UK CMA Targets Microsoft: 20M Users at Risk [2026]

Britain’s competition watchdog moved against Microsoft on October 16, 2026, proposing to designate the company with “strategic market status” across its business software ecosystem. The decision, if finalized, would hand the Competition and Markets Authority new powers to force changes in how Microsoft bundles, licenses and prices the tools that roughly 20 million UK users touch every month, according to Reuters.

The proposal targets five areas where the CMA says Microsoft holds a dominant position: personal-computer operating systems, productivity software suites, security software, server operating systems and relational database-management systems. That list reads like a map of Windows, Microsoft 365 (including Excel and Teams), Windows Server, SQL Server and Microsoft’s security product line. The Register reported the regulator is also scrutinizing how Copilot, Microsoft’s AI assistant, is woven into that stack.

Google · Preferred Sources

Don't miss new tech stories on Google

Add TrendinTech once in the Google app and our stories appear in your news suggestions.

Add Now

What the CMA Actually Proposed on October 16

The announcement is not a final ruling. It is a provisional decision opened for consultation, and the CMA is required to weigh responses from Microsoft and third parties before it issues a binding outcome. The regulator’s own published notice frames the move as the next stage of an investigation that began in May 2026, five months before the proposed designation landed.

Strategic market status is a relatively new regulatory tool in the UK, created under the Digital Markets, Competition and Consumers Act 2024. It does not require the CMA to first prove that a company broke the law. Instead, the designation lets the regulator impose tailored conduct requirements on a firm once it establishes two things: that the firm has substantial and entrenched market power in a specific digital activity, and that the activity carries strategic significance for the UK economy, businesses, consumers or public bodies. Microsoft, in the CMA’s provisional view, clears both bars in all five of the areas it examined.

CMA chief executive Sarah Cardell framed the stakes in plain terms. “Business software and cloud services underpin workplaces across the UK, from small firms to vital public services,” she said, a point echoed in coverage from Sharecast. She added that the evidence gathered during the investigation shows “a long-standing and significant presence” for Microsoft in the UK’s business software market.

Cardell’s broader argument centers on choice. “Organizations should be able to choose the products that work best for them, switch provider when they want to and combine services from different suppliers,” she said, according to The Register’s reporting. In a companion statement, she said the CMA wants “to ensure businesses have the freedom to choose how they use Microsoft’s products alongside alternatives.” That is the regulatory language for a concern that has dogged Microsoft for two decades: bundling that makes switching away from its stack expensive, technically painful or both.

Why This Investigation Reaches Developer and IT Infrastructure Tools

For engineering and IT teams, the part of this story that matters most is not Excel or Teams. It is the two entries buried in the CMA’s five-category list: server operating systems and relational database-management systems. Those categories point directly at Windows Server and SQL Server, the infrastructure layer underneath a huge share of enterprise applications, internal tools and, increasingly, the data pipelines feeding AI features inside those same applications.

The CMA’s concern, as described in its materials, is that licensing terms tied to that infrastructure layer restrict how organizations deploy workloads across cloud providers. A team running SQL Server under certain Microsoft licensing terms may face different costs, or outright restrictions, depending on whether it deploys to Azure versus AWS or Google Cloud. That dynamic has already shaped how teams in this publication’s own coverage weigh cloud pricing across AWS, Azure and GCP, where licensing portability is one of several factors that swing total cost of ownership by double digits depending on workload.

The CMA’s proposal does not name GitHub, GitHub Copilot, Azure DevOps or Visual Studio Code as separate digital activities under investigation. That is an important distinction and one worth stating plainly: this is not, at least not yet, a developer-tools antitrust case in the way some engineers might expect. But the omission does not mean the developer ecosystem is untouched. Copilot is explicitly referenced in the CMA’s examination of Microsoft 365 integration, and any conduct requirement that eventually applies to how Copilot is bundled into productivity software would likely ripple into how Copilot is positioned against coding-focused rivals. GitHub Copilot, which recently moved to streamline its own lineup by dropping three AI models ahead of a November 16 deadline, already operates in a crowded field where Cursor, Claude Code and other assistants compete on price and model choice rather than platform lock-in.

Editor’s note: reporting reviewed for this story did not identify named competitive responses from Google, Amazon Web Services, Oracle or Salesforce. The clearest industry reaction on record came from a trade association, discussed below.

Microsoft’s Response: Products Are “Open and Interoperable”

Microsoft disputed the CMA’s provisional findings. A company spokesperson said, “All our products, including Copilot, are open and interoperable, giving customers the ability to use them alongside competing services,” a statement reported by Yahoo Finance. The line draws a direct contrast with the CMA’s framing: Microsoft wants the conversation to stay on technical interoperability, while the regulator is focused on commercial and licensing structures that determine whether interoperability translates into real customer choice.

