01Introduction
Moving 800 Users to GCC High for ITAR/CUI Compliance
02Problem Statement
- Defense contractor required Microsoft 365 GCC High for ITAR/DFARS compliance
- Existing Commercial M365 tenant with 6 years of data, SharePoint, Teams, Exchange
- Challenge: migrate without losing email history, Teams channels, or file permissions
- Timeline: 90-day window before DFARS audit; no tolerance for data loss
- Complexity: hybrid AD, on-prem Exchange remnants, third-party app integrations
03Proposed Solution
Phase 1
Commercial to GCC High with Zero Data Loss
- Pre-migration: Azure AD Connect sync verified, UPN format standardized
- Used BitTitan MigrationWiz for mailbox migration (staged batches of 100)
- SharePoint Online migrated via ShareGate with permission mapping preserved
- Teams channels rebuilt via PowerShell + Graph API; chat history via Veeam
- Cutover weekend: MX record flip + Outlook Autodiscover update
Phase 2
Compliance Configuration Post-Migration
- Conditional Access: MFA required, compliant device only, US IP restriction
- Microsoft Purview DLP: CUI and ITAR keyword detection on Exchange/SharePoint
- Intune enrollment for all endpoints; STIG-based configuration profiles deployed
- Microsoft Defender for Endpoint P2 + Defender for Identity connected to GCC High
- Entra ID PIM for all admin roles; no standing Global Admin privileges
04Technologies
- Migration
- BitTitan MigrationWizShareGateVeeam Backup for M365
- Microsoft 365 GCC High
- Exchange OnlineSharePointTeamsEntra IDIntune
- Security
- Purview DLPDefender for Endpoint P2Defender for Identity
- Compliance
- ITAR controls mappingCUI handling proceduresAudit logging
- Scripting
- PowerShellMicrosoft Graph API