CUI Safe AI

Vendor questions

Is Microsoft Copilot FedRAMP authorized?

Short answer

It depends on which Copilot. Of the 4 Microsoft 365 Copilot versions we track, 2 are FedRAMP authorized (Microsoft 365 Copilot in GCC High: High; Microsoft 365 Copilot in GCC (Moderate): Moderate), 1 is not authorized (Microsoft 365 Copilot (commercial cloud)) and 1 has an unclear status (Microsoft 365 Copilot in DoD environment).

Microsoft says GCC High is the environment for organizations handling CUI or needing FedRAMP High, DFARS or ITAR, and that Copilot prompts and responses stay in the government tenant. For CUI, the ones with a "Yes, with conditions" answer are Microsoft 365 Copilot in GCC High and Microsoft 365 Copilot in DoD environment.

GitHub Copilot is a separate product and is not FedRAMP authorized. GitHub says Copilot itself will become FedRAMP authorized as part of GitHub Enterprise Cloud with data residency's authorization path, so it is not authorized today.

Generated from our dataset. Sources last re-checked Oct 17, 2026.

The sourced table

AI offeringFedRAMPDoD ILCan I use it with CUI?Source
Microsoft 365 Copilot in GCC HighMicrosoft · Productivity suite AIAuthorizedHighNot stated for CopilotYes, with conditionsfedramp.govchecked Oct 17, 2026
Microsoft 365 Copilot in GCC (Moderate)Microsoft · Productivity suite AIAuthorizedModerateNot establishedUnclearfedramp.govchecked Oct 17, 2026
GitHub Copilot Business and EnterpriseGitHub (Microsoft) · Coding agentNot listedNone for CopilotNot establishedNofedramp.govchecked Oct 17, 2026
Microsoft 365 Copilot (commercial cloud)Microsoft · Productivity suite AINot listedNoneNot establishedOnly in a separate environmentfedramp.govchecked Oct 17, 2026
Microsoft 365 Copilot in DoD environmentMicrosoft · Productivity suite AIUnclearNot separately listedIL5 (environment)Yes, with conditionslearn.microsoft.comchecked Oct 17, 2026

Every row links to its primary source and full page. Statuses change; open the source before you decide. How we verify.

Related questions

Is Microsoft 365 Copilot in GCC High FedRAMP authorized?

Runs in Microsoft 365 GCC High, FedRAMP Certified Class D (High) since 2024-12-26. Microsoft says GCC High is the environment for organizations handling CUI or needing FedRAMP High, DFARS or ITAR, and that Copilot prompts and responses stay in the government tenant.

Can I use Microsoft 365 Copilot in GCC with CUI?

Unclear. GCC is FedRAMP Moderate, which matches the baseline DFARS 252.204-7012 names on paper. But Microsoft's own guidance sends organizations that handle CUI, or need DFARS or ITAR compliance, to GCC High. Ask your assessor before putting CUI in GCC.

Is commercial Microsoft 365 Copilot FedRAMP authorized?

The government clouds are listed separately; commercial Microsoft 365 is not. Commercial Microsoft 365 Copilot runs outside the government cloud environments. Microsoft directs CUI holders to GCC High.

Is GitHub Copilot FedRAMP authorized?

GitHub Enterprise Cloud is Certified at Class B (Low/LI-SaaS); GitHub says Copilot itself is not yet authorized. GitHub says Copilot itself will become FedRAMP authorized as part of GitHub Enterprise Cloud with data residency's authorization path, so it is not authorized today.

Not legal advice. These answers describe what public authorization records and vendor documentation say, not whether your contract, data or configuration is compliant. Confirm with your contracting officer, assessor or counsel.

More questions

All questions