Summary

• The CMA has proposed strategic market status designation for Microsoft's UK business software ecosystem, following an investigation opened in May.
• Its provisional concerns cover switching barriers, software integration, Copilot competition, security product bundling and cloud licensing.
• Consultation closes on 13 November 2026, with a final designation decision required by 13 February 2027; no intervention has yet been imposed.

Britain’s Competition and Markets Authority has proposed placing Microsoft’s business software ecosystem under its strategic market status regime, opening the possibility of targeted interventions affecting how the company’s products are sold, combined and integrated with competing technology.

The provisional decision, published on 16 October, follows an investigation launched in May into Microsoft’s position across operating systems, workplace productivity software, security products and other enterprise applications. The regulator says established switching barriers and integration advantages may limit the alternatives available to UK businesses and public sector organisations.

An accompanying roadmap identifies questions concerning Microsoft’s Copilot AI products, the bundling of security software and the licensing arrangements that affect customers’ ability to run Microsoft technology on competing cloud infrastructure.

Microsoft has not been designated under the regime. The CMA is consulting on its proposed decision until 13 November and must reach a final determination by 13 February 2027. Any subsequent intervention would require additional regulatory steps and the relevant legal tests to be satisfied.

A large installed base creates switching barriers

Microsoft’s software is embedded throughout British workplaces, from Windows operating systems and Microsoft 365 applications to Teams communications, identity services, security software and server technology.

According to the CMA, its business software products are used by more than one million UK businesses and public sector organisations, serving approximately 20 million monthly users.

The regulator’s provisional assessment identifies a strong Microsoft position across five areas: personal computer operating systems, productivity software suites, security software, server operating systems and relational database management systems.

These categories cover different functions, but their commercial importance is strengthened by the connections between them. Organisations may use several Microsoft applications together, sharing information, administration arrangements and staff expertise across products that have become part of established working practices.

Moving to alternative software can involve retraining employees, converting files, migrating data and rebuilding integrations with other systems. Even where a competing product offers comparable functions, the cost and disruption of changing may discourage customers from switching.

Microsoft’s ability to integrate its products can also provide genuine operational benefits, including easier administration and consistent user experiences. The competition issue is whether those advantages unnecessarily prevent customers from adopting rival software or combining products from different suppliers.

The CMA’s investigation examines whether Microsoft’s position is sufficiently substantial and entrenched to warrant additional regulatory oversight. Its proposed designation does not establish unlawful conduct or require the company to separate products that customers currently use together.

Copilot changes the competitive landscape

The integration of AI into familiar workplace tools has introduced a new dimension to the regulator’s assessment. Microsoft’s Copilot products are increasingly connected with applications used to manage documents, email, meetings and everyday business operations.

Organisations adopting those features may gain access to AI without procuring an entirely separate technology platform. However, the same integration could make it more difficult for competing AI providers to reach customers or offer comparable functionality within established software environments.

The CMA wants to examine whether businesses can choose the AI tools best suited to their needs and whether alternative providers have a fair opportunity to compete with Copilot.

Those concerns extend beyond the availability of rival chatbots. AI systems increasingly interact with enterprise data and software services, so their usefulness can depend on permissions, integration interfaces and access to the applications where employees already perform their work.

Where a business uses several AI providers, administrators may also need to manage security settings, information access and contractual arrangements across those systems. A product that is technically available does not necessarily offer a practical alternative if it cannot operate effectively within the customer’s established environment.

Microsoft’s broader development of Copilot as an enterprise operating layer illustrates how AI is becoming more closely connected with existing business software.

The CMA has not concluded that Copilot should be removed from Microsoft applications or that every integration practice is anticompetitive. It has identified competitive conditions requiring further evidence before deciding whether action is appropriate.

Security products and cloud licensing come under scrutiny

Microsoft also supplies security applications that operate alongside its productivity, identity and infrastructure products. The CMA proposes to investigate whether bundling and integration arrangements limit the ability of customers to select alternatives from competing security suppliers.

Businesses may value a unified approach to monitoring, administration and protection, particularly where their systems share identities and operational data. Yet some organisations may prefer specialist products or a mixture of suppliers to meet particular requirements.

The investigation will consider whether existing commercial and technical arrangements allow those choices to be made effectively. It does not establish that purchasing security products from one supplier is inherently harmful.

Software licensing presents another concern because Microsoft’s customers may want to run applications on infrastructure provided by other cloud operators. Licence costs and contractual conditions can influence whether moving a workload is economically attractive, even when the technical migration is possible.

Changing cloud providers may also require modifications to network arrangements, identity management and application configuration. Licensing and technical interoperability therefore affect different parts of the same purchasing decision.

The CMA’s roadmap includes examining whether customers have effective choice over the cloud infrastructure used for their software. Its eventual conclusions could inform targeted remedies, but no new licensing requirement has been imposed through the October announcement.

Cloud negotiations follow a separate track

Alongside the Microsoft business software proposal, the CMA published an update on its engagement with Microsoft and Amazon Web Services concerning competition in public cloud infrastructure.

That process is separate from the proposed business software designation. The regulator says the companies have taken material steps to address barriers to switching providers and using multiple cloud services.

Reported developments include connections with rival infrastructure providers, changes to data transfer charges, mechanisms for requesting greater interoperability and AI-assisted tools intended to automate some technical migration tasks.

The CMA also says further improvements are needed. It has agreed with both suppliers to focus on identity and access management across cloud environments and on making portable architectures easier to deploy and migrate.

Although the regulator is continuing that engagement, it has retained the option of launching a formal strategic market status investigation into cloud services. Its next update is expected in spring 2027.

The distinction matters because progress in negotiations does not amount to the completion of every promised change, and the absence of an immediate investigation does not mean cloud competition concerns have been resolved.

Designation would start another process

The UK’s digital markets regime allows the CMA to designate companies with substantial and entrenched market power in specified digital activities. Once designated, a company can become subject to targeted conduct requirements or other interventions, depending on the findings and applicable legal procedures.

Strategic market status does not itself establish that a business has broken competition law. The regime is intended to address market conditions prospectively, with measures tailored to the activities and concerns identified.

Microsoft disputes the CMA’s provisional assessment, maintaining that its business software is competitively priced, open and interoperable. The consultation gives the company, its customers and competing developers an opportunity to challenge or support the regulator’s findings before a final decision is made.

Submissions on the proposed designation and roadmap are due by 5pm on 13 November. The CMA’s investigation timetable provides for further evidence gathering and a final decision by the statutory deadline of 13 February 2027.

The outcome could influence how British organisations purchase enterprise software and combine AI, security and cloud services in future. For now, the confirmed regulatory development is a proposed designation and an open consultation, rather than a completed intervention in Microsoft’s commercial arrangements.