Agile IT

100% Unapologetically Focused on the Microsoft Cloud

[Agile IT @Agile_IT]

The tenant is the expensive decision. Conditional access, retention, and sensitivity labels are all reversible. The cloud they run inside is not.

Microsoft documents Government Community Cloud (GCC) and GCC High as separate environments carrying different commitments and different applicability to compliance frameworks.

Getting it wrong is not a configuration change or a ticket with Microsoft. It is a tenant migration: users, mailboxes, files, identity, and every integration built on top, on a schedule someone else set.

Confirm the environment decision holds against the clause before the tenant exists.

What is your migration estimate if the answer turns out to be the other cloud?

#GCCHigh #Microsoft365 #CUI

[Agile IT @Agile_IT]

Before the CMMC review ends, decide which assumptions you want to stop carrying forward.

Maybe the CUI boundary was set before the current Microsoft architecture existed.

Maybe the System Security Plan still describes last year's tenant.

Maybe a control works because one administrator knows exactly why it was configured that way, and the reasoning stops with that person.

Those are useful problems to find while the timetable is unsettled because resolving them doesn’t require knowing the final shape of CMMC.

They require knowing your own environment.

If you want to use the current window to pressure-test your Microsoft environment against the scope, evidence and governance behind it, Agile IT can help. Link in the comments.

Which assumption would you most want resolved before the next CMMC announcement arrives?

#CMMC #Microsoft365 #CUI

[Agile IT @Agile_IT]

The best use of this CMMC review period is reconciliation.

Take the System Security Plan and put it beside the asset inventory.

Then put both beside the network diagram and the Microsoft environment that exists today.

Find out where those documents are aligned and where they’re breaking down.

Did a workload move? A shared mailbox appear? Ownership change? An exception become permanent?

Those are ordinary operational changes, but they become expensive when they surface during assessment preparation and turn into architecture or evidence rework.

Use this time to get clear on those things (and if you need help, reach out to us through the link in the comments)

When was the last time someone compared your assessment artifacts against the live tenant rather than reviewing each artifact by itself?

#CMMC #Microsoft365 #NIST800-171

[Agile IT @Agile_IT]

A smaller CMMC scope can reduce work. An unsupported scope can create considerably more of it.

Organizations have legitimate reasons to contain where controlled information moves. An enclave makes the work more manageable.

The key is making sure whatever boundary you use, it reflects the real data flow.

Once CUI leaves the intended path through a mailbox, application, user workflow, or connected system, the architecture and the documentation need to account for what happened.

That’s why scope design belongs upstream of remediation and Microsoft environment decisions.

We cover the relationship in more detail here:
https://t.co/BmVRrYWTI8

If your organization is considering an enclave, GCC High migration, or another scope-reduction strategy, Agile IT can help test the boundary before the architecture gets expensive to unwind.

Where could CUI leave your intended path today?

#CMMC #CUI #GCCHigh

[Agile IT @Agile_IT]

A smart CMMC budget accounts for the work required to get and stay compliant (not just allot for the assessment itself).

Scope: determines how much of the environment you're paying to bring into scope and maintain (also means a lot at assessment time).

Architecture: can mean migration, enclave design, Azure consumption, or changes to the existing Microsoft environment.

Implementation/remediation: requires engineering time to configure or correct controls.

Documentation and evidence: requires staff or outside resources to create and maintain the assessment record.

Ongoing operations: requires ownership after the initial project because the environment keeps changing.

A smart CMMC budget identifies the labor, technology, and recurring work that's required.

#CMMC #Microsoft365 #NIST800-171

[Agile IT @Agile_IT]

Good preparation during regulatory uncertainty has one useful property: the work survives more than one outcome.

A defensible CUI boundary has value. Period.

So does an accurate System Security Plan.

These are the pieces you need in place no matter what happens with the CMMC pause because they address the obligation you have to the environment itself.

The DoW has said Phase I self-assessment requirements remain in place during its review (https://t.co/Bp26IQZi1k) , meaning contractors remain obligated to safeguard covered defense information under DFARS 252.204-7012. (https://t.co/iF6ToeEni5.?utm_source=https://t.co/1TnvITz64s)

If you want to use this period to test which parts of your Microsoft and CMMC plan hold regardless of the policy outcome, Agile IT can help review those assumptions (link in the comments).

Which part of your current plan depends most heavily on CMMC staying exactly as previously written?

#CMMC #DFARS #Microsoft365

[Agile IT @Agile_IT]

The DoW's July announcement named the priorities behind the review (lowering barriers, reducing compliance cost, and finding cybersecurity measures that can scale across the Defense Industrial Base). (Check out the announcement here if you haven’t seen it: https://t.co/eXYYvLwxZ5)

When the DoW publishes its next move, the important details will be the mechanics: what gets assessed, who does the assessing, how validation works, what changes for contractors at different levels, and which requirements remain connected to existing contract clauses.

Those details affect planning in real life. The volume of LinkedIn predictions does not.

Until then, don’t follow the lax train. Get your environment CMMC compliant so when everyone is playing catch up, you’re ahead.

How are you using the 60-day review period?

#CMMC #NIST800-171 #DFARS

[Agile IT @Agile_IT]

The Microsoft admin center shouldn’t be the only place where a control makes sense.

Your tenant changes constantly.

