UK CMA Microsoft business software probe

What just happened

The UK CMA Microsoft business software probe is moving ahead: the regulator has proposed designating Microsoft with strategic market status (SMS) in its business software ecosystem and will now consult before making a final decision, according to GOV.UK. In the same notice, the CMA set out an indicative roadmap highlighting areas where it may gather further evidence and consider interventions to promote customer choice.

The areas flagged include looking at how Microsoft bundles its software and making it easier for developers to integrate their products with Microsoft’s business software ecosystem, per GOV.UK. The CMA’s findings informing this proposal include that Microsoft has a strong position across five areas: personal computer operating systems, productivity software suites, security software, server operating systems and relational database management systems. The regulator says Microsoft’s strength is reinforced by barriers customers face when switching, and by commercial practices and integration advantages that incentivise adoption, as set out on GOV.UK.

The CMA also notes that Microsoft’s business software is used by over a million businesses and public sector organisations in the UK, with around 20 million monthly users, and that workplace tools are rapidly changing with increased AI functionality and a shift towards agentic AI. It emphasises the importance of choice, switching and combining services—particularly AI—for resilience and strategic autonomy, according to GOV.UK. In parallel, the CMA says it has been engaging with AWS and Microsoft on cloud services, with meaningful improvements already made and more to come, and it continues to work with both companies to agree further actions, per GOV.UK.

Why this matters for organisations

This is not a niche tussle. Business software underpins critical functions across the UK economy, and the CMA’s own findings underline the practical reality many of us recognise: switching is hard, bundles are attractive, and deep integration creates gravity wells that raise the opportunity cost of alternatives. When a single supplier spans operating systems, productivity, security, servers and databases, the compounding effect on choice, cost and risk is material—especially in the public sector and critical industries, as highlighted on GOV.UK.

For technology leaders, the signal is clear. Expect more scrutiny of how products are packaged and integrated, how AI is embedded in tools, and how licence terms steer cloud deployment choices. The CMA has said it will consider whether customers can freely choose the best AI tools and whether alternative providers have a level playing field to compete, as set out on GOV.UK. Even before any outcomes, the antitrust spotlight gives buyers leverage—and a time-bound window—to reset the balance between value and dependency.

In value terms, this can translate into lower total cost of ownership if you can mix-and-match tools cleanly and avoid paying for unused components. In risk terms, it is about resilience and strategic autonomy: the ability to switch or dual-source without business disruption. In governance terms, boards will expect a view on how potential remedies—if Microsoft is designated—could affect pricing, product scope and exit paths in your environment.

Preparing for likely directions in the UK CMA Microsoft business software probe

We do not know what the CMA will decide. The regulator is consulting and has published only an indicative roadmap of areas where it may consider interventions if it designates Microsoft, per GOV.UK. That said, it is prudent to scenario-plan around three themes raised by the CMA’s notice: bundling, interoperability and cloud licensing choice.

The question of who should own these decisions is covered in Do You Need a CTO Yet?.

First, bundling. The CMA says it will look at how Microsoft bundles its software, and separately examine whether the way Microsoft bundles and integrates its security products limits customer choice, according to GOV.UK. While debates about “Teams bundling” exist in the market, the CMA’s announcement does not take a view on any specific product; it simply states it will look at bundling and integration practices. If remedies were to touch bundling, expect unbundled price points, more modular SKUs, or clearer substitution pathways—any of which would change how you buy and phase deployments.

Second, interoperability. The CMA highlights making it easier for developers to integrate with Microsoft’s business software ecosystem. If this translates into action, it could mean more open interfaces, fewer artificial friction points for third‑party add‑ons, and better multi‑vendor workflows. Buyers should assume integration roadmaps will be a live point of evidence and negotiation.

Third, cloud licensing and portability. The CMA says it will determine whether customers have effective choice over which cloud to deploy their software licences on and the impact of Microsoft’s licensing practices on such choice, per GOV.UK. If that yields change, it could lower the penalty for running multi‑cloud or switching hosting environments mid‑term—again shifting the calculus of cost and resilience.

Finally, AI choice. The CMA will assess whether customers can freely choose the best AI tools and whether alternative AI providers have a level playing field to compete with Microsoft’s Copilot, as stated on GOV.UK. If AI assistants become more portable and substitutable, you’ll want your security, data access and change management to be ready.

Practical moves: contracts, interoperability and architecture

Contracts. Use the consultation period to open a constructive dialogue with Microsoft and your partners. Seek explicit portability rights for data, configurations and user settings across identity, collaboration and AI assistants. Ask for documented export mechanisms and service‑level commitments for exports. Pursue price protection and flexibility language so that, if products are unbundled or terms shift, you can adjust entitlements or terminate components without punitive fees. Where appropriate, add triggers that let you revisit terms upon regulatory changes.

When the need is senior judgement on specific decisions rather than ongoing leadership, virtual CTO services are the lighter option.

Interoperability. Catalogue your critical integrations and replace fragile, proprietary linkages with standard, documented interfaces wherever you can. In collaboration, validate that messaging, files and calendar data can be exported at tenant and space levels. In identity, ensure your directory and access policies can support more than one provider for core functions without major redesign. In AI, prefer patterns where assistants consume permissions via existing security models and avoid hard‑coding policies into a single vendor’s tooling.

Architecture. Design for graceful degradation and substitution. Keep a clean separation between content stores, control planes (identity, device, security) and experience layers (mail, chat, meetings, documents, assistants). That way, if unbundling creates new options—or if you choose to diversify—you can swap experiences without breaking governance. Track where proprietary formats or encryption models could trap you and create remediation plans.

Governance and risk. Treat portability as a board‑level risk control, not a technical nice‑to‑have. Define and test exit paths: how long it takes, what it costs, what data you may lose, and what downtime you can tolerate. Document a communication plan for end‑users should you need to move workloads or change tools. Align procurement, legal and security on acceptable terms for new contracts and renewals in light of potential regulatory outcomes.

What to do now: a 90‑day plan

1) Inventory and mapping. Build an authoritative inventory of your Microsoft entitlements and active usage across identity, collaboration, security and AI features. Map data locations, export options and critical integrations. Highlight anything that would impede switching or dual‑running.

2) Contract posture. Ahead of renewals, prepare a positions paper covering portability rights, export SLAs, component‑level termination, and price adjustment mechanisms if packaging changes. Use the CMA’s consultation as context and reference the regulator’s focus areas from GOV.UK when you open conversations.

3) Portability drills. Run a tabletop exercise: simulate moving a representative business unit’s mail, files, chat history, identities and AI assistant settings to an alternative stack. Time it, cost it, and capture blockers. Where you hit friction, assign owners and fix priorities.

4) Proofs of concept. Pilot at least one alternative in each of your critical categories—identity, collaboration, AI assistant—using production‑like data and controls. Measure user experience, security fit and admin overhead. You are not committing to switch; you are building options and an evidence base.

5) Cloud choice readiness. If you run perpetual or hybrid licences, analyse your deployment choices today versus what you would prefer. Document the cost of running those workloads on different clouds and where licensing terms constrain you. That way, if terms change, you can move quickly.

6) Board and budget. Brief your board on potential scenarios and your preparedness. Create a small contingency budget to exploit favourable terms or unbundled options if they appear. Agree decision criteria in advance so you can act without delay.

None of this presumes an outcome. The CMA is consulting and has identified areas for investigation and potential action, as described on GOV.UK. My view is simple: prepare now so that, whatever happens, you can maximise value, reduce risk and keep your options open.