MSFT 10-K & 10-Q changes, risk factors and insider trading

Our operations and financial results are subject to various risks and uncertainties, including those described below, that could adversely affect our business, operations, financial condition, results of operations, liquidity, and the trading price of our common stock. Statements in this section reflect our beliefs and opinions as to matters that could adversely affect us in the future. References to past events are provided by way of example only and are not intended to be a complete listing or a representation as to whether or not such matters have occurred in the past.

Our competitors range in size from diversified global companies with significant research and development resources to small, specialized firms whose narrower product lineswho may let them be more effective in deploying technical, marketing, and financial resources. Barriers to entry in many of our businesses are low and many of the areas in which we compete evolve rapidly with changing and disruptive technologies, shifting user needs, and frequent introductions of new products and services. If we do not continue to innovate and provide products, devices, and services that appeal to businesses and consumers, we may not remain competitive, which could adversely affect our business, financial condition, and results of operations.

An important element of our business model has been to create platform-based ecosystems on which many participants can build diverse solutions. A well-established ecosystem creates beneficial network effects among users, application developers, and the platform provider that can accelerate growth. Establishing significant scale in the marketplace is necessary to meet consumer demand and to achieve and maintain attractive margins. WeFirms face significant competition from firms that provideoffering competing platforms.platforms may make it more difficult to attract and retain customers.

A competing vertically-integrated model, in which a single firm controls the hardware and software elements of a product and related services, has succeeded with some consumer products such as PCs, tablets, smartphones, gaming consoles, wearables, and other endpoint devices. Competitors pursuing this model also earn revenue from services integrated with the hardware and software platform, including applications and content sold through their integrated marketplaces. They may also be able to claim security and performance benefits from their vertically-integrated offer. We also offer some vertically-integrated hardware and software products and services. Shifting a portionExpansion of our business to a vertically-integrated modelcapabilities, mayincluding developing proprietary hardware, infrastructure, and artificial intelligence (“AI”) models, could increase our cost ofstructure, revenuereduce margins, and reduceexpose ourus operatingto margins.operational risks.

We derive substantial revenue from licenses of Windows operating systems on PCs. We face significant competition from competing platforms developed for new devicestypes andof formdevices, factors such asincluding smartphones and tablets. These devices compete on multiple bases including price and the perceived utility of the device and its platform. Users continue to turn to these devices to perform functions that in the past were performed by PCs. Even if many users view these devices as complementary to a PC, the prevalence of these devices may make it more difficult to attract application developers to our PC operating system platforms. Competing with operating systems licensed at low or no cost may decrease our PC operating system margins. Popular products or services offered on competing platforms could increase their competitive strength. In addition, some of our devices compete with products made by our OEM partners, which may affect their commitment to our platform.

Competing platforms have content and application marketplaces with scale and significant installed bases. The variety and utility of content and applications available on a platform are important to device purchasing decisions. Users may incur costs to move data and buy new content and applications when switching platforms. To compete,compete successfully, we must successfully enlist developers to write applications for our platform and ensure that these applications have high quality, security, customer appeal, and value. Efforts to compete with competitors’ content and application marketplaces may increase our cost of revenue and lower our operating margins. Competitors’ rules governing their content and applications marketplaces may restrict our ability to distribute products and services through them in accordance with our technical and business model objectives.

We are investing in artificial intelligence (“AI”) across the entire company and infusing generative AI capabilities into our consumer and commercial offerings. AI technology and services are a highly competitive and rapidly evolving market, and new competitors continue to enter the market. WeOur willAI bearofferings significantcompete developmentwith AI products from hyperscalers, open-source offerings, and operationalfrontier costsmodel toproviders, build and support the AI models, services, platforms, and infrastructure necessary to meet the needssome of ourwhich customers.are also current or potential partners. To compete effectively we must also be responsive to technological change, new and potential regulatory developments, and public scrutiny.

