In addition to the core Microsoft 365 subscriptions mentioned earlier, Microsoft has also created specialized packages for governmental and educational organizations designed to suit their specific needs. The Microsoft 365 Government G3 and G5 subscriptions contain the same tools and services found in their Enterprise E3 and E5 equivalents, but the packages are designed to adhere to the additional compliance regulations and requirements to which United States government entities are often subject.
For all the Microsoft 365 Government products, data is stored under special conditions, including the following:
- All Microsoft 365 Government user content, including Exchange Online mailboxes, SharePoint site content, Skype for Business conversations, and Microsoft Teams chat transcripts, is stored in datacenters located within the United States.
- The user content generated by Microsoft 365 Government subscribers is logically segregated from commercial Microsoft 365 user content within the Microsoft datacenters.
- Access to Microsoft 365 Government user content within the Microsoft datacenters is restricted to employees who have undergone additional security screening.
Access to Microsoft 365 Government products is restricted to United States federal, state, local, tribal, or territorial government entities and other entities required to handle government data in compliance with the same regulations and requirements as a government entity. Eligibility to purchase these products is subject to verification by Microsoft using various government resources, including those of law enforcement agencies and the Department of State, as well as government standards, such as the International Traffic in Arms Regulations (ITAR) and the FBI’s Criminal Justice Information Services (CJIS) Policy.
In addition to the Microsoft 365 Government G3 and G5 subscriptions, which define the products’ feature sets, there are versions of Microsoft 365 Government that define various levels of security and compliance, including the following:
- Microsoft 365 U.S. Government Community (GCC) Intended for Federal Risk and Authorization Management Program (FedRAMP) moderate risk impact situations; also complies with the Internal Revenue Service Publication 1075 standard, the U.S. Criminal Justice Information Services (CJIS) Security Policy, and the U.S. Department of Defense (DoD) Defense Information Systems Agency (DISA) Level 2 requirement for noncontrolled unclassified information
- Microsoft 365 U.S. Government Community (GCC) High Intended for FedRAMP high-impact situations; complies with the International Traffic in Arms Regulations (ITAR) and the Defense Federal Acquisition Regulation Supplement (DFARS)
- Microsoft 365 DoD Restricted to the exclusive use by U.S. Department of Defense agencies; complies with the U.S. DoD Defense Information Systems Agency (DISA) Level 5 requirement for controlled unclassified information and unclassified national security systems
In addition to the Microsoft 365 Government subscriptions, Microsoft also maintains an alternative means of accessing Microsoft 365 cloud services, called Azure Government ExpressRoute, which is a private, dedicated network connection to the Microsoft cloud services for eligible subscribers that have regulatory requirements that prevent them from using the public Internet.