Inteldefense
The IL6 Problem Is the Model Catalog
Microsoft's own roadmap shows the classified cloud platform is authorized at IL6 while model hosting is still forecasted. The catalog is the gate.
A program office hears "AI is available at IL6" and plans a pilot. Six months later the platform is authorized, the network is built, the users are trained, and the model they wanted is not in scope.
That gap is the story. Not the model. The catalog.
Two clouds, three authorizations
Microsoft runs two government clouds, and the distinction matters more than the marketing.
Azure Government is the FedRAMP High environment, compliant with DoD impact levels 4 and 5. Azure Government Secret is the air-gapped environment for Secret-level classified data, built to meet IL6. They are separate environments with separate authorization scopes, and a service that is available in one is not automatically available in the other.
That is the first thing program teams get wrong. The second is assuming that a service listed as generally available at IL6 means the model behind it is available at IL6.
What the roadmap says
Microsoft publishes a general availability roadmap (opens in a new tab) that lists products against FedRAMP High, IL4, IL5, and IL6. The rows are not uniform, and the pattern is instructive.
| Capability | IL6 status |
|---|---|
| AI platform (Microsoft Foundry) | Generally available |
| Azure AI Search | Generally available |
| Model catalog (Foundry Models) | Forecasted |
| Azure Machine Learning | Forecasted |
| Copilot Studio | Not available |
Read that table as an authorizing official would. The platform, the search layer, and the storage are inside the boundary. The model hosting and the model catalog are not yet.
A platform is a place to run things. A catalog is a set of specific artifacts that have been evaluated, versioned, and approved. The first is an infrastructure authorization. The second is a model-by-model decision, and it moves slower for good reasons.
Why the catalog lags the platform
A model is not a service feature. It is a set of weights, a tokenizer, a configuration, an evaluation record, and a behavior profile. Each one has to be reviewed against the classified environment's rules, and the review has to answer questions that a platform review does not ask.
What data was it trained on, and can that be described without disclosing someone's proprietary corpus? What does it do when it is wrong? How was it evaluated, against what test set, and who scored it? What happens when the provider ships a new version, and who decides whether the new version enters the boundary?
Those questions are why model availability lags platform availability. They are also why a program that plans around the platform rather than the catalog gets surprised.
The Microsoft roadmap is dated and changes. That is the point of checking it rather than trusting a briefing. A row that says forecasted today may say generally available next quarter, and a row that says generally available can change when a service is retired.
What to plan for
Four planning assumptions will keep a classified AI program out of trouble.
Assume a fixed model version for the program's life. If the model cannot be updated on your schedule, the evaluation you ran at the start is the evaluation that has to hold. Design the use case so that it does.
Put the model in the authorization boundary, not next to it. The boundary is what the authorizing official signed. A model that reads data from inside the boundary but runs outside it is a data flow problem, and data flow problems are where spillage happens.
Write the evaluation into the package. An evaluation that lives in a slide deck is not evidence. An evaluation with a test set, a scoring method, and a named reviewer is.
Plan the update path before you need it. A new model version is a significant change. Who evaluates it, who approves it, and how it reaches the enclave are decisions that should be made while the system is being built, not after a provider announces a release.
The capability is real, the scope is narrow
None of this argues that classified AI is a mirage. The platform is there, the search layer is there, and the storage and networking are there. A document search, a summarization workflow, a translation task, or a retrieval system can be built inside the boundary today with the pieces that are authorized.
What is not there yet is the assumption that any model you want is waiting. The catalog is the constraint, and the catalog is a list of decisions, not a product launch.
The program that plans around the catalog ships. The program that plans around the announcement waits.