Government agencies run a lot on SharePoint: documents, records, intranets and the everyday forms staff submit. So supporting it takes more than a help line. SharePoint has to stay inside a Microsoft government cloud or on your own servers, meet federal and state rules, and run on a version Microsoft still backs. This guide is for US federal, state, local and tribal agencies, and it flags which rules apply only to federal or defense environments.
What SharePoint Support Covers for a Government Agency
The federal government spends over $100 billion a year on information technology (IT). Agencies have typically put about 80% of that toward running and maintaining the systems they already have, according to the U.S. Government Accountability Office (GAO).
For SharePoint, that day-to-day support splits three ways.
| Who provides it | What they cover | What to watch for |
|---|---|---|
| Microsoft | The platform: SharePoint Online in its government clouds, and security updates for supported SharePoint Server versions | Microsoft’s customer support for its government clouds sits outside their accreditation boundary, so Microsoft advises against sharing controlled information in support cases |
| Your IT team or an implementation partner | Setup, permissions, upgrades and migrations | Hands-on experience with your environment, such as GCC High or an air-gapped network |
| App vendors | The forms, workflows, help desks and request systems you run on SharePoint | Where each app runs and where it stores your data |
Which of these matters most depends on where your SharePoint runs.
SharePoint Options for Government Agencies Compared
Microsoft offers SharePoint Online in three US government clouds. For agencies that run SharePoint on their own servers, Microsoft offers SharePoint Server Subscription Edition.
| Option | Who it’s for | Microsoft’s security baseline | Who runs the servers |
|---|---|---|---|
| GCC | US federal, state, local and tribal governments, plus contractors handling data for them. Not for data covered by the International Traffic in Arms Regulations (ITAR), which needs GCC High | Federal Risk and Authorization Management Program (FedRAMP) High; DoD Impact Level 2 | Microsoft |
| GCC High | Eligible non-DoD organizations, such as contractors holding DoD controlled unclassified information (CUI) or data covered by ITAR | FedRAMP High; designed around DoD Impact Level 4 controls | Microsoft |
| Microsoft 365 DoD environment | DoD organizations only | Designed for DoD Impact Level 5 | Microsoft |
| SharePoint Server Subscription Edition | Agencies that keep SharePoint on their own servers, including air-gapped networks isolated from the internet | Set and maintained by your agency | Your agency |
- These baselines apply to Microsoft’s in-scope services, and Microsoft checks each organization’s eligibility before it sets up a government cloud.
- For more on the cloud options, read our guide to Microsoft 365 GCC High.
Federal and state rules then decide what you need to check in each environment.
Rules That Shape SharePoint Support in Government
| Requirement | Applies to | What it means for SharePoint support |
|---|---|---|
| FedRAMP (a federal cloud authorization program) | Federal agencies using cloud services | Microsoft’s in-scope services in GCC and GCC High, including SharePoint Online, hold authorities to operate (ATOs) from US agencies. Your agency reviews Microsoft’s FedRAMP documentation to issue its own ATO. |
| Criminal Justice Information Services (CJIS) Security Policy (a security policy from the Federal Bureau of Investigation, or FBI) | Law enforcement and criminal justice agencies | The FBI doesn’t certify cloud services. Microsoft signs CJIS agreements with state CJIS authorities, covering agencies in 47 states and the District of Columbia, and lists SharePoint Online in GCC as in scope. |
| ITAR (export-control regulations) and CUI (a category of sensitive government information) | Agencies and contractors handling export-controlled data or DoD CUI | Microsoft designed GCC High to support these requirements. |
| Section 508 (federal accessibility law) | Federal agencies | Technology that agencies develop, buy, maintain or use must be accessible to people with disabilities. Agencies are encouraged to ask vendors for an Accessibility Conformance Report (ACR) before buying. |
| Records retention | Federal agencies (National Archives and Records Administration rules); state and local agencies (state records laws) | SharePoint content, and records kept in apps on SharePoint, need to follow your retention schedules. |
Microsoft’s 2026 retirements add one more thing to plan for.
SharePoint Support Changes in 2026
The changes differ for on-premises SharePoint and SharePoint Online.
On-premises SharePoint
- SharePoint Server 2016 and 2019 reached end of support on July 14, 2026, as did the InfoPath 2013 and SharePoint Designer 2013 products. Microsoft no longer provides security updates or assisted support for them.
- SharePoint Server Subscription Edition is still supported, but Microsoft ended support for InfoPath Forms Services and SharePoint 2010 workflows in it on the same date.
SharePoint Online
- SharePoint 2013 workflows and SharePoint Add-ins in SharePoint Online were retired on April 2, 2026. Microsoft confirmed both retirements apply to its government clouds, including the Microsoft 365 DoD environment.
- InfoPath Forms Services in SharePoint Online reached end of support in July 2026, and Microsoft began turning off SharePoint Alerts in mid-July 2026.
Still on 2016 or 2019? See our guides to SharePoint 2016 end of life and SharePoint Server Subscription Edition.
With these changes in mind, here’s what to check in any partner or app.
What to Look For in SharePoint Support for Government Agencies
Use these seven checks with every partner and app vendor you’re considering.
