This is not an official U.S. federal government website. The Federal Modernization Workbook is independent technical analysis. It does not represent the position of, and has not been reviewed or endorsed by, any federal agency.

Federal Modernization Workbook · Book 10

Book 10 — Cloud Boundary & Landing Zone

What the Boundary Lets You Use

Why the authorization boundary, not the product catalog, decides what an agency can use: what changed at FedRAMP, what GCC leaves out, how the landing zone makes the boundary concrete, who owns it, and how to compensate and evidence it

Book 10 of the Federal Modernization Workbook: the invisible boundary, FedRAMP’s 2026 rules, GCC and the commercial feature gap, the landing zone, IPAM and network as code, the front door, who owns the boundary, in-boundary equivalents and documented exceptions, alternative collaboration paths, and evidencing the boundary in the authorization package.

Status — baseline book

This book is part of Release 2.0, the workbook’s baseline edition: it is complete, checked against every other book and approved by the workbook’s editor, and later changes are tracked against Release 2.0. Baseline is not a claim of independent peer review (Status labels). This book replaces the workbook’s Boundary Impact Model, the cloud boundary case studies, the FedRAMP 20x feature-gap whitepaper, the Google Workspace collaboration path, the cloud modernization spec and the platform host’s Git server interface paper. Every external claim was checked against a primary source from October 20, 2026 and carries a footnote with its date. The earlier pages are kept in the repository’s archive/b10-cloud-boundary/ folder, and their old addresses forward to the chapters that replaced them.

Download and present

b10-cloud-boundary-bundle.docx: the whole book as one Word document, regenerated on every site deploy.

15-minute presentation (about 13 minutes narrated): the Why / What / Who / How deck is on the Presentations page.

Executive briefing (about 30 minutes live, 21 narrated): for authorizing officials and ISSOs, on the Presentations page.

Technical deep dive (about 50 minutes live, 18 narrated): the boundary and the 2026 FedRAMP rules, GCC and the feature gap, the landing zone, IPAM as code and the front door, and the authorization package, in modules on the Presentations page.

A cloud product’s feature list describes the commercial service. What an agency can actually use is decided by three separate checks, each with its own owner. First, the provider documents, feature by feature, what its government cloud environment leaves out: Microsoft’s network connectivity reporting in the Microsoft 365 admin center, for example, supports commercial tenants “but not GCC Moderate, GCC High, or DoD.”¹ Second, FedRAMP certifies a named cloud service offering at a Certification Class, and the provider’s assessment scope says what that certification covers; Microsoft 365 GCC, for example, is listed as FedRAMP Certified at Class C.² Third, the agency authorizes its own system: FedRAMP says each agency “still authorizes its own federal information systems.”³ A feature can pass one check and fail another, so none of them stands in for the other two. The book’s worked case is Microsoft 365 GCC, with GCC High for comparison, and Azure, including Azure Government, where Microsoft lists each security feature as generally available, in preview or not available.⁴ Much of what these checks remove is invisible. A feature that isn’t offered in a government cloud rarely announces itself; a design simply depends on it, and the gap surfaces later as missing data or a capability that never arrives. FedRAMP’s 2026 rules changed the vocabulary (services are certified in Classes A through D, and “the boundary” is now a set of scope rules rather than a drawn shape) and gave agencies more to ask a provider for. The landing zone is where the boundary becomes concrete, in management groups, subscriptions, policy, address authority and the front door every change passes through. When a capability is outside the boundary, an agency has three responses: compensate in-boundary, use a documented exception, or choose an alternative path, and in every case evidence the choice in its own authorization package. Going without the capability is also a legitimate outcome when someone decides it and records it.

