While the announcement is not an immediate order to unbundle Windows Server or rewrite Azure licensing rules overnight, it represents one of the most comprehensive regulatory challenges to Microsoft’s core enterprise business model in years. Under Part 1 of the UK Digital Markets, Competition and Consumers (DMCC) Act 2024, an SMS designation gives the CMA the legal authority to impose targeted conduct requirements and pro-competition interventions on how a tech giant packages, integrates, and licenses its software.
For IT administrators, chief information security officers, and procurement teams, this probe hits right at the intersection of modern workplace tooling: Windows operating systems, Microsoft 365 productivity suites, Microsoft Copilot AI integrations, enterprise security bundling, and cloud licensing mobility.
What the UK CMA Is Proposing—and What It Means
The CMA’s investigation, which officially launched on May 14, 2026, examined how UK businesses and public-sector organizations procure and use foundational workplace software. According to the CMA’s published findings, Microsoft software—spanning Word, Excel, Outlook, PowerPoint, Teams, Copilot, security tools, server products, and operating systems—is used by more than one million UK businesses and public-sector bodies, representing roughly 20 million monthly users.
In its October 16, 2026 announcement, the regulator stated that Microsoft holds a strong position across five distinct areas of digital activity:
- Personal computer operating systems (Windows client OS)
- Productivity software suites (Microsoft 365 / Office applications and Teams)
- Security software (Defender and Entra-style enterprise security tooling)
- Server operating systems (Windows Server)
- Relational database management systems (SQL Server)
According to the CMA, Microsoft’s entrenched strength in business software stems from the high barriers customers face when attempting to switch providers, which limits customer choice and weakens competitive pressure from rival software developers. Furthermore, the watchdog noted that Microsoft’s commercial practices and deep integration advantages incentivize organizations to adopt additional Microsoft products, creating hurdles that third-party software vendors struggle to overcome.
It is important to draw a clear line between a regulatory proposal and a final penalty. As the CMA explicitly notes in its documentation, proposing Strategic Market Status does not assume wrongdoing, nor does it immediately force Microsoft to alter its products or pricing. Instead, the CMA has opened a formal consultation period running until 5:00 p.m. on November 13, 2026, ahead of a statutory deadline of February 13, 2027, for a final designation decision.
Key Takeaways on the SMS Proposal
- Status: Provisional proposed decision; open for public and industry consultation through November 13, 2026.
- Final Decision Deadline: Statutory deadline of February 13, 2027.
- Scope: PC operating systems, productivity suites, security software, server operating systems, and relational databases.
The Three Pillars of the CMA’s Intervention Roadmap
Alongside the proposed SMS designation, the CMA published an indicative roadmap outlining where it intends to gather further evidence and potentially intervene if the designation is finalized in February 2027. Rather than attacking Microsoft’s market share in the abstract, the regulator is zeroing in on three practical pain points that every systems architect and IT buyer knows intimately.
1. Copilot and Leveling the Enterprise AI Playing Field
The business software sector is rapidly shifting toward embedded and agentic AI inside everyday workplace applications. The CMA wants to assess whether UK organizations can freely choose the best AI tools and functionalities for their specific workflows, and whether rival AI providers have a level playing field to compete against Microsoft Copilot.
In practical terms, when an enterprise lives inside Word, Excel, Outlook, and Teams, third-party AI assistants often need deep API access, identity hooks, and UI integration to feel as seamless as a native Copilot button. The CMA is signaling that it wants to ensure customers can mix and match AI services from competing suppliers without artificial friction. Separately, as reported by Bloomberg and The Business Times, the CMA has also been examining whether customers were misled into paying higher subscription fees after Microsoft added Copilot to software packages.
2. Security Software Bundling and Integration
Any CISO who has debated renewing a standalone endpoint detection or identity governance tool while already paying for Microsoft 365 E3 or E5 licenses knows the gravity of the "good enough and already included" bundle. The CMA is examining whether the way Microsoft bundles and integrates its security products limits customer choice. If rival cybersecurity vendors cannot integrate as cleanly with the Windows OS or Microsoft productivity stack—or if licensing structures make buying third-party security economically punitive—regulators could step in to mandate fairer interoperability or unbundled purchasing options.
3. Cloud Licensing Choice
For years, European and UK cloud competitors have complained that bringing existing on-premises Windows Server or SQL Server licenses to rival clouds is more expensive or contractually restrictive than running those exact same workloads on Microsoft Azure. The CMA’s roadmap explicitly targets whether customers have effective choice over which cloud provider they use to deploy their software licenses, and how Microsoft’s licensing practices influence that decision.
