The UK Competition and Markets Authority (CMA) proposed on 16 October that Microsoft receive strategic market power status for business software, including cybersecurity products. Its investigation examines whether bundled offerings and restrictions on system access constrain rivals. For enterprise buyers, the questions concern the cost of choosing another security provider and whether that provider can obtain the information it needs.
Bundled pricing complicates supplier choice
The proposed designation spans Windows, Office, Windows Server and SQL Server, alongside security software. The CMA is collecting evidence about both commercial arrangements and the technical conditions under which other vendors operate.
Microsoft 365 E5 combines productivity applications with security capabilities. These include Defender for threat detection, Entra for access management and Intune for device oversight. Microsoft began adding Security Copilot to E5 on 18 November 2025 through a phased rollout, with a monthly usage allowance.
Microsoft’s US pricing illustrates the difficulty of separating those costs. From 1 July 2026, E5 with Teams is priced at $60 monthly per user, compared with $39 for E3. That $21 gap pays for security and additional features; Microsoft does not identify a separate protection component within it.
An E5 customer considering CrowdStrike or SentinelOne therefore faces an additional purchase while continuing to pay for Microsoft’s included capabilities. Integration also adds expense. The CMA is examining whether this arrangement discourages customers from changing providers.
Possible obligations described by the regulator include:
- Offering security separately from productivity applications, with explicit pricing.
- Providing rival vendors access to Windows equivalent to what Defender receives.
- Establishing requirements concerning access to security information.
These remain options rather than selected remedies. Designation would establish a basis for special obligations, rather than constitute a finding of unlawful conduct. Breaching those obligations could expose Microsoft to penalties reaching 10 per cent of global turnover.
Technical access remains an unresolved issue
Competitors have told the CMA that Microsoft’s own applications receive attack-detection information sooner and in greater detail. They also allege restrictions on how frequently rival tools can retrieve information. The regulator has not verified those allegations.
Windows architecture adds a separate consideration. Microsoft estimated that a defective CrowdStrike Falcon update in July 2024 disabled approximately 8.5 million Windows PCs. The incident demonstrated the operational consequences when a security application with privileged access suffers a serious fault.
Microsoft subsequently introduced the Windows Resiliency Initiative in November 2024. On 18 November 2025, it said selected partners were testing WESP, a new platform intended to let security applications operate outside the Windows core, with broader availability planned for 2026.
That design could limit the damage caused by application errors. Whether competing products can match Microsoft Defender’s detection and response capabilities on the platform remains unresolved. The CMA has not launched a distinct investigation into WESP, and there is no evidence to date that Microsoft grants rivals fewer capabilities than Defender.
Decision timetable and implications for procurement
Microsoft disputes the CMA’s assessment and says its products, including Copilot, support connections with rival services.
A potential commercial precedent comes from Teams. In September 2025, the European Commission accepted Microsoft’s commitments to offer eligible European customers packages excluding Teams, widen the pricing gap and improve interoperability with competing communication applications. A comparable approach to security could make the savings from removing bundled protection easier to assess, although the CMA has chosen no such measure.
The consultation closes on 13 November. A designation decision is due by 13 February 2027, with any subsequent obligations requiring additional assessment and consultation. Initial changes are therefore unlikely before the second half of 2027.
Procurement teams evaluating alternative protection should distinguish the additional licence expense from any potential reduction in their Microsoft bill. They should also establish what system access and security information the alternative requires, since pricing alone will not settle whether it can meet the organisation’s needs.
