Why Microsoft's Native File Sharing Is Breaking Down for GCC High Organizations — and What to Do About It

If you’re an organization operating in Microsoft’s Government Community Cloud (GCC or GCC High) and working toward or already holding strict compliance requirements, like CMMC Level 2, ITAR, SOC 2, or others, you’ve likely run into a frustrating reality: sharing files externally from Microsoft SharePoint or Microsoft OneDrive is harder than it should be, and lately, it may have stopped working altogether.

This isn’t a configuration problem unique to your environment. It’s a structural one, and it’s affecting organizations across the Defense Industrial Base (DIB).

"It Stopped Working Altogether"

We've heard a version of the same story from multiple GCC High customers in recent months. A defense contractor, already CMMC Level 2 certified, had a straightforward external sharing workflow in place: maintain an approved domain list, allow external users from vetted organizations to access a carved-out SharePoint site via a one-time passcode. Controlled, auditable, workable — until it wasn't.

What happened? Microsoft is migrating GCC High tenants to a new external sharing model that eliminates the one-time passcode mechanism. Microsoft’s retirement of SharePoint one-time passcode (OTP) authentication, announced in Message Center post MC1243549, replaces OTP with Microsoft Entra B2B guest accounts.

The rollout has been paused for GCC High customers, and the old system was partially reinstated. As of Microsoft’s October 1, 2026 update, GCC High remains excluded, and no new dates have been announced. For organizations that depend on this workflow to move Controlled Unclassified Information (CUI) between primes and subs, that's an untenable position.

The Deeper Problem with Native SharePoint External Sharing

This isn't just about a temporary outage. The pain points we hear consistently from GCC High organizations reveal structural friction that predates — and will outlast — any single Microsoft update.

Configuration burden falls on both sides. Under Microsoft's updated model, the receiving organization also needs to modify their tenant settings to allow the connection. Many partners — particularly smaller contractors or commercial tenants on platforms without full Microsoft Entra ID (formerly Azure Active Directory) support — simply don't have the administrative infrastructure to do that. One organization told us they had a partner whose domain was managed through GoDaddy, with no way to make the required configuration changes on their end. The share never worked.

External users get access directly into your Microsoft tenant. Even with controls in place — expiration dates, domain whitelisting, link restrictions — external users are accessing a live SharePoint site inside the GCC High environment. That's a meaningful security and compliance consideration, especially when you're trying to minimize your CUI attack surface.

CMMC compliance adds a vetting layer that slows everything down. Organizations can't just share CUI with anyone. Before adding a domain to an approved list, many teams now require recipients to complete a questionnaire verifying they meet the 110 NIST SP 800-171 controls. That's the right call — but it turns what should be a simple file share into a multi-step approval process. When the underlying technology is also unstable, the organizational burden compounds.

No advance notice from Microsoft. The communication gap has been a consistent frustration. GCC High organizations are used to seeing change notices in the Microsoft 365 admin center with dates and documentation. On this particular shift, several organizations we spoke with said they received nothing — the feature simply broke. For compliance-driven organizations that need predictability in their security stack, silence from a critical platform vendor is unacceptable.

What GCC High Organizations Actually Need

When we talk to IT and security teams in CMMC environments, their requirements for external file sharing aren't complicated. They're not asking for e-signatures, in-browser editing, or an elaborate collaboration suite. They need:

• A simple way to send and receive files with vetted external parties
• No requirement for recipients to create new accounts or navigate complex authentication flows
• Granular controls: expiration dates, download permissions, domain whitelisting
• FedRAMP authorization — because if CUI is going to the cloud, the platform needs to be authorized
• An experience that doesn't expose access into the core Microsoft tenant

These are reasonable, well-defined requirements. The challenge is that Microsoft's own platform — the one these organizations are already paying for — increasingly struggles to meet them in a GCC High context.

Share CUI Without Opening Your Tenant

Virtru Share is FedRAMP Moderate authorized as a Virtru-managed SaaS deployment (Virtru has held FedRAMP Moderate authorization since 2019) and built specifically for secure, controlled file sharing, without the complexity of managing guest access inside your Microsoft tenant.

Send Files Without Guest Accounts

Files are encrypted at the object level using FIPS 140-3 validated encryption before they ever leave your environment. Recipients authenticate with their existing credentials (Microsoft, Google, or via email verification), so there are no new accounts and no new passwords. Your partners don’t need to change anything in their own tenant.

Keep Partner Work Moving With Virtru Collaborate

For teams that need ongoing work with partners rather than one-off file exchange, Virtru Collaborate offers secure Workspaces that are isolated from Microsoft 365 and work alongside it. External members are added by email, and audit logs can be exported as evidence for a CMMC Level 2 assessment.

Policy Controls and Audit Logging, Managed Centrally

Virtru also provides audit logging that captures every file access event, and policy-based controls that can enforce expiration, disable downloads, or block sharing to unapproved domains, all managed centrally.

Support for Your CMMC Assessment

For CMMC-scoped workflows, Virtru provides a CMMC Shared Responsibility Matrix that maps which of the 110 NIST SP 800-171 controls Virtru supports, which are shared, and which remain your responsibility, along with a pre-filled System Security Plan (SSP) template. Virtru’s support centers on the Access Control, Audit and Accountability, and System and Communications Protection families. Virtru is not a CMMC consultant, and these resources are meant to support your own assessment preparation.

Read the CMMC Shared Responsibility Matrix

Trusted in Defense and Beyond

Virtru is trusted by over 6,000 public and private sector organizations, including the U.S. Department of Defense. If your organization is running into the same walls with GCC High external sharing, we’d welcome the conversation. [Talk to a Virtru expert →]