Microsoft SMS investigation: the CMA turns to business software
In short: The Microsoft SMS investigation is the CMA’s inquiry into whether Microsoft has strategic market status in business software. Launched on 14 May 2026 under the Digital Markets, Competition and Consumers Act 2024, it covers Office, Windows, Windows Server, SQL Server and security software. The invitation to comment closed on 4 June 2026 and the CMA must decide by 13 February 2027.
Hundreds of thousands of UK organisations run their working day on Microsoft software, from Outlook and Excel to Windows Server and the identity systems that secure their networks. The question the CMA has now put is whether that dependence has tipped into market power the law should constrain. On 14 May 2026 it opened a strategic market status investigation into Microsoft’s business software ecosystem, its fourth such inquiry under the digital markets regime. The consultation closed on 4 June 2026 and the CMA has now published the responses: most urge it to act, and Microsoft rejects the case. The investigation has moved into its evidence phase, and must finish by 13 February 2027.
Key facts of the Microsoft SMS investigation
- This is the CMA’s fourth SMS investigation, after Apple and Google in mobile platforms and Google in general search. Source: CMA press release, 14 May 2026.
- The CMA estimates more than 20 million UK organisational users rely on the Microsoft ecosystem. Source: Invitation to comment, 14 May 2026.
- Five digital activities are in scope and may be grouped as one ecosystem: productivity software (including Copilot), the PC operating system, the server operating system, the relational database system and security software.
- The invitation to comment closed on 4 June 2026; a proposed decision is expected in October 2026; the statutory deadline for a final SMS decision is 13 February 2027.
- The CMA is examining four issue areas: extension into adjacent markets such as cloud, interoperability, bundling, and default and design choices, with AI shaping all four.
What the Microsoft SMS investigation covers
The Microsoft SMS investigation asks whether Microsoft holds strategic market status in business software supplied to UK organisations. The CMA has described five digital activities: a productivity software suite (Outlook, Word, Excel, PowerPoint, OneDrive, SharePoint and Teams, including Copilot features); a PC operating system (Windows 11); a server operating system (Windows Server); a relational database management system (SQL Server); and security software (Entra ID, Active Directory, Intune and Defender). Consumer use sits outside the scope; the focus is businesses and the public sector.
The CMA’s working theory is that these activities are not really separate. Under section 3(3) of the Digital Markets, Competition and Consumers Act 2024, the CMA may group several digital activities and treat them as one where they serve substantially the same purpose or are carried out in combination. Microsoft markets its products as an integrated, secure, one-stop package, and the CMA proposes to treat the whole as a single digital activity, Microsoft’s Business Software Ecosystem. How the products interoperate, and how far third-party software can plug into them, is central to that assessment.
From designation to conduct requirements: how the SMS regime works
The bar for designation is high. Under Part 1 of the Act, which came into force on 1 January 2025, the CMA may designate a firm with SMS in a digital activity where, under section 2, it has substantial and entrenched market power and a position of strategic significance, and where the turnover condition is met (global group turnover above £25 billion or UK turnover above £1 billion). Microsoft clears the turnover threshold comfortably. The CMA must reach a final decision within nine months, here by 13 February 2027.
Designation by itself changes nothing about how Microsoft behaves. The operative tools come next. Under section 19, the CMA may impose conduct requirements on a designated firm where proportionate for one of three objectives, fair dealing, open choices, and trust and transparency, and the requirement must be of a permitted type listed in section 20. Beyond conduct requirements, a pro-competition intervention can compel deeper structural change where the CMA finds an adverse effect on competition. Breach of a conduct requirement exposes a firm to penalties of up to ten per cent of worldwide turnover.
The CMA has just run the same sequence with Google. It designated Google with SMS in general search on 10 October 2025 and, on 17 June 2026, imposed the first conduct requirements on the search business. Our analysis of those Google search conduct requirements sets out how a designation turns into enforceable rules, and the first commitments accepted from Apple and Google show the voluntary route the same regime allows. Microsoft is now where Google was before its October 2025 designation, and the Google sequence shows what designation can produce.
