Today, Microsoft marks a milestone with the general availability of Azure Enclave in both Azure and Azure for US Government. Azure Enclave is a managed Azure service designed to help organizations streamline the deployment and management of their isolated cloud environments for sensitive and special access workloads while applying policy governance and monitoring.

For US Government agencies and the Defense Industrial Base (DIB), Azure Enclave builds on Microsoft’s experience supporting sensitive, classified, and special access program missions where agencies, mission partners, contractors, national laboratories, academic institutions, and suppliers need to work together across organizational boundaries. That experience requires a repeatable approach to network isolation, explicit connectivity, and centralized visibility.

Those needs are not unique to a single mission or sector. Governments worldwide and organizations in highly regulated industries also need to collaborate around sensitive information while maintaining strong controls over access, connectivity, monitoring, and operations. Azure Enclave addresses that shared challenge by helping organizations start from a governed foundation rather than assembling custom isolation architectures independently for every program or workload.

A repeatable foundation for mission success

Sensitive government work rarely occurs within a single program office, agency, or organization. Agencies may need to collaborate with mission partners, contractors, suppliers, national laboratories, or academic institutions, and some participants may not have the resources to independently establish and manage a complex isolated environment.

Azure Enclave brings together managed infrastructure and predefined architectural isolation patterns so organizations can begin with a foundation designed for isolation and adapt it to their workload, policy, and operational requirements. The service uses a community-and-enclave model: a community provides shared network controls, while each enclave provides an isolated workload boundary. Policy and routing controls can be applied across explicitly approved connection paths among authorized users, applications, services, and data.

This model helps teams streamline planning, configuration, testing, and ongoing management. Workload resources can span subscriptions while organizations apply shared governance across related enclaves, giving agencies and partners a consistent way to establish compartmentalized, policy-governed environments, potentially reducing the need to create one-off architectures for every workload.

Delivering mission-critical capabilities requires infrastructure that helps us move quickly without compromising security. Azure Enclave helps simplify the deployment of applications and services across secure, isolated environments, allowing us to provision mission workloads and expand capacity more efficiently while maintaining the controls our customers require. This enables teams to spend less time managing infrastructure and more time focused on delivering outcomes for the mission.

—Justin Shirk, Joint & Strategic Defense Lead at Accenture Federal Services

Our customers are looking for ways to modernize sensitive workloads without compromising security, compliance, or operational effectiveness. Azure Enclave helps address that challenge by reducing the complexity of establishing secure cloud environments and enabling trusted collaboration at scale. Azure Enclave is well-aligned to the security standards the US Government and its partners rely on, making compliance reviews and security conversations much easier compared to traditional deployment models. Combined with our expertise in cloud operations, security and compliance, we look forward to helping our customers accelerate their delivery while staying focused on what matters most: the mission.

—Carroll Moon, CEO and co-founder, CloudFit

Layered security, governance, and visibility

Azure Enclave is designed around a defense-in-depth approach. Virtual networking infrastructure is isolated by default, connections are explicitly configured and managed by the customer, and Azure Policy supports policy governance across communities and enclaves. Network segmentation, role-based access, controlled endpoints, defined permissions, and approval workflows provide multiple layers of control and oversight.

Centralized logging and built-in observability help teams monitor access, configuration changes, and data flows. Security alerts and analytics can be established with Microsoft Sentinel or other Security Information and Event Management (SIEM) tools. This will provide additional visibility into activity and system changes, helping mission owners, security teams, platform teams, application teams, and compliance stakeholders maintain a clearer view of an environment’s posture.

Azure Enclave complements, rather than replaces, an organization’s broader security and compliance program; customers remain responsible for configuring their environments, evaluating the service against applicable requirements, and meeting the obligations associated with their workloads. For US Government agencies and their partners, Azure Enclave provides a governed foundation for sensitive mission workloads, with accreditation efforts underway to comply with FedRAMP and DoD Impact Levels 4, 5, and 6, as well as Intelligence Community environments governed by ICD 503 requirements. Its tools are designed to support alignment with the applicable requirements as workloads move across classifications up to the Top Secret level.

Extending the model to worldwide governments and regulated industries

Government organizations worldwide may face similar requirements to control connectivity, govern access, monitor activity, and collaborate with external institutions or partners. Azure Enclave can provide a repeatable model for isolated environments, while each organization remains responsible for evaluating its deployment against the legal, regulatory, security, and operational requirements applicable to its workloads.

Highly regulated industries face similar collaboration and data-protection challenges. Healthcare providers, pharmaceutical companies, and research institutions can establish isolated environments for projects involving protected health information, clinical research, genomic data, and other sensitive datasets. Universities, laboratories, and research organizations can create shared environments for joint studies and multidisciplinary programs while maintaining separation among projects and applying consistent controls. Financial institutions can use isolated environments to support sensitive analytics, risk modeling, regulatory reporting, and controlled collaboration involving confidential financial information.

Azure Enclave provides capabilities for bringing authorized users, applications, services, and data into controlled environments while preserving boundaries between workloads.

Get started with Azure Enclave

Azure Enclave helps support sensitive collaboration by helping reduce the complexity of the underlying infrastructure, allowing teams to focus on mission, research, services, and business outcomes.

Organizations can start with a focused deployment for one workload and a defined group of users, then expand to include additional teams, applications, partners, or data sources. Azure Enclave supports that progression by enabling users to group enclaves with similar requirements into communities, deploy workload resources across subscriptions, and manage access at the application level. This structure gives organizations a path to evolve deployments as mission and operational requirements change while maintaining a consistent approach to isolation, governance, and observability.

Explore Azure Enclave to learn more about its capabilities, use cases, and pricing. Connect with your Microsoft representative to discuss how Azure Enclave can support your organization’s security, governance, operational, and collaboration requirements.

Azure Enclave

Streamlines the deployment and management of isolated cloud environments for sensitive workloads.

Get started

The post Azure Enclave is now generally available: Managed workload isolation for government and regulated industries appeared first on The Microsoft Cloud Blog.

The next evolution of Microsoft 365 for government brings productivity, AI, agents, security, identity, compliance, and governance together for organizations operating in Government Community Cloud (GCC) environments.

Across government, leaders are being asked to modernize services, address evolving cybersecurity needs, and help their teams meet growing demands simultaneously. AI tools can play an important role, but technology alone is not enough. Agencies need intelligence grounded in how they work, agents that extend that intelligence, and a control plane to help govern AI adoption securely. Innovation and trust must advance together.

Today, we are announcing the launch of Microsoft 365 G7, the Frontier Suite for government, to Government Community Cloud (GCC) environments. G7 extends the Intelligence + Trust vision introduced with Microsoft 365 E7 to government agencies, bringing together productivity, AI, agents, security, identity, compliance, and governance to support government organizations as they help accelerate mission outcomes and further mature their governed approach to adopting AI at organizational scale.

Both Microsoft 365 G7 and Agent 365 will be available for GCC customers to purchase beginning October 1, with additional purchasing options available November 1, and capabilities expanding in phases. Customers can begin licensing, planning, and adopting available experiences at launch, with additional workloads rolling out as they complete required GCC authorization milestones. This phased approach advances innovation with the rigor government missions demand.

Built on the trusted foundation of Microsoft 365 for government

Microsoft 365 G7 extends the Microsoft 365 foundation agencies know, starting with Microsoft 365 G5 solutions that bring together productivity and collaboration with information protection, security, and compliance capabilities. Microsoft Entra Suite builds on this with advanced identity, access governance, and network security capabilities for users and agents.

G7 is designed to support Frontier Transformation across the U.S. public sector by providing capabilities that agencies can use as they move from isolated AI experimentation toward governed adoption at organizational scale. It connects intelligence to the flow of everyday work, gives agencies a foundation for creating and using mission-focused agents, and provides the controls that IT and security leaders need to manage people, agents, data, and access with confidence.

AI embedded in the flow of work

AI should make everyday work simpler, not create another destination. G7 brings Microsoft Copilot and AI-powered Microsoft 365 experiences into the applications government employees already use. Work IQ grounds these experiences in organizational data, context, and tools with governance capabilities designed to operate in accordance with applicable permissions, so Copilot can provide assistance informed by an agency’s work context and help users complete mission-related work.

