RegulationsJune 26, 202612 min read

My MSP Tech

Italy antitrust probe into Microsoft 365 price hikes: what it means for commercial property IT

Quick Answers for Property & Facility Managers

How could the Italy antitrust investigation into Microsoft 365 price hikes affect commercial property and facility IT budgets?

Italy’s AGCM is investigating whether Microsoft moved customers into more expensive Microsoft 365 plans with AI tools like Copilot and Designer without clear consent.[1][4][7] Property and facility managers should expect closer scrutiny of license structures, potential future price corrections, and the need for tighter IT contract governance with their MSP.

Should building owners and facility managers change how they buy or renew Microsoft 365 after the Italy investigation?

The probe focuses on communication and automatic plan changes rather than banning price rises.[1][2][4] Facility leaders should respond by demanding full license transparency from IT providers, documenting business justification for AI add-ons, and aligning Microsoft 365 choices with security and compliance frameworks like NIST CSF and FTC Safeguards instead of a default upgrade path.

Does the Italian Microsoft 365 investigation change compliance obligations for commercial properties using Microsoft 365?

The investigation itself does not alter laws like HIPAA, PCI DSS, or FTC Safeguards, but it highlights the risk of poorly documented license changes.[2][4][7] Property organizations should ensure that any move to AI-bundled Microsoft 365 plans is assessed for data protection, access controls, and auditability under their applicable compliance regimes.

Italy’s antitrust probe into Microsoft 365: the headline commercial property leaders need to understand

Italy’s competition authority, the Autorità Garante della Concorrenza e del Mercato (AGCM), has opened a formal investigation into Microsoft over alleged unfair business practices tied to price increases on Microsoft 365 subscriptions.[1][4][7] The focus is not merely that prices went up, but how customers were moved into higher-cost plans when AI tools like Copilot and Designer were bundled into Microsoft 365.[1][2][4]

According to public statements, the regulator is examining whether Microsoft inadequately informed customers about the integration of Copilot and Designer, and whether users were effectively shifted by default into more expensive plans unless they actively opted out.[1][2][4][7] The concern is that this may have limited customers’ freedom of choice and could be considered an aggressive commercial practice.[2][4]

For building owners, property managers, and facility managers whose operations rely on Microsoft 365 for email, collaboration, document management, and security, this investigation should trigger a deeper look at how licenses are selected, renewed, and governed with internal IT teams or managed service providers (MSPs).

What the Microsoft 365 investigation is really about: AI bundles, default upgrades, and customer choice

Italy’s watchdog is probing Microsoft Ireland Operations Ltd. and Microsoft S.r.l. over the way Microsoft 365 subscription prices were raised when AI capabilities were added.[4][7] Copilot and Designer were integrated into Microsoft 365, and the authority alleges that customers were:

Not fully or clearly informed that these AI tools were now part of their Microsoft 365 subscription.[1][2][4]
Automatically moved to a more expensive, AI-bundled plan unless they exercised a right to withdraw or actively opted out.[1][2][4][7]
Given fragmented or insufficient information at renewal, limiting their ability to assess alternatives or overall cost impact.[4][5]

In other words, the question is whether customers truly chose the AI upgrade or slid into it by default. For commercial properties, that default behavior can propagate across hundreds or thousands of mailboxes, shared kiosks, security stations, and back-office accounts, significantly affecting operating budgets.

The investigation is still ongoing and is not yet a finding of liability or a requirement to reverse prices.[4][5] However, it underscores a broader regulatory trend: competition authorities and data protection regulators are increasingly focused on how major technology vendors present choice, consent, and value to business customers in cloud subscription models.

Why building owners and facility managers should care: budget, risk, and governance

Most commercial property portfolios rely on Microsoft 365 as the backbone for email, tenant communication, maintenance ticketing, project collaboration, and document storage. Price changes at the platform level, especially when tied to AI bundles, can have several direct impacts:

Operating budgets and CAM allocations: If a portfolio’s Microsoft 365 licenses were quietly shifted to more expensive AI-bundled SKUs, total IT costs per user may rise, affecting common area maintenance (CAM) charges or central services budgets.
Contract governance with MSPs and IT outsourcers: Managed IT providers often manage licensing on behalf of property owners. The Italian investigation highlights the importance of reviewing how your MSP communicates licensing changes, whether they proactively explain add-ons like Copilot, and how they document approvals.
Risk management and compliance: AI features can change data flows, data retention, and access patterns inside Microsoft 365. That matters for buildings handling regulated data, such as health records under HIPAA in medical office properties, payment data under PCI DSS in retail environments, or personal financial data governed by the FTC Safeguards Rule in multifamily and commercial lending contexts.

