Microsoft 365 G7 vs G5 for GCC: 12 of 26 Agent 365 Capabilities

Microsoft 365 G7, the government version of the E7 "Frontier Suite," became available to eligible GCC customers on October 1, 2026, with more purchasing options on November 1. If you run a GCC tenant, you're probably getting the pitch now.

I haven't tested G7 in a tenant. I read Microsoft's announcement and the Agent 365 service description, which has a GCC column for every capability. The short version: the bundle is real, but the service description lists 26 Agent 365 capabilities, and 12 of them are available in GCC. None of the Purview controls for agents are.

What G7 is

G7 is built on G5's productivity, security, and compliance stack and adds three things, per Microsoft's announcement:

• Copilot grounded by Work IQ, with the Researcher and Analyst agents, Agent Builder, Copilot Studio for custom agents, and Copilot connectors.
• Entra Suite, for identity, access governance, and network security for users and agents.
• Agent 365, the control plane for discovering, governing, and securing agents.

Microsoft lists several features as coming in the months after GA: newer GPT models, Work IQ memory and personalization, Edit with Copilot in Word, Excel, and PowerPoint, and Copilot Cowork. Capabilities roll out in phases as services complete GCC authorization milestones, so plan on those arriving later, not on day one.

G7 doesn't change what G5 already gives you. Everything G5 licenses today stays the same.

The Agent 365 gap in GCC

This is the part that decides whether G7 is worth it now. The Agent 365 service description has three columns that matter: included with base plans, requires E7, G7, or Agent 365, and available in GCC.

Available in GCC (12): the agent registry, basic governance actions, conditions-based lifecycle rules, syncing agents from external platforms, policy templates, observability and monitoring, tenant-wide control of which tools and MCP servers agents can use, Entra access packages for agents, Entra lifecycle policies, conditional access and identity protection for agents with delegated access, Defender's unified agent observability logs, and Intune device compliance for agent conditional access.

Not available in GCC (14): every Purview capability for agents. That's audit logs and eDiscovery, data lifecycle management, compliance review, DSPM with AI observability, insider risk, sensitivity label inheritance, and DLP. Also missing are three of four Defender capabilities (shadow AI agent sync, misconfiguration and exposure mapping, and detection with tool-call blocking), the Entra network traffic controls for agents, the Graph API for the registry, and two Intune controls for local agents.

The four capabilities at the top of that table, registry, basic governance, lifecycle rules, and external sync, are marked as included with Microsoft 365 Enterprise, Business, Education, and Frontline plans. A G5 tenant already has them. So, of the twelve that work in GCC, eight are what G7 actually adds for agents.

Directions on Microsoft reads the same gaps as a production problem: without audit, DLP, threat detection, and runtime controls, higher-risk agents are hard to approve. Two more caveats sit on the service description itself. Agent 365 meets all FedRAMP High controls reviewed by Microsoft's third-party assessor as of October 1, but final authorization by the accrediting agency is pending. And Directions reports that G7 reached only the lowest GCC tier; GCC High and DoD customers will wait until closer to the end of 2026.

What it costs

Microsoft hasn't published a G7 price. The commercial reference point is E7 at $99 per user, with Agent 365 alone at $15.

For the G5 baseline, one partner's CSP list, synced October 1, shows G5 GCC at $60 per user per month on annual billing, $63 for an annual term paid monthly, and $72 month to month. That's one reseller's list, not Microsoft's, so treat it as a starting point and get a G7 quote from your account team or partner.

How to decide

Here's the order I'd work through before signing anything:

1. Write down what you need agents to do and what you need to prove about them. Audit, eDiscovery, DLP, and label inheritance are the usual compliance asks.
2. Mark each requirement against the GCC column of the service description. If a must-have is a "No," G7 won't deliver it in GCC today, whatever the bundle includes in commercial.
3. Check what G5 already gives you. The registry and basic governance are in the Microsoft 365 admin center with your current license. Use them to inventory agents before you pay for more.
4. Price the bundle against the parts you'd actually use. If you already pay for Copilot and Entra Suite separately, G7 may cost less and simplify licensing. If you only want Copilot, the bundle buys you capabilities you can't use in GCC yet.
5. If you need agent audit trails now, restrict agents instead. Use basic governance to block or limit agents, and the tool access controls to keep them away from sensitive MCP servers, until the Purview rows turn to "Yes."

The honest counterpoint: Microsoft says capabilities arrive as GCC authorization milestones complete, so this table is a snapshot, not a verdict. It's also the only snapshot that matters on the day you sign.

The takeaway

G7 in GCC is a real bundle with a large hole where the compliance controls for agents should be. Directions on Microsoft's verdict is "G7 is not worth your investment, yet," and the service description backs that up for anyone whose case rests on agent audit or DLP. If your case is Copilot plus simpler licensing, the math may work today.

Before your next licensing call, open the service description and count the missing rows. Which of the fourteen does your program actually need?