CMA Proposes Special Status for Microsoft - What It Could Mean for UK Businesses Locked Into 365

The Competition and Markets Authority proposed on 16 October 2026 to designate Microsoft as having strategic market status (SMS) in its business software ecosystem, under the Digital Markets, Competition and Consumers Act 2024. The CMA defines that ecosystem as five digital activities: operating systems, productivity software, security software, server operating systems, and relational database management systems such as SQL Server. Together they reach more than a million UK businesses and public sector bodies, with around 20 million monthly UK users. A consultation is opening, and a final decision is due by February 2027.

The CMA’s headline provisional finding will be familiar to anyone who has tried to move part of a business off Microsoft: customers face real difficulty switching away from Microsoft, or combining it with alternative providers. CMA chief executive Sarah Cardell put the principle plainly: “Organisations should be able to choose the products that work best for them, switch provider when they want to and combine services from different suppliers.” Microsoft disputes the premise, saying it operates in a “vigorously competitive” market and pointing to rivals including Google Workspace, macOS, Linux, PostgreSQL and Okta. Two points matter for UK businesses straight away. Designation, if it comes, does not itself allege wrongdoing or change anything in the market — it gives the CMA power to impose targeted requirements after further investigation. And nothing is final until February. This is a process to watch and plan around, not a reason to change anything this week.

What the CMA has proposed, and what it has not

Strategic market status is the central tool of the UK’s digital competition regime under the Digital Markets, Competition and Consumers Act 2024. Designating a firm does not, in itself, find that it has done anything wrong, and it does not change any product, price or contract. What it does is give the CMA power to impose targeted conduct requirements, or pursue pro–competition interventions, following further investigation. The proposal published on 16 October is the start of that process, not its outcome.

The CMA’s provisional findings describe Microsoft as holding a strong position across all five activities it has identified. It points to switching barriers, and to commercial bundling and integration advantages, that rival software developers struggle to overcome. Its headline finding is about customers: they face real difficulty switching away from Microsoft or combining Microsoft products with those of other providers. That is the point most directly relevant to a UK business, because it describes the everyday experience of trying to use a non–Microsoft tool alongside Microsoft 365.

The regulator has also set out an indicative roadmap of the areas it would look at if designation goes ahead. There are four: cloud licensing terms; whether customers can freely choose AI tools beyond Copilot; how Microsoft’s bundling of security products limits customer choice; and communications and collaboration software such as Teams. Each of these is a potential area for future intervention, not a decision already taken.

Microsoft’s position deserves to be stated fully. The company argues that it operates in a “vigorously competitive” market and cites rivals within its ecosystem including Google Workspace, macOS, Linux, PostgreSQL and Okta. It also notes that its 34,000 UK partners contribute £38bn to the UK economy. Those rivals are real and widely used, and a business choosing between them today faces genuine options. The CMA’s point is narrower: not that alternatives do not exist, but that switching to them, or mixing them with Microsoft, is harder than it should be.

Support for designation has come from outside groups. The Open Cloud Coalition estimates that Microsoft’s licensing practices cost the UK public sector around £60m a year, and more than £300m over a Parliament — an estimate from the coalition, not a CMA finding. More than 30 organisations urged the CMA to proceed. Separately, the CMA said Microsoft and AWS have made some voluntary progress on cloud interoperability, including removing data transfer fees for customers who switch, but that more work remains, with a further update due in spring 2027.

From new powers to a proposed designation

The chronology below follows the regulatory process as reported. Most of the consequential dates are still ahead, which is the point for planning purposes.

The planning implication of that timeline is that any practical changes for customers are some way off. Even if the CMA designates Microsoft in February 2027, specific requirements on licensing, AI tools, security bundling or Teams would come after further investigation. A business renewing its Microsoft licences this winter is doing so under the current terms. What it can do now is understand its own dependencies, so that if changes do arrive — or if it simply wants more choice at its next renewal — it knows which parts of its estate could actually move.

Where lock–in actually lives in a Microsoft 365 business

The chart below is an indicative planning model — not measured data — ranking common parts of a typical UK SME’s Microsoft estate by how difficult they usually are to replace or to run alongside a rival product.

The ordering matches the CMA’s point about integration. Identity sits at the top because everything else depends on it: sign–in for email, files, Teams, line–of–business apps and often third–party services too. Replacing it is rarely a single project; it touches everything. Email, Teams and files follow because they carry years of accumulated data, links, habits and integrations. Security tools bundled into a licence are moderately hard to replace, not technically but commercially — a rival product has to compete against something that appears to cost nothing extra, which is precisely the bundling concern on the CMA’s roadmap.

Desktop apps and document formats sit lower than many people expect, because standard file formats travel reasonably well between products. SQL Server is lower still for most SMEs, simply because many do not run their own databases; for those that do, the difficulty depends heavily on the applications built on top. The point of the chart is not that any of these should be moved. It is that each one is a different kind of dependency, and a business that knows which kind it has is in a much better position at renewal time.

Three of the four roadmap areas touch a typical SME directly

Set the CMA’s indicative roadmap against what an ordinary UK small business on Microsoft 365 actually uses.