Some companies compete with us by modifying and then distributing open sourceopen-source software at little or no cost to end users, developing, making available, or using AI models that are open, and earning revenue on advertising or integrated products and services. These firms do not bear the full costs of research and development for the open sourceopen-source products. Some open sourceopen-source products mimic the features and functionality of our products.

Acquisitions, joint ventures, and strategic alliances could have an adverse effect on our business. We expect to continue making acquisitions and entering into joint ventures and strategic alliances as part of our long-term business strategy. For example, in October 2023 we completed our acquisition of Activision Blizzard, Inc. (“Activision Blizzard”). In January 2023Additionally, we announcedhave thea third phase of our OpenAIlong-term strategic partnership.partnership with OpenAI. Acquisitions and other transactions and arrangements involve significant challenges and risks, including that they do not advance our business strategy, that we get an unsatisfactory return on our investment, that they raise new compliance-related obligations and challenges, that we have difficulty integrating and retaining new employees, business systems, and technology, that they distract management from our other businesses, or that announced transactions may not be completed. If an arrangement fails to adequately anticipate changing circumstances and interests of a party, it may result in early termination or renegotiation of the arrangement. We also have limited ability to control or influence third parties with whom we have arrangements, which may impact our ability to realize the anticipated benefits. The success of these transactions and arrangements depend in part on our ability to leverage them to enhance our existing products and services or develop compelling new ones, as well as the acquired companies’ ability to meet our policies and processes in areas such as data governance, privacy, digital safety, responsible AI, and cybersecurity. It may take longer than expected to realize the full economic benefits from these transactions and arrangements, such as increased revenue or enhanced efficiencies, or the benefits may ultimately be smaller than we expected, which could cause an impairment of goodwill or intangibles. We have recorded, and may in the future be required to record, a significant charge in our consolidated financial statements during the period in which any impairment of our goodwill or amortizable intangible assets is determined, negatively affecting our results of operations. In addition, anthese acquisitiontransactions and arrangements have been and may be subject to challengelegal evenand afterregulatory it has been completed.challenge. These events could adversely affect our business, operations, financial condition, and results of operations.

Threats to security can take a variety of forms. Threat actors, including individual and groups of hackers and sophisticated organizations, including nation-states, state-sponsored organizations, or cybercriminal groups, continuously undertake attacks that pose threats to our customers and our internal infrastructure, and we have experienced cybersecurity incidents in which such actors have gained unauthorized access to our systems and data, includingas customerwell as customer, partner, and supplier systems and data. These actors use a wide variety of methods, which include developing and deploying malicious software; exploiting knownknown, andlatent, or potential vulnerabilities or intentionally designed processes in our or third-party hardware, software, or other infrastructure to attack our products and services or gain access to our networks and datacenters; using social engineering and AI-assisted techniques to induce our employees, users, partners, suppliers, or customers to disclose sensitive information, such as passwords, or take other actions to gain access to our data or our users’ or customers’ data; or acting in a coordinated manner or conducting coordinated attacks. For example, as previously disclosed in our Form 8-K filed with the Securities and Exchange Item 1A Commission on January 19, 2024 and amended on March 8, 2024, beginning in late November 2023, a nation-state associated threat actor used a password spray attack to compromise a legacy test account and, in turn, gain access to Microsoft email accounts. The threat actor used information it obtained to gain unauthorized access to some of our source code repositories and internal systems, and the threat actor could continue to utilize this and other information to attempt to gain access to our systems or otherwise adversely affect our business and results of operations. This incident has and may continue to result in harm to our reputation and customer relationships. Nation-state and state-sponsored actors can sustain malicious activities for extended periods and deploy significant resources to plan and carry out attacks. Nation-state attacks against us, our customers, suppliers, or our partners have and may continue to intensify due to our transparency to our customers, other stakeholders, and the public about cyberattacks, and during elections or periods of intense diplomatic or armed conflict. Challenges or failures into applyingupdate or apply security patches to all hardware and devices connected to our systems, including end-of-life and end-of-support equipment, have and may continue to result in unauthorized access to our systems and data in the future. Cyber incidents and attacks, individually or in the aggregate, could adversely affect our financial condition, results of operations, competitive position, and reputation, or expose us to legal or regulatory risk.

