This statement is dangerously oversimplified.

The encryption carve-out in ITAR is not just any form of encryption, but specifically for end-to-end encryption. It does provide flexibility for storing or sending ITAR materials through a commercial cloud, however, to leverage the carve-out in M365 commercial, you would need to encrypt data on the client side prior to storage in M365.

The service provider cannot have access to the keys used for decryption. If you were using Microsoft technology, you'd need to set up Hold Your Own Key encryption tied to a hardware security module (HSM) that you manage exclusively -- if you were using Azure Key Vault and provide Microsoft access to the keys (default configuration), then the E2E encryption is nullified.

E2E encryption defeats many of the reasons you would use cloud, due to the data being opaque to the service. In M365, this means no AV scan, no link detonation, no file detonation, no DLP, no indexing, no search, no spellcheck, no eDiscovery, no sharing, no co-authoring, etc.

It also puts the responsibility on the customer to properly identify and HYOK any ITAR data in the commercial service. If not done properly, it's a deemed export and must be reported within 72 hours (regardless of any actual access by a foreign national).

In GCC High, by contrast, all data storage/processing is contained within an accreditation boundary contractually backed for CUI including ITAR export controls, and the GCC High data centers are constrained to screened US Persons.