1. Does the support work in your environment?
- Coverage for GCC, GCC High, the Microsoft 365 DoD environment or on-premises, including air-gapped networks if you have them
- The same features in each environment, or a clear list of what differs
Ask: Which environments do you support, and does every feature work in ours?
2. Where does your data actually live?
Microsoft warns that some third-party apps store or process your data outside its cloud, where its compliance and data-protection commitments don’t reach.
- App data kept inside your own tenant or server farm
- Vendor access during support cases that you approve and control
Ask: Where is our data stored and processed, and who can reach it during a support case?
3. Is your SharePoint version still supported?
- Support for SharePoint Server Subscription Edition if you stay on-premises
- Help moving off SharePoint Server 2016 or 2019, as they are no longer supported
Ask: Which SharePoint versions do you support, and how do you handle upgrades?
4. A Plan for Retired Features
- Replacements for InfoPath forms and for SharePoint 2013 workflows retired from SharePoint Online
- Replacements that also work on-premises, if any of your sites run there
Ask: What replaces our old workflows and forms, and where does it run?
5. Changes Your Own Staff Can Make
Agencies change forms and approval rules often, and waiting on outside developers for each change slows that down.
- No-code/low-code tools your admins can learn
- Training for the people who will maintain them
Ask: Which changes can our admins make themselves, and which need a developer?
6. What security evidence can you review?
- Independent audits or certifications, such as a System and Organization Controls (SOC) 2 report or International Organization for Standardization (ISO) 27001 certification
- Plain statements about what the vendor is and isn’t authorized for, such as FedRAMP
Ask: Which audits back your security claims, and can we review them?
7. What Support Includes
- Updates, bug fixes, response times and escalation paths
- What’s billed separately, such as setup, customization, training and migration
Ask: What does standard support cover, and what counts as project work?
Here’s how Crow Canyon answers each one.
How Crow Canyon Supports Government Agencies on SharePoint
Crow Canyon is a Microsoft Preferred Partner that has worked with SharePoint since its first release. It builds business process automation apps for Microsoft 365, Teams, and SharePoint, such as NITRO Help Desk, NITRO Asset Management, NITRO Purchase Requests and others, all built on its no-code/low-code platform, NITRO Studio. It supports these apps and handles setup, customization, training and migration as separate projects, while your IT team or partner keeps managing SharePoint itself.
| What to look for | How Crow Canyon handles it |
|---|---|
| Works in your environment | Deployment supports SharePoint On-Premises, including connected and air-gapped environments, and SharePoint Online in commercial, GCC and GCC High environments. For SharePoint Online, the NITRO engine is Azure-hosted (customer-hosted for GCC and GCC High). Teams integration and artificial intelligence (AI) features need a Microsoft 365 deployment. |
| Data that stays inside your environment | Data stays in SharePoint lists in your own tenant or farm. |
| Supported versions and an upgrade path | On-premises, NITRO runs on SharePoint Server Subscription Edition. Migration services move unsupported farms to Subscription Edition or Microsoft 365. |
| A plan for retired features | NITRO Studio replaces InfoPath forms, on-premises and in SharePoint Online, and the SharePoint 2013 workflows retired from SharePoint Online. Forms are rebuilt, not converted automatically. |
| Changes your own staff can make | Admins build forms, workflows, approvals and notifications with no-code/low-code tools. Instructor-led training is available. |
| Security evidence you can review | Crow Canyon’s security and compliance frameworks include SOC 2 Type 2, ISO 27001:2022 and Cybersecurity Maturity Model Certification (CMMC) 2.0 Level 1 (self-assessment) for its assessed environment. NITRO holds no FedRAMP authorization of its own, but in GCC and GCC High it runs in your own Microsoft cloud, built on FedRAMP-authorized Microsoft services. |
| What support includes | Standard support is included and works the same in every environment, covering maintenance releases, updates, bug fixes and response targets that are faster for more urgent issues. Enterprise Support adds phone support, higher priority and extended coverage. Setup, customization, training and migration are billed as separate projects. |
Case Study: Spokane Regional Health District
Spokane Regional Health District (SRHD) is a local public health agency in Washington State, running Microsoft 365 GCC with Microsoft Teams and SharePoint.
- Challenge: The agency needed to replace paper processes and legacy InfoPath forms while its IT team was stretched thin and budgets were tight.
- Solution: Its in-house Office 365 team used NITRO Studio to replace InfoPath forms and SharePoint 2010 and 2013 workflows in GCC, and added the help desk and project management apps.
- Result: Staff built most workflows themselves, with Crow Canyon’s support team helping finish them. The agency automated many of its paper-based processes and kept its remote workforce running on a tight budget.
“The Crow Canyon Software Support Team is always available to walk me through the final stage of my workflow and business process automation. I’m usually about 80% there, and with a quick chat or call from support, I can finish it.”
Kimberlee Kealiher, Office 365 team at SRHD
Choosing SharePoint Support: Next Steps
Start by confirming which environment each of your SharePoint sites runs in, and whether any still run on SharePoint Server 2016 or 2019. Then use the seven checks above with each partner and app vendor on your list, and explore our SharePoint government solutions.