Cyberthreats are constantly evolving and becoming increasingly sophisticated and complex, increasing the difficulty of preventing, detecting and successfully defending against them. Threat actors may also utilize emerging technologies,technologies such as AI and machine learning.learning to, among other things, increase the speed and scale of attacks by generating and refining malicious content and code, automate reconnaissance and targeting, accelerate their ability to detect or exploit vulnerabilities, and rapidly iterate on attack techniques, which can broaden the scope, intensity, and sophistication of campaigns and reduce the time we have to identify and mitigate emerging threats. Our current capabilities may not detect certain vulnerabilities or new attack methods, which may allow them to persist in the environment over long periods of time. It may be difficult to determine the best way to investigate, mitigate, contain, and remediate the harm caused by a cyber incident. Such efforts may not be successful, and we may make errors or fail to take necessary actions. It is possible that threat actors may gain undetected access to other networks and systems after establishing a foothold on an internal system. Cyber incidents and attacks can have cascading impacts that unfold with increasing speed across our internal networks and systems, as well as those of our partners and customers. In addition, it may take considerable time for us to investigate and evaluate the full impact of incidents, particularly for sophisticated attacks. As a result of these and other factors, we may not be able to provide prompt, full, and reliable information about the incident to our customers, partners, suppliers, regulators, and the public. Breaches of our facilities, network, or data security can disrupt the security of our systems and business applications, impair our ability to provide services to our customers and protect the privacy of their data, result in product development delays, compromise confidential or technical business information, result in theft or misuse of our intellectual property or other assets, subject us to ransomware attacks, require us to allocate more resources to improve technologies or remediate the impacts of attacks, or otherwise adversely affect our business. In addition, actions taken to remediate an incident could result in outages, data losses, and disruptions of our services.

The security of our products and services is important in our customers’ decisions to purchase or use our products or services across cloud and on-premises environments. Security threats are a significant challenge to companies like us, whose business is providing technology products and services to others. Threats toto, or attacks onon, our own infrastructure, such as the nation-state attack described in the prior risk factor, have also affected our customers and may do so in the future. The reliability of our cloud-based services and the protection of customer data depend on the security of our infrastructure,infrastructure and the security of third-party infrastructure upon which we rely, which includes hardwarehardware, software, and other elements provided by third parties. Adversaries tend to focus their efforts on the most popular operating systems, programs, and services, including many of ours, as well as customers with sensitive data, and we expect that to continue. In addition, adversaries can attack our customers’ on-premises or cloud environments, sometimes exploiting previously unknown (“zero-day”) vulnerabilities. Product vulnerabilities can persist even after we have issued security patches if customers have not installed the most recent updates, or if attackers, potentially with the attackersassistance exploitedof artificial intelligence, reconstruct and exploit the vulnerabilities before patchingpatching. Attackers may utilize vulnerabilities to install additional malware to further compromise customers’ systems. Adversaries will continue to attack customers using our cloud services as customersthey embrace digital transformation. Adversaries that acquire user account information can use that information to compromise our users’ accounts, including where accounts share the same attributes such as passwords. Inadequate account security practices may also result in unauthorized access, and user activity may result in ransomware or other malicious software impacting a customer’s use of our products or services. WeaknessesOur products are highly complex and weaknesses may exist in our development processesprocesses. canFor resultexample, incode generated by AI could include errors, deficiencies, or vulnerabilities inthat increase our products.exposure Opento sourcecyberattacks. Additionally, open-source software can also contain vulnerabilities that may make our products susceptible to cyberattacks as we increasingly incorporate open sourceopen-source software into our products. Additionally,Accordingly, featuresour thatproducts relyhave onand generativemay AI can be susceptiblecontinue to securitycontain threats.vulnerabilities or undetected errors.

