Defense Contractors Should Audit CUI Permissions Before GCC High Copilot Deployment

Defense contractors considering Microsoft 365 Copilot in GCC High should first determine which users can access controlled unclassified information (CUI) across their Microsoft 365 tenant. In guidance reported on October 27, 2026, eSoftware Associates (ESW) urged organizations to map proposed users’ access before assigning Copilot licenses. The core concern is that Copilot works within existing permissions: moving data to GCC High does not automatically correct who can open individual files. As ESW founder and CEO Russell Kommer put it, “Moving to GCC High doesn’t automatically mean the right people have access to the right files. You still need to review permissions inside your tenant.” For contractors, this makes access governance a deployment prerequisite, not merely a post-launch cleanup task.

The source describes three controls with distinct roles. The cloud environment—GCC or GCC High—determines where CUI is stored and which compliance commitments apply, but does not decide who inside the tenant can access a file. User permissions determine what Copilot may surface to each signed-in user, so permissions broader than intended can carry into Copilot responses. Sensitivity labels and encryption can impose additional limits; for encrypted files, Copilot can return content to users who hold both VIEW and EXTRACT rights. Contractors should therefore assess permissions and encryption together rather than assume that selecting a government cloud or applying a label alone prevents inappropriate disclosure.

Cloud selection should match the organization’s workload and contract requirements. The reported guidance points to applicable contract clauses, including DFARS 252.204-7012, as well as relevant export-control requirements. Microsoft positions GCC High for organizations handling CUI or operating under requirements involving DFARS, ITAR, or EAR compliance. Contractors planning a GCC High deployment should settle the environment choice before licensing Copilot, then validate access in program sites, shared mailboxes, and Teams channels—including access held by people outside the program. ESW also reports that its GCC High work includes feature analyses comparing standard SharePoint with GCC High, helping organizations understand changes when content moves into the government cloud.

The compliance timing adds a separate issue for capture, contracts, and security teams. The supplied reporting says CMMC Phase II requirements, originally scheduled for November 10, 2026, were suspended pending review on July 13, 2026. That reported suspension concerns the Phase II requirements; it does not remove CMMC language already included in active solicitations or contracts. The source also states that CMMC Level 2 covers 110 security requirements in NIST SP 800-171 Revision 2, including access control. Contractors should continue to meet applicable existing terms and verify current guidance and amendments rather than treating the reported pause as a blanket waiver. For GovCon service providers, the deployment risk creates potential demand for permission audits, SharePoint cleanup, labeling and encryption reviews, and GCC High implementation support.

• Audit CUI access before licensing Copilot: Map which proposed users can open relevant files and confirm access is appropriate to their program roles.
• Review the full collaboration environment: Include program sites, shared mailboxes, and Teams channels, and identify access held by people outside the program.
• Treat GCC High as an environment control, not an access fix: The cloud establishes where CUI is stored and applicable commitments; tenant permissions still govern internal file access.
• Check encryption rights: For encrypted content, the source says Copilot can return material to users with both VIEW and EXTRACT rights.
• Align cloud choice to contract requirements: Evaluate DFARS 252.204-7012, relevant export-control requirements, and applicable ITAR or EAR considerations before deployment.
• Maintain existing CMMC obligations: The reported July 13, 2026 suspension of Phase II requirements does not remove terms already incorporated into active solicitations or contracts.
• Account for the stated Level 2 baseline: The source describes CMMC Level 2 as covering 110 NIST SP 800-171 Revision 2 requirements, including access control.
• Assess support opportunities: Contractors may need permission audits, SharePoint cleanup, sensitivity-label and encryption reviews, and GCC High deployment assistance.
• Consider ESW’s stated migration experience: ESW reports more than 200 migrations into Microsoft 365 GCC and GCC High with zero data loss; this is a company-reported claim.