That gap between “technically possible to switch” and “commercially practical to switch” sits at the heart of nearly every major platform antitrust case of the past decade, and it is why this dispute is likely to run well past the October 2026 announcement. The CMA is not required to prove Microsoft broke a specific law to proceed with SMS designation. It only needs to establish entrenched market power and strategic significance, a lower bar than a full abuse-of-dominance finding, which is exactly why the tool was built the way it was under the 2024 Act.

Industry Reaction: CCIA UK Wants a Firmer Timetable

The most detailed trade-group reaction came from CCIA UK, an industry association whose members include major cloud and software competitors. In a statement reported by CCIA, the group welcomed the fact that software licensing restrictions remain under active scrutiny but criticized the CMA for not attaching a firm timetable to enforcement action, arguing UK businesses and public-sector bodies should be able to pick cloud providers with fewer constraints. CCIA UK also pointed back to earlier work from Ofcom and the CMA’s prior cloud-market investigation, arguing those reviews had already surfaced licensing-related competition concerns that have gone unresolved.

That critique matters for how this story should be read going forward. A proposed SMS designation is a procedural milestone, not a remedy. Nothing in the October 16 announcement forces Microsoft to change a single licensing term today. The practical consequences, if they arrive at all, will show up only after the consultation period closes and the CMA issues conduct requirements, a process that could easily stretch well beyond the statutory decision deadline.

The UK’s Strategic Market Status Regime, Explained

Strategic market status is the centerpiece enforcement tool created by the Digital Markets, Competition and Consumers Act 2024. Unlike a conventional competition case, which typically requires regulators to prove a company engaged in specific anticompetitive conduct and then litigate a remedy, SMS designation works in two stages. First, the CMA designates a firm as holding SMS in one or more defined digital activities. Second, once designated, the CMA can impose conduct requirements tailored to that firm and that activity, without needing to relitigate market power from scratch for every individual complaint.

That structure is deliberately built for speed relative to traditional antitrust litigation, which can run for years. It also gives the CMA room to pursue pro-competitive interventions, a category broad enough to include anything from mandated interoperability standards to changes in default settings or licensing terms, depending on what the regulator decides is necessary after designation.

Milestone	Date	Status
CMA opens SMS investigation into Microsoft	May 2026	Completed
CMA publishes proposed SMS designation	October 16, 2026	Completed
Public consultation period	Through mid-November 2026	Open
Microsoft and third-party submissions reviewed	Late 2026	Pending
Final SMS decision due	By February 2027	Pending
Possible conduct requirements, if designated	After February 2027	Unconfirmed

How the UK Regime Compares to the EU’s Digital Markets Act

Microsoft is not new to ex ante digital regulation. The European Union has already designated Microsoft a gatekeeper under its Digital Markets Act for specific services, including the Windows PC operating system and LinkedIn. The EU’s approach works through enumerated core platform services with quantitative thresholds largely based on user counts, turnover and market position, followed by a fixed list of obligations and prohibitions that apply once a company is designated.

The UK’s approach is structurally different, and in this case, broader in scope. Rather than evaluating each Microsoft service in isolation the way the DMA does, the CMA’s proposal treats Windows, Microsoft 365, Windows Server, SQL Server and Microsoft’s security software as a connected ecosystem, with the strategic significance test applied to the whole rather than to any single product line.

Dimension	UK Strategic Market Status	EU Digital Markets Act
Legal basis	Digital Markets, Competition and Consumers Act 2024	Digital Markets Act
Designation test	Entrenched market power plus strategic significance	Quantitative thresholds on users, turnover, market position
Scope for Microsoft	Windows, Microsoft 365, Windows Server, SQL Server, security software, treated as one ecosystem	Individual core platform services, including Windows PC OS and LinkedIn
Remedy style	Custom conduct requirements set per firm and activity	Standardized list of obligations and prohibitions
Geographic reach	United Kingdom	European Union

The two regimes can and likely will overlap in practice. A licensing change Microsoft makes to satisfy EU gatekeeper obligations will not automatically satisfy a UK conduct requirement, because the legal tests and the products in scope do not line up one to one. That creates a genuine compliance puzzle for Microsoft’s enterprise licensing teams, who may end up managing parallel, partially overlapping rulebooks for the same underlying products across two of its largest markets outside the United States.