Our customers operate complex systems with third-party hardware and software from multiple vendors that may include systems acquired over many years. They expect our products and services to support all these systems and products, including those that no longer incorporate the strongest current security advances or standards. As a result, we may not be able to discontinue support inof our services for a product, service, standard, or feature solely because a more secure alternative is available. Failure to utilize the most current security advances and standards can increase our customers’ vulnerability to attack. Further, customersthe rapid evolution of AI technologies and use cases may outpace the development, deployment, and effectiveness of security products, controls, and industry standards, particularly in complex customer environments, increasing the risk that security measures will be insufficient to address newly emerging threats. Customers of widely varied sizes and technical sophistication use our technology, and consequently may still have limited capabilities and resources to help them adopt and implement state-of-the-art cybersecurity practices and technologies. In addition, we must account for this wide variation of technical sophistication when defining default settings for our products and services, including security default settings, as these settings may limit or otherwise impact other aspects of operations and some customers may have limited capability to review and reset these defaults.

To defend against security threats to our internal infrastructure, our cloud-based services, and our customers’ systems, we must take a complex and multifaceted approach. This includes continuously engineering more secure products and services, and enhancing security, threat detection, and reliability features.features, including through the deployment of AI-based and automated defenses. We must also escalate and improve our development processes and the deployment of software updates to address security vulnerabilities in our own products as well as those provided by others in a timely manner. In addition, we must develop mitigation technologies that help to secure customers from attacks even Item 1A when software updates are not deployed, and maintain the digital security infrastructure that protects the integrity of our network, products, and services. Further, we must provide security tools such as firewalls, anti-virus software, and advanced security and information about the need to deploy security measures and the impact of doing so.

The cost of these measures to protect products and customer-facing services could reduce our operating margins. If we fail to do these things well, actual or perceived security vulnerabilities in our processes, products, and services, data corruption issues, or reduced performance could harm our reputation and lead customers to exercise contractual or other remedies against us, reduce or delay future purchases of products or subscriptions to services, or to use competing products or services. Customers and third parties granted access to customer systems may fail to update their systems, continue to run software or operating systems we no longer support, may fail to timely install or enable security patches, or may otherwise fail to adopt adequate security practices.practices, including in response to enhanced AI-based threats. Customers may also spend more on protecting their existing computer systems from attack, which could delay adoption of additional products or services. Customers in certain industries such as financial services, health care, and government have enhanced or specialized expectations and requirements to which we must develop and engineer our products and services. Any of these could adversely affect our reputation and results of operations. Actual or perceived vulnerabilities may lead to claims against us. Our license agreements typically contain provisions that eliminate or limit our exposure to liability, but there is no assurance these provisions willmay not withstand legal challenges. At times, to achieve commercial objectives, we may enter into agreements with larger liability exposure to customers.

Disclosure and misuse of personal data could result in liability and harm our reputation. As we continue to grow the number, breadth, and scale of our cloud-based offerings, we store and process increasingly large amounts of personal data of our customers and users. The continued occurrence of high-profile data breaches provides evidence of an external environment increasingly hostile to information security. Despite our efforts to improve the security controls across our business groups and geographies, it is possible ourOur security controls over personal data, our training of employees and third parties on data security, and other practices we follow may not prevent the improper disclosure or misuse of customer or user data we or our vendors store and manage. Relatedly, despite our efforts to continuously improve security controls, it is possible that we may fail to identify or mitigate insider threat activities that could lead to the misuse of our systems or customer and user data. In addition, third parties who have limited access to our customer or user data may use this data in unauthorized ways. Improper disclosure or misuse could harm our reputation, lead to legal exposure to customers or users, or subject us to liability under laws that protect personal data, resulting in increased costs or loss of revenue. Our software products and services also enable our customers and users to store and process personal data on-premises or in a cloud-based environment we host. Government authorities can sometimes require us to produce customer or user data in response to valid legal orders. In the U.S. and elsewhere, we advocate for transparency concerning these requests and appropriate limitations on government authority to compel disclosure. Despite our efforts to protect customer and user data, perceptionsPerceptions that the collection, use, and retention of personal information is not satisfactorily protected could inhibit sales of our products or services and could limit adoption of our cloud-based solutions by consumers, businesses, and government entities. Additional security measures we take to address customer or user concerns, or constraints on our flexibility to determine where and how to operate datacenters in response to customer or user expectations or governmental rules or actions, may increase costs or hinder sales of our products and services.

