An intelligence analyst working a Top Secret dataset in 2024 had a strange problem. The best language models on Earth were a browser tab away — on the wrong network. Their data lived somewhere those models legally could not go. So the analyst did what everyone did: nothing, or something clumsy and manual, because the convenient shortcut was a felony.
That gap just closed. Microsoft’s Azure Government team announced this week that Azure OpenAI Service is authorized across every U.S. Government data classification level, Top Secret included. The roadmap that started at unclassified now runs all the way to the top.
Which sounds like someone flipped a switch. Nobody did. “Authorized” is a specific, narrow word, and the distance between it and “an analyst is actually running GPT-4 against classified data” is where most of this article lives.
On timing: the authorization is effective now — the announcement is the milestone, not a future-dated promise, so the service is cleared into these clouds today. What that date does not set is your deployment date. That runs on your program’s accreditation clock, not Microsoft’s. An agency starts under the new authorization the moment its own paperwork and landing zone are ready, which for most missions is weeks or months after the blog post, not the same afternoon.
Four buildings, not one network
Start with how the data is sorted. U.S. government information isn’t one pile with a sensitivity dial. It’s tiered, and the Defense Department maps those tiers onto Impact Levels. IL2 is roughly public-facing unclassified. IL4 and IL5 cover Controlled Unclassified Information — the sensitive-but-not-classified middle where a lot of defense work actually happens. IL6 is Secret. Above that sits Top Secret, in a world of its own.
Here’s the part people from commercial Azure find genuinely surprising: these tiers aren’t logical partitions inside one big cloud. They’re physically separate clouds. Azure Government handles the IL4/IL5 range from data centers on U.S. soil staffed by screened U.S. persons. Azure Government Secret is a different, isolated cloud for Secret workloads. Azure Government Top Secret is another one again. Air-gapped. No cable runs between them, by design.
Think of four vaults in four different buildings — each with its own guards, its own door, its own rules about who gets in. A tool approved for the lobby of one building is not automatically allowed into the vault of another. It gets inspected and cleared for each building separately.
What “authorized” actually buys you
That inspection is the authorization. In federal terms it’s an Authority to Operate: an accreditation that a specific service, run a specific way, meets the security controls required for a given classification level. FedRAMP High and the DoD’s IL5, IL6, and Top Secret control baselines are the rulebooks.
So the announcement means Azure OpenAI has been cleared into each building, up to and including the Top Secret one. What it does not mean: that the service is deployed, that your subscription can see it, or that your data is allowed near it. The tool is approved for the building. Someone on your side still has to wheel it into your room, plug it in, and run it under your program’s rules. The accreditation is Microsoft’s homework. Deploying it correctly is yours.
Not every model rides the elevator to the top floor
The trap in a story like this is reading “all levels authorized” as “everything, everywhere.” It isn’t. Model and SKU availability differs by cloud, and the high-side clouds run behind the commercial one. A model that shipped to commercial Azure OpenAI months ago may only now be reaching Azure Government, and later still — if at all yet — the Secret and Top Secret clouds. Air-gapped environments update on a slower, deliberate cadence, because every change is a new thing to accredit.
And here’s the thing the announcement itself won’t settle for you: it declares the authorization but doesn’t publish a region-by-region or SKU-by-SKU map — it doesn’t tell you which specific Gov regions carry which classification level, or which models are live at IL5 versus IL6 versus Top Secret. That’s not an oversight so much as the nature of the thing; those inventories move, and the classified ones aren’t advertised in a blog post. Which is exactly why the authoritative answer isn’t the announcement — it’s the platform. Check the specific cloud you’re deploying into and ask it directly:
For the Secret and Top Secret clouds you won’t run this from your laptop — access is from inside accredited environments against separate endpoints, and the list you get back will be shorter. Plan around GPT-4-class chat and a text-embedding model as your likely baseline, and confirm anything newer against the live endpoint before you promise it to a mission owner.
The controls are the point
Encryption. By default Azure OpenAI encrypts data at rest with Microsoft-managed keys. For classified work you’ll almost certainly be required to bring your own — customer-managed keys in Key Vault, or Managed HSM where a FIPS 140-2 Level 3 hardware boundary is mandated. The point isn’t stronger math. It’s that you hold the key and can revoke it.
Data residency. The entire reason the clouds are separate. Data in Azure Government Top Secret stays in the Top Secret cloud, on accredited infrastructure, run by cleared personnel. There’s no burst-to-commercial safety valve, and you would not want one.
Network isolation. Turn the public endpoint off. Full stop. A classified Azure OpenAI account reachable over a public IP is a finding waiting to happen. Use Private Link so the only path to the service is a private endpoint inside your virtual network, and set the account’s default network action to deny.
Auditing — and the control people miss. Standard Azure OpenAI runs abuse monitoring: prompts and completions can be retained for a limited window and, in some cases, reviewed by humans to catch misuse. On classified data that’s a non-starter — you cannot have a Microsoft reviewer reading Top Secret prompts. Eligible government customers can apply for modified abuse monitoring, which turns off human review and the retention that comes with it. Deploy without arranging that and you’ve built a compliant-looking service with a data-handling hole in the middle of it.
Wiring it up without tripping the alarms
None of this is click-ops. The expected pattern is a landing zone — a pre-built, policy-governed slice of Azure — with the guardrails encoded as Azure Policy so the wrong thing can’t be deployed in the first place. A locked-down account in Bicep looks roughly like this:
Then enforce it above the workload. Built-in Azure Policy definitions exist to deny Cognitive Services / Azure AI accounts with public network access and to require customer-managed key encryption — assign them at the management group in deny mode, not audit, so nobody quietly stands up a softer version. And deploy behind a preview every time:
Run it with --what-if first, always, in an environment where a mistake is a security incident and a change-control meeting.
Here’s what won’t be in the announcement. The models on the high side will lag the commercial ones, sometimes badly, and mission owners who’ve used the newest thing on the low side will be annoyed to find it isn’t there yet. Capacity and quota in the classified clouds are tighter. And the authorization is a floor, not a finish line — it says the service can meet the controls, not that your deployment does. The paperwork that clears the tool into the building is done. The part where you don’t leave the vault door open is still yours.