How This Compares to the CMA’s Cases Against Google, Apple and Amazon

The Microsoft proposal is the latest in a string of CMA digital-market actions, but it does not look like the others. The CMA’s Google investigations have generally zeroed in on discrete practices: default search placement, advertising-technology conflicts of interest, or restrictions affecting rivals in mobile ecosystems. The CMA’s Apple scrutiny has centered on the relationship between iOS, the App Store, payment processing and third-party developers, essentially a single consumer-facing funnel. The Amazon cases have focused on marketplace dynamics, how sellers are treated and how first-party data gets used against them.

Microsoft’s case is structurally different from all three. Its use, as the CMA frames it, comes less from a single consumer storefront and more from decades of enterprise purchasing habits, software licensing terms, product bundling, identity and administration tooling, and the deep switching costs that build up when a company’s accounting, communication, security and database systems have run on one vendor’s stack for years. That is why the CMA’s proposal spans five categories rather than one narrow product line, and why the eventual remedies, if any, are likely to look different from anything imposed on Google, Apple or Amazon to date.

What a Final SMS Designation Could Mean for IT Buyers

It is worth being precise about what has and has not happened. Microsoft has not been found to have broken UK competition law. No fine has been proposed. No specific remedy, such as mandated product separation or a rewritten licensing schedule, has been announced. What exists today is a provisional CMA assessment, open for public comment through the consultation window, with a final decision due by the February 2027 statutory deadline.

If the CMA does finalize the designation, the realistic next step is a period in which the regulator works out specific conduct requirements, likely focused on the licensing and bundling practices it has already flagged as concerns: software-licensing terms that affect cloud-deployment choices, and bundling that limits a customer’s ability to adopt competing security products or AI tools instead of Copilot. None of that is confirmed yet, and any IT leader budgeting around a specific policy change based on today’s announcement would be acting on speculation rather than fact.

What is more immediately actionable is the signal this sends about licensing audits. Enterprises running mixed Microsoft and non-Microsoft stacks, the kind of organizations already comparing serverless costs the way this publication covered in its breakdown of container orchestration pricing, now have a regulatory body actively examining exactly the licensing frictions they encounter when moving workloads between providers. That alone is likely to embolden procurement teams to push back harder on restrictive terms during contract renewals, regardless of how the CMA’s final decision lands.

The Developer Platform Angle: Copilot, VS Code and the Coding Tools Market

Even though GitHub, GitHub Copilot, Azure DevOps and Visual Studio Code are not named as separate activities in the October 16 proposal, Microsoft’s developer tooling sits downstream of every product category under review. Windows is the operating system millions of developers code on. Microsoft 365 and Teams are the collaboration layer most enterprise engineering orgs use for standups, documentation and planning. SQL Server and Windows Server underpin a large share of the backend infrastructure those same developers build against.

That indirect exposure matters because the coding tools market has gotten more competitive, not less, over the past year. Editor battles like Zed versus VS Code versus JetBrains AI show a market where developers increasingly weigh editor choice independent of which cloud or OS vendor they use. The .NET ecosystem, examined in this outlet’s look at .NET 11 RC2 against a resurgent Java 27, is another front where Microsoft competes on technical merit rather than platform lock-in, a dynamic the CMA’s bundling concerns do not directly touch but that shapes how much use Microsoft actually has left in developer-facing markets specifically.

If the CMA’s eventual conduct requirements touch Copilot’s integration into Microsoft 365, the effect on the standalone coding-assistant market, where GitHub Copilot already competes against Cursor, Claude Code and other tools on pricing and model access rather than platform exclusivity, would likely be smaller than the effect on productivity software. Copilot’s position in Excel and Teams is a bundling story. Copilot’s position in software engineering is already a head-to-head feature and pricing competition, one that regulatory intervention in office software is unlikely to reshape directly.

Historical Context: Microsoft’s Long Run-In With Antitrust Regulators

Microsoft’s current regulatory position is shaped by a long institutional memory of antitrust exposure, stretching back to the US Department of Justice’s case over Internet Explorer bundling in the late 1990s and the EU’s long-running disputes over Windows Media Player and browser defaults in the 2000s. Those earlier cases followed the traditional model: prove a specific abuse, then negotiate or litigate a remedy. The UK’s SMS framework represents a deliberate departure from that model, designed explicitly because regulators concluded the old approach moved too slowly to keep pace with how quickly digital markets consolidate.

Microsoft has also spent much of 2026 navigating a different kind of regulatory conversation, pushing back on how fast AI policy itself is moving. The company’s own public position, voiced by president Brad Smith, has been that AI oversight in some jurisdictions lags behind rules governing far more mundane products, a point this publication covered in its report on Brad Smith’s comparison of AI regulation to dairy safety rules. The CMA’s business-software proposal and that AI-regulation debate are separate workstreams, but together they frame a company facing scrutiny from multiple regulatory angles at once, on both its legacy enterprise software and its newest AI products.

