Is Office 365 International Traffic in Arms Regulations (ITAR) Compliant?

The simple answer is "no".

There are multiple flavors called Office 365 and the shared version (the most common) is not ITAR compliant. This comes from two different concerns around ITAR – 1) That only US citizens manage the data – Microsoft uses follow the sun support which includes non-Americans providing support and accessing the data 2) Is that the data stays in the US only. While this is typically true for Office 365, it does have the ability to fail over workloads to data centers located in other countries.

There are a few options:

1. The ITAR compliant platform version of Office 365 is ITAR compliant, but it starts at 30,000 users and is considerable more expensive. http://technet.microsoft.com/en-us/library/dn270088.aspx
2. Clients can split their users between platforms. Clients move everyone not working on defense contracts, including foreign nationals, out to the cloud and then hybrid the connection back to their existing Exchange installation where the ITAR restricted users and projects are housed.

Other Resources: Office 365 ITAR-support

This posting is provided “AS IS” with no warranties, and confers no rights.