At general availability, G7 will bring the value of Microsoft Copilot into a unified offering designed for government. Government teams can use Copilot to support research and analysis, find and synthesize organizational knowledge, and draft, refine, and collaborate on content in the Microsoft 365 apps and experiences they use every day. 

In the months following GA, G7 will also benefit from a surge of new capabilities rolling out in Microsoft Copilot across our US Government clouds, including the latest commercially available GPT models, Work IQ memory and personalization, Edit with Copilot across Word, Excel, and PowerPoint, and Copilot Cowork for longer-running, multi-step work. To learn more about how these advances can help public servants navigate complex work and support their organizations’ mission priorities, read our companion announcement on the Microsoft Public Sector blog.

Agents at the mission’s edge

Agents can support specialized government work, from research and policy analysis to case management, grants, inspections, and constituent service. G7 provides an agentic foundation for government, with mission-focused agents grounded in Work IQ, and operating in accredited government clouds with policy-governed access for connecting to approved agency systems and data.

Agencies can start with Microsoft agents available in GCC, including Researcher and Analyst, and use Agent Builder to create experiences closer to the work. For specialized missions, teams can build custom agents with Microsoft Copilot Studio. Microsoft 365 Copilot Connectors bring agency knowledge from other systems within reach, while managed connections provide secure access to approved data and line-of-business applications. Natural-language creation broadens who can build, while organizational controls keep deployment aligned to agency standards.

Agent 365: The control plane for AI adoption

The speed of agent adoption creates enormous opportunity, but without the right controls it can also create new blind spots. Leaders need to know which agents exist, who owns them, what they can access, and whether they are operating as intended. Agent 365 provides the control plane for agents in G7, helping organizations discover, register, and manage agents and take governance actions such as deploying, blocking, or removing them.

At general availability, Agent 365 will give organizations a unified foundation to discover, identify, and govern agents, with core controls to manage how they are deployed and used. Over time, we expect Agent 365 capabilities to evolve across security, risk management, and lifecycle governance. For detailed information about GCC feature availability, customers can refer to the Microsoft Agent 365 service description. As additional services complete required GCC authorization and readiness milestones, their status will be updated there.

Advancing the mission with confidence

AI creates tremendous opportunity for government teams to build capacity, strengthen resilience, and respond more effectively to the people they serve. Realizing that opportunity requires leadership, workforce readiness, responsible governance, and technology that unites intelligence and trust.

Microsoft 365 G7 advances Frontier Transformation for government, giving agencies a path to empower employees, scale agents and adopt AI securely as capabilities expand. By combining AI in the flow of work, mission-focused agents, and a unified control plane, agencies can advance modernization with controls designed to support the stringent trust, security, and governance needs of public service and national missions.

Public sector transformation is about more than technology. It is about helping people serve communities and advance the mission. With G7, Microsoft builds on its longstanding government partnership to help public servants apply AI with the intelligence to support the mission and the controls to move forward with confidence.

The post Introducing Microsoft 365 G7: Intelligence + Trust for the mission ahead appeared first on The Microsoft Cloud Blog.

These advancements help enable government organizations to accelerate mission outcomes, empower their workforce, and deliver services more effectively, all while meeting the rigorous security, compliance, and operational requirements their missions demand.

Moving from AI interactions to mission-ready agents
Government organizations often need more than a simple prompt-and-response AI experience. They need AI solutions that can understand their mission, use approved information, follow established processes, and keep people involved in important decisions.

The Microsoft Foundry Agent Service helps organizations build these kinds of AI-powered assistants in Azure Government. These agents can be used with trusted data and tools, directed to follow organizational rules and policies, and support work in secure mission environments.

This makes it easier for agencies to create AI solutions that can be reused across different teams and missions, rather than building a new system for every need. For example, agents can help employees find and summarize information, support case management and service delivery, assist with planning and operations, and provide guided support for employees and the public.

AI agents are designed to help people, not replace them. People remain responsible for important decisions and actions, while agents handle time-consuming tasks, help coordinate complex processes, and provide the right information when it’s needed. This allows government employees to spend less time on the leg work and more time focused on serving their mission and constituents.

Bringing advanced models to government missions
The availability of GPT-5.6 Sol, Terra, and Luna in Azure Government gives organizations the flexibility to choose the AI model that best fits their needs, whether they’re tackling complex analysis, supporting everyday productivity, or delivering fast and responsive experiences at scale.

These models can help government organizations:

Review and summarize large amounts of mission-relevant information more quickly.
Build AI-powered applications and agents that assist employees and improve services for the public.
Speed up software development, research, planning, and operational work.
Create experiences that can understand and work with multiple types of information, such as text, images, and other content, while providing data management and oversight capabilities.
Azure Government provides a trusted environment for adopting these capabilities responsibly. Organizations can take advantage of advanced AI and leverage the enterprise capabilities in Azure to help protect sensitive information.

Building a trusted AI foundation
AI adoption in government must be grounded in trust. Microsoft continues to invest in the controls, platforms, and services that help enable customers to innovate responsibly, protecting sensitive data, supporting compliance obligations, and providing the operational visibility needed for mission-critical deployments.

With GPT-5.6 Sol, Terra, and Luna and the Microsoft Foundry Agent Service now available in Azure Government, organizations can use these models directly or through agents to turn AI experimentation into scalable mission impact.

We look forward to working with our government customers and partners as they use these capabilities to build the next generation of trusted AI solutions.

Learn more about GPT-5.6 and Microsoft Foundry Agent Service and get started today!

The post Advancing trusted AI innovation with Agents and new Azure OpenAI models in Azure Government appeared first on The Microsoft Cloud Blog.

For government, the significance is straightforward. The software weaknesses that put agency missions at risk are rarely the obvious ones. They are subtle problems that only become visible when you look across an entire software supply chain at once, and they are precisely what a well-resourced cyberattacker will be looking to exploit. Codename MDASH was built specifically to find those kinds of vulnerabilities, and to help find them first.

Defending the nation’s critical systems from an increasingly sophisticated cyberthreat landscape is a shared mission, and Microsoft is committed to bringing the most advanced security capabilities to US government agencies, building on its longstanding partnership with federal, state, and local government customers.

How codename MDASH works: Finding flaws faster

Most traditional security scanning tools work by looking for known patterns, the software equivalent of checking for a list of common mistakes. They are fast but quickly become difficult to maintain at high quality as the number of patterns to scan for can number in the thousands. This approach can miss more complex flaws that could matter most, and in the process generate so many uncertain results that developers and security teams often spend more time sifting out the false positives than fixing real issues. Codename MDASH takes a fundamentally different approach by working as an agentic code scanner that finds and validates exploitable vulnerabilities in source code. It reads and reasons about software the way an expert security researcher would, rationalizing the codebase and following how information moves through a program to work out whether a weakness could actually be exploited by a cyberattacker.

Codename MDASH works by putting more than 100 specialized AI agents, leveraging a variety of models, to work on the same body of code, each trained to recognize a different category of weakness. Their findings are then handed to a second group of agents whose job is to argue the case, for and against, whether each suspected flaw is genuinely reachable and genuinely dangerous. The harness also saves time for defenders by merging and deduplicating results, and where possible the system demonstrates the flaw rather than merely asserting it. What reaches the security team at the end is a more comprehensive, refined, and prioritized list of vulnerabilities that can be assessed and acted on, consistently finding strong signals in the noise.

This multi-model, multi-step agentic approach is the key factor in how codename MDASH scored a 96.55 on the public CyberGym benchmark of real-world vulnerabilities and has produced similar results on first-party code validated against Microsoft’s historical vulnerability cases.

Built to keep getting better: The advantage of a multi-model approach

The key differentiator of codename MDASH is its harness design, a system that directs and coordinates the use of whichever models are best for a specific task. This allows for more robust analysis, increased cost effectiveness, and the flexibility to rapidly adopt new models. Multiple models provide independent analysis, because disagreement between models is useful information in its own right: when one AI flags a problem and another cannot argue it away, or when two models agree out of the gate, confidence in the finding rises.