Why, what, who, how

	Question	Chapters
Why	Why does the boundary decide what you can use, and why is so much of it invisible?	01, 02
What	What changed at FedRAMP, what GCC leaves out, and how the landing zone, IPAM, network as code and the front door make the boundary concrete	03, 04, 05, 06, 07
Who	Who owns the boundary, and who decides inside it	08
How	Compensate or take a documented exception, choose an alternative path when that’s the honest answer, and evidence the boundary in the authorization package	09, 10, 11

Appendices: A — What to ask a cloud provider for · B — Platform host interface reference

Reading paths

Executives (20 minutes): Chapters 01, 04 and 08, or the 15-minute presentation.
Architects: Chapters 01–07, then 09.
Authorizing officials and ISSOs: Chapters 02, 03, 08, 09 and 11, with Appendix A.
Cloud platform engineers: Chapters 05–07, with Appendix B.

Where this book sits in the workbook

This is Book 10 of the Federal Modernization Workbook. Book 08 — DNS, DHCP & IPAM owns the name and address layer the landing zone depends on, and Book 09 — Network & Transport the TIC 3.0 and transport decisions at its edge. Book 04 — Access & Privilege carries Conditional Access, and Book 01, Chapter 03 the platform host whose interfaces Appendix B lists. For control-level depth, the Federal Compliance volumes on the cloud landing zone, landing zone and network as code and the landing zone front door remain in the repository.

New and revised procedures in this book follow the workbook’s implementation conventions (control states, the How-section template, authority labels, the evidence checklist, change safety and the Zero Trust mapping block), defined once in Book 00, Appendix D.

Chapters

Title	Description
Chapter 01 — Why the Boundary Decides What You Can Use	Why the FedRAMP certification, the provider’s published exclusions for the agency’s cloud environment and the agency’s own authorization decide which features an agency can use, why impact level and feature availability are different questions, what the 2026 FedRAMP rules changed about the word “boundary,” and the three responses when a capability falls outside.
Chapter 02 — The Invisible Boundary	Why much of what the boundary removes stays invisible until a design depends on it, a corrected version of the most-cited GCC example, the program’s four-dimension model of what changes across a boundary, how the program makes the boundary visible, and why the boundary is an architectural concern rather than a compliance one.
Chapter 03 — What Changed at FedRAMP	What FedRAMP’s Consolidated Rules for 2026 changed about the cloud boundary: certification classes in place of impact levels, a rulebook with no provider authorization boundary, Minimum Assessment Scope as a data-flow test with per-resource security categories, change notification in place of re-authorization, certification data delivered through trust centers, and how Rev5 and the new rules coexist.
Chapter 04 — GCC, GCC High and the Commercial Feature Gap	What Microsoft 365 GCC is in Microsoft’s own documentation, why its feature gaps are published one feature at a time and run in both directions, what agencies verifiably lose (the admin center’s network connectivity layer above all), the three Microsoft 365 government packages on the FedRAMP Marketplace including a second GCC package pursuing Class D (High), and why impact level and feature availability are different axes.
Chapter 05 — The Landing Zone	What a cloud landing zone is, how management groups, subscriptions and Azure Policy turn the authorization boundary into enforceable structure, the AWS equivalent, and what a landing zone can and can’t prove.
Chapter 06 — IPAM and Network as Code	Why the address plan is the join key for inventory and boundary evidence, how the enterprise IPAM stays the authority while Azure Virtual Network Manager pools mirror it and Azure Policy enforces it, and how the landing zone, address plan, naming plane, network and enforcement edge are deployed as layered code.
Chapter 07 — The Landing Zone Front Door	The governed request that turns landing-zone code into an approved, evidenced and reconciled provisioning event: subscription vending, the six-step loop from catalog request to closed change, the ServiceNow and Terraform paths that implement it, where the pipeline itself must live, and the evidence it produces.
Chapter 08 — Who Owns the Boundary	Who decides, who does the work and who is consulted when an agency draws, changes and evidences the boundary around its use of a certified cloud service: the authorizing official, the system owner, the ISSO, the cloud platform team, workload owners, the cloud provider, FedRAMP and acquisition, with a responsibility matrix, a three-party responsibility split and an owner for each boundary impact dimension.
Chapter 09 — In-Boundary Equivalents and Documented Exceptions	What an agency does when a capability is outside its cloud boundary: inventory the exclusions feature by feature, probe what actually works, build in-boundary equivalents that are labeled as derived, use a provider’s documented exception path or a dated risk acceptance, make the scope arguments the 2026 FedRAMP rules allow, and buy capabilities rather than badges.
Chapter 10 — Alternative Collaboration Paths	When the tenant’s own suite isn’t the right answer for a workload, an agency can move collaboration to a different certified service while keeping the identity plane, and must evidence that choice like any other boundary decision.
Chapter 11 — Evidencing the Boundary in the Authorization Package	What the cloud boundary means for the agency’s own authorization: what the package contains, how the boundary becomes a named artifact that the system security plan, plan of action and milestones and component definition all cite, how to write control narratives for inherited, shared, agency and compensating controls, and how provider change notices and ongoing certification reports keep the package current.
Appendix A — What to Ask a Cloud Provider For	Specific, evidenced requests an agency can put to a cloud provider about its government offering, each tied to a FedRAMP 2026 rule or to the provider’s own documentation, with Microsoft 365 GCC as the worked example: a machine-readable exclusion list, a named exception path per feature, the network observability layer, a FedRAMP-compatible trust center, the relationship between same-named packages, and more.
Appendix B — Platform Host Interface Reference	Every interface the program’s Git-based platform host on Windows Server 2025 exposes, grouped into six families and mapped to its boundary, authentication model and controls, with illustrative configuration.

