Summary

  • AWS and Microsoft have advanced switching and multi-cloud measures, but the CMA reports limited uptake and unfinished work. A cheaper data transfer is not a complete migration.
  • Cross-cloud authorisation and Kubernetes dependencies are the next priorities. The spring 2027 Board review is a checkpoint for voluntary cooperation, not a delivery deadline.

Suppose an employee may read a file but may not delete it. After the company moves that application to another cloud, the employee should still be able to read it—and still be unable to delete it.

That modest-sounding test captures a difficult part of the UK Competition and Markets Authority's next cloud project. Getting someone recognised in a new system is one task. Carrying over the limits on what that person can do is another.

The CMA's 16 October update puts those authorisation rules, alongside the portability of Kubernetes workloads, at the centre of its next discussions with Amazon Web Services and Microsoft. The read-and-delete example is illustrative, not a customer incident reported by the regulator.

The data can leave before the work is finished

There has been progress. The two providers have advanced measures on data-egress charges, direct connections between data centres, interoperability requests and management of resources across clouds. These can reduce both the bill for moving data and some of the engineering involved.

But the report is not a list of entirely new offers. Microsoft's free-switching programme dates to March 2024; its UK at-cost multi-cloud offer to September 2025. Some actions announced in the March 2026 package remain outstanding. Uptake is still limited, and the newer programmes have not had long to prove their effect.

Nor does a waiver of data-egress charges pay for the whole move. Engineers still have to make an application work in its new surroundings. The CMA says customers face material costs translating the different languages and models used for identity and access management, or IAM.

Identity federation can help one cloud recognise a user authenticated elsewhere. It does not, by itself, make two providers express “may read, may not delete” in the same way. Some customers value the fine-grained controls that make these systems different. Making permissions portable without discarding useful protection is harder than agreeing on a common login.

A container is not its entire environment

Kubernetes supplies a common framework for deploying and managing containerised applications. That is a real aid to portability, not an empty promise. Yet an actual deployment can still depend on a provider's identity system, networking and other services.

Starting the container somewhere else would therefore be an incomplete test. Can it reach the resources it needs? Do its permissions still have the intended limits? Those are practical questions suggested by the dependencies customers described to the CMA, not a new certification scheme announced in the report.

The regulator and the two providers have agreed to work on these problems. They have not settled on ready-made solutions or dates for delivering them. The next step is a clearer route from identifying a problem to developing a solution, with customers, competitors and others in the industry involved.

A successful exit need not end in departure

A company with a credible alternative may negotiate a better renewal and stay put. The CMA explicitly wants to consider such market outcomes as well as uptake. Counting completed migrations alone would miss that possible benefit.

The report does not supply an uptake count, a measured improvement in negotiated prices or a success rate for moving live workloads with their security controls intact. Multi-year contracts also make renewal dates important: a newly available option may not be used immediately.

The CMA Board will assess the momentum of voluntary dialogue in spring 2027. That is not a promise that portable permissions will be ready by then. The government publication record also distinguishes this update from the same-day proposed strategic-market-status decision on Microsoft's business-software ecosystem. A proposal in that separate statutory process is not an already imposed cloud remedy.

The CMA has retained a more formal route if voluntary action proves insufficient. For now, the useful question is whether a customer can demonstrate a workable alternative. The employee who could not delete the file before the move should not gain that power merely because the cloud changed.