UK regulator moves to put Microsoft's business software under special rules

It's a status under the UK's Digital Markets, Competition and Consumers Act 2024. It goes to a company the CMA finds has substantial and entrenched market power in a digital activity.

The label itself is not a fine and not a verdict. The CMA says plainly that designation does not assume wrongdoing. What it does is unlock the power to write tailored rules for that one company, called conduct requirements, or to order wider pro-competition fixes.

Think of it like a building inspector who gets a key to one specific building. Nothing is wrong yet. But now they can walk in and check the wiring.

The big picture: Google already holds this status for search. In October 2025 the CMA confirmed it for Apple and Google in mobile platforms. BM Magazine notes that Microsoft would be the third company designated.

The investigation started on 14 May 2026. It looked at five areas of Microsoft's business software:

• PC operating systems: Windows.
• Productivity suites: Word, Excel, Outlook, PowerPoint, Teams and, increasingly, Copilot.
• Security software: tools such as Defender, Entra, Active Directory and Intune.
• Server operating systems: the software that runs business servers.
• Relational databases: the software that stores and organizes business data in tables.

The provisional finding is that Microsoft has a strong position in all five. According to the CMA, more than a million UK businesses and public sector organizations use this software, with around 20 million monthly users.

The regulator says Microsoft's strength comes from "the barriers customers face when switching." It also points to commercial practices and integration advantages that make Microsoft's products the easy pick, and that rivals cannot easily match.

"Organisations should be able to choose the products that work best for them, switch provider when they want to and combine services from different suppliers," said Sarah Cardell, the CMA's chief executive.

The CMA published a roadmap of possible interventions alongside the proposal. AI inside productivity software is one of its four focus areas.

Rival AI providers told the CMA that Microsoft's customers get immediate access to the free version of Copilot, which may nudge them toward a paid Copilot license. Some customers also told the regulator that the return on Copilot is unclear for what they see as a high license cost, and they worry about future price rises.

Microsoft's side, as recorded in the roadmap: rival firms can reach organizational data through publicly available APIs, so third-party AI tools get substantially the same access to Microsoft 365 data as Copilot.

If the CMA decides rivals do need help, the ideas on its list include:

• Parity rules: rivals get access to the same Microsoft functions and data as Copilot.
• Defaults and prominence: making it easier for users to pick and change which AI tool appears.
• API notice periods: a minimum warning before Microsoft changes the connections rivals rely on.
• Unbundling: selling AI features separately from Microsoft's existing suites.

This is the part with the most detail. Security software rivals told the CMA that Microsoft's integration options for outside products "generally do not provide equivalent functionality" to what Microsoft's own security tools get.

Their specific concerns, as the roadmap lists them:

• Data: the information rivals get to detect threats is less complete and less timely than what Microsoft receives.
• Control: Microsoft-run APIs come with rate limits and revocations that Microsoft decides alone.
• Identity: Entra ID is a must-have identity layer for many Microsoft products, which makes switching harder.

Then there's the bundle. Defender comes included in Microsoft 365 E3, E5 and Business Premium licenses. The CMA's customer research found that buying a third-party alternative is sometimes seen as paying twice, and some customers said that inclusion makes them less inclined to look further.

In real life Say your company already pays for Microsoft 365 E5. A rival antivirus vendor pitches you a better product. Your finance team asks the obvious question: "Don't we already have one of those?" That moment is exactly what the CMA wants to study.

Microsoft told the CMA that customers benefit from its range of security suites, and that its products work with others through documented APIs, integration hooks and extensibility. Some customers also told researchers that Microsoft's security offer has improved in recent years.

Yes, in Europe. In September 2025 the European Commission accepted commitments from Microsoft. They include offering Microsoft 365 without Teams, keeping a meaningful price gap between the bundled and unbundled versions, and better interoperability and data portability for rivals.

Microsoft rolled those changes out globally on a voluntary basis, with extra guarantees in the European Economic Area. But the CMA notes they don't formally apply in the UK. It will look at how they work in Europe before deciding whether the UK needs its own version.

Microsoft argues that customers who don't want Teams don't have to use it, and that core Office apps are sold separately. It points to Slack, now part of Salesforce, which it says has grown to tens of millions of daily active users.

Cloud is the fourth focus area, and it has history. In July 2025 a CMA inquiry concluded that Microsoft's licensing practices for certain business software limit choice and competition in cloud services.

The roadmap says the evidence since then shows Microsoft has not altered those licensing practices. If Microsoft is designated, the CMA plans to look at whether and how to tackle that under the new law.

Separately, the CMA gave an update on its work with Amazon Web Services and Microsoft on cloud switching. Both companies have:

• Connected data centers with rivals, starting with Google.
• Dropped data transfer fees for customers moving to another cloud provider, and cut them for customers using more than one.
• Added a way to request interoperability for competitors and customers.
• Rolled out AI tools that automate the technical steps of switching.

The CMA says more is still needed and will publish another cloud update in spring 2027.

Microsoft disagrees with the proposal. "All our products, including Copilot, are open and interoperable, giving customers the ability to use them alongside competing services and choose solutions that work best for them at attractive prices," a spokesperson said, as quoted by BM Magazine. Grafa reports that Microsoft disputes the regulator's preliminary findings.

• 14 May 2026: the CMA opens the investigation.
• 16 October 2026: proposed designation and roadmap published.
• 13 November 2026, 5pm: deadline for comments.
• 13 February 2027: statutory deadline for the final decision.

What's next: even if Microsoft is designated, nothing changes overnight. Every intervention would need its own evidence, consultation and legal test. The CMA calls its approach "proportionate" and "pro-innovation." The CMA also frames choice as a matter of resilience and strategic autonomy for government and critical organizations. Some are already acting on their own: the Dutch tax office recently dropped Microsoft 365.

• If you run IT at a UK organization: you can send your views to the CMA by 13 November. Real buying stories, like being told a rival is "paying twice," are the evidence it says it wants.
• If you use Copilot at work: nothing changes today. Down the line, you might see more choice over which AI assistant sits inside Word and Teams.
• If you sell software that competes with Microsoft: the roadmap is a preview of the rules that could come, from equal data access to API notice periods.
• If you're a home user: this case is about business software, so your personal Windows PC isn't the target.