This matters more than it might first appear. AI models improve at a rapid pace, and a security tool tied to one model is only ever as good as that model’s last release. Because codename MDASH is multi-model by design, adopting newer, better models as they arrive doesn’t require going back to the drawing board, and everything an agency has already invested in downstream of the system carries forward. The models will keep changing. The harness stays the same, and for the customer the experience remains consistent in their existing Microsoft security products.

This design also helps control costs. Microsoft’s own MAI model family is designed to make this work affordable at scale, and our newest addition is expected to cut the cost of an individual scan roughly in half. There is far more code in the world than can currently be reviewed at this level of depth, so agencies are ranking their software by mission importance and working steadily down the list. Every reduction in cost moves that line closer to the goal of 100% code coverage without additional budget cycles.

Azure Government: A secure home for sensitive work

The source code behind a mission system is a critical element of national security systems that requires additional levels of assurance, especially when dealing with vulnerability analysis. Azure Government provides a separate, isolated cloud operated by screened US persons and built to meet the compliance obligations that federal, national security, and state and local government customers carry, including FedRAMP High authorization and Department of War accreditation for controlled and mission-critical workloads. Codename MDASH is available in Azure Government as a feature of Microsoft Defender that works with models available within the FedRAMP High-authorized Microsoft Foundry service. This allows an agency’s source code and everything the system learns about it to remain within a boundary already approved for handling of that data.

A warning worth heeding

AI offers tremendous capabilities for interacting with software that can cut both ways. An AI system capable enough to find a vulnerability in a defender’s software is capable enough to help a threat actor find one to exploit. Threat actors are investing in AI capabilities, and the only durable advantage available to defenders is time—the gap between when a weakness can be found and patched and before someone else finds it.

The good news is that agencies do not have to wait to act. Microsoft has been using codename MDASH on its own software for months, and the US government is not far behind, with customers across national security and civilian agencies already exploring its capabilities. If your organization owns software a mission depends on, the question is no longer whether to examine it with a system like this. It is how quickly you can work through the list.

For more information on how to access codename MDASH in your tenant contact your Microsoft account team about MDASH in Azure Government.

The post Codename MDASH brings agentic AI security scanning to US government appeared first on The Microsoft Cloud Blog.

Today, we are excited to announce the availability of Microsoft Fabric in Microsoft 365 Government Community Cloud High (GCC High). Beginning September 2, 2026, Microsoft Fabric will be available in public preview for GCC High customers, with general availability starting October 1, 2026. Feature availability at public preview and general availability will vary by workload and expand over time. Visit the Microsoft Fabric for US Government GCC High customers Learn page for current details.

To realize the full potential of AI, agencies need a modern data foundation that brings together analytical, operational, transactional, structured, and unstructured data while meeting the security, compliance, and governance requirements of regulated environments.

That is the challenge Microsoft Fabric is designed to address. As Microsoft’s unified data and AI platform, Fabric helps organizations unify their data, establish shared business context, and move from isolated AI experiments to production-ready agent systems grounded in trusted organizational knowledge.

Experience a unified data and AI platform designed for the next frontier of AI

Microsoft Fabric brings together data integration, analytics, databases, real-time intelligence, and business intelligence into a single open SaaS platform. By unifying data in OneLake and connecting people, data, and workloads on a common foundation, Fabric helps organizations achieve faster insights, more productive teams, and optimize costs on an enterprise-grade platform.

For government organizations, this provides a modern data foundation for analytics, AI, and intelligent agents on a single, integrated platform. Instead of managing separate tools for data movement, storage, analytics, and reporting, agencies can bring these capabilities together in a single environment that helps teams collaborate, simplify governance, and prepare data for analytics, AI, and intelligent agents.

Building this kind of AI-ready foundation typically involves four key steps:

• Unify your data estate: Eliminate silos and reduce architectural complexity by bringing data together.

• Process and harmonize data: Stream, integrate, and transform historical and real-time data to make it AI-ready.

• Create semantic meaning: Add business context to data so agents understand data the same way your teams do.

• Empower AI agents to act: Use unified, context-rich data to automate workflows, accelerate decisions, and drive action.

Microsoft Fabric unifies data integration, databases, analytics, business intelligence, and AI on a single platform while delivering the capabilities organizations expect from category leaders. Microsoft is recognized as a Leader in the 2026 Gartner® Magic Quadrant™ for Analytics and Business Intelligence Platforms and in the 2025 Gartner® Magic Quadrant™ for Data Integration Tools, Cloud Database Management Systems, and Cloud AI Developer Services.

Unify your data estate with Microsoft OneLake

Preparing data for AI often starts with a simple challenge: finding and connecting all the data an organization already has.

Most government data estates span multiple systems, clouds, departments, and applications. Data teams spend significant time moving, copying, synchronizing, and managing data before they can use it for analytics or AI. This complexity creates additional cost, operational overhead, and governance challenges.

At the center of Microsoft Fabric is Microsoft OneLake, a single, unified data lake that helps organizations bring together their entire data estate. With zero-copy, zero-ETL tools in OneLake, agencies can connect data across clouds, on-premises systems, and third-party platforms without creating unnecessary copies or duplicating data across multiple environments. For example, Lumen, a leader in enterprise connectivity, cut 10,000 hours of manual effort.

We used to spend up to six hours a day copying data into SQL servers. Now it’s all streamlined…OneLake allowed us to ingest once and use anywhere.

Chad Hollingsworth, Cloud Architect at Lumen

This approach reduces data silos, simplifies architecture, and creates a common foundation that analytics, reporting, AI applications, and agents can all leverage. By bringing data together in one place, organizations can spend less time managing infrastructure and more time extracting value from their information.

Process and harmonize data

Unifying data is only the beginning. To support AI and advanced analytics, organizations also need to prepare, transform, and continuously refine their data.

Microsoft Fabric provides a complete suite of analytics capabilities that help organizations ingest, process, analyze, and visualize data across the entire lifecycle. Data engineers can build pipelines, data scientists can develop models, analysts can create reports and dashboards, and operational teams can monitor live streams of information, all on a shared platform operating over a common data foundation.

Because these capabilities are integrated within Fabric, organizations can move seamlessly from raw data to analytics, business intelligence, and AI applications without stitching together multiple disconnected services.

Instead of managing fragmentation, my team now focuses on building reliable patterns that scale with closely integrated capabilities like Fabric Data Warehouse and Fabric’s native executive engine for Spark. The shift reduced costs and operational friction and restored confidence.

Nagaraju Gutlapalli, Head of Data Engineering, Bajaj Finserv

For government organizations, this creates a more efficient path from data collection to actionable insight, helping teams respond more quickly to changing operational needs while maintaining trust in the underlying data.

Create semantic meaning

One of the biggest challenges with AI is that data alone is not enough. To generate meaningful insights and take useful actions, AI systems need to understand how an organization operates, including its business processes, policies, operational state, and institutional knowledge.

Fabric helps address this challenge through Fabric IQ, the intelligence layer for enterprise knowledge and operations. Fabric IQ brings together unified data in OneLake, business intelligence through semantic models and metrics, and operational intelligence. Together, these capabilities create a shared knowledge foundation that gives data consistent business meaning across the organization.

For government organizations, this is particularly important because useful AI outcomes often depend on understanding complex relationships between people, programs, assets, operations, and policies. By combining data with institutional and operational knowledge, Fabric helps ensure AI systems are grounded in trusted organizational context rather than isolated datasets or technical schemas.

The result is a shared intelligence foundation that people and AI can understand, reason over, and act upon. This foundation enables trusted AI experiences, intelligent applications, and specialized agents that can analyze information, recommend actions, automate workflows, and support mission-critical decisions.

Empower AI agents to act

As organizations move beyond AI assistants and toward intelligent agents that can reason, automate work, and take action, the quality of the underlying data foundation becomes increasingly important.

Microsoft Fabric provides the foundation for these next-generation AI experiences by bringing together unified data in OneLake, analytics across the Fabric platform, and enterprise knowledge through Fabric IQ. Together, these capabilities enable agents to access trusted data, understand business context, reason over current conditions, and take informed action.

Organizations can connect data and knowledge from Fabric to AI experiences built with Microsoft Copilot Studio, Microsoft Foundry, Microsoft 365 Copilot, and custom applications, helping ensure agents operate with a consistent understanding of enterprise data and operations.