The four competition concerns the CMA is examining
The invitation to comment sets out four issue areas the CMA may address if it designates Microsoft. The first is the extension of market power into adjacent markets, above all cloud. The CMA’s cloud services market investigation, concluded on 31 July 2025, found that Microsoft charges rival clouds materially higher wholesale prices to run key software such as Windows Server and SQL Server than it charges for the same software on its own Azure platform, weakening the competitive constraint that AWS and Google Cloud can exert. An SMS designation would let the CMA address those licensing practices directly, including through fair, reasonable and non-discriminatory pricing obligations.
The other three concerns sit inside the ecosystem itself. Interoperability is about whether technical design, asymmetric interface access or control over de facto standards make it harder for customers to combine Microsoft products with rival software. Bundling is about whether packaging and pricing across the suite, including where AI tools are folded into existing subscriptions, steer customers away from standalone competitors. Defaults are about whether pre-enabled settings, prominence and the number of steps to switch quietly entrench Microsoft’s own products. AI cuts across all four: the CMA wants to ensure that as Copilot and agentic tools become embedded in everyday software, customers can still mix and match AI services from competing suppliers.
For firms whose products depend on integrating with the Microsoft stack, or whose deals turn on a target’s exposure to it, these issues belong in regulatory due diligence now rather than after designation. The broader UK regime is mapped in our guide to what the CMA does.
What Microsoft and the published responses say
The invitation to comment closed on 4 June 2026 and the CMA has published the non-confidential responses. Microsoft’s submission rejects the case for designation. It argues that it competes vigorously across the five activities, pointing to Google Workspace, macOS, Linux, PostgreSQL and Okta as evidence that customers have alternatives, and that AI is lowering the barriers to building enterprise software rather than entrenching an incumbent. On that view a third SMS investigation, after mobile and search, is disproportionate, and the better course is to monitor outcomes rather than to designate.
The weight of the other responses runs the other way. Rivals, enterprise customers, public-sector bodies and industry coalitions, among them Google, the Startup Coalition, the Open Cloud Coalition, Jisc, the Lloyd’s Market Association and Virgin Media O2, urge the CMA to designate. The recurring themes track the CMA’s four concerns: lock-in across interconnected products, bundling and pre-enabled settings, licensing that customers describe as offered on a take-it-or-leave-it basis, and the risk that embedding Microsoft’s own AI across the stack forecloses rivals before the market settles. The Open Cloud Coalition put the cost of Microsoft’s licensing to the UK public sector at around £60 million a year; the Startup Coalition’s warning captures the timing worry, that a remedy which arrives late arrives weakened.
The split matters less than the numbers suggest. The CMA cannot designate on a show of hands; it has to find the statutory tests met on the evidence, and Microsoft’s contestability and AI arguments go to the heart of the entrenchment question it must answer.
How the UK investigation compares with the EU and Germany
The UK is a late mover here, and that shapes what the investigation is for. The European Commission has already acted twice. It accepted legally binding commitments from Microsoft on 12 September 2025 over the tying of Teams to Office 365 and Microsoft 365: Microsoft must offer those suites without Teams at a reduced price, improve interoperability between Teams and competing collaboration tools, and let customers move their data out of Teams to switch. The commitments run for seven years, and ten years for the interoperability and data portability elements. Separately, Microsoft is a designated gatekeeper for Windows under the EU Digital Markets Act since 5 September 2023, which subjects it to per-se obligations on defaults, interoperability and self-preferencing under Articles 5 and 6 of Regulation (EU) 2022/1925. In Germany, the Bundeskartellamt determined on 27 September 2024 that Microsoft is of paramount significance for competition across markets under section 19a of the German Competition Act, an ecosystem-wide finding that expressly takes in cloud and AI.
The gap the CMA is closing is enforceability. Microsoft applies the Teams commitments globally as a matter of choice, but they are not legally enforceable in the UK, and the DMA and section 19a operate only on their own side of the Channel. Without an SMS designation the CMA has no standing tool to require interoperability, unbundling or fair licensing from Microsoft in the UK. The design of the UK response also differs in kind. The EU works through the DMA’s fixed, per-se obligations and through Article 102 commitments tied to a specific product; the CMA’s SMS regime is bespoke and forward-looking, letting it shape conduct requirements to the evidence, group the whole ecosystem as one activity, and weigh how AI entrenches market power over a five-year horizon. That bespoke design is slower than the EU model: each case must be built rather than read off a statute.
