CMA proposes giving itself rule-writing power over Microsoft's business software

On its own, designation leaves Microsoft's licensing as it is. In Crypto Briefing's account it is the step that lets the CMA write specific rules for how the company operates instead of relying on case-by-case enforcement after problems surface ^[2]. Those rules take the form of conduct requirements, which Crypto Briefing describes as tailored obligations on how the business behaves ^[3]. The CMA frames designation as a tool for introducing such requirements and says it would not imply wrongdoing by Microsoft ^[15].

We think the reach of that power matters more than the label. Crypto Briefing puts Microsoft's UK customers at over one million organisations ^[8] and approximately 20 million monthly users ^[9], which works out to at most about 20 users per organisation ^[18]. If the typical customer is that small, few will have the leverage to bring a bundling complaint, and a case-by-case approach waits for a problem to surface first ^[2]. The average could hide a handful of very large buyers, so the point holds only if the long tail is long.

The counter-case is that the label is worth only what the first requirement says. The CMA expects its final decision 92 days after the consultation closes on 13 November ^[19], which is 120 days after the proposal ^[17]. Crypto Briefing also notes that the probe follows prior commitments made by Microsoft and AWS ^[20], so a final decision that narrows the five activities, or requirements that mostly restate those commitments, would show the designation added little.

Crypto Briefing's account does not include a draft conduct requirement or a date for one. Its own list of likely changes, more transparent practices and a revisit of bundling and licensing, is its reading of the CMA's research findings ^[21]. The CMA flagged cloud licensing, AI productivity tools and security software ^[5]. Rivals in the last two so far have only a decision date to plan around ^[14].