Appendix C — Applicability
The architecture travels to every environment; the services, integrations and authorizations underneath it don’t.
The environment the book is written for, and what changes in GCC High, Azure Government and AWS GovCloud (US), at DoD impact levels 4 and 5, and in air-gapped and classified networks, with a quick-reference table. Readers in higher-impact environments should start here, then read Chapter 03.
Service availability in government clouds changes month to month. Every platform fact on this page was checked against the provider’s documentation or the FedRAMP Marketplace on October 20, 2026. Recheck the linked pages before relying on them.
The architecture in this book applies in every environment: one authoritative DDI policy plane, agency-controlled resolvers as the first hop, and consistent forwarding and policy everywhere. What changes from one environment to the next is which services are authorized, which integrations exist and which optimizations are available. This appendix sets out those boundaries so that readers in higher-impact environments know which statements in the chapters need adjusting.
The book uses GCC-Moderate for the Microsoft 365 Government Community Cloud offering that Microsoft documents as “GCC.” GCC uses the Worldwide endpoint set, and the FedRAMP Marketplace lists it (as Microsoft 365 Government Community Cloud & Supporting Services) as FedRAMP Certified at Class C, which the Marketplace labels Moderate. Microsoft’s GCC service description uses broader wording about FedRAMP accreditation; for authorization purposes, read the Marketplace listing and the package.
Primary scope: commercial cloud at FedRAMP Moderate
The book is written for agencies whose workloads run in commercial Azure, commercial AWS Regions and Google Cloud, with Microsoft 365 in GCC-Moderate, at the FedRAMP Moderate impact level. In this environment:
- Everything in Chapters 01–12 applies as written.
- A DDI management service delivered as a cloud service must hold a FedRAMP certification at Moderate or higher, and the agency authorizes its own DDI system that uses it; FedRAMP’s rules say an agency “should never create a standalone authorization to operate for a cloud service offering.” On-premises and in-tenant resolvers stay inside the agency’s own boundary (Chapter 03).
- Microsoft 365 informed network routing (INR) is not available. Microsoft says it “supports tenants in WW Commercial cloud but not the GCC Moderate, GCC High, DoD, Germany, or China clouds” (Chapter 05).
- The Amazon VPC IPAM integration that lets an external Infoblox IPAM act as the authority for a VPC IPAM scope is available in commercial AWS Regions, for private scopes only, and requires the VPC IPAM Advanced Tier (Chapter 07).
- Because GCC-Moderate uses the Worldwide endpoint list, the DNS risk for Microsoft 365 is path consistency rather than resolving to the wrong cloud (Chapter 02).
GCC High, Azure Government and AWS GovCloud (US)
The architecture is unchanged. The differences are in authorization and integration:
- A policy plane certified only at FedRAMP Moderate doesn’t cover High-impact systems. Either use a service certified at High, or keep the policy plane inside the agency’s own High boundary (on-premises or in-tenant management), and confirm the approach with the authorizing official.
- Microsoft 365 GCC High uses its own endpoints and namespaces, many under
.us domains (for example outlook.office365.us, *.sharepoint.us, gov.teams.microsoft.us and login.microsoftonline.us), and every resolver that GCC High users depend on must answer them correctly (Chapter 02).
- INR is not available.
- The Amazon VPC IPAM–Infoblox integration is not available in the AWS GovCloud (US) Regions (or the AWS China Regions). Treat GovCloud like Azure and Google Cloud in Chapter 07: discovery, reconciliation and a reservation process.
- Azure Government feature availability differs from commercial Azure. On Microsoft’s Azure Government roadmap, Azure DNS private zones and public zones are generally available and authorized at FedRAMP High, DoD IL4 and DoD IL5, and Azure DNS Private Resolver is generally available at FedRAMP High. Confirm DNS security policy and DNSSEC signing availability in the target Azure Government regions before design.
- Private endpoint DNS zone names differ in Azure Government (for example
privatelink.database.usgovcloudapi.net rather than the commercial names), so conditional forwarding rules written for commercial Azure don’t carry over unchanged (Chapter 07).
DoD (impact levels 4 and 5)
Everything in the GCC High section applies, plus the DoD Cloud Computing Security Requirements Guide (SRG) and component-specific requirements. Azure Government holds DISA provisional authorizations at IL4 and IL5, with separate IL5 provisional authorizations for the US Gov and US DoD regions. Not every service is authorized at every level: on the Azure Government roadmap, Azure DNS Private Resolver is forecast, not yet authorized, at IL4 and IL5. This book doesn’t map the SRG. Treat Chapter 03 and Appendix B as a starting point only, and confirm provisional authorization status at the required impact level for every cloud service in the design.
Air-gapped and classified networks
The core design still applies: one authoritative policy plane, agency resolvers as the first hop, consistent forwarding, DNSSEC validation under agency control and full logging. Several things in this book don’t:
- No SaaS management plane. The policy plane, resolvers and IPAM run entirely inside the enclave.
- No CISA Protective DNS forwarding and no public recursion. The internet-facing guidance in Chapters 02 and 05 doesn’t apply; local response policy zones carry threat intelligence imported through approved cross-domain processes.
- DNSSEC trust anchors and any internal root are managed locally.
- Cloud-provider integrations apply only where the provider offers a corresponding isolated cloud, and availability there must be confirmed separately. In Azure Government Secret (IL6), for example, Azure DNS private zones are generally available, Azure DNS Private Resolver is awaiting review and public zones are planned.
Mission-specific guidance governs these environments, and this book’s sources don’t cover it.
Quick reference
| Single DDI policy plane |
Applies |
Applies |
Applies |
Applies |
| Cloud-delivered management certified at FedRAMP Moderate |
Sufficient for Moderate systems; the agency authorizes its own system |
Not sufficient alone |
Not sufficient alone |
Not applicable |
| CISA Protective DNS forwarding |
Required for federal civilian agency egress |
Required for federal civilian agency egress |
Per DoD requirements |
Not applicable |
| Microsoft 365 INR |
Not in GCC-Moderate (Worldwide commercial only) |
Not available |
Not available |
Not applicable |
| Amazon VPC IPAM external-IPAM (Infoblox) integration |
Commercial Regions, private scopes |
Not in GovCloud |
Not in GovCloud |
Not applicable |
| Azure DNS Private Resolver |
Available |
FedRAMP High (Azure Government) |
Forecast at IL4 and IL5 |
Awaiting review in Azure Government Secret |
| Azure Private DNS DNSSEC signing |
Not supported (Azure DNSSEC signs public zones only) |
Not supported |
Not supported |
Not applicable |
The Protective DNS row rests on M-22-09’s statement that agencies “are already required to have DNS requests routed through CISA-operated infrastructure.” The DNSSEC row rests on Microsoft’s prerequisite that a zone to be signed “must be hosted by Azure Public DNS.”
Back to top