Azure Virtual Desktop in GCC High: What's Different and What to Plan For

By David, 2026-11-05

Defense contractors ask the same question sooner or later: can we run Azure Virtual Desktop in GCC High? The short answer is yes. Azure Virtual Desktop is available in Azure Government, which is the Azure side of a GCC High estate. The longer answer is that almost every planning assumption you'd carry over from a commercial deployment needs checking: the portal, the sign-in endpoint, the firewall allowlist, the client your users install, which features have arrived, and how the desktops fit into your CMMC or ITAR scope.

This guide walks through those differences in the order you'll hit them. It's written to be useful whatever tooling you choose, and it's dated, because Microsoft closes parity gaps in Azure Government every few months.

The short version: First confirm which Microsoft cloud you're actually in, because Microsoft 365 GCC runs alongside Azure commercial while GCC High pairs with Azure Government. In Azure Government, AVD uses its own endpoints (login.microsoftonline.us, *.wvd.azure.us), its own relay range for RDP Shortpath, and its own workspace URL for Windows App. Features usually arrive later than in commercial Azure, so check Microsoft's "What's new" page before you design around one. For CMMC, the regulation lets a properly locked-down VDI endpoint sit outside your assessment scope, which makes AVD a strong way to keep the enclave small, but only if redirection is genuinely off. Atlas AVD runs in Azure commercial today; GCC High support is coming soon, with a waitlist open.

1. GCC, GCC High or DoD: which cloud are you actually in?

The names sound like tiers of one product. They aren't. They're separate environments with different eligibility, different infrastructure and, for AVD, different Azure clouds.

Two consequences matter for AVD:

• A GCC tenant runs AVD in Azure commercial. Microsoft's GCC service description says it "operates in conjunction with Azure Public Cloud". Your host pools, session hosts and endpoints are the commercial ones, so most commercial AVD guidance applies as written. If someone tells you that you need Azure Government because you're "in GCC", check which GCC they mean.
• A GCC High tenant's identity lives in the US Government cloud, so its AVD deployment runs in an Azure Government subscription, through the Azure Government portal and Resource Manager (management.usgovcloudapi.net). Azure Government's US Gov Virginia, US Gov Arizona and US Gov Texas regions host it, with US DoD Central and US DoD East for DoD.

GCC High isn't something you sign up for in an afternoon. Microsoft sells it through Volume Licensing after an eligibility validation, and it offers no trials. If you're still deciding between GCC and GCC High, that decision belongs with your compliance lead and your assessor, based on the data you handle. It doesn't belong to your desktop platform.

2. Is Azure Virtual Desktop the same in Azure Government?

The service is the same. Host pools, application groups, workspaces, session hosts, scaling plans, FSLogix and RDP all work the way you know them. What differs is when a feature arrives and how you reach it.

Microsoft's own comparison of the two clouds says it plainly: services and features available in some global Azure regions "might not be available in Azure Government", and "feature configurations in Azure Government might differ". For AVD, recent parity milestones from Microsoft's AVD release notes show how the lag works in practice:

Several Azure services an AVD design leans on have their own Government caveats too:

• Azure Lighthouse in Azure Government doesn't support delegation across national clouds, or between a national cloud and Azure public, and its just-in-time PIM authorization isn't enabled. An MSP that manages commercial customers through Lighthouse needs a separate approach for its GCC High clients.
• Cost Management + Billing for cloud solution providers (CSPs) isn't available in Azure Government. If you resell Azure through CSP, plan cost reporting another way.
• Multifactor authentication's Trusted IPs isn't supported. Use Conditional Access with named locations instead.
• Log Analytics workspaces can't move from Azure commercial to Azure Government. A migration is a new build, with new workspaces and fresh history.

The practical rule: before you design around a feature, check it against Microsoft's products available by region for the Government regions and the AVD what's new page. Don't rely on a blog post for this, including this one.