Using Fabric and Foundry Agent Service, we’ve built agents that allow us to talk to our data, ask personalized questions, and uncover insights based on role or function.

Maureen Tan, Head of AI Center of Excellence, NTT DATA

For government agencies, this creates new opportunities to accelerate analysis, improve operational efficiency, automate mission-critical processes, and empower employees with AI experiences grounded in trusted organizational knowledge.

Getting started with Microsoft Fabric in GCC High

The availability of Microsoft Fabric in GCC High represents an important milestone in bringing Microsoft’s data and AI platform to government customers operating in regulated environments.

Organizations can begin exploring and adopting Fabric capabilities using their existing Power BI Premium capacities. Both Power BI and Fabric workloads will consume from the same capacity, enabling you to start using Fabric workloads immediately while continuing to run existing Power BI reports, dashboards, and semantic models without interruption.

For organizations already using Power BI Premium, Microsoft Fabric is available as part of their existing capacity. To learn more about the changes coming to your Power BI Premium environment, visit the Microsoft Fabric for US Government GCC High customers Learn page.

For GCC High organizations that do not currently have Power BI Premium, Microsoft Fabric capacity is available for purchase starting today.

Not all Microsoft Fabric capabilities will be available at launch. To view the complete list of supported features and the latest availability information, visit the same Fabric in GCC High Learn page. Please continue checking back as many more features will continue to be released over the following months.

Building the data foundation

As agencies continue their AI transformation journeys, success will increasingly depend on the strength of their data foundation. By helping organizations unify their data estate, prepare data for analytics and AI, add business context, and create trusted AI experiences, Microsoft Fabric provides a platform designed for the next generation of government innovation.

The future of AI starts with data. With Microsoft Fabric in GCC High, government organizations can begin building that foundation today.

Explore Microsoft Fabric in GCC High

Discover the latest information and a complete list of available features.

Learn more

The post Microsoft Fabric in GCC High: Building the data foundation for AI appeared first on The Microsoft Cloud Blog.

The Genesis Mission represents an ambitious vision, bringing together DOE’s 17 National Laboratories, world-class experimental facilities, decades of irreplaceable scientific data and next-generation computing into a single, unified platform capable of transforming how science gets done. The critical goal of the Genesis Mission is to double the productivity and impact of American research and innovation within a decade by embedding AI directly into the scientific process. It’s a bold step forward and exactly the kind of moonshot that defines American science.

At Microsoft, we believe that this goal is not only achievable, but also essential as a national security imperative and an economic engine for generations to come. With this commitment and the launch of SPARK, we’re ready to partner fully in this mission and build on our collaborations across government and with academia.

Microsoft investing in AI for science

Today, Microsoft’s $60 million investment package will begin to accelerate AI for science in support of DOE and the National Laboratories. As sustained scientific impact requires more than infrastructure alone to enable lasting scientific outcomes, Microsoft’s investment package is structured in two parts:

• $40 million in Azure compute and AI credits, distributed over three years, to power the large-scale AI and scientific workloads at the heart of the mission. This gives researchers room to train, simulate and iterate at a scale that matches their ambition.
• $20 million in solution engineering enablement services. Dedicated engineering, architecture, deployment, adoption and acceleration support to turn cloud and AI capacity into operational scientific outcomes. This investment helps ensure that the Genesis Mission advances in practice and in principle.

Together, this investment reflects a simple conviction: While infrastructure opens the door, it is people, expertise and disciplined delivery that carry discoveries across the finish line. Microsoft is committing to both.

Introducing SPARK: Microsoft’s catalyst for advancing scientific partnerships

Great partnerships need more than good intentions and good technology — they need a clear way to work together. So, alongside this commitment, we are standing up a new program office and coordination hub: SPARK, or Scientific Partnership Advancing Research & Knowledge.

SPARK is the single front door and coordination hub for Genesis Mission collaboration with Microsoft. SPARK orchestrates the full breadth of what Microsoft brings to bear: program, technical, research, engineering, security, compliance, partner and field teams into one clear, consistent path from first idea to deployed science.

SPARK is built around five commitments:

• A dedicated Genesis Mission Program Management Office. This office handles intake, prioritization, a disciplined sprint-and-checkpoint cadence and a steady operational interface with DOE for alignment, reporting and sustained partnership.
• An AI for Science Center of Excellence. An integrated delivery team that moves use cases from concept to secure, compliant, scalable implementation, with enablement through office hours, hackathons and training grounded in responsible AI and reproducible research.
• Optimization of Azure credits. Ensures computing resources are directed toward the projects where they can accelerate science most.
• Management of technical services. Dedicated support to help labs adopt and operationalize AI-for-science capabilities, delivered by Microsoft teams and select partners.
• Joint research and development. A focused set of Genesis Mission-aligned challenge problems, co-developed by Microsoft researchers and DOE scientific leadership, with milestones, publications and IP governed by mutually agreed terms.

Underneath SPARK sits the full breadth of Microsoft’s secure, FedRAMP-authorized cloud and AI portfolio. This includes Microsoft Azure infrastructure, Microsoft Foundry and Zero Trust security through Microsoft Defender, Sentinel and Entra. Azure capabilities will help extend the DOE’s American Science Cloud capabilities by providing computing, AI, data and collaboration services that complement existing scientific infrastructure. Together, these capabilities will help accelerate discovery, enable secure collaboration across institutions and provide researchers with flexible access to advanced technologies and resources. This will enable DOE and National Laboratory scientists to move faster from hypothesis to discovery, without compromising the security, reproducibility and governance that mission-critical research demands.

Accelerating science with Microsoft Discovery and Quantum

Microsoft’s new commitments build on capabilities we recently announced through Microsoft Discovery and Microsoft Quantum. They are designed to accelerate scientific research and will support the Genesis Mission’s ambition to bring AI, advanced computing and emerging technologies more deeply into the scientific process.

To enable a unified research platform for Genesis Mission work, Microsoft will provide access to Microsoft Discovery, our integrated platform that unites AI models, simulation, data and experimental workflows driven by advanced cognition rooted in scientific method, within a single governed environment. Microsoft Discovery, now generally available, includes support for autonomous lab orchestration, integration of Microsoft Research’s AI models for science, continuous AI learning through the scientific loop and agentic memory, advances in Discovery Bookshelf for data curation and scalable indexing and deeper integration and multi-hop reasoning over enterprise science data estates, including data governance. Together, these capabilities are designed to help researchers move more quickly from data to insight, from simulation to experiment, and from promising idea to scientific breakthrough.

We also recently announced the preview of the Microsoft Discovery app, a local desktop experience that helps researchers, students and scientific teams begin working with Microsoft Discovery today. Our support for the Genesis Mission will include access to the Microsoft Discovery app to enable DOE and National Laboratory teams with early access to its capabilities.

Microsoft’s recent quantum progress further strengthens the foundation for Genesis Mission work. With Majorana-based quantum advances, including more reliable topological qubits and a roadmap toward scalable quantum computing, Microsoft is helping move quantum from long-range research toward practical scientific capability. For DOE and National Laboratory teams, that progress can open new ways to model complex materials, chemistry, energy systems and national security challenges that are difficult or impossible to solve with classical computing alone. Just as important, the same agentic AI for science approach behind Microsoft Discovery is helping accelerate quantum research itself, creating a reinforcing cycle in which AI speeds quantum breakthroughs and quantum computing expands what scientists can ultimately discover.

The work is already underway

Working alongside and supporting federal researchers and universities, we’re already seeing real-world impact, from faster materials screening to advanced biosurveillance modeling. Four of the first projects taking shape under this partnership show what that looks like in practice:

Discovering critical energy storage materials and biosystems design (Pacific Northwest National Laboratory)
Using AI to dramatically accelerate the discovery of new energy storage materials through novel experimentation design and shrinking analysis of massive volumes of scientific data from years to weeks. In biosystems design, Microsoft Discovery is plugging directly into PNNL’s laboratory automation infrastructure to launch self-driving scientific workflows that autonomously design, run and fine-tune biological experiments in real time.

