Two tracks, not one
The CMA is proposing to designate Microsoft with SMS in its business software ecosystem and will consult before making a final decision. That is a proposal, not a verdict.
The cloud-services work is a different process. The CMA describes it as engagement with AWS and Microsoft outside a formal designation process. Neither company's cloud business has been designated. The CMA says it is keeping the possibility of a full SMS investigation under review, and it will publish a further update in spring 2027.
The Microsoft SMS proposal
The CMA has been investigating Microsoft since May. Its proposed decision sets out a provisional assessment that Microsoft meets the statutory conditions for SMS designation in respect of its business software ecosystem.
The CMA's provisional findings cover five areas of digital activity:
- PC operating systems
- Productivity software suites
- Security software
- Server operating systems
- Relational database management systems
Computer Weekly notes that the last category includes products such as SQL Server.
The CMA's reasoning is that Microsoft's strength comes from the barriers customers face when switching. It also says commercial practices and integration advantages create further obstacles that rival developers can't easily overcome. The CMA says Microsoft's software reaches over a million UK businesses and public bodies, with around 20 million monthly users.
The roadmap areas
The CMA has published an indicative roadmap of areas for further evidence-gathering and possible action if Microsoft is designated. It lists three:
- AI choice: whether customers can freely pick AI tools, and whether rivals compete on a level footing with Copilot.
- Security bundling: whether the way Microsoft bundles and integrates its security products limits choice.
- Cloud licensing: whether customers have effective choice over which cloud they deploy their software licences on.
Computer Weekly's summary of the roadmap also mentions communications and collaboration software such as Teams. The CMA's own press release excerpt doesn't list Teams among its three bullets.
What SMS does and doesn't mean
The CMA stresses that SMS designation does not assume wrongdoing, but would let the CMA consider targeted conduct requirements or pro-competition interventions. Any intervention would still have to meet legal tests.
Microsoft has pushed back. A Microsoft spokesperson disagreed with the decision and said all its products are open and interoperable.
Timeline
- Consultation responses are due by 5pm on 13 November 2026.
- The statutory deadline for the final decision is 13 February 2027.
- If approved, Microsoft would become the third tech company under the UK's new digital market rules, after Google and Apple.
The cloud update: progress, with gaps
The CMA says both providers are delivering material steps. Its list of developments:
- Connecting their data centres with rivals, beginning with Google.
- Completely removing data transfer fees for customers changing cloud provider, and reducing them for customers using more than one cloud.
- Introducing a new mechanism for competitors and customers to request greater interoperability.
- Rolling out AI tools to automate the technical steps of switching.
The CMA says plainly that more can be done. Its detailed 23-page update covers March to October 2026. The details below come from the evidence brief for that update, and I couldn't open the PDF itself to check them.
- The free-switching window was reportedly extended from 90 to 180 days.
- Uptake of recently introduced offers has so far been limited.
- Customers still report material obstacles to switching or multi-cloud use.
- Some measures announced in March remain outstanding.
- AWS–Microsoft data-centre links were still in progress, with UK availability planned for the coming months.
Next priorities: IAM and Kubernetes
The CMA says it has agreed with both companies to focus next on two practical headaches. The first is how identity and access management (IAM) works across clouds. The second is making sure cloud architectures designed for portability can be deployed and migrated across providers without unnecessary barriers.
The evidence brief adds that identity federation can authenticate users across clouds. The harder problem is that authorisation models and policy languages differ, so customers end up translating logic by hand. The CMA reportedly calls a fix technically challenging and has no settled solution or firm timeline. On Kubernetes, the brief says deployments can still depend on cloud-specific services such as IAM and networking, which undermines portability.
What it means for Windows and IT admins
This is early-stage, but several points are worth tracking:
- Licensing: if you run Microsoft software on a rival cloud, the cloud-licensing question is the one most likely to change your costs and options.
- Security stack: if you use Defender alongside third-party tools, the bundling probe is relevant to your next renewal.
- Copilot and AI: the CMA is looking at whether alternatives to Copilot can compete on equal terms.
- Multi-cloud design: AI migration tools reportedly reduce engineering effort, but the CMA stresses they don't remove the need to adapt workloads and security-test generated code. IAM and Kubernetes dependencies remain real constraints.
- Nothing changes yet: no conduct requirements exist today. Treat this as a roadmap, not a rule change.
Perspectives and caveats
Amazon welcomed the outcome. It said the review recognises the concrete steps AWS has taken, and it pointed to 2026 investment in AI, multi-cloud and open-standard capabilities. That is the company's own characterisation, not an independent finding.
Regulators and critics may read the same facts differently. Voluntary commitments can be faster than formal rules, but the CMA's own note about limited uptake suggests that offering a measure and customers actually using it are two different things. Microsoft's counterargument is that its products are open and interoperable. The consultation is where that dispute gets tested.
The next dates to watch are 13 November 2026 for consultation responses, February 2027 for the SMS decision, and spring 2027 for the CMA's next cloud review.