Notes on a project from winter 2023-24, when I was global sysadmin at Infoblox.

Two of everything

Federal work cannot live in the commercial tenant. GCC High exists because DoD and ITAR-adjacent requirements need data residency and personnel controls that standard Microsoft 365 does not provide.

Day to day that means two of everything:

  • two tenants
  • two identity boundaries
  • two device management stacks (Intune on both sides, Jamf Connect for the Macs)
  • two imaging paths
  • two sets of admin credentials, with nothing shared

I built and ran the federal side for about 60 users on Windows and Mac.

The part people expect to be hard

The technology, mostly, and it is not. GCC High Intune is Intune. Jamf Connect pointed at a federal tenant behaves like Jamf Connect. If you can run the commercial versions you can run these.

There are wrinkles. Feature parity lags commercial, so some things land later and some never land, and you learn to check availability before promising anything. Documentation is thinner and more of it is out of date. None of that is the real problem.

The part that is hard

Every shortcut available to you is the thing you are not allowed to take.

You have a working commercial environment right there, with a golden image already built, policies already tuned and an enrollment flow that already works. Every time something breaks on the federal side, the fastest fix is to reach over and reuse a piece of it.

Reusing it is the compliance failure. Nothing errors and it would work perfectly, which is what makes it dangerous. The convenient path and the wrong path are the same path and there is no friction on it.

What that meant in practice:

  • Federal Windows machines got their own custom ISO images and install media, built for that environment, never provisioned from the commercial deployment path.
  • Federal Macs enrolled through Jamf Connect bound to the federal tenant, so they authenticated against federal identity from first boot and never touched the commercial directory.
  • I administered both tenants, with no shared credential or policy object between them.

The result was zero audit findings across two consecutive review cycles. The build was not clever. The boundary held.

What it taught me

Compliance discipline is procedural. I could have drawn the architecture on day one. Holding it for months, under time pressure, with a working shortcut within reach, is the actual skill. Nobody audits intentions.

“It would have worked” is not a defense. This failure mode never announces itself. There is no alert for a federal laptop provisioned from a commercial image. You find out in an audit, or you never find out, and the finding is that nobody found out.

Separation you maintain by hand will eventually fail. The parts I trusted were structural: a different tenant, different enrollment media, different credentials. The parts that depended on me remembering were the ones that would have slipped. Anywhere the two environments could touch, eventually they would have.

The last one generalizes past federal work. A boundary enforced by discipline alone has a half-life. If it matters, make the wrong thing hard to do instead of just forbidden.