3. Identity, endpoints and networking

Firewall allowlists are different, not just longer

A commercial AVD allowlist will not work in Azure Government. Session hosts need the Government endpoints instead. From Microsoft's required-endpoints list for Azure for US Government:

The relay range is the one people miss. Commercial AVD relays through 51.5.0.0/16; Azure Government uses 20.140.236.0/22. Where you can, use the WindowsVirtualDesktop and AzureMonitor service tags rather than hand-maintained lists. If you route session host traffic through a firewall, test the agent with Microsoft's AVD Agent URL Tool before you register hosts, not after.

Clients: Windows App, pointed at the Government workspace

Users connect with Windows App. On macOS, iOS/iPadOS and Android, Windows App connects to Azure Government by adding a workspace with Microsoft's Azure for US Government URL, https://rdweb.wvd.azure.us/api/arm/feeddiscovery, rather than through the default sign-in. Put that step in your user guide, because it's the first support ticket otherwise.

On Windows, check Microsoft's current guidance before you standardize. Microsoft ended support for the older Remote Desktop client (MSI) for public cloud on 27 March 2026 and extended it for Azure Government until 28 September 2026, and it directs users to Windows App. The Remote Desktop web client has no announced end-of-support date in Azure Government.

Identity and devices

• Sign-in happens against Entra ID in the Government cloud. Every app registration, Conditional Access policy and service principal your AVD estate depends on lives there too. Tools built for commercial Entra need to support the Government authority to work at all.
• Intune for GCC High can manage the devices your users connect from, which since February 2025 includes devices connecting to AVD.
• Keep sensitive details out of resource names. Microsoft's Azure Government guidance warns not to put export-controlled or restricted information in Azure resource names. A host pool called itar-program-x is a finding waiting to happen.

Storage and private connectivity

FSLogix profile containers on Azure Files use the Government storage endpoints (file.core.usgovcloudapi.net). If you use private endpoints for storage or for AVD itself, check Private Link availability for the Government regions and use the Government private DNS zone names, which differ from commercial ones.

4. CMMC and ITAR scoping: keep the enclave small

This is where AVD earns its place in a defense contractor's architecture.

The CMMC program rule, 32 CFR Part 170, took effect on 16 December 2024, and the DFARS rule that puts CMMC requirements into contracts took effect on 10 November 2025. CMMC Level 2 assesses the NIST SP 800-171 requirements across the assets in your CMMC scope, starting with everything that processes, stores or transmits CUI and the security protection assets around it. The bigger that scope, the more there is to assess and maintain.

The rule's scoping table includes a sentence that matters for virtual desktops. Under 32 CFR 170.19(c)(1), "an endpoint hosting a VDI client configured to not allow any processing, storage, or transmission of CUI" beyond the keyboard, video and mouse traffic sent to the VDI client is an Out-of-Scope Asset.

That's the enclave pattern. CUI lives in a small, well-governed environment: the AVD session hosts, the storage behind them and the identity and network services that protect them. Users reach it from laptops that never hold CUI. The laptops leave scope; the enclave becomes the thing you assess.

The condition is the hard part. "Configured to not allow" means the redirection that makes VDI convenient has to be off for the host pools that handle CUI:

• Drive, clipboard, printer and USB redirection disabled in the host pool's RDP properties. Copy and paste out of the session is transmission.
• File transfer routes blocked, including any "download to local" path in the apps you publish.
• Screen capture protection and watermarking considered as supporting controls. Check that each is available in your Government region and with your client.
• Separate host pools for CUI work and for everything else, so a convenience setting for one group never leaks into the enclave.

The VDI platform itself stays fully in scope: session hosts, profile storage, Entra ID, networking, and anything that manages them. A management tool with write access to your session hosts is part of your story to the assessor, which is why where your AVD management platform runs is a scoping question, not a procurement detail.

None of this replaces your assessor's judgment. Document the configuration, test it (try to copy a file out and show that it fails), and keep the evidence.

