Skip to content
Documentation

Microsoft 365 & Azure

What this guide covers

How to actually buy Microsoft 365 licensing and Azure cloud for a Maryland agency — which statewide vehicle you ride (this is the rare tool that does not primarily ride Carahsoft), which reseller fulfills the order, the FedRAMP/ATO path across the commercial and government clouds, and the functionality gates to clear before you sign.

Who it’s for

Engineering leads, program staff, and procurement officers at a Maryland State agency or education entity who have decided they need Microsoft 365 productivity, Azure infrastructure, or both, and need the path from “we want it” to “it’s authorized and on contract.”

Part of the SaaS Catalog. For the vehicles themselves, see Maryland Master Contracts; for the process and thresholds, see Maryland Procurement.

Disclaimer. Not legal or procurement advice. FedRAMP authorizations, contract catalogs, and BPO numbers change as awards are renewed and authorizations are re-baselined. Verify every figure below against the FedRAMP Marketplace, the live Microsoft government compliance docs, and the DoIT Statewide Contracts hub before relying on it. The exact Microsoft 365 government baseline (Moderate vs. GCC High) is in particular not settled in the facts below — see Authorization and ATO.

TL;DR

  • Category: Cloud platform — Microsoft 365 productivity (Exchange, SharePoint, Teams) plus Azure IaaS/PaaS.
  • Maryland vehicle: ICPA — Microsoft Licensing Packages, BPO 001B5600254, via OMNIA Partners, reseller SHI. Microsoft is also reachable on COTS 2012 (BPO 060B2490021).
  • Reseller: SHI (primary, via the OMNIA ICPA); Insight and CDW-G are alternates.
  • Authorization: Azure commercial is FedRAMP High (JAB P-ATO); Azure Government is FedRAMP High + DoD IL2/IL4/IL5. The exact M365 government level is UNVERIFIED — confirm the specific package on the live Marketplace.
  • The ATO trap: only M365 GCC High meets ITAR/export-controlled CUI and DoD requirements. Commercial and GCC-Moderate M365 do not. Azure Government is a separate cloud from commercial Azure.

What This Tool Is

Microsoft 365 and Azure are two products bought as one relationship: M365 is the managed productivity suite (Exchange Online, SharePoint, Teams, the Office apps), and Azure is the IaaS/PaaS cloud (compute, storage, networking, managed databases). Agencies reach for them when they want Microsoft’s integrated identity-plus-productivity-plus-infrastructure stack rather than assembling it themselves. The self-hostable infrastructure alternative is the Kubernetes/Postgres/MinIO stack from Tools and Software → Infrastructure, but that substitutes only for the Azure IaaS layer — there is no drop-in OSS swap for the M365 productivity suite, so for most agencies this is a procurement-and-ATO exercise, not a build-versus-buy one.

Which Maryland Vehicle

VehicleBPOHow Microsoft rides it
ICPA — Microsoft Licensing Packages (via OMNIA Partners)001B5600254The primary path. A Maryland Intergovernmental Cooperative Purchasing Agreement riding OMNIA Master Agreement 2024056-02 (Lead Agency City of Mesa AZ). Award 2025-08-27; term 2025-09-29 to 2028-07-01. Reseller SHI fulfills.
COTS 2012060B2490021An alternative path — Microsoft is also reachable on the Carahsoft-era COTS master contract. Compare ceiling pricing and terms before choosing.

This is the rare tool that does not primarily ride Carahsoft — the OMNIA ICPA via SHI is the default Microsoft vehicle. Which vehicle you ride affects ceiling pricing, terms, and which approvals apply — see Maryland Master Contracts → Where Carahsoft Fits for how the same publisher can sit under more than one vehicle.

Resellers and Pricing Path

SHI is the primary reseller holding the Maryland Microsoft award through the OMNIA ICPA (BPO 001B5600254); Insight and CDW-G are common alternates. You do not buy an “SHI contract” — SHI fulfills your order against the ICPA. Request a quote referencing BPO 001B5600254 so the order is priced against the cooperative ceiling rather than commercial list price. Microsoft licensing is seat- and tier-metered (per-user E3/E5, plus Azure consumption that is usage-metered), so size both the seat count and the expected Azure spend before you ask — and revisit, because consumption-based Azure bills drift upward.

