Derek Mills

The CMA Is Going After Microsoft and Every IT Buyer Should Be Paying Attention

March 31, 2026

I told Tory about the CMA investigation into Microsoft cloud licensing last week and he said, "That's interesting, Derek," in the voice of someone who has decided to be present but not actually listen. He's been doing that a lot lately since the car went. But I'm going to keep talking about it because this story is important, and most IT buyers in small and mid-sized businesses have no idea it's happening.

Here is what happened, and I'm going to try to say it as plainly as possible: the UK's Competition and Markets Authority - one of the most aggressive regulatory bodies in the world right now - spent over a year digging into Microsoft's cloud licensing practices, found genuine reasons for concern, and has now formally launched a strategic market status investigation into Microsoft's business software ecosystem. That investigation starts in May and can take up to nine months to complete. This is not a minor regulatory skirmish. This is a fundamental challenge to how the most powerful software company on earth sells to businesses.

Every procurement decision you're making about Microsoft right now is happening inside a market that is actively being questioned by national regulators on two continents. That should change how you think about it.

What the CMA Actually Found

The investigation started before the CMA even got involved. Regulatory bodies have a habit of noticing what most businesses miss. In September 2022, Ofcom launched a probe into the UK's cloud services market, and by the time they handed findings to the CMA in October 2023, the picture was already concerning. The CMA was prompted to investigate the UK cloud infrastructure services market after Ofcom conducted its own study, unearthing evidence of uncompetitive behaviour from AWS and Microsoft, which Ofcom then referred to the CMA for further probing.

The investigation was supposed to wrap up by April 2025. It didn't. The CMA extended its deadline to August 2025, citing the complexity of Microsoft's licensing structure specifically. It concluded on July 31, 2025. The extension is meaningful. The CMA doesn't drag things out for fun - they extended because Microsoft's licensing structure is genuinely complicated to untangle.

The core allegation isn't subtle. The CMA focused on concerns about Microsoft's alleged anti-competitive cloud licensing tactics, which include accusations that the software giant charges enterprises more for running its software in its competitors' clouds - and similarly charges customers more for opting to run software made by other IT providers in its Azure cloud. Read that twice. Microsoft allegedly makes it more expensive for you to run Microsoft software on AWS or Google Cloud than on Azure. If you want the flexibility of a multi-cloud environment, you pay a penalty for that flexibility.

The CMA's final report confirmed it: Microsoft's licensing practices are adversely impacting the competitiveness of AWS and Google in the supply of cloud services, particularly in competing for customers. In fact, the price Microsoft charges rivals for some products can be higher than the retail price it charges its own customers. That's not a theory. That's a finding backed by a two-and-a-half-year investigation.

The Egress Fee Sleight of Hand

Microsoft made a PR move that deserves some scrutiny. In March 2024, they announced they were removing Azure egress fees - the charges you pay when you move data out of their cloud. On its face, that sounds like they heard the complaints and responded. The reality is more complicated.

The crux of the problem, according to customers and regulators, is that while these tech giants make it free to move data into their clouds, they charge for moving data out - whether to a rival provider or to in-house infrastructure - and this can make it prohibitively expensive to leave. Microsoft's move to waive those fees looks like a concession. But read the fine print.

Microsoft's blog post doesn't mention this, but the free transfer out only applies to storage data - so data transfers from other Azure services, such as the Azure Content Delivery Network, will still include standard charges. The headline was "Microsoft removes egress fees." The reality was narrower than that.

And more importantly - even if egress fees disappeared entirely, they were never the main problem. A Gartner analyst called egress fees "a red herring," saying that anyone who claims egress fees make it difficult to switch has "no understanding of what it actually takes to leave," and that the cost of the move is trivial compared to the ongoing cost of storing data. The real lock-in is the licensing structure. It's the penalty Microsoft builds into what it costs to run Office, Teams, and the rest of its productivity stack somewhere other than Azure. That's what the CMA is actually after.

This Is the 1990s Case, But Bigger

Jamie came by my desk yesterday and told me he'd read something about this and that it was "basically the same thing as the browser stuff from back in the day." He's not wrong, but he undersells it significantly, which is very on-brand.

The investigation targets Microsoft's dominance across multiple interrelated markets: operating systems, productivity software, cloud infrastructure, and artificial intelligence. The probe examines cloud and AI offerings as part of a comprehensive review of how the company leverages its existing market power to foreclose competition in emerging technology sectors - a holistic approach that reflects concern that Microsoft is replicating the bundling strategies that led to antitrust action in the 1990s.

That's not just one market. That's the stack. And the stack dynamic is exactly what makes this harder to crack than the old browser wars. Back then, Microsoft had one dominant product and one market it was leveraging it into. Now Microsoft operates a vast ecosystem of interconnected services - Windows, Office, Azure, Teams, Copilot, security tools, identity management - which makes it harder for regulators to identify specific harmful practices, but also potentially more damaging to competition when they do.

This is exactly why The Last Jedi is the most structurally ambitious film in the sequel trilogy - Rian Johnson didn't just subvert one expectation, he was subverting the entire enterprise mythology simultaneously. It's genuinely harder to pull off. Same thing here. Harder to regulate, harder to prove, but the scale of the concern is proportionally larger. Nobody at the office agrees with me about The Last Jedi, but I've made this point eleven times this week and I'm not stopping.