Market Impact: What Investors and Enterprise Buyers Are Watching

A proposed SMS designation, on its own, is unlikely to move Microsoft’s business fundamentals in the near term. The company’s enterprise software and cloud revenue streams are diversified across markets far larger than the UK, and nothing in the October 16 announcement imposes an immediate cost. The bigger question for investors and competitors is precedent: if the CMA follows through with firm conduct requirements by its February 2027 deadline, it would mark one of the first real tests of the UK’s post-Brexit digital markets regime against a US technology giant, and the shape of that remedy would likely influence how other regulators, including in the EU, approach similar bundling and licensing concerns going forward.

For competing software vendors, the near-term impact is more about use in sales conversations than any concrete policy shift. A regulator publicly scrutinizing Microsoft’s bundling practices gives rival security, database and productivity vendors a talking point in procurement negotiations, even before any formal remedy exists.

Predictions: Where This Investigation Likely Goes Next

The consultation period will draw formal submissions from major Microsoft competitors in cloud, security and productivity software, even though none were named in the initial round of public reaction beyond CCIA UK.
Microsoft will continue publicly framing its products as interoperable while privately negotiating the scope of any eventual conduct requirements, a pattern consistent with how it handled EU Digital Markets Act gatekeeper obligations for Windows and LinkedIn.
If the CMA finalizes the SMS designation by the February 2027 deadline, the first conduct requirements will likely target software-licensing terms affecting multi-cloud deployment before touching Copilot bundling directly, since licensing restrictions are the concern the CMA has described in the most concrete terms so far.
Expect limited direct impact on the standalone coding-assistant market in the short term, since GitHub Copilot, Cursor and Claude Code already compete on pricing and model access rather than the bundling dynamics under CMA review.
The EU is likely to monitor the UK outcome closely, and any UK remedy that proves effective at increasing switching could become a template referenced in future Digital Markets Act enforcement actions against Microsoft’s remaining designated services.

What Happens Between Now and the February 2027 Deadline

The immediate milestone is the consultation window, during which Microsoft and third parties can submit formal responses to the CMA’s provisional assessment. The CMA is statutorily required to consider that input before reaching a final decision, and it retains the ability to narrow, modify or outright reject parts of its own proposal based on what it hears. That is a meaningful check on the process, and it means today’s five-category list is a starting point for negotiation, not a locked outcome.

Assuming the CMA does designate Microsoft with strategic market status, the clock then resets for a separate, undefined process: drafting and imposing the actual conduct requirements. Nothing in current reporting establishes a timeline for that second phase, which means the practical, felt effects of this proposal, if any reach UK customers at all, are unlikely to arrive before late 2027 at the earliest.

Frequently Asked Questions

What is strategic market status?
It is a UK regulatory designation created under the Digital Markets, Competition and Consumers Act 2024 that lets the Competition and Markets Authority impose tailored conduct requirements on a company found to have entrenched market power and strategic significance in a specific digital activity.

Has Microsoft actually been designated with SMS status?
No. As of October 16, 2026, the CMA has only proposed the designation. It is subject to a public consultation, and a final decision is due by February 2027.

Which Microsoft products are covered by the proposal?
The CMA’s five areas point to Windows as a personal-computer operating system, Microsoft 365 productivity software including Excel and Teams, Microsoft’s security software, Windows Server, and SQL Server as a relational database-management system. Copilot is examined in relation to its integration into these products.

Does this investigation cover GitHub Copilot, Azure DevOps or Visual Studio Code?
Not directly. The CMA’s published proposal does not list these as separate digital activities under review. Any effect on the developer-tools market would come indirectly, through conduct requirements applied to the five named categories.

How does this differ from the EU’s Digital Markets Act rules on Microsoft?
The EU has already designated Microsoft a gatekeeper for specific services, including the Windows PC operating system and LinkedIn, under a framework built around enumerated services and quantitative thresholds. The UK’s approach instead treats Microsoft’s business software as a connected ecosystem and applies a different two-part test focused on entrenched market power and strategic significance.

What has Microsoft said in response?
A Microsoft spokesperson said the company’s products, including Copilot, are open and interoperable and can be used alongside competing services, pushing back on the CMA’s provisional assessment.

What happens if the CMA finalizes the designation?
The CMA would gain the ability to impose conduct requirements on Microsoft specific to the designated activities, potentially including changes to licensing terms or product bundling. No specific remedy has been announced, and the timeline for any such requirements beyond the February 2027 decision deadline is not yet established.

When can businesses expect a final decision?
The CMA faces a statutory deadline of February 2027 to reach a final decision on the proposed designation, following the public consultation period that opened on October 16, 2026.

UK CMA Targets Microsoft Business Software: 20M Users [2026]