GCC High: Who Needs It, How It Gets Installed, and What It Costs

You're halfway through a Teams Phone migration when someone on the compliance team flags that the standard GCC environment you're deploying into won't satisfy your DFARS obligations. The phones work. The calling plans are set. But none of it meets the bar for handling CUI, and your contract says it has to.

That's usually how organizations end up at GCC High. Not because they went looking for it, but because they found out the hard way that commercial Teams, and even standard GCC, weren't built for the compliance requirements they're bound by. GCC High is a separate, sovereign cloud environment, and for some organizations like DoD subcontractors handling CUI, it's the only option that holds up under audit.

In this article, we’ll walk you through the three questions we hear most often: Do you actually need GCC High? What does the installation process look like from end to end? And what does it cost before you commit?

Microsoft Teams Phone, Set Up and Managed for You

Most providers hand you Operator Connect and walk away: Atlantech Online includes atlantech | call manager. We handle your setup, number porting, and day-to-day changes so you don't have to.

That's why we offer a free two-week trial — because once you see how it works, you won't want to go back to doing it yourself.

Wizard-based setup, live in days

Number porting managed end-to-end

One team to call when anything changes

Try Operator Connect Free for 2 Weeks →

Who Needs GCC High

If your organization deals with controlled unclassified information, ITAR-regulated technical data, or defense contracts with DFARS 252.204-7012 clauses, GCC High is a baseline requirement for you.

These are the organizations that typically fall under GCC High requirements:

• DoD contractors and subcontractors handling CUI
• Defense Industrial Base (DIB) companies
• ITAR-regulated organizations working with items on the U.S. Munitions List
• DFARS 7012 covered entities
• Federal agencies operating at Impact Level 4 or above
• CMMC 2.0 Level 2 and Level 3 candidates

What puts these organizations in GCC High territory isn't just the data they store. It's the compliance frameworks they're subject to:

• CMMC 2.0 Level 2+ requires protection of CUI across all systems, including communications
• DFARS 7012 mandates NIST SP 800-171 compliance for covered contractor systems
• ITAR controls apply to technical data in any medium, voice included

That last point is the gap most organizations miss. They'll lock down endpoints, encrypt file storage, and migrate email to a compliant environment, but leave their phone system running on commercial Teams or a standard carrier. As Atlantech's Morgan Henry puts it, "If your phone service doesn't meet these compliance requirements, then implementing Microsoft 365 Government Teams Phone should be your top priority."

In March 2025, a contractor was fined $4.6 million for NIST 800-171 compliance failures. Voice and communications gaps are exactly the kind of thing that shows up in those findings.

Who doesn't need GCC High? State and local government agencies using FedRAMP Moderate environments can typically operate within standard GCC. The same goes for federal contractors that don't handle CUI or covered defense information. If your compliance requirements stop at FedRAMP Moderate, standard GCC covers you.

How GCC High Gets Installed

If you've deployed Teams Phone in a commercial or standard GCC environment, set those expectations aside. GCC High doesn't support Microsoft Calling Plans or Operator Connect. The only path to PSTN calling is Direct Routing, which means every deployment comes down to one of two models.

1. Self-Managed Direct Routing. This means your organization buys, configures, and maintains its own Session Border Controller. This makes sense if you have in-house UC engineering and want full control over routing, dial plans, and failover. It also means you own every piece of the infrastructure.
2. Direct Routing as a Service (DRaaS). Here, the SBC infrastructure, carrier connection, and routing are handled by a provider like Atlantech. There's no hardware to buy and no SBC to manage. For most organizations without a dedicated UC team, this is the faster and more predictable path.

What the process looks like

Regardless of which model you choose, a typical GCC High deployment happens in the following steps:

1. Discovery and compliance scoping to confirm GCC High is the right environment for your requirements
2. Microsoft tenant verification and licensing review, including whether you're on E3 or E5
3. SBC selection and procurement, or DRaaS provisioning if you're going the managed route
4. Carrier provisioning, covering SIP trunks, DIDs, and peering
5. SBC configuration, including dial plans, codec negotiation, and failover
6. Teams Admin Center configuration for voice routing policies and user assignment
7. Testing and cutover, including UAT, number porting, and go-live

How long it takes

If your organization is starting with new numbers and your team is responsive on their end, GCC High can be up and making calls in as little as two weeks. Number porting adds time. Plan on at least two additional weeks for porting, sometimes more depending on the carrier you're coming from. For a full deployment with porting, four to six weeks is a more realistic expectation.