Strengthening biosecurity (Lawrence Livermore National Laboratory)
Pairing advanced AI with modern bioinformatics to identify emerging biological threats sooner and develop responses faster, strengthening the nation’s ability to stay ahead of the next outbreak and developing proactive defenses against evolving biosecurity risks. By applying advances in AI, scientific computing and biotechnology, Microsoft and the Lawrence Livermore National Laboratory are helping strengthen the nation’s ability to prevent, detect and respond to biological threats, advancing US biosecurity and biodefense priorities while supporting the long-term resilience and competitiveness of the US bioeconomy.

Autonomous labs for accelerated materials discovery (Johns Hopkins University Applied Physics Laboratory)
Supporting the development of AI-enabled autonomous (“self-driving”) laboratories through the integration of advanced foundation models and simulation tools — including MatterGen and MatterSim — to rapidly design, execute and optimize experiments for structural materials and superconductors. By combining autonomous experimentation with accelerated computational materials discovery, this approach dramatically shortens the path from scientific hypothesis to validated, manufacturable, mission-enabling materials, while exploring a vastly larger design space than is possible through traditional methods.

Accelerating nuclear energy permitting and autonomous energy operations (Idaho National Laboratory)
Applying AI to streamline the licensing, permitting and review of new nuclear projects. AI helps automate the development of complex engineering and safety analysis materials, a historically time-consuming and expensive process, to get this critical documentation into the hands of regulators and safety reviewers sooner. The lab also demonstrated that secure, distributed, hyperscale cloud can enable autonomous remote operations for nuclear power generators. Together, these efforts are helping bring safe and reliable power online faster and ensure scalable, efficient and reliable operations to meet the nation’s surging demand for energy.

Why this matters

We are entering an era where AI and quantum don’t just support the scientific process — they are essential to it. Through the Genesis Mission, Microsoft is committing to work as part of America’s research enterprise by providing hyperscale compute, advanced models, emerging quantum capabilities and dedicated expertise that run alongside the labs’ own world-leading systems. We are helping to ensure that the nation’s scientific strength is built on American technology. This commitment builds and expands upon the decades of collaboration through Microsoft Research and partnerships across the US government and our national labs. Now is the time to scale these breakthroughs across the entire R&D ecosystem.

The mission ahead is significant, and it should be. Whether it’s advancing the frontiers of energy, chemistry and materials science, hardening our national security or simply giving the country’s best scientists better tools to ask bigger questions, this is work worth doing and worth doing together. With a $60 million investment and SPARK, Microsoft is ready to help ensure America’s scientific leadership continues to accelerate.

Fueling scientific discovery is one of the most important things these technologies can do. AI and quantum are transforming how we tackle the toughest challenges facing the country, from sustainable materials and clean energy to biosecurity and drug discovery. The Genesis Mission is a pivotal step toward advancing that progress. We commend the DOE’s vision in building a unified, holistic approach to these critical national missions. For America to seize this opportunity and set the global standard, we must put these breakthrough technologies to work advancing the nation’s research and development.

We’re ready to deepen this partnership across government and academia. We move faster together. I’ve never been more optimistic about what’s possible when the nation’s scientific talent meets the best of modern AI and quantum. The Genesis Mission is that moment. Let’s get to work.

To get started, reach out to your Microsoft account team or email genesismission@microsoft.com.

The post Powering America’s Genesis Mission: Microsoft’s commitment to scientific discovery appeared first on The Microsoft Cloud Blog.

The U.S. Department of Energy announced the Genesis Mission as a historic national effort to use the power of artificial intelligence to accelerate scientific discovery, strengthen national security, and drive energy innovation. The Genesis Mission brings together the DOE’s 17 National Laboratories, advanced experimental facilities, large-scale scientific datasets, and next-generation computing resources into a more integrated scientific discovery platform. The goal is to double the productivity and impact of American research and innovation within the decade by embedding AI directly into the scientific process.

This initiative builds on the Removing Barriers to American Leadership in Artificial Intelligence Executive Order. It also advances America’s AI Action Plan, a directive to reduce dependence on foreign adversaries and unleash the full strength of America’s scientific enterprise. DOE officials describe Genesis as building a “national AI platform for scientific discovery,” where labs can combine traditional simulation with generative and agentic AI for fields ranging from fusion and grid optimization to climate modeling and materials science.

Introducing SPARK: Microsoft’s Answer to the Mission

Microsoft’s Scientific Partnership Advancing Research & Knowledge (SPARK) is a mission-aligned program designed to help DOE National Laboratories accelerate AI-for-science outcomes for the Genesis Mission. SPARK combines disciplined program execution, hands-on technical delivery, and significant investments in AI and scientific computing services — so high-value pilots can be selected quickly, delivered predictably, and scaled into secure, compliant, repeatable production workflows.

SPARK alignment focuses on 5 key pillars:

1. A Dedicated Program Management Office

Microsoft is standing up a dedicated PMO to serve as the front door for Genesis Mission collaboration and the coordinating hub for the full breadth of resources Microsoft brings to bear. The PMO will orchestrate engagement across Microsoft program, technical, research, engineering, security, compliance, partner, and field teams — ensuring DOE and the National Laboratories have a clear, consistent path to access Microsoft expertise, align priorities, remove blockers, and move high-value use cases from intake through delivery. This includes project intake and selection, sprint and checkpoint cadence, cross-team resource coordination, capacity planning, and an operational interface with DOE for alignment, reporting, and sustained partnership.

2. An AI-for-Science Center of Excellence

Operating under the PMO, Microsoft’s COE is an integrated delivery team helping DOE labs move AI-for-science use cases from concept to secure, compliant, scalable implementation — spanning solution design, data and AI engineering, HPC-enabled training and inference, and production workflow automation. The COE provides enablement through office hours, hackathons, and targeted training, with emphasis on responsible AI and reproducible research pipelines. It also maintains reach-back to Microsoft research and engineering teams to help labs evaluate and leverage emerging capabilities.

3. Substantial Azure Cloud Service Credits

Microsoft is making available significant Azure cloud service consumption credits to support DOE-sponsored research initiatives. Credits will be allocated to projects that use Microsoft technology to accelerate science, with preference for rapid adoption of AI services and joint DOE–Microsoft researcher participation.

4. Professional and Technical Services Investment

Microsoft is making available dedicated investment funds to support professional and technical services for DOE National Laboratories — helping labs adopt and operationalize Microsoft AI-for-science capabilities. These services can be delivered by Microsoft teams or Microsoft-approved partners.

5. Joint Research & Development

Microsoft and DOE labs will jointly select a focused set of Genesis-aligned challenge problems for co-development — combining Microsoft research expertise with DOE scientific leadership and facilities. Collaboration may include joint experimental and computational work, scientific validation using DOE lab capabilities, and joint AI-for-science model training and evaluation. Milestones and success criteria will be co-defined; publications, IP, and data use will follow mutually agreed terms.

“An undertaking the magnitude of the Genesis Mission only works when partnership and discipline match the energy behind it. The SPARK PMO’s role is to keep Microsoft and DOE moving as one team — capitalizing on every bit of momentum to deliver tangible outcomes quickly to turn our shared ambition into mission-scale science.”

– Clementine Wall, Director, SPARK Program Management Office

The Technology Behind SPARK

SPARK is powered by the full breadth of Microsoft’s enterprise cloud and AI portfolio — a proven, secure, and FedRAMP-authorized technology stack built for the demands of government science. Key capabilities include:

Azure Cloud Infrastructure — Hyperscale compute, storage, and networking purpose-built for high-performance scientific workloads, with government-grade security and compliance accreditations spanning unclassified to Secret environments.

Azure AI Foundry & AI Models — A unified platform for building, deploying, and governing AI and machine learning models at and agents scale, giving DOE researchers access to frontier AI capabilities within a controlled, auditable environment.

Scientific Computing   — GPU and CPU resources optimized for simulation, model training, and inference workloads that complement DOE’s on-premises HPC systems at the National Laboratories.

Cybersecurity Tools — Microsoft Defender, Sentinel, and Entra ID provide layered, Zero Trust security across the research environment, protecting American science by meeting NIST 800-53 standards and supporting continuous compliance monitoring.

Data Lakes & Analytics — Azure Data Lake and Fabric enable labs to ingest, store, and analyze massive scientific datasets across disciplines — breaking down silos and creating a unified data foundation for AI-driven discovery.

