The UK competition regulator wants new powers over Microsoft’s business software estate, and security tooling such as Defender and Entra sits squarely inside the scope. For security teams that have consolidated on E3 or E5, the outcome could change how controls are bought, integrated and justified to the board.
What happened
On 16 October 2026 the Competition and Markets Authority (CMA) published a proposed decision to give Microsoft strategic market status (SMS) across what it calls Microsoft’s “Business Software Ecosystem”. The ecosystem spans five linked activities: Windows on the desktop, the Microsoft 365 productivity suite, security tooling, Windows Server and database software such as SQL Server.
SMS is the designation created by the Digital Markets, Competition and Consumers Act. It does not imply wrongdoing, as the regulator stresses. What it does is unlock the ability to impose conduct requirements and pro-competition interventions tailored to a specific firm. The CMA opened the investigation on 14 May 2026. Comments on the proposal are invited until 5pm on 13 November 2026, and the statutory deadline for a final decision is 13 February 2027.
The CMA also published an indicative roadmap of areas it would examine if designation goes ahead. Three headline themes stand out: whether customers can freely choose AI tools rather than defaulting to Copilot, whether Microsoft’s licensing limits where its software can run in the cloud, and whether Microsoft’s packaging and integration of its own security tools narrows the options open to customers.
Microsoft told The Register it does not share the CMA’s views, insisting its products are open and interoperable with competing services. The CMA’s chief executive, Sarah Cardell, argued that buyers ought to be free to “switch provider when they want to”.
The detail
The security section of the roadmap is the part that matters most to this audience. In a footnote, the CMA provisionally places Entra, Active Directory, Intune and Defender in scope, plus some features of Purview, Security Copilot and Agent 365. That is effectively the identity, endpoint management and detection backbone of most Microsoft-centric organisations in the UK.
Rival vendors have raised two broad complaints with the regulator. The first is technical. Microsoft does publish APIs and integration hooks, but competitors argue these do not deliver functionality equal to what Microsoft’s own tools enjoy. According to the roadmap, rivals say the telemetry they receive to detect and block threats is less complete and less timely, that Microsoft-controlled APIs carry rate limits and revocation risks Microsoft alone controls, and that Entra ID has become a must-have identity layer which makes switching less practical.
The second complaint is commercial. Security capabilities are folded into Microsoft 365 licences and Enterprise Agreements, so many buyers see Defender as effectively free once they hold the suite. The CMA’s own customer research, carried out by Jigsaw, found that buying a third-party product is sometimes seen as paying twice unless the licence tier can be lowered. Some participants said Defender’s inclusion in E5, E3 or Business Premium made them less inclined to look elsewhere, although a minority judged that superior third-party capability outweighed the convenience.
If it does intervene, the CMA floats two kinds of remedy for security: rules to stop bundling from unduly disadvantaging rival security vendors, and parity requirements so competitors can reach relevant ecosystem functions, data and integration pathways on equivalent terms. Separately, it says it has agreed with Microsoft and AWS to work on how identity and access management operates across clouds.
Why it matters for UK organisations
The CMA puts Microsoft’s UK footprint at more than a million business and public sector customers and around 20 million monthly users. Its press release goes beyond pure economics, arguing that for government and critical bodies, avoiding overdependence on one supplier is now a matter of resilience and strategic autonomy. That is concentration risk, expressed in competition law language, and it lines up with what operational resilience regimes, DORA for firms with EU exposure and the forthcoming Cyber Security and Resilience Bill already ask boards to think about.
There are practical implications too. A parity requirement on telemetry and APIs could make third-party EDR, identity threat detection and SIEM integrations with Microsoft 365 more capable and more stable, which is good news for organisations running mixed estates. Clearer licence pricing could put a visible number on the security components inside E5, enabling fair comparisons at renewal. Nothing changes yet: any conduct requirements would need their own consultation.
Expert view
In my experience, the Defender-by-default decision is rarely a security decision at all. It is made in procurement, because the licence is already paid for, and security teams then inherit the result. That is not necessarily bad: Microsoft’s tooling has improved markedly, and a well-configured E5 stack beats a poorly integrated pile of best-of-breed products. But it does mean many organisations have never tested whether their controls are the right ones, only whether they are the cheapest ones on the invoice.
The concern rivals raise about telemetry deserves attention from defenders regardless of how the competition case ends. When we test environments that rely on a third-party EDR or identity product sitting on top of Microsoft 365 and Entra, the gaps often appear at the joins: delayed audit logs, API throttling during an incident, or signals the third-party tool simply cannot see. Attackers will find those blind spots before your vendor does.
The flip side is that single-vendor consolidation creates a single point of failure. Entra ID compromise is among the most damaging outcomes we see in assessments, because it opens everything else.
What to do now
- Map your Microsoft security dependency. List which controls depend on Entra, Intune, Defender and Purview, and record which licence tier delivers each one. This supports the Cyber Essentials user access control and malware protection requirements and gives you evidence for your risk register.
- Price the bundle honestly. Ask your licensing partner to break out the security value inside E3 or E5, so that future comparisons with third-party tools are not distorted by the “already paid for” effect.
- Test integration seams. If you run third-party EDR, SIEM or identity tooling, check log latency, API rate limits and coverage gaps during a tabletop or purple team exercise, not mid-incident.
- Harden Entra ID as crown jewels. Enforce phishing-resistant MFA for administrators, limit standing privileged roles, and keep a tested break-glass process. This maps to the Cyber Essentials secure configuration and user access control controls.
- Consider responding to the consultation. Organisations with real experience of integration limits or licensing constraints can submit evidence before 13 November 2026.
- Brief the board on concentration risk. Frame single-vendor dependency as an operational resilience question, with an exit or contingency plan for identity.
Bottom line
The CMA is not saying Microsoft’s security products are poor, nor that anyone should rip them out. It is saying bundling and privileged integration may be shaping security choices more than capability does. Whatever the February 2027 decision, UK security leaders should use this moment to understand exactly what they rely on, what it really costs, and what they would do if that single identity and security layer failed.
Sources
- GOV.UK (CMA): CMA takes first steps to ensure choice in business software
- GOV.UK (CMA): Microsoft’s business software ecosystem case page
- CMA: Roadmap of possible interventions (PDF)
- The Register: British watchdog seeks tougher terms around Microsoft’s dominance of business software
- Computer Weekly: CMA to decide Microsoft strategic market status by February 2027
