Recent Discussions
CMMC Compliance without GCC High
Hello MS team, As a government contractor we regularly access CUI and are required to be CMMC level 3 compliant. Currently we run Office 365 on our systems and do not intend on upgrading to GCC High. What configurations, settings or group policies should a contractor put into place in order the be level 3 compliant w/out GCC High. I am looking for guidance in AU, CM, MP, SC & SI domains. Thank you in advanceWelcome to the Public Sector community!
Hi all, Welcome to the Public Sector Community! This is a space to connect and discuss the solutions, challenges and best practices for IT in the public sector. A special thanks to Tracy Moran for suggesting this space in our Ideas Exchange. Thanks for your help keeping this community a vibrant and useful place!
That's a wrap: Microsoft Teams Government AMA
Thank you for joining us and voicing your questions and feedback during this fun and action-packed hour. Please note that you won't be able to ask new questions in this space until our next live event. We will be disabling posting and further comments in this AMA space but encourage you to post any new questions or follow up in our Public Sector, Local/State Government Space. We will put together a summary document of what was covered during and share it in this group. See you next time!Extending the Shared Responsibility Model into CMMC
A quick review of Compliance Manager (or the Office 365 MT FedRAMP system security plan) shows that Microsoft has documented the areas where customer orgs need to implement their own controls (policies, procedures, tenant configurations) in order to fully satisfy a FedRAMP control requirement. I know that CMMC is different. We aren't focusing on just the cloud system, but rather the entire organization, its people, information, technology and facilities. That distinction aside: how much do we think Microsoft's security capabilities can be "inherited" by subscriber organizations for use in a CMMC assessment? How much still needs to be documented, performed, and managed by the organization itself? More than FedRAMP? Less? 42?
Win32 Content Prep tool doesn't work with FIPS mode
This issue on GitHub has been languishing unacknowledged for the past three years. Since the elder days of yore, the Win32 Content Prep tool - the only option for deploying non-MSI applications through Intune - has been unable to operate on and endpoint which has been FIPSed. This process has caused much consternation among those of us who must, by reason of government directive, FIPS ourselves and our endpoints for the security of the nation. I would humbly beseech those who create the great and powerful content prep tool to update it with support for FIPS so that those of us who wish to use it can do so. GitHub Reference Link Error for Windows Platform FIPS · Issue #33 · microsoft/Microsoft-Win32-Content-Prep-Tool (github.com)
Documentation Templates and Snippets
Can Microsoft provide templates, snippets, and/or examples of documentation for each of the CMMC controls that the GCC High environment helps meet? For example, AU 3.048 - Collect audit info into 1 or more central repos. The recommendation is to use Azure Sentinel, which we are implementing, but having documentation examples that we can copy/paste/modify into our documentation for certification purposes would be very helpful. Obviously, this could be very different for each customer, which is where a template of sorts with a full example would be very helpful.GCC Meetup in Washington DC
I am looking to host an interactive event to generate conversations around compliance (records/retention), Teams, PowerApps, PowerAutomate, and/or adoption programs for GCC customers in the Washington DC area. The first challenge is met, I have a good space that is located close to a metro station. Part two is getting feedback on topics. What would be useful? I am favoring small table conversations on a few key topics/questions and then coming back together to share the answers or observations. This event could then turn into the beginnings of a Washington DC Office 365 GCC user group. We just need to figure out who wants to help at the decision and planning level and who is an interested participant. We have a lot of MVPs, some very active companies, and some solid Microsoft contacts that we can leverage as speakers once we decide some topics that are meaningful and are real challenges. Share your thoughts and lets see if we can get this launched!Planner is coming to all F1 commercial plans and government offerings starting in October
Planner has always been for people like you—people who manage work on a daily basis without being in a formal work management role. And it’s with people like you in mind that we’re releasing Planner for all F1 commercial plans and government offerings starting in October. Microsoft’s F1 plans are specifically designed for Firstline Workers, who are the first people to interact with customers and see their company’s products and services in action. Learn more here .
Recent Blogs
- SharePoint End of support for SharePoint Server 2016 and 2019 is scheduled for July 14, 2026. It's advisable to upgrade directly to SharePoint Server Subscription Edition Purview Informatio...Mar 11, 2025
- Effective March 1, 2025, the 5% price increase for Office 365 G1 will take effect. Learn more about the changes.Mar 04, 2025