We may not be able to protect information in our products and services from use by others. LinkedIn and other Microsoft products and services contain valuable information and content protected by contractual restrictions or technical measures. In certain cases, we have made commitments to our members and users to limit access to or use of this information. ChangesLimitations in the law or interpretations of the law may weakenon our ability to prevent third parties from scraping or gathering information or content through use of bots or other measures and using it for their own benefit whichdue to, among other things, changes in the law, interpretations of law, or increasing use of agentic AI, could adversely affect our business, financial condition, and results of operations.

Our consumer services as well as our enterprise services may be used to find, generate, store, or disseminate harmful or illegal content in violation of our terms or applicable law. We may not proactively discover such content due to scale, the limitations of existing technologies, and conflicting legal frameworks. When discovered by users and others, suchThis content may negatively affect users, our reputation, our brands, andor usercould engagement.impact Regulationsour business in certain markets. Regulatory enforcement is increasingly focused on product design, safety-by-design, and otherthe initiativesresponsibility haveof beenplatform enacted to make platforms responsible for preventing or eliminating harmful content online, and we expect this to continue with focused attention on child safety.providers. At the same time, regulationslaws designed to reduce risks to children are driving new obligations for age-assurance systems, age-appropriate design, and otherparental initiativescontrols regardingacross freedomthe ofonline expressionecosystem, including within app stores and operating systems. In addition, certain AI technologies, including conversational or emotionally engaging AI systems, may conflictpresent withdistinct suchrisks contentfor moderation regulations. The legalchildren and regulatory environment in this area is complex and continues to evolve across multiple jurisdictions. As a result, there is considerable uncertainty regarding both current and future compliance obligations.adolescents. Failure to comply with contentthese requirements may subject us to enhanced regulatory oversight, civil or criminal liability, fines and penalties, or other reputational damage, which could adversely affect our business, financial condition, and results of operations.

Issues in the development, deployment, and use of AI may result in reputational or competitive harm or liability. We are buildingproviding access to AI into many ofacross our offerings,offerings includingand enabling customers and partners to build AI-based solutions using our productivityplatforms. services,These and we are also making AI available for our customers to use in solutions that they build. This AIcapabilities may be developed by Microsoft or others,third includingparties ourand strategicare partner,becoming OpenAI.an Weincreasing expect these elementspart of our businessbusiness. The increasing scale and adoption of AI amplifies challenges that may affect its development, deployment, and use, which could give rise to grow.reputational, Wecompetitive, envisionor alegal futureharm. in whichOur AI operating in devices, applications,models and the cloudmethodologies helpsused ourto customerstrain be more productive in their work and personal lives. As with many innovations, AI presents risks and challenges that could affect its adoption, and therefore our business. AI algorithms or training methodologiesthem may be flawed. Datasets may be overbroad, insufficient, or contain biased or inaccurate information. Content generated by AI systems may be offensive, illegal, inaccurate, or otherwise harmful. Ineffective or inadequate AI development or deployment practices by Microsoft or others could result in incidents that impair the acceptance of AI solutions, cause harm to individuals, customers, or society, or result in our products and services not working as intended. Human review of certain inputs and outputs or other forms of human oversight may be required, including for agentic AI systems that can take actions autonomously. Companion or highly-personalized AI systems may result in over-reliance or dependence by users that is harmful. Our implementation of AI systems could result in legal liability, regulatory action, litigation, brand, reputational, or competitive harm, or other adverse impacts. These risks may stem from issues related to AI model and system capabilities, intellectual property, data privacy, product liability, and other claims associated with AI trainingtraining, outputs, and outputs.system behavior. They are further compounded by the evolving regulatory landscape, with new laws emerging globally,globally includingand theincreased Europeanscrutiny Unionfrom (“EU”).regulators Someand lawmakers. Certain AI scenariostechnologies and use cases present ethical issues or may have broad or uneven impacts on society or vulnerable groups within society. There is also rising divergence globally in how to address these issues and impacts, with the result that we will need to navigate a web of different tensions across geographies. Finally,We ifhave experienced, and expect to continue to experience, instances in which the AI solutions we enable or offer AI solutions that haveproduce unintended consequences, unintendedare usageused or customizationcustomized in unforeseen ways by our customers andor partners, areor contraryoperate toin a Item 1A manner inconsistent with our responsible AI policies and practices,practices. These outcomes may give rise to public controversy, societal concerns, or areregulatory otherwiseactions controversialrelating because of the impact onto human rights, privacy, employment, or other social, economic, or political issues, and could adversely affect our reputation, competitive position, business, financial condition, and results of operations could be adversely affected.operations.