Authorization and ATO

OfferingFedRAMP / DoD statusMarketplace ID
Azure (commercial / global)FedRAMP High (JAB P-ATO)confirm on Marketplace
Azure GovernmentFedRAMP High + DoD IL2/IL4/IL5confirm on Marketplace
Microsoft 365 GCCMarketplace classifies this package as Moderate; Microsoft’s own docs sometimes label it “GCC High” — treat the exact M365 government level as UNVERIFIEDMSO365MT
Microsoft 365 GCC High (separate offering)FedRAMP HighFR1824057433

The single thing to get right for the ATO: only M365 GCC High meets ITAR / export-controlled CUI and DoD requirements — commercial M365 and GCC-Moderate M365 do not. And Azure Government is a separate cloud from commercial Azure, with separate tenancy and endpoints; a commercial Azure subscription does not inherit the Azure Government authorization. Because the Marketplace classifies the MSO365MT GCC package as Moderate while Microsoft documentation sometimes calls it “GCC High,” confirm the specific package’s government impact level on the live FedRAMP Marketplace listing against your system’s data classification before you commit. Do not rely on the package name alone.

Functionality Gates to Verify

Clear these before price comparison — any one can disqualify the buy regardless of cost. See the canonical list in Tools and Software → Enterprise Functionality.

GateMicrosoft-specific note
SSO (SAML/OIDC) + SCIMNative — Entra ID (formerly Azure AD) is the identity provider, with SCIM provisioning built in.
Audit logsAvailable via Microsoft Purview; confirm retention meets your records policy at your tier.
RBACGranular roles across Entra, M365, and Azure; map to least-privilege before rollout.
Data residency / FedRAMP boundaryThe government clouds (Azure Government, M365 GCC/GCC High) are the residency answer — see above, and confirm the specific package’s boundary.
Accessibility (VPAT/ACR)Request Microsoft’s current VPAT; Maryland’s Nonvisual Access (NVA) requirement applies to the procurement.
BAA / DPAAvailable; required if any data could carry PII/PHI — confirm for the specific government offering you buy.

Procurement Steps

  1. Confirm the need over the alternative. Azure IaaS overlaps the self-hostable Kubernetes/Postgres/MinIO stack ($0 license); M365 productivity has no OSS drop-in. Document why managed is worth the spend — that rationale is the core of the budget justification.
  2. Register / confirm eMMA. Your agency and the reseller must be set up in eMMA.
  3. Pick the vehicle. Default to the OMNIA ICPA, BPO 001B5600254, via SHI; compare COTS 060B2490021 if its terms suit you better.
  4. Get an SHI quote referencing the BPO, sized to your seat count and expected Azure consumption, for the specific government offering you need (Azure Government and/or M365 GCC High).
  5. Check the threshold. The order’s dollar value drives the method. See Maryland Procurement → how the value picks the path. Do not split a buy to dodge a threshold.
  6. Run the ATO package. Inherit the FedRAMP/DoD controls for the specific boundary you bought — and verify the M365 government level first, because the package name and the Marketplace classification disagree.
  7. Issue the order against the vehicle once approvals clear.

Sources

ClaimSource
Azure / Azure Government FedRAMP & DoD audit scopeMicrosoft Learn — Azure services in FedRAMP audit scope
Microsoft 365 GCC package (classified Moderate on Marketplace)FedRAMP Marketplace — MSO365MT
Microsoft 365 GCC High (FedRAMP High)FedRAMP Marketplace — FR1824057433
Maryland Microsoft licensing ICPA (BPO 001B5600254)DoIT — ICPA Microsoft Licensing Packages

The exact M365 government impact level (Moderate vs. GCC High) is unverified in the facts compiled here — the Marketplace classifies MSO365MT as Moderate while Microsoft’s docs sometimes label it “GCC High.” Confirm the specific package against the live Marketplace listing before relying on any figure here.