Can we use Microsoft 365 Copilot with CUI in GCC High?
Microsoft lists Copilot as available in GCC High. That settles availability, not your compliance. This page shows what Microsoft documents as of November 9, 2026. Your compliance lead decides whether Copilot touches CUI.
| Feature | GCCH status | Your decision |
|---|---|---|
| Chat | Yes | Pilot group only |
| Copilot in Outlook | Yes | Lead decides |
| Agent Builder | Yes | Hold for review |
| Copilot in Teams | Not available | None needed |
| Web grounding | Off by default | Keep off |
Microsoft's label is "Not currently available". Service description table, August 2026.
- Asset
- Microsoft 365 Copilot (GCC High)
- Category
- CUI Asset, 32 CFR 170.19
- Allow web search in Copilot
- Not configured: off
- Decision owner
- Sample Compliance Lead
- Status
- Draft, not approved
How it runs.
Staff want Copilot. It shows whatever each user can already open, so loose permissions become the exposure. Features differ from commercial, and your SSP has to say how it is used.
Microsoft's feature table
The GCCH column of the service description, with its date.
Your dataCompare your tenant
Web search, connectors, agents and labels set against your SSP.
AutomatedCompliance lead decides
Who may use Copilot on CUI, and with which features on.
A personSSP entry drafted
Draft language for a person to edit and approve.
Automated
Microsoft 365 GCC High / Microsoft 365 admin center / Cloud Policy service / Microsoft Purview / System Security Plan (SSP)
The rules and limits.
- Availability
- Microsoft's table marks Chat, Copilot Search, Researcher, Analyst and Copilot in Outlook as available in GCCH. Copilot in Teams and SharePoint are not. Table last updated August 2026.
- DFARS 252.204-7012
- Paragraph (b)(2)(ii)(D): a cloud provider handling covered defense information must meet FedRAMP Moderate equivalent security. Microsoft says it supports the 7012 flow-down in GCC High.
- Web search
- Off by default in government clouds. If enabled, Copilot sends generated queries to Bing, which Microsoft says operates separately. The control is the Allow web search in Copilot policy.
- Permissions
- Copilot surfaces only data a user has at least view permission to, and it honors Purview encryption usage rights. Overshared SharePoint sites are the practical risk.
- Your SSP
- 32 CFR 170.19: assets that process, store or transmit CUI go in the asset inventory, network diagram and SSP. Use of an outside provider must be documented there.
What a person does.
- Your compliance lead decides whether Copilot may process CUI.
- Your own admin changes tenant settings and applies sensitivity labels.
- Counsel reviews contract terms and the DFARS 7012 flowdown.
- Your security lead approves any SSP change.
Where we stand: we have not shipped this. This page answers a common question. It is not a product, an assessment, or legal advice.
Common questions.
Can we use Microsoft 365 Copilot with CUI in GCC High?+
Microsoft offers it there and lists Microsoft Copilot in GCC High's FedRAMP scope. Whether your CUI may go through it depends on your contract, SSP and settings. Your compliance lead and counsel make that call.
Does this make us compliant?+
No. Microsoft says customers remain responsible for configuring Copilot to meet their obligations. Nothing here is legal advice or a CMMC determination.
Which features are missing in GCC High?+
In Microsoft's August 2026 table: Copilot in Teams, Copilot in SharePoint, SharePoint agents, Scheduled Prompts, Edit with Copilot and Power Platform Connectors. Insider Risk Management is also unavailable. Check the live table before deciding.
Sources
- Microsoft Copilot service description, feature availability
- Microsoft: US government cloud environments and Copilot
- Microsoft: web search in Copilot
- Microsoft: data, privacy and security for Copilot
- Microsoft FedRAMP offering, in-scope services
- Microsoft: compliance across commercial and government clouds
- DFARS 252.204-7012
- 32 CFR 170.19, CMMC scoping
General information, not legal, tax, or compliance advice. Rules change; confirm against the current source and your own advisers.
Bring us your version of this.
Intro calls are 30 minutes, free, and useful even if we never work together. We'll be honest about whether this is the right fit for your government contracting team.