If you're a federal contractor or a defense-adjacent organization, your Microsoft 365 tenant may live in the Government Community Cloud High (GCC High) enclave — and Teams voice works differently there. The enterprise-standard question "Direct Routing vs Calling Plans" collapses quickly in GCC High, and the practical question becomes: how do I architect Direct Routing properly inside the enclave?
What GCC High Is
GCC High is Microsoft's community cloud for US Government agencies and contractors handling controlled unclassified information at Impact Levels 4 and 5, and data governed by ITAR, EAR, FedRAMP High, and DoD requirements. It's a logically isolated, US-only environment with its own accreditation boundary — not the commercial cloud with extra licenses.
For voice, the implication is direct: conversations can themselves carry controlled information, so the PSTN path your calls travel is in scope for your security posture.
Why the Normal Options Narrow in GCC High
In commercial tenants, the choice set is Calling Plans, Operator Connect, or Direct Routing. In GCC High, that set has historically been much smaller:
- Microsoft Calling Plans — not generally available for GCC High tenants; this has been the long-standing gap that pushes every GCC High voice project to Direct Routing
- Operator Connect — availability for GCC High is recent and limited to specific operators; verify current status with your account team before planning around it
- Direct Routing — fully supported, and the de facto standard for Teams voice in GCC High
So for a federal contractor, the real comparison isn't "Direct Routing vs Calling Plans" — it's "Direct Routing in GCC High" vs "stay on the on-prem PBX." And the PBX is usually the thing your CUI-era security plan is trying to retire.
Architecture: Where the SBC Lives
The defining decision in a GCC High Direct Routing deployment is SBC placement, because the SBC is your bridge between the enclave and the PSTN:
- Azure Government hosting — virtual SBC (AudioCodes Mediant VE, Ribbon SWe) deployed in Azure Government regions, keeping the voice infrastructure inside an accredited boundary with US-only residency
- On-premises in a controlled facility — appliance or virtual SBC in your own CONUS data center, under your existing physical security accreditation
Both patterns work; the right one depends on whether your compliance model favors cloud-native (inherit Azure Government controls) or facility-based (extend existing accreditations).
Carrier and Number Considerations
Not every SIP carrier will serve a GCC High-connected trunk. You need a carrier that will contractually support US-only call handling, deliver E911 with location (PIDF-LO) to your PSAPs, and ideally will sign the data-handling terms your contract flow-downs require. Number porting into the enclave environment also takes longer than commercial — plan the timeline into your cutover, not after it.
Compliance Mapping: CMMC, ITAR, FedRAMP
- CMMC — a Direct Routing architecture concentrates voice into one hardened boundary: one SBC with strict SIP ACLs, TLS 1.2+ signaling, SRTP media, FIPS-capable cryptography on the SBC, and logged administrative access. That maps cleanly to boundary protection and transmission-encryption practices
- ITAR/EAR — US-only data handling is the core requirement; US-hosted SBC and US-carrier trunking keep the voice path onshore, and you should document the call path in your technology-control plan
- FedRAMP — Azure Government inherits FedRAMP High authorization for the hosting layer; your SBC and carrier remain your responsibility to accredit
Emergency calling deserves special attention in enclaves: dynamic location for E911 must work for office, remote, and site-based users, and Kari's Law notification requirements still apply. We cover the mechanics in the E911 compliance guide.
What to Verify Before You Commit
- Licensing — confirm the Teams Phone license SKUs available and required in your GCC High tenant with your licensing partner (they differ from commercial)
- Certificate chain — the enclave's TLS and root CA behavior for your SBC certificate; validate early, not at cutover
- SBC firmware — certified firmware for Direct Routing, with FIPS mode if your SSP requires it
- E911 — a location solution that works inside the enclave, not a commercial-tenant bolt-on
- Carrier — US-only trunking with contractual data terms and E911 delivery
GCC High voice projects fail in the seams: licensing assumptions, carrier terms, E911 inside the enclave. Start with an E911 and compliance audit, or talk to us about the architecture before you buy anything.