Mistakes that come up more often than they should

A few of the most common mistakes people make when migrating to GCC High include:

• Assuming commercial Teams tutorials and documentation apply to GCC High (they don't)
• Selecting a voice provider that only supports commercial Teams
• Mixing GCC High and non-GCC High domains in the same environment
• Underestimating how long the Microsoft approval process takes
• Skipping proper testing before going live
• Failing to configure E911 location services

Most of these come down to treating GCC High like a standard Teams deployment. It isn't one, and the setup needs to reflect that from day one.

What It Costs

Pricing for GCC High voice depends on which deployment model you choose, how your Microsoft licensing is structured, and how many users you're supporting. There's no single number, but here's how to think about the major cost areas.

Self-Managed Direct Routing

If you're managing your own SBC infrastructure, expect costs across several categories:

The ranges are wide because they depend on org size, redundancy needs, and how much of the configuration you handle in-house versus outsource.

Direct Routing as a Service (DRaaS)

The DRaaS model eliminates the upfront hardware spend and rolls everything into a predictable monthly cost. Pricing is typically based on the number of DIDs, SIP trunks, and the GCC High tenant connection. There's no SBC to buy or maintain, which makes the total cost easier to forecast and easier to justify as an operational expense.

Microsoft Licensing

Your Microsoft license tier matters here. E5 GCC High includes Teams Phone, so voice capability is built into the license. E3 GCC High does not, which means you'll need to add the Teams Phone add-on separately. The difference in per-user cost between E3 plus the add-on and E5 is worth calculating before you commit, especially at scale.

Watch the bundling

One thing worth paying attention to is how carriers package their pricing. You want a carrier that separates the cost for users from the cost for telephone service. Some carriers bundle these into a single per-user price, and when they do, you're often overpaying without a clear way to see where the money is going. Look for line-item transparency, and watch for overage charges and hidden porting fees.

Expert Recommendations

By this point, you should have a good sense of whether GCC High applies to your organization. But knowing you need it and knowing which deployment path to take are two different decisions. Here's how to think through both.

When GCC High is the right call

GCC High is your environment if you hold DoD contracts with DFARS 7012 clauses or handle CUI or ITAR-regulated data. It also applies if you're pursuing CMMC 2.0 Level 2 or Level 3 certification, or if you operate at Impact Level 4 or above. There's no workaround and no lighter-weight alternative that satisfies these requirements.

When standard GCC is enough

Not every government-adjacent organization needs GCC High. If you're a state or local agency that doesn't handle CUI and your compliance requirements don't exceed FedRAMP Moderate, standard GCC is likely sufficient. It gives you a government cloud environment without the added complexity and cost of GCC High. The key question is whether your data and your contracts require the higher bar.

When DRaaS makes more sense than self-managed

For most organizations under 250 users without a dedicated UC engineering team, DRaaS is more practical. You avoid the capital outlay on SBC hardware, you're not responsible for maintaining the infrastructure, and you can be up and running in weeks. It's also easier to budget for, since everything rolls into a predictable monthly cost. If your organization prefers OpEx over CapEx, that alone can make the case.

When self-managed Direct Routing is worth the investment

If you have a UC team that knows its way around SBC configuration and you need granular control over routing, dial plans, and failover, self-managed Direct Routing gives you that. At scale, the math can also work in your favor, since per-user DRaaS costs may eventually exceed what you'd spend on hardware amortized over time. But you're taking on the full operational burden, so the expertise needs to be there.

Need Help Deciding?

Setting up GCC High is a complex, multi-layered process. It starts with figuring out whether you need it, then moves into licensing, tenant setup, carrier provisioning, voice configuration, and testing. Each step has its own dependencies, and the decisions you make early on, like whether to go DRaaS or self-managed, shape everything that comes after.

If you're still figuring out whether GCC High is the right fit, or you already know it is and need a partner to handle the deployment, Atlantech's engineering team can walk you through it. Ashley Moreau, IT Manager at SilverEdge Government Solutions, described her experience with Atlantech's Teams Calling migration as timely, efficient, and professionally managed, rating it 10 out of 10.

Reach out to start a conversation.