Version and revision history

Version 2.0, in edition 2026.11.5 (November 8, 2026). Every edition is kept on the Archive page; every change between editions is in the commit history.

Versions of this book, newest first
Version	Edition	Date	Changes
2.0	2026.11.5	2026-11-08	Release 2.0, the baseline: checked against every other book; Draft becomes Baseline; Edition 2026.11.4: record the edition and point deck links at it (#362); Book 10: fix confirmed crosswalk errors (GCC example counts, egress allowlist, POA&M vs exception, table description) (#399); Book 10: make chapter terms, cites and Rev5 dates agree (inconsistency wave) (#432); Decisions pass, Books 05-12: apply Mike’s calls and take-the-recommendation items (#453); Claim language: supports, not satisfies (rule, check, first sweep) (#474); Decisions 10-27 (Nov 8): Books 10-19, guides, training, help desk guide (#487); Decks: supports, not satisfies (wording, narration, re-rendered videos) (#489); and 1 more (all changes)
1.4	2026.11.4	2026-11-05	Sweep stale wording, and link sources on every deck (#361)
1.3	2026.11.3	2026-11-05	Book decks: narration names the book or the original source, and 68 videos re-exported (#344)
1.2	2026.11.1	2026-11-01	Edition 2026.11: record the edition, and publish the four gate-level decks and videos (#282)
1.1	2026.11	2026-11-01	Move the decks and narration audio out of git, onto edition 2026.10 (#260); Retire Research: move each page to a home by type (guides, training, reference, evaluations, explainers) (#269); Content rules: one home per type, and the federal layers every guide carries (#271)
1.0	2026.10	2026-10-31	First edition (17 merged changes since the book began)

Microsoft Learn, “Network connectivity in the Microsoft 365 Admin Center,” https://learn.microsoft.com/en-us/microsoft-365/enterprise/office-365-network-mac-perf-overview?view=o365-worldwide (accessed Oct 21, 2026).↩︎
FedRAMP Marketplace product data, https://www.fedramp.gov/marketplace/products.json, last_change 2026-10-21T16:12:00Z (accessed Oct 21, 2026). Listing MSO365MT, “Microsoft 365 Government Community Cloud & Supporting Services”: status FedRAMP Certified, cert_class Class C.↩︎
FedRAMP, “Using a FedRAMP Certified Cloud Service,” FedRAMP Consolidated Rules for 2026, https://www.fedramp.gov/2026/agencies/use/ (accessed Oct 21, 2026).↩︎
Microsoft Learn, “Cloud feature availability for US Government customers,” https://learn.microsoft.com/azure/security/fundamentals/feature-availability (accessed Oct 21, 2026).↩︎