Three agencies. One target.
The FTC’s escalation of its Microsoft investigation, originally launched in November 2024, moved from monitoring to evidence-gathering this week. According to CIO Magazine’s reporting, the agency issued Civil Investigative Demands to at least six unnamed Microsoft competitors, asking them to document how Microsoft’s bundling of AI tools, security features, and productivity software affects their ability to compete. According to the same reporting, each CID reportedly contained more than 15 detailed questions targeting Microsoft’s licensing and bundling practices.
A Civil Investigative Demand is a formal legal instrument, the FTC’s equivalent of a pre-litigation subpoena. Recipients must respond. The questions in a CID define the theory of harm the agency is building: in this case, whether Microsoft’s integration of AI capabilities (Copilot, Azure OpenAI), enterprise security (Defender, Sentinel), and productivity software (Microsoft 365) into cloud-licensing bundles effectively traps customers in Microsoft’s infrastructure.
The investigation is also reported to examine whether Microsoft’s licensing terms create prohibitive costs or technical restrictions for enterprise customers who want to run Microsoft software on rival cloud infrastructure, per CIO’s reporting. That’s the cloud portability question: can a Microsoft 365 customer run their workloads on AWS or Google Cloud without a meaningful cost penalty? The FTC’s position, if the investigation follows through, is that the answer is no, and that the no is anticompetitive.
Timeline
Microsoft hasn’t publicly responded to the CID escalation as of this brief’s publication. That’s standard, companies typically don’t comment on ongoing investigations. Don’t expect a statement that acknowledges the theory of harm.
Context matters here. The FTC’s November 2024 investigation into Microsoft predates the current wave of AI bundling concerns, but the CID timing lands as Microsoft Copilot has been embedded into more enterprise product tiers. The bundling theory isn’t new, the European Commission has been examining similar questions. What’s new is the FTC moving from investigation to formal evidence collection.
CIDs don’t guarantee a formal complaint. The FTC gathers evidence, evaluates the record, and makes an enforcement decision. Some investigations close without action. The CID stage does mean the agency has concluded there’s enough to investigate formally, and that six companies in Microsoft’s market have been asked to help build that record.
What to Watch
What to watch
Watch for any public statement from the CID recipients, competitors have an incentive to cooperate, and their responses could accelerate or narrow the FTC’s theory. The timeline from CID to complaint, if the FTC proceeds, typically runs six to eighteen months.
The real question is whether Microsoft’s AI bundling strategy, which has moved faster than any prior product integration cycle, gives the FTC more evidence of harm than the agency found in its earlier cloud licensing review.