| Authority | What it has done on Microsoft business software | Legal basis | Status |
|---|---|---|---|
| CMA (UK) | Opened an SMS investigation into the business software ecosystem; bespoke conduct requirements and pro-competition interventions available on designation | DMCCA 2024, Part 1 | Open; final decision due by 13 February 2027 |
| European Commission | Accepted binding commitments to sell Office 365 and Microsoft 365 without Teams, improve interoperability and enable data portability | Article 102 TFEU | Accepted 12 September 2025; runs 7 to 10 years |
| European Commission | Designated Windows a gatekeeper service, applying per-se duties on defaults, interoperability and self-preferencing | Digital Markets Act, Articles 5 and 6 | Designated 5 September 2023; obligations from 7 March 2024 |
| Bundeskartellamt (Germany) | Found Microsoft of paramount significance for competition across markets, ecosystem-wide including cloud and AI | Section 19a, German Competition Act | Determined 27 September 2024; valid 5 years |
Viewpoint
Whether Microsoft holds substantial and entrenched market power is the question the investigation exists to answer, and on the AI point it is genuinely open: rapid change can dislodge an incumbent as readily as entrench one, and the CMA must take a five-year forward view. Microsoft’s own response stakes out that ground, arguing AI is lowering entry barriers, while the submissions against it argue the opposite. The CMA’s options if it does designate are, by contrast, already clear. The cloud services investigation has given it a tested theory of harm on software licensing and a menu of remedies it chose not to impose in 2025, and an SMS designation would supply the enforceable tool it lacked then. I would expect software licensing and cloud to do the heavy lifting in any first tranche of conduct requirements, with interoperability close behind, because both are evidenced and both have international precedent the CMA can draw on. The Google sequence shows the CMA will move in tranches and at speed once it designates, so the February 2027 deadline understates how quickly the first obligations could follow. AI is the harder judgement: the CMA is right that the contest worth protecting is whether customers can combine AI services across suppliers rather than take Copilot by default, but that is a moving target, and a conduct requirement framed against today’s product architecture can date quickly. The EU has already secured real concessions from Microsoft on Teams; the UK’s task is to turn its later start into a more durable, ecosystem-wide settlement rather than a narrower copy. The wider convergence and divergence of the UK and EU regimes is set out in our analysis of competition law and data protection, and the enforcement trajectory in digital platform follow-on litigation.
Frequently asked questions
What is the CMA’s Microsoft SMS investigation?
It is an inquiry under Part 1 of the Digital Markets, Competition and Consumers Act 2024 into whether Microsoft has strategic market status in its business software ecosystem. Launched on 14 May 2026, it covers productivity software, the PC and server operating systems, the SQL Server database and security software supplied to UK organisations. The CMA must decide whether to designate Microsoft by 13 February 2027.
What would an SMS designation allow the CMA to do?
Designation is a gateway to intervention. It would let the CMA impose conduct requirements under section 19 of the Act, for the fair dealing, open choices or trust and transparency objectives, and to pursue pro-competition interventions where it finds an adverse effect on competition. Likely areas include fair licensing of Microsoft software on rival clouds, interoperability with third-party products, and limits on bundling and default settings.
How does the UK investigation compare with EU and German action?
The EU and Germany have already acted. The European Commission accepted binding commitments on 12 September 2025 requiring Microsoft to unbundle Teams from Office 365 and Microsoft 365, and Windows is a designated gatekeeper under the Digital Markets Act. The Bundeskartellamt found Microsoft of paramount significance under section 19a in September 2024. Those measures do not bind Microsoft in the UK, which is why the CMA needs its own SMS designation to act.
When will the CMA decide?
The CMA expects to publish a proposed decision for consultation in October 2026, consult into November 2026, and issue its final decision and any SMS designation notice by the statutory deadline of 13 February 2027. Any conduct requirements would follow designation and could be imposed in tranches, as the CMA has done with Google.
What did Microsoft argue in response?
Microsoft’s submission rejects the case for designation. It argues that it competes vigorously across the five activities, pointing to Google Workspace, macOS, Linux, PostgreSQL and Okta as alternatives available to customers, and that AI is lowering the barriers to building enterprise software rather than entrenching an incumbent. Most other published responses take the opposite view and urge the CMA to designate.
For advice on how the Microsoft SMS investigation affects a business that depends on the Microsoft ecosystem, or a transaction involving a platform-dependent target, contact Rob Bratby at Bratby Law. We advise on the digital markets regime, regulatory due diligence and platform terms and policies.
