GCC High FAQs and Troubleshooting

Microsoft provisions the SharePoint document library in the background after the site is created. On GCC High this can take anywhere from about 15 minutes to 48 hours, with no guaranteed time, so the drive may look empty or missing at first — check back later. If it still isn't accessible, confirm the affected person is a member of the CUI Users group, since access to the CUI Shared Drive follows that group's membership.

That policy requires each device to be marked compliant by a mobile device management (MDM) solution such as Microsoft Intune. Until your MDM is enrolled and reporting device compliance, turning this policy on will block CUI users. Set up device compliance first, confirm devices are reporting as compliant, and then enable the policy.

Yes. Conditional Access policies are created in report‑only mode so no one is locked out during rollout — they log what would happen without actually enforcing it. Review the report‑only results in the Microsoft Entra admin center, then switch each policy to On when you're ready.

In the Microsoft Entra admin center, go to Identity → Monitoring → Sign‑in logs, filter by Conditional Access and the policy name, and review the report‑only results. Once the results look clean for your tenant, switch the policy to On.

Once enabled, the "Block Legacy Authentication" policy blocks legacy protocols such as Exchange ActiveSync and SMTP AUTH that can't satisfy modern MFA. We also disable POP and IMAP on the default mailbox plan and disable SMTP client authentication tenant‑wide. Move affected clients to modern authentication, and if a specific service account genuinely needs SMTP AUTH, re‑enable it only for that account.

This is intentional. To protect CUI, we add mail‑flow rules that block external auto‑forwarding and external mailbox forwarding, and we disable auto‑forwarding on the default remote domain. If a specific business case requires external forwarding, handle it through a reviewed exception rather than re‑enabling forwarding broadly.

We tighten SharePoint and OneDrive sharing for CUI: external sharing is restricted to existing guests only, sharing links default to specific people with view‑only access, the allowed‑domains list is locked down, external links expire after 30 days, and downloads/sync from unmanaged devices are blocked. Re‑share within those limits, or add the recipient as a guest first.

This is by design. Super Admins are excluded from the Conditional Access policies so these break‑glass accounts remain accessible if your sign‑in infrastructure is ever degraded. Keep Super Admin accounts few in number and tightly controlled.

The risk‑based Identity Protection policies require Microsoft Entra ID P2 (Entra ID P1 is not sufficient). Add Entra ID P2 to your tenant and contact your Customer Success Manager to re‑run setup.

IT Admins are granted the custom GCC High IT Admin role plus User Administrator, scoped to the Defense Trust Boundary. If an admin sees a permissions error, confirm they're a member of the IT Admins group — the roles are assigned to the group, not to individuals.

The Teams meeting policy auto‑admits only people in your organization, prevents anonymous users from starting or joining, and prevents PSTN callers from bypassing the lobby. Organizers can admit waiting participants from the lobby. Cloud recording is also turned off by policy.

To limit unmanaged data paths, Teams apps are restricted to an approved list with sideloading disabled, third‑party file services (Dropbox, Box, Google Drive, ShareFile, Egnyte) and email‑into‑channel are blocked, and self‑service SharePoint site creation is disabled tenant‑wide. Have an admin provision sites or approve apps as needed.

Our anti‑spam, anti‑phishing, and anti‑malware policies are intentionally strict (high‑confidence spam is quarantined, ~50 executable/script attachment types are blocked, and zero‑hour auto‑purge is on). An admin can review and release messages from the Microsoft Defender portal and, where appropriate, refine the policies.