I'm waiting to hear back from the Microsoft sales team on the price difference between M365 GCC and commercial, but I was wondering if I might get some advice from the kind folks over here. We don't have a ton of resources to bring in a 3rd party, but if that ends up being the most efficient, I'm not opposed.

I'm in the process of setting up a very small electronic manufacturing setup. I'm a process engineer, with very little IT experience and I'm trying to sort out how to keep things as simple as possible. We are talking 3 total people with 5 workstations. All workstations are physically wired together, and all CUI will be stored in a shared folder on one machine. We do not have remote work. Export Control and ITAR is going to pop up here and there.

I think my main issue is that we don't have a domain controller, so it's annoying to set up sign in policy and get audit logs from each workstation. Least privilege is ~tricky~ with 3 people, but I think I could separate a "production" group from an "office" group. Here is my very dumb question: would the Commercial subscription which includes Microsoft Entra and Intune be compliant? All files would still be stored on the local network, so we would not need to use the government cloud storage.

Thanks in advance!