Microsoft Discovery — Building on these foundational components is Microsoft Discovery — Microsoft’s integrated science platform that brings together AI models, simulation, data, and experimental workflows in a single governed environment. Microsoft Discovery is designed to match how modern science operates: across labs, disciplines, and data types.

Advanced cognition capabilities enabling autonomous workflow orchestration: AI-driven planning, execution, and adaptation of complex scientific workflows under researcher direction. Together, this technology stack gives DOE scientists the tools to move faster — from hypothesis to discovery — without compromising the security, reproducibility, or governance standards that mission-critical research demands.

Why This Matters

Under its Genesis Mission agreements, Microsoft is effectively becoming part of the federal R&D stack — providing hyperscale compute, advanced models, and tooling that runs alongside DOE’s own high-performance computing systems at national labs like Argonne and Los Alamos. The program is explicitly framed as a way to boost scientific productivity and reduce reliance on foreign technology as AI demand continues to grow.

Ultimately, SPARK is designed to turn Genesis Mission priorities into measurable scientific outcomes — combining disciplined execution, hands-on delivery, and targeted investment to move the most promising use cases from selection to mission-scale impact across the DOE and National Labs.

America’s scientific leadership is not just an academic achievement. It is a national security imperative and an economic engine. With SPARK, Microsoft is committed to making sure that leadership is not just maintained — but accelerated.

For more information, reach out to your Microsoft Account Team or email genesismission@microsoft.com

The post Microsoft SPARK: Powering America’s Genesis Mission for Scientific Discovery appeared first on The Microsoft Cloud Blog.

With the rollout of the Analyst and Researcher agents and expanded agent creation capabilities in U.S. Government clouds, we’re marking another step forward in our commitment to delivering Copilot experiences to public sector customers—deliberately, responsibly, and ready for use from day one. 

Agentic experiences, built for U.S. Government clouds 

Agentic capabilities in Copilot for U.S. Government clouds now include Researcher and Analyst, along with Agent Builder and Copilot Studio publishing to create and share agents. 

Researcher (rolling out now, starting with GCC) supports multi‑step research by gathering and synthesizing information across work content to produce clearer, grounded drafts—within U.S. Government cloud security and compliance boundaries. Learn how to get started with Researcher today. 

Analyst (now available in GCC, GCC-High, and DoD) supports data analysis by turning information into structured insights and visualizations for decisions and briefings, including pattern detection and clear summaries of large volumes of information. Learn how to get started with Analyst today. 

Agent Builder (now available in GCC and GCC-High) expands agent creation capabilities in U.S. Government clouds by enabling users to package instructions, prompts, and work knowledge into reusable agents that help ensure more consistent Copilot responses—grounded in the right organizational context and shareable across teams. Learn more about Agent Builder. 

Publishing Copilot Studio Agents to Teams and Microsoft 365 (now available in GCC) extends agentic experiences to the tools users rely on every day. By enabling agencies to make vetted, purpose-built agents available directly in familiar Microsoft 365 surfaces, this capability helps scale consistent, role-relevant guidance and workflows—while keeping usage within the same security and compliance boundaries of U.S. Government clouds. Learn how to connect and configure an agent for Teams and Microsoft 365. 

What else is new this quarter 

Many core Microsoft 365 Copilot capabilities have also been enhanced in U.S. Government clouds in recent months, including: 

• Updated OpenAI models (GCC, GCC-High, DoD): Microsoft 365 Copilot for U.S. Government now leverages GPT 5.1 for Copilot Chat, GPT-5 for reasoning, and GPT-4o for image generation, supporting more accurate and contextual responses.  
• Microsoft 365 Copilot app enhancements: Copilot Search (GCC, GCC-High, DoD) helps users find relevant info across work content; the Create module (GCC, GCC-High) helps draft and refine images and other content.  
• Copilot Chat improvements (GCC, GCC-High, DoD), including enhanced language understanding for clearer, more accurate responses; Code Interpreter for in-chat data analysis and complex problem solving; and image upload with OCR to extract text for summaries, interpretation, and next steps.  
• Microsoft 365 Copilot Connectors (GCC, GCC-High) expand access to relevant third-party and line-of-business data sources to ground Copilot experiences in more of your organization’s knowledge. Learn more about Microsoft 365 Copilot Connectors. 
• In-product user feedback (GCC, GCC-High, DoD). U.S. Government users can now submit in-product feedback directly within Microsoft 365 and Copilot to help improve product experiences for mission work.  

All these capabilities – agentic and otherwise – are built to support applicable regulatory and compliance requirements out of the box. U.S. Government compliance needs—including data residency, operational isolation, and restricted personnel access—are carefully considered prior to release, reducing the need for administrators to retrofit controls, disable features, or manage separate compliance workflows.

Moving forward 

Delivering Copilot to U.S. Government clouds is a journey, not a single moment. Each new capability reflects a careful, staged approach to availability—helping to ensure features are compliant by design and usable as-is by government organizations. 

For guidance on leveraging Microsoft 365 Copilot effectively, visit the Microsoft 365 Copilot for US Government Adoption site. Admins can also review how to manage Copilot agents in the Microsoft 365 Admin Center to help make the most of new agentic capabilities as they roll out. 

We’ll continue to share updates as additional Microsoft 365 Copilot features continue to roll out across GCC, GCC‑High, and DoD. Thank you to our government customers and partners for your continued engagement and feedback. Your input helps shape how we responsibly bring AI to mission critical work. 

The post Continuing our momentum: Expanding Microsoft 365 Copilot capabilities across U.S. Government clouds appeared first on The Microsoft Cloud Blog.

We unequivocally stand by all of our products and services for the U.S. government, as well as our FedRAMP authorizations and adherence to the FedRAMP process. While we recognize that conversations about security and compliance are both important and essential, recent flawed reporting seeks to undermine confidence in the U.S. government’s FedRAMP process and our Office 365 products.  

To be clear, Office 365 GCC High is a fully authorized service at FedRAMP High following a comprehensive and exhaustive technical review by authorizing agencies, accredited third-party assessors, and the FedRAMP Program Management Office (PMO). Additionally, the service is continuously monitored, annually audited, and supported by one of the industry’s largest and most extensive security and compliance teams. 

Why FedRAMP High Authorization Matters 

FedRAMP High represents rigorous cybersecurity authorization framework. Its mandate is designed to validate that cloud services meet consistently high security standards. Authorization is grounded in independent verification by an accredited third‑party assessment organization (3PAO), which conducts a comprehensive evaluation of a provider’s security controls. Final risk acceptance rests with federal agency Authorizing Officials, supported by oversight from the FedRAMP PMO, which enforces standardized requirements and review processes across agencies. 

Critically, FedRAMP authorization is not a one‑time certification, but an ongoing compliance posture. Cloud service providers must maintain continuous monitoring, including regular reporting, vulnerability management, incident response activities, and demonstrate sustained adherence to FedRAMP High requirements over time. This continuous oversight model reflects the reality that security risk evolves.  

Office 365 GCC High Authorization Process 

The authorization of Microsoft’s Office 365 GCC High followed a multi‑year review process involving the Department of Justice, accredited 3PAOs, and sustained oversight by the FedRAMP PMO. Over the course of these reviews, additional assessments and validation activities were conducted as requirements evolved. This process culminated in the Fall 2024, with the FedRAMP PMO’s final assessment that resulted in FedRAMP authorization, reflecting a comprehensive evaluation against FedRAMP High security standards. 

That authorization signifies satisfaction of applicable security requirements based on documented evidence and risk acceptance by the appropriate authorizing officials. As is standard practice for FedRAMP authorizations and consistent with continuous risk management principles, the authorization included Plans of Actions and Milestones (POA&M) to address residual items under ongoing oversight. This approach aligns with FedRAMP’s established model, in which authorization represents a sustained compliance posture supported by continuous monitoring, rather than a static or one‑time determination. 

Throughout the authorization process, Microsoft provided extensive technical artifacts, clarifications, and updated documentation in response to detailed review by accredited 3PAOs and the FedRAMP PMO. These materials were submitted as a comprehensive package that reflected the depth and complexity of assessing a hyperscale cloud environment. Microsoft’s complete security authorization package is made available to agency Chief Information Officers through the FedRAMP PMO, enabling independent government review and informed risk decisions. Iterative exchanges with the PMO and 3PAOs are a normal and expected feature of rigorous FedRAMP High assessments, particularly for large, evolving cloud services.  

