The idea that Office 365 is compliant for use in any regulated space is *absolutely laughable*, but apparently the reason GCC High is approved for government use is because the government let agencies use it while they were evaluating it, and then realized so many agencies were now dependent on it, that they had to approve it even though it wasn't able to actually meet the security criteria.

https://arstechnica.com/information-technology/2026/03/federal-cyber-experts-called-microsofts-cloud-a-pile-of-shit-approved-it-anyway/