Federal SharePoint Migration Guide: GCC, GCC-High, and DoD¶

# GCC-High SPO admin center URL
# https://agency-admin.sharepoint.us

# Connect to GCC-High SPO
Connect-SPOService -Url "https://agency-admin.sharepoint.us" -Region ITAR

# Connect PnP to GCC-High
Connect-PnPOnline -Url "https://agency.sharepoint.us/sites/sitename" `
    -AzureEnvironment USGovernmentHigh -Interactive

# DoD SPO connection
Connect-SPOService -Url "https://agency-admin.sharepoint-mil.us" -Region USGovernmentDoD

Connect-PnPOnline -Url "https://agency.sharepoint-mil.us/sites/sitename" `
    -AzureEnvironment USGovernmentDoD -Interactive

Connect-IPPSSession -ConnectionUri "https://ps.compliance.protection.office365.us" `
    -AzureADAuthorizationEndpointUri "https://login.microsoftonline.us/common"

# Create retention labels for federal records schedules
New-RetentionCompliancePolicy -Name "Federal Records Schedule" `
    -SharePointLocation All `
    -OneDriveLocation All

# Create retention label: Temporary Records (7 years)
New-ComplianceRetentionEventType -Name "RecordDisposition"

New-RetentionComplianceRule -Policy "Federal Records Schedule" `
    -Name "Temporary Records - 7 Year" `
    -RetentionDuration 2555 `  # 7 years in days
    -RetentionComplianceAction KeepAndDelete `
    -ExpirationDateOption CreationAgeInDays

# Create retention label: Permanent Records (transfer to NARA)
New-RetentionComplianceRule -Policy "Federal Records Schedule" `
    -Name "Permanent Records" `
    -RetentionDuration Unlimited `
    -RetentionComplianceAction Keep `
    -IsRecordLabel $true

# Create retention label: Vital Records
New-RetentionComplianceRule -Policy "Federal Records Schedule" `
    -Name "Vital Records" `
    -RetentionDuration Unlimited `
    -RetentionComplianceAction Keep `
    -IsRecordLabel $true `
    -IsRegulatoryLabel $true  # Cannot be removed once applied

# Create file plan descriptors matching NARA GRS
$filePlan = @{
    "GRS 5.1" = @{
        Description = "Common Office Records"
        RetentionPeriod = "6 years"
        DispositionAction = "Destroy"
    }
    "GRS 5.2" = @{
        Description = "Transitory and Intermediary Records"
        RetentionPeriod = "When no longer needed"
        DispositionAction = "Destroy"
    }
    "GRS 6.1" = @{
        Description = "Email Records"
        RetentionPeriod = "7 years"
        DispositionAction = "Destroy"
    }
}

Connect-IPPSSession -ConnectionUri "https://ps.compliance.protection.office365.us" `
    -AzureADAuthorizationEndpointUri "https://login.microsoftonline.us/common"

# Create CUI sensitivity labels
New-Label -DisplayName "CUI" `
    -Name "CUI" `
    -Tooltip "Controlled Unclassified Information" `
    -Comment "Content subject to CUI handling requirements per 32 CFR 2002" `
    -ContentType "File, Email" `
    -EncryptionEnabled $true `
    -EncryptionProtectionType Template

# CUI sub-categories
New-Label -DisplayName "CUI//SP-CTI" `
    -Name "CUI-SP-CTI" `
    -ParentId (Get-Label -Identity "CUI").Guid `
    -Tooltip "CUI Specified - Controlled Technical Information" `
    -ContentType "File, Email" `
    -EncryptionEnabled $true

New-Label -DisplayName "CUI//SP-ITAR" `
    -Name "CUI-SP-ITAR" `
    -ParentId (Get-Label -Identity "CUI").Guid `
    -Tooltip "CUI Specified - International Traffic in Arms Regulations" `
    -ContentType "File, Email" `
    -EncryptionEnabled $true

New-Label -DisplayName "CUI//SP-PRVCY" `
    -Name "CUI-SP-PRVCY" `
    -ParentId (Get-Label -Identity "CUI").Guid `
    -Tooltip "CUI Specified - Privacy" `
    -ContentType "File, Email" `
    -EncryptionEnabled $true

# Publish CUI labels
New-LabelPolicy -Name "CUI Label Policy" `
    -Labels "CUI","CUI-SP-CTI","CUI-SP-ITAR","CUI-SP-PRVCY" `
    -ExchangeLocation All `
    -SharePointLocation All `
    -OneDriveLocation All `
    -Settings @{
        "mandatory" = "true"
        "defaultlabel" = "CUI"
    }

# Auto-detect and label CUI content in migrated SharePoint sites
New-AutoSensitivityLabelPolicy -Name "CUI Auto-Detection" `
    -SharePointLocation All `
    -OneDriveLocation All `
    -ApplySensitivityLabel "CUI" `
    -Mode TestWithNotifications

# CUI keyword detection rule
New-AutoSensitivityLabelRule -Policy "CUI Auto-Detection" `
    -Name "CUI Banner Detection" `
    -ContentContainsSensitiveInformation @{
        Name = "U.S. Social Security Number (SSN)"
        MinCount = 1
    } `
    -HeaderMatchesPatterns @("CUI", "CONTROLLED", "FOUO", "FOR OFFICIAL USE ONLY")

Import-Module Microsoft.SharePoint.MigrationTool.PowerShell

# GCC connection
Register-SPMTMigration `
    -SPOUrl "https://agency.sharepoint.com" `
    -SPOCredential (Get-Credential) `
    -Environment GCC `
    -Force

# GCC-High connection
Register-SPMTMigration `
    -SPOUrl "https://agency.sharepoint.us" `
    -SPOCredential (Get-Credential) `
    -Environment GCCHigh `
    -Force

# Configure Entra ID (Azure AD) for certificate-based authentication
# This is configured in the GCC-High/DoD Entra portal

# Users authenticate to SPO using their CAC/PIV certificate
# No password-based authentication for privileged access

# PnP PowerShell with certificate authentication (GCC-High)
Connect-PnPOnline -Url "https://agency.sharepoint.us/sites/sitename" `
    -ClientId $clientId `
    -Thumbprint $certThumbprint `
    -Tenant "agency.onmicrosoft.us" `
    -AzureEnvironment USGovernmentHigh

# Require compliant device + MFA for SPO access
# Configure in GCC-High Entra ID portal (portal.azure.us)

# Typical federal Conditional Access policies:
# 1. Require MFA for all users accessing SPO
# 2. Require compliant (Intune-managed) device
# 3. Block access from non-US locations
# 4. Require CAC/PIV for privileged roles
# 5. Block legacy authentication protocols