Someone adjusts Conditional Access. A vendor receives an exception. Ownership moves to another team. An application keeps legacy authentication longer than planned. Your tenant is NOT static.

Months later, the technical setting may still work but the documentation describes an earlier version of the environment.

That creates rework at exactly the wrong time: when people are already reconciling the System Security Plan evidence and live configuration for review.

Our assessment article looks at that gap from the Microsoft side:

https://t.co/aNwHvpF7RR

Agile IT can help compare the configuration being operated today with the decisions and evidence expected to support it.

Where would your documentation disagree with the tenant if you compared them this week?

#CMMC #Microsoft365 #NIST800-171

[Agile IT @Agile_IT]

A control can work perfectly and still fail an assessment.

Consider a Conditional Access exception.

Microsoft Entra can enforce the policy exactly as configured. The harder part arrives when someone asks why that exception exists, who approved it, and whether the current System Security Plan reflects the decision.

The setting answers one question.

The decision record answers another.

Over time, Microsoft environments collect exceptions like ownership changes and configuration decisions that make operational sense (but don’t support compliance).

Assessment preparation exposes the policies and controls that never made it back into the governance record.

That is one of the patterns we unpacked here:

Blog: Where CMMC Assessments Break Down in Microsoft Environments
https://t.co/aNwHvpF7RR

Pick one long-running exception in your tenant. Could someone outside the team reconstruct why it exists from the evidence alone?

#CMMC #Microsoft365 #MicrosoftEntra

[Agile IT @Agile_IT]

Want to save yourself time and money on your CMMC compliance? Map how your CUI is stored, processed, and transmitted before you build your environment.

Your boundary decisions influence identity, access, logging, user provisioning, data movement and the environment used to support the workload. When the boundary changes later, the correction can reach into the architecture rather than staying inside a document.

Our latest article walks through the sequence in detail, including why the data boundary needs to come before the Microsoft environment decision.

Click here to see it: What Counts as CUI in Microsoft 365 and Azure Government https://t.co/BmVRrYWTI8

If your organization made its CUI scope decision before the current architecture took shape, this is a good time to compare the two again.

Agile IT can help pressure-test the boundary and the Microsoft decisions built on top of it.

Would the same scope decision still be made with what you know about the environment today?

#CMMC #CUI #AzureGovernment

[Agile IT @Agile_IT]

Smart organizations are often resourceful. The current CMMC L2 pause gives you a unique opportunity to get ahead.

Instead of staying in limbo to see what happens, use the CMMC pause to check your scope and lock in the decisions that are expensive to walk back.

Weak boundaries become expensive problems.

Take the time now to track where CUI enters the environment, where it moves, and if any new systems have become part of that path since the original scope design.

Check out our blog on how CUI scope shapes Microsoft 365 and Azure Government decisions here:
What Counts as CUI in Microsoft 365 and Azure Government

https://t.co/BmVRrYWTI8

Which part of your CUI boundary has gone the longest without being reviewed?

#CMMC #CUI #Microsoft365

[Agile IT @Agile_IT]

Azure Virtual Desktop now runs in US Gov Texas for Azure Government. Deploy host pools in-region to cut latency, improve connection performance, and add another compliant Gov region to meet mission and placement requirements.

Read more: https://t.co/xE7VTFfFLd

[Agile IT @Agile_IT]

The Microsoft Copilot data connector for Microsoft Sentinel is now in public preview—bringing Copilot activity logs directly into Sentinel for threat detection, hunting, and SOC visibility across your tenant.

Read more: https://t.co/YTpkF2QWFz

[Agile IT @Agile_IT]

Viva Engage communities are now built into Microsoft Teams (public preview), making it easier to engage in company-wide conversations, discover communities, and share knowledge—without leaving the flow of work.

Read more: https://t.co/wOCfhPaxU2

[Agile IT @Agile_IT]

Connect Dataverse to Microsoft Sentinel to gain centralized visibility, detect risky Power Platform activity faster, and automate response—all from one SIEM.

Read more: https://t.co/luodmnWABY

[Agile IT @Agile_IT]

Excel’s Jan 2026 update boosts productivity: Agent Mode is GA (Windows) and rolling out (Mac), Power Query is GA on the web, and Office Scripts now save + email PDFs.

Read more: https://t.co/jWZQHN53DP

[Agile IT @Agile_IT]

Microsoft Purview Data Security Investigations (DSI) is now generally available, giving security teams an AI-driven way to find, analyze, and remediate data risks across Microsoft 365 without manual file-by-file review.

Read more: https://t.co/Gcsk9FK2Zv

[Agile IT @Agile_IT]

SSMS 22.2.1 ships key bug fixes and adds GitHub Copilot code completions in the query editor, using database context to improve T-SQL suggestions.

Read more: https://t.co/VXHeupSY7X

[Agile IT @Agile_IT]

Microsoft expands access to Microsoft Places and brings more Teams town hall/webinar features to more licenses starting April 1, 2026.

Read more: https://t.co/UMWsDPTzl0

[Agile IT @Agile_IT]

Azure released Bicep-based Azure Verified Modules (AVM) for Platform Landing Zone as generally available, giving you a modular, fully customizable Azure Landing Zones setup built entirely on Microsoft-supported AVM modules.

Read more: https://t.co/5ArJXHwzYd