Hi everyone, I am currently running into an issue with trying to add a intune policy for m365 apps. I check the registry and it shows its enabled but when i go into the settings of the app. I am able to change it manually and its not greyed out. For example, the blocking of macros by default the settings are in place of the policy but its not greyed out so i can enabled them manually. Majority of the users are on business premium with defender and purview add on. I am checking the GCC-high table for the licenses table where it shows it supports microsoft group policy support for windows M365 and cloud policy service under business premium licensing.

Has anyone encounter a similar issue? If so what was the fix?

Hi Everyone, This week we migrated from commercial to GCC-High and the users are encountering issues with signing in. All of the DNS records were added , the domain has been verified on GCC-high. the ODC is now showing the domain is under our GCC-High tenant ID but it still points commercial but its acting very odd. For example, at the moment my outlook is showing a Fix me sign in the account. but it still shows its connected to the exchange servers so no issues.

The weirdest issue i just encountered was I was related all of the pointers to cache data and after deleting the cached data some users were able to be in the same position as my outlook but the weirdest issue was that I was recently setting up a brand new out of the box pc and this pc still gave me the error

AADSTS500011 the recource principal named https:outlook.office365.com was not found in my tenant.

Has anyone encountered this issue? if so what was the fix? and any help, advise or guidance is greatly appreciated.

Can I satisfy controls 3.3.4, 3.3.5 and 3.3.6 using Purview in GCC High?

Is copilot safe to use in the GCC high environment? From what I read it doesn’t share your information but want to confirm if that’s true or if there’s some gotchas to be concerned about

We recently made the jump to GCC High and we are now running into an issue where we cannot use Graph to Send Emails. The application has all the proper permissions but when the "Send-MGUserMail" function is called it throws an error about "Remote forest discovery is not supported on restricted forests." Has anyone else come across this issue? If so have you figured out a way to get this functionality working?

I just got a new subscription and I don’t have access to almost any of the VM SKUs in Virginia due to “high demand”. Support tells me that Virginia is basically full and there’s nothing they can do and won’t even give me access to 10 cores of the smallest Basv2 instance type. Anyone else experiencing this?

We have some sendmail servers that need to send mail out through our 365 gcc high environment. Are there specific requirements to configure a connector in Exhcange for this? If I set up the connector how I normally would in our commercial tenant it creates fine, but if I try to set it up the same way in our gcc high gov tenant (verifying the sending server matches one of the ip addresses, which belong exclusively to our organization), I get "connector creation failed. Error executing request. Failed to validate connector settings due to an internal system issue. Please try again later." We have a palo on-prem using the US-GOV (GCC High) dynamic list, so I don't think its a communication issue.

Any thoughts?

Has anyone seen this in GCC H? I am trying to figure out how i can enable it. i think its disabled for GCC high but im having trouble confirming

Interesting, that should save a few dollars!

https://techcommunity.microsoft.com/blog/publicsectorblog/introducing-microsoft-m365-business-premium-for-gcc-high/4465740

I'm getting a Uri Mismatch Error when trying to login to azure while running the configure for Azure Arc in Azure Gov.. has anyone been having this issue? The device Login code also does not work, and its showing "That code didn't work. Check the code and try again."

What are you all seeing for wait times for adding user licenses? O365 etc

Can someone verify these dynamic distribution click through share either broken or not available in gcc high? When I click through whether the Distribution List or Dynamic Distribution List , they both look the same. The Dynamic option simple shows manually adding members -no dynamic options.

What’s the easiest option to create an Employee only distribution list. I don’t want a collaborative SharePoint or Teams associated with it, just a DL. Gcc-high is a bit different in the gui than regular as far as I can tell.

Hey all,

I’m running into a frustrating issue in a GCC High environment and hoping someone here has seen this before.

We’ve got users in Excel who cannot enable macros — the entire Macro Settings section in the Trust Center is greyed out.

Here’s what I’ve tried so far:

• Verified the users are in an exclusion group for the Microsoft 365 Apps Security Baseline (via Intune).
• Confirmed their names show in the group and the profile assignment reflects the exclusion.
• Even created a temporary exclusion group and added affected users — no change.
• Checked for AppLocker policies → doesn’t look like that’s the culprit (UI still greyed out, not runtime block).
• Waited through policy syncs and even forced Intune syncs on devices.

Despite all this, users still can’t enable macros. What’s odd is:

Questions for the hive mind:

1. Has anyone seen macro policies still apply in GCC High even when a user is excluded from the 365 Apps security baseline?
2. Could this be coming from another security baseline (Defender, Windows 10), or something in M365 Security/Compliance?
3. Any tricks to definitively trace which policy source is locking down the Excel macro settings?

At this point, I’m not sure if I’m fighting Intune, or some Defender ASR rule. Any guidance from those who’ve untangled this in GCC High would be huge.

Thanks in advance!

Hey All,

I’m trying to enable S/MIME email signing for a customer who has a few users in a GCC High Microsoft 365 environment, and I’m running into some roadblocks. Here’s my situation:

Environment:

• Microsoft 365 GCC High
• Users are cloud-only (Entra ID), no on-prem Active Directory
• No access to domain-joined devices for auto-enrollment
• Goal: Users need to sign contracts using S/MIME

What I have considered:

• Installing S/MIME certificates manually for individual users (manual import)
• Looking into AD CS, but we have no on-prem AD, so auto-enrollment isn’t possible
• Considering third-party S/MIME certificates

Challenges / Questions:

1. What’s the best practice for issuing S/MIME certificates in GCC High without on-prem AD?
2. Can this be done entirely with Entra ID / Azure portal, or is a third-party CA required?
3. Are there any free or low-cost options that still work for signing emails for contracts in a GCC High environment?
4. Any tips for deploying and managing certificates for multiple users in this scenario?

I’d really appreciate guidance from anyone who’s done S/MIME in GCC High or managed cloud-only users needing email signing.

Thanks in advance!

What’s the solution for having direct dial phone numbers? Teams doesn’t support it in GCC high.

Has anyone set up an Azure Front Door CDN for use with the GCC-High flavor of SharePoint Online? The built-in Microsoft 365 CDN isn’t available in US Government environments but SharePoint Online generally supports the use of Azure CDNs. I don’t see anywhere where this wouldn’t be supported in GCC-High and the use of an Azure Front Door CDN hosted in AzureGov seems to be a good option as a replacement if it’s available.

Is there a decent list that shows what features are unavailable in GCC High?

We want to purchase YubiKeys for a subset of our users in GCC High to use as an alternative to Authenticator. I'm looking at the YubiKey 5C NFC FIPS model. Will this work in GCC High? Any issues with setup?

I’m working on deploying the purview information scanner. Once the scanner is installed and I’m trying to authenticate it is still pointing at commercial cloud.

Hows do I get this to point at gov cloud?

We have a logic app running in Azure Gov that ingests logs for an external SIEM. It runs every half hour for an average of two minutes per run. It's been running since June 26, and I'm trying to figure out what, exactly, I'm paying for. The cost analysis shows the logic app has accumulated costs of $116.33 since we started running it just five days ago, and the forecast for July alone says it will be close to $1,000. This is nothing like the pricing I saw in the calculator. I'm new to this, so I"m not sure what to look for to bring this cost down. The logic app is the only cost that spiked. Everything else in our resource group that supports it is costing pennies.