Microsoft 365 F3 GCC
Included products
Derived from the service plans Microsoft provisions with this SKU — Microsoft publishes no product-in-bundle mapping.
What's included
Curated capability groupings first, then every remaining service plan Microsoft provisions with this SKU — together they're the complete list, nothing is hidden.
| Identity |
|---|
| Conditional Access Advanced identity and access management: Conditional Access, group-based access management, and self-service password reset with on-premises write-back. Enforce sign-in rules (require MFA, block legacy auth, require a compliant device, restrict by location) based on user, app, and risk signals. |
| Multi-Factor Authentication Requires a second sign-in verification step (phone call, SMS, or app notification) in addition to a password. |
| Self-Service Password Reset With on-premises writeback (Entra ID P1) Advanced identity and access management: Conditional Access, group-based access management, and self-service password reset with on-premises write-back. Let users reset or unlock their own account without a help desk call. Basic cloud-only SSPR is available broadly; on-premises writeback (syncing the reset back to Active Directory) requires Entra ID P1. |
| Device Management |
| Intune Device Management Cloud-based mobile device and application management — enroll, configure, and enforce compliance policies on company and personal devices. Enroll, configure, and manage Windows, iOS, Android, and macOS devices: compliance policies, app deployment, and remote wipe. |
| Windows Autopilot Cloud-based mobile device and application management — enroll, configure, and enforce compliance policies on company and personal devices. Provision and configure new Windows devices out of the box, straight from the cloud, with no imaging. Autopilot itself has no separate license line item — it’s an Intune-dependent deployment workflow, mapped here to Intune Plan 1 as the plan that actually enables managing the enrolled device afterward. |
| BitLocker Management Cloud-based mobile device and application management — enroll, configure, and enforce compliance policies on company and personal devices. Centrally enforce BitLocker drive encryption policy and escrow recovery keys. BitLocker itself ships with Windows Pro/Enterprise; cloud-based policy and key escrow specifically need Intune, mapped here as the enabling plan since there’s no dedicated BitLocker-management license line item. |
| Other service plans |
| Azure Information Protection Premium P1 for GCC |
| Azure Rights Management · RMS_S_ENTERPRISE_GOV Encrypts and applies usage restrictions (view-only, no-forward, expiration) to documents and email so protection travels with the file. |
| Common Data Service - O365 F1 |
| Common Data Service for Teams_F1 GCC |
| Exchange Online (Kiosk) for Government |
| Forms for Government (Plan F1) |
| Microsoft Search Unified search across Microsoft 365 apps and connected data sources, including third-party content via Graph connectors. |
| Microsoft Stream for O365 for Government (F1) |
| Microsoft Teams for Government |
| Mobile Device Management for Office 365 Basic mobile device management for Office 365 apps and data — PIN/encryption enforcement and remote wipe of company data, without a full Intune deployment. |
| Office 365 Planner for Government |
| Office for the Web for Government Browser-based versions of Word, Excel, PowerPoint, and OneNote for viewing and editing documents without installing desktop apps. |
| Office Mobile Apps for Office 365 for GCC |
| Power Apps for Office 365 F3 for Government |
| Power Automate for Office 365 F3 for Government |
| SharePoint KioskG |
| Skype for Business Online (Plan 1) for Government |
| To-Do (Firstline) |
| Whiteboard (Firstline) |
Conditional Access
Multi-Factor Authentication
Intune Device Management