GCC High & Sovereign Cloud Support

How Atlas AVD works in Azure Government (GCC High is currently waitlisted), with screenshots.

Before you begin

  • An Azure Government (GCC High) tenant and subscription for GCC High deployments
  • A Global Administrator account in the government tenant for admin consent
  • The appropriate Government licensing for optional features you plan to use (Intune, Defender for Endpoint, Entra ID Premium)

The three supported environments

GCC is not Azure Government: it runs on the Azure public (Commercial) cloud, its endpoints are identical to Commercial, and US data residency is enforced by Microsoft through Entra ID policy rather than by different service hosts. It is still a distinct choice in Atlas: a GCC tenant uses Join the waitlist on the Microsoft 365 GCC card at atlasavd.com/deploy, never the Azure Commercial card, and we set up its trial as soon as GCC opens. GCC High is where sovereign endpoints begin: it runs in the physically separate Azure Government cloud with its own sign-in authority, management plane, and API hosts.

  • Azure Commercial: the default for most organizations.
  • Microsoft 365 GCC: runs on Azure Commercial infrastructure (not Azure Government) with the same endpoints as Commercial; residency guaranteed by policy. A distinct option in Atlas, with its own card at signup.
  • Azure Government (GCC High): sovereign endpoints throughout (see the table below).

Azure Secret (US Nat / US Sec), Azure China, and the retired Azure Germany clouds are not supported. Atlas refuses to start against them rather than silently falling back to Commercial endpoints. A near-miss environment value (for example "gcc-high" or "usgov") is rejected the same way, so a typo can never route government traffic to Commercial hosts.

Automatic endpoint switching

The Azure Environment you select for a tenant drives every API call Atlas makes for that tenant. For GCC High, Atlas automatically targets the sovereign hosts:

Sign-in authority     login.microsoftonline.us
Azure management      management.usgovcloudapi.net
Microsoft Graph       graph.microsoft.us
Defender XDR          api-gov.security.microsoft.us
Log Analytics         api.loganalytics.us
Exchange Online       outlook.office365.us
Key Vault             *.vault.usgovcloudapi.net
Blob storage          *.blob.core.usgovcloudapi.net
Azure portal          portal.azure.us
AVD gateway / web     rdweb.wvd.azure.us

Commercial and GCC tenants use the standard public endpoints (login.microsoftonline.com, graph.microsoft.com, api.security.microsoft.com, and so on). The one GCC exception is Defender: if Microsoft moved a GCC tenant's Defender to the Government offering, set Defender offering to Defender for Endpoint in Government (GCC) when you edit that tenant, and Atlas calls Microsoft's GCC Defender hosts. Sign-in is unchanged. Mixed estates are fine: an MSP can manage a Commercial tenant and a GCC High tenant side by side, and each tenant's traffic stays inside its own cloud.

Starting a GCC High trial

GCC High is not open for new trials yet: Atlas AVD launches for commercial Microsoft 365 tenants first. On atlasavd.com/deploy, the GCC High & Azure Government card is marked Coming soon: use Join the waitlist, and we email you as soon as GCC High opens. If you sign up with a GCC High tenant anyway, no trial is started and you are added to the waitlist. Once GCC High opens, setup works exactly as it does in Commercial (see Activate Your Trial & What to Expect), and Atlas routes every step to Azure Government for you:

  • Approving Atlas in Microsoft Entra signs you in at login.microsoftonline.us. The small setup app Atlas adds to Enterprise applications in your directory is named AtlasAVD-Provisioning-GCCH; like the commercial one, it is removed automatically once your deployment is running.
  • The deploy sign-in and any Azure Portal fallback open in Azure Government (portal.azure.us), and your Atlas AVD instance runs there too, at an azurewebsites.us address.
  • If you create the app registration yourself with the setup script, run it in the Azure Government Cloud Shell at shell.azure.us. The command is the same; the script detects the cloud and uses graph.microsoft.us.

Confirm the CMMC boundary before you deploy

When you pick a GCC High subscription on the deploy form, Atlas asks you to Confirm GCC High Boundary Authorization before anything is deployed. Connecting a subscription can change your CMMC assessment boundary, so check with your Information System Owner (ISO) or other security or compliance authority first. Then tick the confirmation and click Continue. Cancel clears the subscription you picked, and choosing it again asks again.

First-run setup in GCC High

Your deployment tells Atlas which cloud it runs in, so the first-run wizard's Azure Setup step opens with Azure Government (GCC High) already selected as the Azure Environment. On the Permissions step, a notice lists the important GCC High differences: grant admin consent from portal.azure.us (not portal.azure.com), Intune needs Intune for Government licensing, some Graph beta endpoints are unavailable, and sign-in goes to login.microsoftonline.us.

In some Government SKUs, an Application Administrator who could grant consent in Commercial gets a 403 or an incomplete consent screen, especially for permissions that make changes. Use a Global Administrator account for admin consent.

Licensing and feature caveats in GCC High

The permission scopes Atlas requests are identical in every cloud, but several optional features depend on Government-specific licensing or have reduced coverage:

  • Intune features (device inventory, retire/wipe, policy import) require Microsoft Intune for Government licensing.
  • PIM-eligible role visibility in privileged-access reports requires Entra ID (Azure AD) Premium P2 Government; without it, eligible-assignment queries return empty results.
  • Self-Service Password Reset availability varies by Government SKU and Entra Premium tier. Verify SSPR is provisioned before relying on reset flows.
  • Service Health advisories cover Microsoft 365 Government workloads only; Azure infrastructure incidents are not surfaced through this API in GCC High. Check the Azure Government portal.
  • Defender features require Microsoft Defender for Endpoint Government licensing, and some advanced Defender XDR features may be limited or unavailable.
  • Last sign-in data (used by access reviews and CMMC evidence) comes from a Graph beta endpoint whose parity with Commercial is not guaranteed. Validate that sign-in activity is populated in your tenant before building compliance workflows on it.
  • Microsoft Purview audit log search is not available in GCC High, so the Purview Audit tab shows as unsupported there and links to audit search in the Purview portal.

Atlas Ink in sovereign clouds

Atlas Ink (managed email signatures) is Commercial-cloud-only at launch and fails closed in GCC and GCC High: provisioning is refused rather than partially attempted. Support for Azure Government is on the roadmap. Usage is metered only as an aggregate active-user count per month; the signature content itself never leaves the customer's tenant.

Next steps