# Securing GCC High > A free, comprehensive implementation reference for securing Microsoft 365 and Azure in GCC High (Microsoft's sovereign US Government cloud) to CMMC Level 2 / NIST SP 800-171. Written from production deployments in the Defense Industrial Base. Versioned monthly. The material below is first-hand implementation guidance, not a restatement of Microsoft's documentation. Where the two diverge, the book documents the divergence and says so explicitly. ## Start here - [Field Notes: Where GCC High Diverges From the Documentation](https://docs.mindline.com/docs/field-notes): 27 field-verified failures in GCC High and Azure Government where the official documentation is absent, scattered, or wrong. Includes Intune App Control blocking the Azure VM guest agent (Run command returns nothing, Service Control Manager event 7000, Azure Backup silently degrading to crash-consistent snapshots while reporting success), Intune enrollment failing with 0x80192efd on commercial MDM URLs in a sovereign tenant, Windows activation failing with 0xC004F074 because Azure Government KMS resolves to the Internet service tag, all-zeros AAGUID defeating phishing-resistant authentication strengths on Windows desktop apps, Azure Firewall wildcard rules not matching the domain apex, `Install-Module` failing with "Source Location is not valid" because the PowerShell Gallery serves discovery and download from different hosts and the `azureedge.net` endpoints in most firewall guides are retired, NTANetAnalytics flow-log queries returning zero rows because two Microsoft pages document contradictory field values, a device moved to a new tenant refused by Defender for Endpoint because it was never offboarded from the old one, Copilot DLP blocking a web search with no banner or policy tip, the Copilot chat box flattening prompt line breaks so banner-line classifiers never fire on typed prompts, and Endpoint DLP sensitive service domain groups blocking labeled uploads to specific SharePoint sites in your own tenant. - [Executive Introduction](https://docs.mindline.com/docs/introduction/): scope, audience, and the book's relationship to a System Security Plan. - [Changelog](https://docs.mindline.com/docs/changelog): release notes and update history. ## Scoping - [CUI Data Flows and Business Applications](https://docs.mindline.com/docs/scoping/data-flows/): mapping how CUI enters, moves through, and exits business applications, grounded in the CMMC Level 2 Scoping Guide and 32 CFR 170.19. - [External Service Provider Management](https://docs.mindline.com/docs/scoping/external-service-providers/): when a provider is an ESP, the CSP/MSP distinction, and the staff-augmentation carve-out. - [Migrating to GCC High](https://docs.mindline.com/docs/scoping/migrating-to-gcc-high/): tenant migration, identity re-registration, cross-cloud B2B, and cross-cloud Teams limits. ## Identity - [Phishing-Resistant Authentication](https://docs.mindline.com/docs/identity/identity-foundation/phishing-resistant-authentication): Windows Hello for Business, FIDO2, and Entra certificate-based authentication, including the passkey Registration campaign (the nudge at sign-in, verified in GCC High), the AAGUID limitation on Windows desktop applications, and why External Authentication Methods cannot satisfy a phishing-resistant Authentication Strength. - [Conditional Access](https://docs.mindline.com/docs/identity/conditional-access/): the CMMC baseline policy set, including token protection against adversary-in-the-middle token theft. - [Directory Synchronization](https://docs.mindline.com/docs/identity/identity-foundation/directory-sync): Entra Connect architecture, filtering strategy, and hybrid identity gotchas. ## Devices - [Open Intune Baseline Deployment](https://docs.mindline.com/docs/devices/device-operations/oib-deployment): the layered Intune baseline for CMMC Level 2, including App Control for Business built on a Microsoft-signed base with the Recommended Block List merged and the file path rules required for the Azure guest agent and Defender for Endpoint. - [Defender for Endpoint](https://docs.mindline.com/docs/devices/device-operations/defender-for-endpoint): MDE onboarding, the Endpoint Security baseline, the degraded states where a device reports Managed by MDE while delivering no policy, offboarding (tenant-specific packages that expire within days), and the shared device onboarding that makes every MDE-onboarded device a Purview Endpoint DLP location. - [Azure Virtual Desktop: Dedicated Sovereign Tenant](https://docs.mindline.com/docs/devices/device-architecture/scenario-azure-virtual-desktop): host pool architecture, endpoint scope, and peripheral redirection as it affects CMMC assessment scope. - [Shared PC Mode](https://docs.mindline.com/docs/devices/device-architecture/scenario-shared-pc-mode): shared workstation configuration, and the SharedPC CSP tattooing behavior that survives policy removal. - [Entra Device Hygiene](https://docs.mindline.com/docs/devices/device-operations/entra-device-hygiene): stale and duplicate device object cleanup, trust type priority, BitLocker key preservation, and moving a device to another tenant in the order that does not resurrect deleted objects. ## Data protection - [Sensitivity Labels](https://docs.mindline.com/docs/data/info-protection-impl/sensitivity-labels): label taxonomy, encryption, and auto-labeling against GCC High sovereign endpoints. - [Data Loss Prevention Policies](https://docs.mindline.com/docs/data/info-protection-impl/data-loss-prevention-policies): DLP scope across Exchange, SharePoint, OneDrive, Teams, and endpoints. - [Microsoft 365 Copilot Data Readiness](https://docs.mindline.com/docs/data/info-protection-impl/copilot-data-readiness): preparing the data layer before enabling Copilot, and GCC High availability caveats. ## Monitoring and assessment - [SIEM Strategy](https://docs.mindline.com/docs/m365security/siem-strategy/): Microsoft Sentinel for GCC High, including connectors that do not appear and the Azure RBAC requirement that blanks the Defender portal under GDAP or Lighthouse delegation. - [Audit Readiness](https://docs.mindline.com/docs/m365security/audit-readiness/): Purview Audit Premium, log retention, and the C3PAO evidence package structure. - [Security Assessments](https://docs.mindline.com/docs/assessments/): a 75-check tenant posture framework aligned to Microsoft's Zero Trust Assessment. ## Reference appendices - [CMMC Level 2 Control Matrix](https://docs.mindline.com/docs/appendices/a-cmmc-control-matrix/): all 110 CMMC Level 2 practices and all 97 active NIST SP 800-171 Rev. 3 requirements mapped to implementing Microsoft technology. - [AVD Deployment Runbook](https://docs.mindline.com/docs/appendices/d-avd-operational/avd-deployment-runbook): empty subscription to Entra-joined, Intune-enrolled session hosts. - [AVD Firewall Reference](https://docs.mindline.com/docs/appendices/d-avd-operational/avd-firewall-reference): Azure Firewall rule collections for GCC High AVD, including the sovereign endpoint gaps that FQDN tags do not cover. - [AVD East-West Segmentation (NSG) Reference](https://docs.mindline.com/docs/appendices/d-avd-operational/avd-nsg-reference): blocking lateral traffic between host pools, with flow-log queries. - [Licensing and Compliance Matrix](https://docs.mindline.com/docs/appendices/licensing-matrix/): G3 vs. G5 mapped to CMMC Level 2 practices.