The UK Competition and Markets Authority has proposed placing Microsoft’s business-software ecosystem under the country’s strategic market status regime, opening a path to rules that could reach well beyond Office and Windows. The regulator’s October 16 proposal covers five linked activities: PC operating systems, productivity suites, security software, server operating systems and relational databases.
No remedy has been ordered. The designation is provisional, Microsoft and other parties can respond through November 13, and the CMA must issue its final decision by February 13, 2027. But an accompanying intervention roadmap shows what could follow: equal access to Microsoft 365 data and functions for rival AI tools, clearer AI defaults, possible Copilot unbundling, cloud-licensing changes and equivalent security integrations for competing vendors.
The proceeding matters because the CMA is treating Microsoft’s products as one connected system rather than a collection of isolated markets. Its 179-page proposed decision says more than one million UK organisations spent over $7 billion on Microsoft products in 2025. It estimates 10 million to 20 million paid monthly Office 365 users and 20 million to 30 million organisational Windows 10 and Windows 11 devices in the country.
Copilot could face API parity, rival placement and unbundling rules
The most consequential part of the roadmap concerns AI inside Microsoft 365. The productivity-suite activity is defined broadly enough to include Office and Office 365 applications, Microsoft 365 Copilot, Copilot Chat, Copilot Cowork, Agents for Microsoft 365 Copilot, the Copilot app and Copilot add-ins. Microsoft Graph, Work IQ, the Microsoft 365 Admin Center and Agent 365 also fall within scope when they underpin or manage productivity functions.
Microsoft told the regulator that third-party AI providers can use public APIs to obtain substantially the same access to organisational Microsoft 365 data as Copilot. Rival providers challenged that account. Their concern is not merely whether an API exists, but whether it exposes equivalent functions and data, what access costs, whether a competing assistant can be discovered and invoked inside Microsoft-controlled surfaces, and how much engineering work is required when Microsoft changes an interface.
If further work finds that those differences restrict competition, the CMA says it could consider parity requirements giving alternative providers access to relevant Microsoft functions and data on equivalent terms. Other possibilities include prominent placement for rival AI products, user-selectable defaults, minimum notice periods before API changes and a durable process for requesting interoperability.
The commercial side could be just as important. The roadmap raises improved transparency around AI licensing and the possible unbundling of Microsoft’s AI features from its existing suites. That would aim to prevent a customer from effectively paying twice when it keeps Microsoft 365 but chooses Claude, ChatGPT or another specialist assistant.
The regulator’s commissioned customer research found that businesses are already testing several assistants. Copilot often wins on perceived security, company controls and Microsoft 365 integration, while respondents sometimes rated other tools more highly for specialist work. Customers also questioned Copilot’s return on investment and future pricing. Those findings do not prove unlawful conduct, but they explain why defaults, data access and suite pricing have become competition issues before workplace agents are fully established.
Cloud licensing remains a separate pressure point
The CMA is also examining whether Microsoft software costs or works differently when customers run it on AWS or Google Cloud instead of Azure. The products include Windows Server, SQL Server, Microsoft 365 and Windows 10 or 11.
The roadmap records concerns that some customers cannot bring newer Windows Server or SQL Server licences to certain large cloud providers, that rival clouds face higher service-provider licence prices, and that features such as unlimited Windows Server virtualisation, SQL Server failover rights, dual-use rights and Windows desktop multisession may be reduced or unavailable outside Azure.
Potential responses include fair, reasonable and non-discriminatory pricing across clouds, restrictions on licensing terms that favour Azure, and changes that let customers transfer previously purchased licences to the cloud they choose. These remain options for investigation, not commitments. The trade group CCIA welcomed the continued focus but criticised the lack of a firm timetable for action on licensing restrictions.
Security vendors say Microsoft receives better data
Security is the third area where the proposed ecosystem approach could have practical effects. The scope includes Entra, Active Directory, Intune and Defender, plus relevant functions in Purview, Security Copilot and Agent 365.
Competing security vendors told the CMA that Microsoft’s APIs and integration hooks do not always provide data as complete or timely as Microsoft receives. They also pointed to rate limits, Microsoft-controlled API changes and the difficulty of replacing Entra ID when it acts as the identity layer for the rest of a Microsoft deployment.
Pricing reinforces the technical advantage. When Defender and other security functions are already included in Microsoft 365 tiers or enterprise agreements, buyers can view a rival tool as an additional cost even if it performs better. The CMA’s customer work found that this “paying twice” problem can discourage third-party purchases unless an organisation can reduce its Microsoft licence tier.
Teams remedies provide a useful warning
Microsoft already offers Microsoft 365 without Teams after commitments accepted by the European Commission in 2025. Those measures require a meaningful price difference, interoperability and data-portability support, and Microsoft has extended parts of the package globally.
The UK evidence suggests formal unbundling alone may not reset a market. Customers still valued Teams because it was integrated with Office, even when they considered it merely sufficient rather than best in class. Rivals pointed to Outlook’s default Teams meeting link, placement inside Microsoft applications and the network effect created by an established user base. The CMA says it has not seen significant switching from Teams since Microsoft’s changes.
That experience is relevant to Copilot. A standalone price or checkbox would address only one part of the advantage. Rival assistants would also need workable data access, predictable APIs, visible entry points and defaults that administrators can change without degrading the employee experience.
What IT buyers should document now
Nothing in the proposal requires a customer to change products today. It does, however, identify the evidence that procurement and IT teams should preserve before their next renewal:
- the standalone and bundled prices for Copilot, Defender, Teams and other add-ons;
- features or data sources available to Microsoft products but missing from rival integrations;
- API fees, rate limits, deprecations and engineering work caused by interface changes;
- licence and functionality differences for the same Windows Server, SQL Server or desktop workload on Azure, AWS, Google Cloud and on-premises systems;
- data-export gaps, migration costs, retraining requirements and security work needed to replace one component; and
- defaults or Microsoft-controlled screens that steer users back to Teams, Edge, Copilot or another first-party service.
The distinction between designation and intervention is crucial. Strategic market status would not find that Microsoft broke the law. It would give the CMA authority to design targeted conduct requirements or, after another investigation, a pro-competition intervention. Each measure would require its own evidence, proportionality assessment and consultation.
The consultation therefore marks the start of a more specific fight, not its conclusion. The central question is whether customers can genuinely assemble a mixed workplace stack, or whether Microsoft’s licensing, identity layer, data access and user interfaces make alternatives viable only at the edges.