5. Architecture checklist

Use this before the first host pool goes in:

• Cloud confirmed: the Microsoft 365 environment (GCC vs GCC High) is decided, and the AVD subscription sits in the matching Azure cloud.
• Region chosen: US Gov Virginia, Arizona or Texas, with the VM sizes and quota you need confirmed available there.
• Feature list checked: every feature in the design is confirmed available in Azure Government, with the date you checked it.
• Allowlist built from the Government endpoints, including 20.140.236.0/22 UDP 3478 for relayed RDP, and validated with the AVD Agent URL Tool.
• Clients tested: Windows App with the Government workspace URL on every platform you support, and your Windows client decision made against Microsoft's current guidance.
• Identity ready: Conditional Access uses named locations, app registrations are in the Government tenant, and every third-party tool supports login.microsoftonline.us.
• Enclave host pools locked down: redirection off, separate pools for CUI, and the configuration tested and recorded.
• Storage private: FSLogix shares on Government storage, behind private endpoints where your design calls for them.
• Names clean: no program names, customer names or controlled terms in resource names.
• Monitoring in-cloud: Log Analytics and AVD Insights in Azure Government, with diagnostics flowing from the start.
• MSP access planned: if you manage GCC High clients from a commercial tenant, an approach that doesn't depend on cross-cloud Lighthouse delegation.
• Tools vetted: every management, monitoring and automation tool runs in, or talks only to, the Government cloud. Ask where its data goes before you grant it a role.

If you're new to AVD's building blocks, What Is Azure Virtual Desktop? covers host pools, workspaces and licensing first.

6. Where Atlas AVD stands

We'd rather be specific than vague here.

• Atlas AVD runs in Azure commercial today. Microsoft 365 GCC and GCC High / Azure Government support are coming soon. They're being validated end to end before we open them. Join the GCC High waitlist, or the GCC waitlist for a Microsoft 365 GCC tenant, and we'll set up your trial the moment it opens. Pricing will be the same as Azure commercial.
• The architecture is built for it. Atlas AVD deploys into your own Azure subscription, so the management app, its database and its secrets sit inside the boundary you already govern. The application is built to target the sovereign endpoints automatically, and it refuses to start against an unsupported cloud rather than falling back to commercial hosts. That's a CMMC-aligned architecture. It isn't a certification: Atlas isn't FedRAMP authorized, and CMMC always applies to your whole environment, with your assessor as the authority.
• Atlas Ink, our email signature product, is commercial-only today. The GCC High signatures post explains the architecture question to ask any signature vendor, and email signatures for CMMC contractors covers the CUI marking side.

Our government page has the rest, and the GCC High guide in the Support Center describes how onboarding will work once it opens.

FAQ

Is Azure Virtual Desktop available in GCC High?

Yes. A GCC High organization runs AVD in an Azure Government subscription tied to its Government Entra ID tenant. The service is the same, but endpoints, clients and feature timing differ from Azure commercial.

Does a Microsoft 365 GCC tenant need Azure Government for AVD?

No. Microsoft 365 GCC operates alongside Azure commercial, so a GCC tenant's AVD runs in Azure commercial with the commercial endpoints.

Is RDP Shortpath available in Azure Government?

Yes. RDP Shortpath via TURN relay became generally available in Azure Government in October 2026, together with RDP Multipath. The relay range is 20.140.236.0/22 on UDP 3478, not the commercial 51.5.0.0/16.

Can user laptops be out of scope for CMMC if they only use AVD?

The CMMC rule treats an endpoint hosting a VDI client as out of scope when it's configured so no CUI is processed, stored or transmitted beyond keyboard, video and mouse. That means drive, clipboard, printer and USB redirection must be off, and you should be able to show it. Your assessor makes the call.

Can I move an existing commercial AVD deployment to Azure Government?

Plan it as a new build. Azure commercial and Azure Government are separate clouds with separate portals and tenants, and Microsoft notes that Log Analytics workspaces and their data can't be moved between them.

Does Atlas AVD support GCC High?

Not yet. Atlas AVD runs in Azure commercial today, and GCC High support is coming soon. Join the GCC High waitlist and we'll set up your trial the moment it opens.

Microsoft details are drawn from Microsoft Learn as of November 2026: Compare Azure Government and global Azure, Required FQDNs and endpoints for Azure Virtual Desktop, What's new in Azure Virtual Desktop, Connect with Windows App, the Remote Desktop client overview, and the Office 365 GCC and GCC High and DoD service descriptions. CMMC references are to 32 CFR Part 170 and the DFARS CMMC rule. Azure Government changes often, so confirm current availability with Microsoft before you design around it.