Building owners and facility managers should treat AI-bundled price changes as a governance event, not just a budget line item. The right response is to verify what you’re paying for, understand the risk and value of AI features, and align licensing choices with your security and compliance strategy.

Compliance and security implications: tying Microsoft 365 choices to NIST, HIPAA, PCI DSS, and FTC Safeguards

Although the AGCM investigation is framed around competition and consumer choice, it intersects with IT governance and compliance. Many commercial properties and corporate real estate portfolios are subject to one or more of the following frameworks:

NIST Cybersecurity Framework (CSF) and NIST SP 800-171 for service providers, government contractors, and organizations handling controlled unclassified information.
CMMC 2.0 for entities in the U.S. defense supply chain using Microsoft 365 to process defense-related data.
HIPAA for medical office buildings or healthcare facilities storing or transmitting protected health information through Microsoft 365.
PCI DSS for retail and mixed-use properties integrating payment workflows with Microsoft-based systems.
FTC Safeguards Rule for property companies and lenders managing consumer financial information.
SOC 2 guidelines for service organizations providing property management and facilities services to enterprise clients.

AI tools like Copilot can access and process email, documents, and internal data to generate responses and summaries. That can be a productivity win for leasing teams, engineering, and facilities operations—but it must be evaluated under your security program. Questions to ask with your MSP or internal IT team include:

Have AI features been enabled across all tenants and service accounts, or only for specific roles?
Do access control policies and conditional access rules still align with NIST CSF and NIST 800-171 requirements when AI features are active?
Has your HIPAA or PCI DSS risk analysis been updated to account for new data processing paths introduced by Copilot?
Do your policies and user training reflect how tenant information, maintenance records, and financial data might be surfaced by AI tools?

The Italian probe does not automatically change these frameworks, but it reminds property organizations that licensing and feature changes should be evaluated and documented within their compliance and risk management programs, not treated as invisible background updates.

Practical steps for property and facility leaders: license audits, MSP coordination, and contract language

Regardless of whether your buildings are in Italy or elsewhere, the Microsoft 365 investigation offers a practical checklist for commercial property and facilities executives:

1. Perform a Microsoft 365 license and SKU audit

Work with your MSP or IT department to identify exactly which Microsoft 365 plans you’re using today, how they changed over the last 12–24 months, and which include AI bundles like Copilot and Designer.[4][5] Map licenses to user roles: property managers, facility engineers, security desks, accounting, and executive teams.

For each license type, document:

Monthly and annual cost.
Included security features (MFA, Conditional Access, Defender, data loss prevention).
AI capabilities and data access scope.

2. Review contract terms and communication practices

Italy’s AGCM is investigating whether customers received fragmented or insufficient information about changes.[4][5] Ask your MSP:

How are license and price changes communicated to you?
Is there a standard approval process for moving users to new plans?
Are changes documented in change logs or governance reports suitable for audits and SOC 2-style reviews?

Consider updating contracts to require explicit written approval for any license upgrades, particularly those that materially increase cost or introduce new data-processing features.

3. Align Microsoft 365 choices with building risk profiles

Not every user or building needs AI-enhanced licenses. For example, engineering kiosks, security desk accounts, or shared conference room devices may only need basic collaboration without Copilot. Leasing and asset management teams may benefit more from AI tools, but should be governed by stricter access policies.

Use your risk register and compliance obligations (HIPAA, PCI DSS, FTC Safeguards, CMMC 2.0, NIST CSF) to decide where AI-enabled licenses are justified and where a lower-cost, lower-risk SKU is preferable.

4. Update training and internal policies

If your environment has already adopted Copilot or similar AI tools in Microsoft 365, incorporate them into user training and acceptable use policies. Make sure staff understand:

What data AI tools can access within the tenant.
How to avoid exposing confidential tenant information or maintenance records in prompts.
Which channels are appropriate for regulated data.