Summary of Potential Intervention Areas
| Focus Area | Regulatory Question | Practical IT Impact |
|---|---|---|
| AI & Productivity | Can third-party AI tools compete fairly with Copilot inside Microsoft’s ecosystem? | Potential API, integration, and procurement parity for rival enterprise AI assistants. |
| Security Bundling | Does bundling and native integration of Microsoft security tools crowd out rivals? | Possible scrutiny of E3/E5 security packaging and third-party security hooks in Windows. |
| Cloud Licensing | Do licensing terms restrict where customers can deploy Microsoft software in the cloud? | Potential changes to Bring-Your-Own-License (BYOL) rules on non-Azure clouds. |
Microsoft’s Counterargument: Openness vs. Integration
Any fair analysis of enterprise IT has to wrestle with a central paradox: the very thing regulators call "switching barriers and integration advantages" is often what exhausted IT administrators call "stuff that actually works together on a Tuesday morning."
In response to the watchdog's announcement, Microsoft stated, as reported by Bloomberg and The Business Times, that it "does not share the CMA’s views in its proposed decision on business software solutions". The company added that all of its products, including Copilot, "are open and interoperable, giving customers the ability to use them alongside competing services".
From a purely technical standpoint, Microsoft has a point worth considering. Modern Windows and Microsoft 365 environments routinely run alongside Slack, Zoom, Google Workspace, CrowdStrike, Okta, AWS, and Salesforce. Microsoft maintains extensive Graph APIs, identity federation standards, and plug-in architectures. Moreover, many small and medium-sized businesses actively prefer pre-integrated suites because stitching together five different vendors for OS management, productivity, email security, and database hosting requires specialized engineering talent and raises integration risk.
However, the CMA’s argument—headed by Chief Executive Sarah Cardell—is not that third-party software is impossible to run on Windows. Rather, the regulator argues that commercial bundling and architectural advantages tilt the board so heavily that customers lose the practical freedom to switch or combine best-of-breed alternatives, which is especially critical for government bodies and essential services seeking resilience and strategic autonomy.
Separate Progress on Cloud Switching with AWS and Microsoft
While the business software SMS proposal grabbed the headlines, the CMA’s October 16, 2026 announcement also included an important update on a separate track: its ongoing monitoring of cloud infrastructure services involving both Microsoft and Amazon Web Services (AWS).
Rather than immediately launching a formal SMS designation probe into cloud infrastructure, the CMA has been engaging directly with Microsoft and AWS since March 2026 to lower cloud switching barriers. According to the CMA, both cloud giants have already delivered material changes:
- Direct Data Center Connections: Connecting their data centers directly with rivals, starting with Google Cloud.
- Slashing Egress Fees: Completely removing data transfer fees for customers switching cloud providers, and reducing those fees for organizations running multi-cloud deployments.
- Interoperability Requests: Introducing a formal mechanism for customers and competitors to request greater technical interoperability.
- AI Migration Tools: Rolling out AI-powered tools designed to automate the technical steps required to migrate workloads between clouds.
Even with those concessions, the CMA warned that more work is needed. Both Microsoft and AWS have agreed to work with the regulator on improving cross-cloud Identity and Access Management (IAM) and ensuring that cloud architectures built for portability can be migrated without unnecessary technical hurdles. The CMA plans to publish a further update on this cloud monitoring track in Spring 2027, while keeping the option of a formal cloud SMS investigation on the table.
How IT Leaders and Vendors Can Participate
Because the CMA’s business software proposal is currently in its consultation phase, enterprise IT buyers, managed service providers, and independent software vendors in the UK have a direct window to put their real-world experiences on the regulatory record.
Notably, the CMA’s official case documentation includes a crucial assurance for enterprise customers who might otherwise worry about legal blowback: any non-disclosure agreement (NDA) an organization has in place with Microsoft should not prevent them from responding to the consultation. According to the CMA, Microsoft has explicitly confirmed that it will not use confidentiality provisions to block any party from submitting evidence to the regulator.
If your organization handles UK software procurement or IT architecture, here is the official timeline and procedure for the consultation:
- Review the Scope: Assess whether your organization has empirical examples regarding software switching costs, E3/E5 security bundling, Copilot integration vs. third-party AI tools, or cross-cloud SQL/Windows Server licensing.
- Prepare Confidential and Non-Confidential Versions: If your submission references sensitive commercial pricing or third-party confidential terms, clearly mark the confidential material and provide a redacted, non-confidential version that the CMA can publish on its case website.
- Submit Before the Deadline: Send consultation responses via the CMA’s official consultation portal or by email to
[email][email protected][/email]no later than 5:00 p.m. UK time on November 13, 2026. - Watch the Winter Milestones: Following the November close, Microsoft will have the opportunity to make oral representations, and the CMA will conduct further evidence gathering through December 2026 before issuing its final decision report by February 13, 2027.
Three years after Microsoft and the CMA clashed over the $69 billion Activision Blizzard acquisition, the battleground has shifted from console gaming to the enterprise server room and the AI-powered desktop. Whether the CMA ultimately forces changes to how Microsoft bundles security, licenses Windows Server in the cloud, or opens Office to rival AI models, enterprise architects should keep a close eye on February 2027.