The FTC is running a parallel investigation in the United States that's actually broader in scope. The FTC escalated its antitrust investigation into Microsoft, issuing demands to competitors examining cloud licensing, AI bundling, and market dominance - with regulators investigating whether Microsoft uses licensing restrictions and product bundling to illegally monopolize enterprise computing markets. And notably, this investigation launched under former FTC Chair Lina Khan continues under current Chair Andrew Ferguson despite the administration change. Bipartisan. Both sides of the Atlantic. Multiple regulatory agencies. This isn't fringe.

What the SMS Designation Actually Means for Buyers

The CMA's most significant action is the formal SMS investigation it has just announced into Microsoft's business software ecosystem, launching in May under the Digital Markets, Competition and Consumers Act 2024. This is new regulatory territory and it matters.

Rather than imposing its own remedies under existing market investigation powers, the CMA is using its powers under the DMCC Act to launch a Strategic Market Status investigation - a designation that, if granted, would enable the CMA's Digital Markets Unit to impose targeted and bespoke interventions to address the identified concerns. The investigation can take up to nine months once it starts.

The Open Cloud Coalition had called for acceleration, stating that "the extensive data and evidence gathered as part of this CMA market investigation and the preceding Ofcom market study provides a clear and compelling evidence basis" for a quick conclusion, and urged the CMA to "actively consider the anti-competitive impact of restrictive software licensing and excessive egress fees when awarding contracts." The Board heard them.

If Microsoft gets the SMS designation, regulators can legally dictate specific changes to how they license software. That's not a fine. That's not a settlement. That's a structural intervention. And if it sticks in the UK, it creates pressure for similar moves in the EU and potentially the US. Google and Apple were already designated SMS by the CMA in October for their mobile platforms - so this isn't theoretical. The CMA has done it before and the licensing math that currently punishes multi-cloud decisions could change significantly.

The Real Cost of Waiting This Out

Here's my actual position, and I'll say it directly: I think the CMA is right. The licensing practices they're describing are real, they're documented, and they're being felt by businesses that have no idea there's a regulatory case being built about the exact thing making their IT decisions harder. Buyers are starting to get leverage in other software categories, but in cloud infrastructure dominated by Microsoft, the leverage gap is enormous.

The problem for IT buyers waiting on regulatory outcomes is that the investigation timeline means paying premium prices while regulators work. And the CMA found that UK spending on cloud services hit £10.5 billion in 2024, having grown by nearly 30% annually since 2020 and expected to continue rising. That's the market running on contracts that regulators believe are structurally unfair. Every year of delay is another year businesses are renewing terms that may eventually be ruled anti-competitive.

Stephanie asked me why any of this matters to the average small business. She's been comparing enterprise SaaS options this month - I pointed her toward our CRM software roundup for context on how quickly vendor dependency builds - and I tried to explain it this way: vendor lock-in at the infrastructure level isn't just inconvenient, it changes your negotiating position on everything that sits on top of that infrastructure. Microsoft's power today comes from connecting its products together - once customers use one product, switching to competitors becomes difficult. And "difficult" is doing a lot of work in that sentence. It often means financially impossible on a business budget.

Linda was in the break room when I was explaining this to Stephanie and she said Gerald spent three years trying to migrate off an Oracle system at his old company. She said it like that was a fun story. It is not a fun story. That is the story the CMA is trying to prevent from playing out at scale with cloud infrastructure.

What IT Buyers Should Actually Be Doing Right Now

I'm not going to tell you to start a multi-cloud migration tomorrow. That's not realistic and it's not what this situation calls for. What it calls for is awareness, and specifically: understanding that the contracts you're signing right now for Microsoft cloud services exist in a market that regulators on two continents believe is operating unfairly. That should factor into how aggressively you negotiate.

The confusion around AI and cloud replatforming is real, but that confusion is partly by design. Complexity is a moat. Microsoft's AI strategy creates what some call "ecosystem lock-in" - customers choosing Microsoft's AI tools get pushed deeper into Azure, Office, and every other ratchet in the stack. Copilot doesn't just sell itself - it sells deeper Azure dependency. Every time you add a Copilot seat, you're adding a ratchet click.

So here's what's actually useful: find out what your exit number is. What would it cost - in licensing penalties, migration effort, and retraining - to move off Azure? Not because you're leaving. Because knowing that number is the only way to negotiate with any leverage at all. The practices under scrutiny include sharply raising subscription fees for customers looking to switch providers, imposing high exit charges, and reportedly making Office 365 less compatible with competitor cloud services. Those are your leverage points. Know them before your next renewal, not after.

The CMA's investigation is genuinely one of the more consequential regulatory actions in enterprise software in years. It moved slowly - the original 18-month timeline raised eyebrows across the UK cloud market, and stakeholders worried the delay would let Microsoft and AWS gain more share and influence while regulators deliberated. That fear was legitimate. But slow doesn't mean inconsequential.

Tory told me yesterday he thinks everything works out eventually. He's going through a lot so I didn't push back as hard as I normally would. But in this specific case - Microsoft, cloud licensing, and the CMA - I'm less optimistic about the timeline. The SMS investigation starts in May. It could take until early 2027 to produce binding conduct requirements. Things will work out eventually. It's the "eventually" that'll cost you if you're not paying attention right now.