This supports both regulatory expectations and manufacturer warranties or vendor support agreements that assume proper use of the tools.

Strategic implications: negotiating with vendors and MSPs in a changing regulatory climate

For commercial property executives, the Italy–Microsoft case is part of a broader pattern: regulators worldwide are examining how big technology vendors structure choices, prices, and data use in cloud and AI services.[1][3][6][8] This has several strategic implications for your IT roadmap:

Vendor negotiation leverage: Public investigations can increase pressure on vendors to improve transparency and flexibility. Property owners can push for clearer licensing options, non-AI plans for certain roles, and more robust reporting from MSPs on user counts and features.
Governance maturity: Boards, investors, and large tenants expect professional IT governance. Demonstrating that you monitor major regulatory developments, audit licenses, and tie Microsoft 365 choices to NIST, SOC 2, and FTC Safeguards can strengthen your position in RFPs and long-term leases.
Future AI adoption strategy: Rather than a blanket upgrade, treat AI in Microsoft 365 as a business case decision. Consider pilot projects in specific buildings or functions (lease analysis, capital planning, maintenance workflows) and evaluate ROI, security, and compliance before broad rollout.

Ultimately, the Italian investigation is a reminder that subscription changes are not just matter-of-fact IT events. For commercial property and facilities leaders, they are strategic decisions with ramifications for cost, risk, compliance, and tenant service quality. By tightening governance around Microsoft 365 licensing and partnering closely with managed IT providers, building owners can capture the benefits of AI while avoiding unmanaged cost creep and regulatory surprises.

Frequently Asked Questions

Will the Italy antitrust probe force Microsoft to lower Microsoft 365 prices for commercial property users?

The AGCM investigation questions whether Microsoft used unfair practices when raising Microsoft 365 prices tied to AI bundles, especially automatic plan changes and limited information.[1][2][4][7] It is not yet a ruling or fine. Property leaders should not assume price cuts, but should proactively review licensing and negotiate transparency with their MSPs.

How should I evaluate the ROI of AI features like Copilot in Microsoft 365 for property operations?

Start by mapping AI-enabled licenses to high-value workflows: lease analysis, tenant communications, capital planning, and maintenance coordination. Estimate time savings and error reduction against the incremental Microsoft 365 cost per user. Weigh benefits against compliance obligations under NIST, SOC 2, HIPAA, PCI DSS, and FTC Safeguards to ensure ROI includes reduced risk, not just productivity.

Does the Microsoft 365 investigation increase my legal or compliance exposure as a building owner?

The investigation itself does not directly expand your legal duties. However, it highlights that undocumented license changes and AI adoption can weaken your position in audits or incidents. To manage exposure, ensure changes to Microsoft 365 plans are approved, logged, and evaluated under your applicable frameworks (HIPAA, PCI DSS, NIST CSF, CMMC 2.0, FTC Safeguards) and your cyber insurance requirements.

What should I ask my MSP about Microsoft 365 after this news?

Request a current license inventory, a history of plan changes over the past year, and a clear breakdown of which users have AI-enabled Microsoft 365 plans. Ask how price changes were approved, how AI features are governed, and whether your environment aligns with standards like NIST CSF and SOC 2. Use this to adjust contracts, SLAs, and governance reporting for stronger oversight.

Are there non-AI Microsoft 365 options that may better fit some building roles or budgets?

Yes, Microsoft maintains multiple Microsoft 365 tiers with different feature sets, some without advanced AI bundles. For low-risk or utility accounts—kiosks, shared facilities mailboxes, or security posts—lower-cost plans can reduce spend and risk. Work with your MSP to right-size licenses so AI features are reserved for roles where they deliver clear operational and financial value.

Find a Qualified Managed IT & Cybersecurity Contractor

Need help acting on this? Browse managed IT & cybersecurity providers in your area, or explore commercial managed IT services like preventative maintenance, inspections, and emergency response. Are you a contractor? List your business on My MSP Tech to reach IT and operations leaders actively searching for help.

Sources

Originally sourced from Reuters

Microsoft 365commercial property ITmanaged IT servicesAI compliance