This effort culminated in Office 365 GCC High being fully authorized at FedRAMP High. 

FedRAMP 20x

Under new leadership, the FedRAMP PMO took steps to modernize the FedRAMP process and reduce a backlog of accreditations, while still ensuring the same level of rigorous review and oversight.  The FedRAMP reform effort launched in March 2025—often referred to as “FedRAMP 20x”—builds on input from agencies, Congress, and cloud service providers to improve clarity, accountability, and efficiency while preserving rigorous security standards.  

We appreciate the Administration’s progress under FedRAMP 20x and welcome continued modernization and transparency in the program. We remain committed to working constructively with government partners to support a FedRAMP program that is both rigorous and responsive, and that continues to earn the trust of agencies, policymakers, and the public. 

We stand behind the security of our cloud service offerings, especially those with FedRAMP High authorization.  Federal customers can continue to rely on Microsoft’s service with high confidence to support mission‑critical operations. As always, we remain committed to transparency, rigorous compliance, and delivering national‑security‑grade cloud services for the U.S. Government. 

The post Built on Trust: Microsoft’s Commitment to FedRAMP High and Federal Cloud Security appeared first on The Microsoft Cloud Blog.

The International Traffic in Arms Regulations (ITAR) govern the export, temporary import, reexport, and transfer of defense articles, services, and related technical data directly related to defense articles listed on the United States Munitions List (USML) as well as furnishing defense services. Administered by the United States’ Department of State’s Directorate of Defense Trade Controls (DDTC), the ITAR imposes strict requirements on manufacturers, exporters, and brokers of defense-related items – and those requirements extend to how and where ITAR-controlled data is stored, processed, and accessed in the cloud.

For federal agencies, Defense Industrial Base (DIB) organizations, and government contractors, choosing the right Microsoft cloud environment is not just a technical decision –  it is a compliance imperative. Getting it wrong can result in civil penalties, criminal prosecution, loss of export privileges, and the erosion of trust with federal partners. It can even cause the government to bar companies from federal contracts.

This guide walks through how ITAR compliance maps to our cloud offerings – specifically Microsoft 365 GCC, Azure Commercial, and Azure Government – drawing exclusively from official Microsoft documentation to help you make informed decisions about where your ITAR-controlled workloads belong.

Understanding ITAR: Core Requirements

Before evaluating cloud environments, it is essential to understand what the ITAR requires:

• Registration with DDTC: Organizations that manufacture, export, or broker defense articles must register with the Directorate of Defense Trade Controls.
• Access Restricted to US Persons: ITAR-controlled technical data may only be accessed by US persons unless specific DDTC authorization has been granted.
• Prohibition on Unauthorized Export: ITAR-controlled technical data may not be exported – included by making it available to foreign person – without authorization from the DDTC. As described in additional detail below, the ITAR does not impose an affirmative requirement that data be stored within the Continental United States (CONUS). However, storing data within CONUS and restricting access to U.S. persons is a widely adopted mitigation strategy. End-to-End Encryption: The revised ITAR rules, effective March 25, 2020, introduced a carve-out stating that sending, taking, or storing unclassified technical data does not constitute an export if the data is secured using end-to-end encryption with FIPS 140 compliant cryptographic modules, the means of decryption are not provided to any person other than the intended recipient, and the data  is not intentionally sent to or stored in a proscribed country listed under 22 CFR § 126.1. Additionally, there are specific requirements for protecting and sharing access information for ITAR data to qualify for the carve-out.

Think of ITAR requirements as a vault within a vault. It is not enough that the building is secure — the room, the safe, and the access list all have to meet the standard independently.

There Is No ITAR Certification

A critical point that often creates confusion: there is no ITAR compliance certification for cloud service providers. We design and operate our in-scope services to be capable of supporting your ITAR obligations and compliance program, but there is no formal ITAR certification to obtain. This means that ITAR compliance is ultimately the responsibility of the data owner — we provide the capable platform, and you are responsible for the protection, architecture, and access controls within your environment.

Reference: International Traffic in Arms Regulations (ITAR) – Azure Compliance | Microsoft Learn

Microsoft Cloud Environments: Where Does ITAR Fit?

Microsoft 365 GCC

Microsoft 365 Government Community Cloud (GCC) is designed for US federal, state, local, and tribal government entities, along with contractors holding or processing data on behalf of the US Government. GCC provides compliance with FedRAMP High, DFARS, and requirements for criminal justice and federal tax information systems.

However, GCC does not natively support ITAR or EAR-controlled data. While GCC stores data within the United States and restricts access to screened personnel, it runs on Microsoft Entra ID Commercial. Support staff may include non-US persons, and we will only agree to ITAR contract language for the GCC High environment – not standard GCC.

Can Compensating Controls Make GCC Viable for ITAR? A Risk-Based Decision

We recognize that not every organization is positioned to leverage to GCC High – whether due to budget constraints, licensing timelines, or operational complexity. For organizations evaluating GCC, it is worth understanding the compensating controls available, the case they enable, and efforts need to reduce risk within their organization.

The core argument for GCC viability rests on four points:

1. Data never leaves the United States. GCC stores all customer data within US boundaries. Unlike Azure Commercial, where data residency depends on customer configuration, GCC’s CONUS data residency is part of the environment boundary itself.
2. No unauthorized human access. When CMK and Customer Lockbox are implemented together, they eliminate the risk of unauthorized human access to ITAR-controlled data — regardless of the background check status of any individual. CMK ensures that we and our agents cannot decrypt your data without keys your organization controls. Customer Lockbox ensures that in rare instances where our support engineers need elevated access, you explicitly approve or reject every request.
3. Automated processing stays within the GCC boundary in CONUS. Automated service operations that process your data remain within the GCC environment and do not leave the United States.
4. Therefore, no export occurs. If the data never leaves the US, no  Microsoft employee can access it in decrypted form without explicit customer approval, and all processing remains within CONUS – the conditions that would constitute an export under ITAR are not met.

Customer Managed Keys (CMK): GCC supports customer-managed encryption keys through Azure Key Vault. With CMK, your organization retains exclusive control of the encryption keys that protect your data at rest. Because Azure Key Vault is designed so that we and our agents cannot see or extract your cryptographic keys, CMK is a critical component of meeting  the ITAR end-to-end encryption carve-out requirement that the means of decryption are not provided to any third party. This is the critical control – even if a non-US person were to encounter the encrypted data, nothing is revealed because they cannot decrypt it without your keys.

Customer Lockbox: Customer Lockbox for Microsoft 365 provides an explicit access governance gate. In rare instances where our support engineers need elevated access to your data to resolve a service request, Customer Lockbox requires your approval before any access is granted. This gives your organization direct control over who touches your data and when — making the background check status of individual support personnel a secondary concern, because no human access occurs without your authorization.

This is fundamentally a risk-based decision – and one that typically falls to the CISO and organizational leadership to approve and be held accountable for. Organizations that implement CMK and Customer Lockbox in GCC can build a defensible technical case that no export occurs, but they should ensure that decision is documented, reviewed by compliance stakeholders, and aligned with their organization’s risk tolerance. For many organizations — particularly those in the DIB handling ITAR-controlled technical data  — GCC High will remain the appropriate path because it eliminates these considerations by design.

Bottom line: Ultimately, it is incumbent on the data owner to decide what tools meet their purposes. GCC is suitable for Federally Controlled Information (FCI) and certain categories of Controlled Unclassified Information (CUI). Organizations with ITAR-controlled data may prefer GCC High or DoD environments, but CMK and Customer Lockbox can serve as meaningful compensating controls for organizations managing the transition or making a documented, risk-based determination that the technical controls in GCC are sufficient for their specific use case.

Reference: Office 365 US Government – Service Descriptions | Microsoft Learn

Azure Commercial

Azure Commercial can play a role in supporting ITAR compliance — but with an important distinction from our government cloud environments: the compliance boundary in Azure Commercial is customer-implemented rather than environment-guaranteed.

