provider. "It's too much liability for Microsoft to actually manage a service and be the cloud service provider at the same time," Wakeman said. Microsoft instead publishes what he calls "scaffolding": the Product Placemat for CMMC, the Technical Reference Guide for CMMC and its FedRAMP customer responsibility matrix. Contractors build on that themselves or with a partner.
Can foreign nationals and overseas affiliates use GCC High?
Yes. Wakeman said "there's no restriction in terms of citizenship or even location" for connecting to Microsoft's government clouds, with one firm exception: users from the embargoed countries listed in ITAR 126.1. Access to export-controlled data inside the tenant is still governed by the contractor's own ITAR and EAR obligations.
How can primes work with sub-tier suppliers that aren't ready for Level 2?
A common approach is for the prime to host the CUI. Supplier staff get guest access to the prime's GCC High tenant or a virtual desktop session in Azure Government, so CUI never lands on the supplier's systems. With primes driving much of CMMC enforcement through flow-down, the arrangement should be written into subcontract terms.
Do CMMC assessors accept Microsoft tools as evidence?
Yes. Configuration exports, audit logs and Intune compliance reports all count. A Compliance Manager score alone does not. Assessors want an artifact showing each objective is implemented and operating.
Where to go from here
The full session covers licensing, Teams, engineering applications and remote workforces in more detail.