AI tools beyond Copilot matters to any business deciding which AI assistants to use. If it is harder to connect a rival AI tool to company email, files and calendars than to switch on Copilot, the choice is shaped by integration rather than by which tool is best. The CMA’s interest is in whether customers can choose freely; for a business, the practical question is whether the AI tool it would prefer can actually work with its Microsoft data, and on what terms.

Security bundling applies to the many SMEs whose Microsoft 365 licence includes security features. Bundled tools can be good value and perfectly capable. The concern on the roadmap is whether bundling makes it difficult for customers to choose a different security product where it would suit them better, because the alternative has to justify a separate cost while the bundled one appears to be free.

Teams applies to almost every Microsoft 365 business, because it is where chat, meetings and increasingly telephony live. The CMA’s roadmap includes communications and collaboration software, and any future requirements in that area would be directly felt by ordinary users. Cloud licensing, the fourth area, is mainly relevant to organisations that run Microsoft software — Windows Server, SQL Server — on cloud platforms other than Azure; for a small business entirely on Microsoft 365, it is less immediate.

The summary is that this is not an enterprise–only story. Most of the areas the regulator has flagged are features a small business uses every day, which is why the outcome of the process is worth following even for organisations with a handful of licences.

Where UK businesses are exposed

The rows below reflect where dependency on a single business–software supplier typically creates risk or limits choice in a UK SME, with badges indicating how much attention each usually needs.

The second row matters regardless of competition policy. A business whose email and files exist only inside one provider’s service is dependent on that provider not just commercially but operationally — for availability, for recovery from accidental deletion, and for recovery from account compromise. An independent backup of Microsoft 365 data held outside the tenant addresses all of those, and it also happens to be the single most useful thing to have if the business ever does want to move part of its estate elsewhere.

The fourth row is the dependency question the CMA’s finding implies. Most businesses have never estimated how long it would take, or what it would cost, to move one component — email to another provider, chat to another tool, a database to another engine. They do not need to move anything to benefit from knowing. The estimate is what turns a vague sense of being locked in into a concrete position, and it is the information a business needs to negotiate at renewal or to take advantage of any changes the regulator eventually secures.

What understanding your dependency costs

The bands below are indicative planning figures for the professional time involved in reviewing a Microsoft dependency — not quotes, and not a recommendation to move away from Microsoft. Licence costs are separate.

The bottom row is the right place to start and costs nothing. Many businesses discover they are paying for licences nobody uses, or for a higher tier than their usage justifies, and almost as many find their only copy of years of email and documents is inside the service they are paying for. Neither has anything to do with competition law; both become more valuable to know as the CMA’s process moves towards a decision.

Two ways to hold a dependency on one supplier

Nothing in the right–hand column means leaving Microsoft. For most UK SMEs, Microsoft 365 is a sensible, capable platform and will remain so. The difference between the columns is whether the dependency is chosen and understood, or simply accumulated. A business that knows where it is locked in, holds its own copy of its data, and buys licences based on use is in a far stronger position — to negotiate, to recover from a problem, and to benefit from whatever the regulator eventually decides.

Why this matters even if you never plan to switch

It is tempting to treat a competition case about the world’s largest software company as relevant only to its rivals and to large enterprises. The CMA’s framing suggests otherwise. It describes a business software ecosystem reaching more than a million UK businesses and public bodies, and its headline concern is the ordinary customer’s ability to switch or combine providers. That is a question about small businesses as much as large ones.

There are practical reasons to care even without any intention of moving. Dependency affects resilience: an organisation whose identity, email, files and chat all sit with one provider is exposed to that provider’s outages and changes, as Microsoft’s recent Azure maintenance incident and OneDrive storage changes have both illustrated in different ways. Dependency affects negotiation: a business that can credibly say which components it could move has more leverage at renewal than one that cannot. And dependency affects choice: when evaluating an AI assistant or a security product, knowing how a rival would integrate with your Microsoft estate is the difference between a real comparison and a default.

The public–sector dimension adds context. The Open Cloud Coalition’s estimate that licensing practices cost the UK public sector around £60m a year is its own figure, not a regulator’s, and Microsoft disputes the premise behind it. But public bodies’ reliance on Microsoft is substantial, as our earlier reporting on police data held on Azure noted, and suppliers to the public sector may find their own technology choices increasingly scrutinised as these questions are worked through.

For a virtual CIO conversation, this is a classic medium–term planning item: no urgency this week, real potential consequences next year, and a decision — how deliberately to manage a major supplier dependency — that nobody in a typical SME owns. The cheapest time to understand that dependency is before a renewal, an outage or a regulatory change forces the question.

The story at a glance

This story connects to several we have covered recently. Microsoft’s OneDrive storage changes showed how a supplier’s decisions can change what customers get without any action on their part. Microsoft’s maintenance breaking Azure hybrid connectivity is a reminder of the operational side of concentrating on one provider. The reporting on UK police data held on Microsoft Azure examined public–sector dependency in detail. The CMA’s nexfibre–Netomnia findings show the same regulator applying competition thinking to a market small businesses buy from. The AI minister’s breach warning argues for knowing which AI tools you run — a choice the CMA roadmap now touches. And the Met Police shadow IT reprimand is the opposite problem: staff reaching for tools outside the approved estate because the approved route was harder.

Frequently asked questions

Cloudswitched

London-based managed IT services provider offering support, cloud solutions and cybersecurity for SMEs.