Summary

  • UK buyer records show a sharp divide: roughly 80%–90% of accounts bought in one of five digital activities and contributed only 0%–5% of revenue, while the 0%–5% buying across all five contributed 80%–90%.
  • The concentration helps explain why the CMA assesses an integrated software environment. It does not establish that every organisation faces the same dependency, or that a later remedy would work equally well for both groups.

A software budget can hide two different buying patterns

A procurement director looking only at an annual software bill may see one vendor relationship. The Competition and Markets Authority’s new purchase analysis exposes a more uneven structure: most customer accounts bought from one activity, while almost all reported revenue came from a small group buying across five.

That split is central to the CMA’s proposed decision, published on 16 October. The authority proposes designating Microsoft with strategic market status in a business-software ecosystem comprising PC operating systems, productivity suites, security software, server operating systems and relational database management systems. It is consulting on that provisional assessment until 5pm on 13 November; the statutory decision deadline is 13 February 2027. The proposal is a gateway question. It does not find or assume wrongdoing, and any later intervention would require its own legal process.

The scale of the distinction is unusually stark. In 2025, the CMA’s cleaned data covered about 1–2 million UK organisational customer accounts and $9–10 billion in purchases across the five activities. About 80%–90% of accounts bought in only one activity. Together, those accounts generated just 0%–5% of revenue. Productivity software made up 90%–100% of this single-activity group’s customers and revenue; reported average spend per account was about $200–300.

At the other end, approximately 10,000–20,000 accounts—reported as 0%–5% of all customers—bought products in all five activities. They generated $7–8 billion, or 80%–90% of the dataset’s revenue, with average spend of about $600,000–700,000. Those multi-activity buyers also accounted for most revenue within each activity.

These numbers describe account purchases, not the number of people who use each product, competitive market shares, contract terms or measured switching costs. The ranges are redacted and rounded. They are still enough to show why a single “typical Microsoft customer” is a poor unit of analysis.

Why an ecosystem lens fits the larger accounts

The CMA’s grouping case does not rest on a purchase table alone. It describes products that can be installed, secured and managed together, native integrations and APIs, common identity and data flows, third-party applications built around Microsoft environments, enterprise agreements and volume discounts. Customer research reports practical value in familiar skills, easier deployment, fewer supplier relationships, lower search and procurement costs, and integrated security. Those benefits are part of the operating reality.

The same connections can increase exit costs. A rival may need equivalent interfaces, access to data and telemetry, application compatibility, identity controls and security assurance before a customer can replace one layer without disrupting another. A buyer may also face duplicate licence costs or lose discounts tied to a broader agreement. Network effects and staff retraining can compound the decision.

The data therefore supports two statements at once. There is a concentrated cohort whose purchases span the full stack; integration across activities is a relevant object for competition analysis. There is also a much larger cohort whose recorded purchases sit in productivity software alone. Grouping five activities may capture how the largest buyers operate. It does not tell the CMA which technical or commercial dependency causes harm for each customer, or how a remedy would affect smaller accounts.

The boundaries in the dataset matter. Microsoft supplied the 2025 account-level purchase data, including reseller purchases; PC operating-system sales through original equipment manufacturers were excluded. Products representing 20%–30% of dataset revenue were initially associated with two activities. The CMA reallocated most of the overlapping productivity/security revenue to one activity, a choice it says may understate cross-activity purchasing. The evidence is informative, but the classification method should remain visible when the data is used to justify future action.

The next test is remedy-level evidence

The CMA’s accompanying roadmap is explicitly a plan for further work, not a finding on a remedy. It lists cloud licensing, AI features in productivity suites, collaboration and communications applications, and security as areas for more evidence. A potential issue in one area does not automatically supply the proof for action in another.

For each proposed measure, decision-makers should be able to answer a buyer-level question: which product or interface is difficult to substitute, what capability is withheld or priced differently, which customers encounter that constraint, and what outcome would show that a remedy worked? The answer may differ between an organisation buying productivity tools on their own and a large enterprise spanning identity, security, servers and databases.

A product that is integrated with identity and security may be valuable precisely because the controls work together. Opening an interface could improve rival access, but a design that ignores authentication, telemetry or incident response could add operational risk. Unbundling may create choice while also changing the total price or the support burden. The remedy test should measure both the competitive opening and the service that customers must continue to run.

The CMA’s September qualitative research can explain how interviewed IT decision-makers describe purchasing and switching. It is not a representative numerical estimate of all UK buyers. Aggregate account data can show concentration, but it cannot establish that a small account is an SME, that a large account cannot switch, or that a price increase has occurred. Those questions need separate evidence.

What procurement leaders can do now

Organisations do not need to wait for a final designation to improve their own visibility. Procurement and technology teams can map software spend to the five activities, record which products are bundled, separate stand-alone prices from enterprise discounts, and identify the APIs, identity, security, data and application dependencies that matter to a proposed exit. A migration estimate should include training, testing, parallel operation and security review—not just licence price.

That record makes both sides of the decision clearer. A customer can show where integration genuinely lowers operating cost, and where a bundled price or dependency narrows a practical choice. It gives a regulator more precise evidence than a general assertion that one vendor is either indispensable or easily replaced.

The CMA’s proposed ecosystem is a useful way to see how the highest-spend buyers combine software. The next decision should keep the other customer group in view and test each proposed intervention against a specific control point, customer effect and operational risk. Consultation runs to 13 November. The final SMS decision is due by 13 February 2027; the roadmap leaves any remedy for a later, evidence-led process.

Sources