Both Azure and Azure Government can help you meet your ITAR compliance obligations. Our Azure datacenters (except for the Hong Kong SAR region) are not located in proscribed countries or the Russian Federation. Azure services rely on FIPS 140 validated cryptographic modules and provide multiple options for encrypting data in transit and at rest, including customer-managed keys (CMK) through Azure Key Vault backed by FIPS 140 validated HSMs.

Data Residency in Azure Commercial

While Azure Commercial is not hard-locked to CONUS the way Azure Government is, we provide you with the tools and transparency to control where your data resides. You select the Azure region where your applications and data are deployed. Most Azure services enable you to specify the region where your customer data will be stored and processed, and we will not store or process customer data outside the selected geography. We publish a data residency page and per-service documentation that identifies which services store data at rest in-region and which have global components that may process data outside the selected geography.

To enforce data residency in Azure Commercial, you can leverage region selection during deployment, Azure Policy to restrict resource creation to specific US regions, and service-specific residency controls documented for each service. It is your responsibility to review per-service documentation to understand which services are fully regional and which may have global processing components, and to architect your environment accordingly.

This is the fundamental difference: in Azure Government, the CONUS boundary is part of the environment. In Azure Commercial, you are building that boundary yourself through policy, encryption, access controls, and deliberate architecture choices for the available localized services.

The Encryption Carve-Out

The key enabler for ITAR in Azure Commercial is the ITAR end-to-end encryption carve-out. The ITAR states that storing encrypted technical data does not constitute an export when the data is unclassified, encrypted end-to-end with FIPS 140 compliant modules, and not intentionally stored in a proscribed country. Also, the means of encryption must not be provided to a third party. Azure Key Vault is designed so that Microsoft and its agents cannot see or extract customers’ cryptographic keys. Customer Lockbox for Azure puts you in charge of approving or rejecting any elevated access requests from our support engineers, providing an additional layer of access governance.

However, Azure Commercial does not provide the additional contractual commitments that Azure Government offers, such as guaranteed storage within the United States and access limited exclusively to screened US persons. The compliance controls are available to you – but the responsibility for implementing, configuring, and maintaining them rests entirely with your organization.

Bottom line: Azure Commercial can support ITAR workloads under the encryption carve-out, but you are building and enforcing the compliance boundary yourself. Most organizations with ITAR obligations are best served by Azure Government, where the boundary is built into the environment.

Reference: International Traffic in Arms Regulations (ITAR) – Azure Compliance | Microsoft Learn

Azure Government

Azure Government is a physically and logically isolated cloud environment built specifically for US government agencies and their partners. Data transmission and processing are restricted to CONUS, and access to systems processing customer data is limited to screened US persons. Azure Government provides contractual commitments regarding data residency and personnel access that go beyond what Azure Commercial offers.

Azure Government holds FedRAMP High authorization and supports DISA SRG Impact Level 5 (IL5), ITAR, and Export Administration Regulations (EAR). For organizations that need to store and process ITAR-regulated data, Azure Government provides the strongest alignment with ITAR requirements available in our cloud ecosystem.

Key capabilities that support ITAR compliance in Azure Government include:

• Data location control: Robust tools to restrict data storage to US regions, ensuring customer data is not intentionally stored in a non-conforming location.
• Access controls: Our technical support personnel do not have default access to customer data. Customer Lockbox for Azure enables you to approve or reject any elevated access requests.
• End-to-end encryption: FIPS 140 validated cryptographic modules with customer-managed key options through Azure Key Vault HSMs.
• Screened US citizens: Personnel with potential access to customer data undergo verification of US citizenship and additional background screening. This is more than what the ITAR requires, which is a US person.

Bottom line: Azure Government is the recommended environment for ITAR-controlled workloads and provides the strongest contractual and technical protections.

Reference: Azure support for export controls | Microsoft Learn

Microsoft 365 GCC High and DoD

For organizations that need Microsoft 365 productivity services (Exchange, SharePoint, Teams, OneDrive) alongside ITAR compliance, GCC High is the appropriate environment. GCC High is built on Azure Government infrastructure, stores data exclusively in US data centers, and limits access to screened US citizens. We will agree to ITAR contract language for the GCC High environment.

The Office 365 GCC High and DoD environments deliver compliance with Department of Defense Security Requirements Guidelines, DFARS, and ITAR. You must sign additional agreements notifying us of your intention to store ITAR-controlled data so that we can comply with our obligations to both you and the US government.

Reference: Office 365 GCC High and DoD – Service Descriptions | Microsoft Learn

Comparing the Environments at a Glance

Shared Responsibility: Your Role in ITAR Compliance

Regardless of which cloud environment you choose, ITAR compliance is a shared responsibility. We provide the platform capabilities — encryption, data residency, access controls, and personnel screening — but your organization is responsible for:

• Registering with DDTC if you manufacture, export, or broker defense articles.
• Classifying and labeling data to identify ITAR-controlled technical data.
• Configuring access controls to ensure only authorized US persons can access regulated information.
• Signing additional agreements with us to formalize your intention to store ITAR-controlled data (required for Azure Government and GCC High).
• Designing application architecture to maintain end-to-end encryption that meets ITAR requirements. We do not inspect, approve, or monitor your applications.
• Managing third-party integrations that may fall outside the compliance boundary.

The Microsoft Enterprise Agreement Amendment enables us and the customer to work together in reporting ITAR violations, fulfilling the specific reporting obligations that ITAR requires.

Reference: International Traffic in Arms Regulations (ITAR) – Microsoft Compliance | Microsoft Learn

Action Plan for Getting Started

• Step 1: Assess Your Data Determine whether your organization handles defense articles, services, or technical data on the USML. Understand which data is ITAR-controlled and map your data flows.Step 2: Choose the Right Environment For ITAR-controlled workloads, Azure Government and Microsoft 365 GCC High provide the strongest alignment. If you are evaluating GCC with compensating controls like CMK and Customer Lockbox, or Azure Commercial under the encryption carve-out, ensure the decision is documented and approved by your CISO and compliance stakeholders — as the CISO is ultimately accountable for the risk acceptance and the defensibility of the chosen approach.
  

  Step 3: Engage Your Microsoft Account Team If you are seeking to host ITAR-controlled data, work with your Microsoft account and licensing teams to obtain proper agreements and access relevant system architecture information.

  Step 4: Develop Your Compliance Architecture Leverage tools like Azure Policy, Microsoft Defender for Cloud, Microsoft Purview Compliance Manager, and Customer Lockbox to enforce and monitor your compliance posture.

  Step 5: Document and Maintain Develop a System Security Plan (SSP) that reflects your ITAR controls, and continuously monitor and update your controls as your environment evolves.

  Resources and Further Reading

  • International Traffic in Arms Regulations (ITAR) – Azure Compliance | Microsoft Learn
  • Azure support for export controls | Microsoft Learn
  • International Traffic in Arms Regulations (ITAR) – Microsoft Compliance | Microsoft Learn
  • Office 365 US Government – Service Descriptions | Microsoft Learn
  • Office 365 GCC High and DoD – Service Descriptions | Microsoft Learn
  • Azure Data Residency
  • Microsoft Azure Export Controls Whitepaper
  • Microsoft Government Compliance Offerings
  • DDTC ITAR Landing Page
  • ITAR Title 22 CFR Part 120-130

Conclusion

ITAR compliance in the cloud is achievable – but it requires deliberate environment selection, proper contractual agreements, and disciplined architecture. Microsoft 365 GCC does not natively support ITAR, but Customer Managed Keys and Customer Lockbox can enable a defensible technical case that no export occurs – a risk-based decision that falls to the CISO and organizational leadership to approve. Azure Commercial can support ITAR under the encryption carve-out, but the compliance boundary is customer-built rather than environment-guaranteed, which demands careful architecture and per-service residency review. Azure Government and GCC High provide the contractual commitments, data residency guarantees, and personnel screening that most closely align with ITAR requirements — with the compliance boundary built into the environment by design.

The path forward starts with understanding your data, choosing the right environment, and building your compliance architecture on our capable platform.

The post ITAR Compliance in the Microsoft Cloud: Navigating GCC, Azure Commercial, and Azure Government appeared first on The Microsoft Cloud Blog.