We may havebe excessiveunable outages,to data losses,develop and disruptions of our online services if we fail to maintain anexpand adequate operations infrastructure. Our increasing user traffic, our growth in services, and the complexity of our products and services demand more infrastructure capacity and computing power. We have spent and will continue to spend substantial amounts to build, purchase, or lease datacenters and equipment and to upgrade our technology and network infrastructure to handle more traffic on our websites and in our datacenters.infrastructure. Our datacentersinfrastructure dependcapacity depends on the availability of permitted and buildable land, predictable and affordable energy, networking supplies, and servers, including graphics processing units and other components. The cost or availability of these dependencies could be adversely affected by a variety of factors, including the transition to a clean energy economy, local and regional environmental regulations, and geopolitical disruptions. These demands continue to increase as we introduce new products and services and support the growth and the augmentation of existing services, includingand throughscale further the incorporation of AI features and/or functionality. We are rapidly growing our business of providing a platform and back-end hosting for services provided by third parties to their end users. Maintaining,In securing, and expanding thisaddition, infrastructure isin expensive and complex, and requires development of principles for datacenter builds incertain geographies withcarries higher safety and reliability risks. ItMaintaining, requiressecuring, thatand weexpanding maintain an Internet connectivityour infrastructure andglobally storageis expensive and compute capacity that is robust and reliable within competitive and regulatory constraints that continue to evolve. Inefficiencies or operational failures, including temporary or permanent loss of customer data, outages, insufficient Internet connectivity, insufficient or unavailable power or water supply, or inadequate storage and compute capacity could diminish the quality of our products, services, and user experience, resulting in contractual liability, claims by customers and other third parties, regulatory actions, damage to our reputation, and loss of current and potential users, subscribers, and advertisers, each of which could adversely affect our business, operations, financial condition, and results of operations.complex.

We may experience supply or quality problems. There are limited suppliers for certain critical device and datacenter components.components, and those items are in short supply. We continue to identify and evaluate opportunities to expand our datacenter locations and increase our server capacity to meet the evolving needs of our customers, particularly given the growing demand for AI products and services. Capacity available to us may be affected asOur competitors are also scaling their infrastructure and use some of the same suppliers and materials for hardware components as we do, which impacts price and availability. We depend on the timely availability of critical hardware, equipment, and components used to construct and operate datacenters and related infrastructure. We have experienced and may continue to experience supply constraints, including shortages of semiconductors, networking equipment, power systems, cooling equipment, and other key components. IfExpanding manufacturing or supply capacity for certain components may require significant investments and multi-year lead times. As components are delayed or become unavailable,unavailable or more expensive, whether because of supplier capacity constraint, industry shortages, legal or regulatory changes that restrict supply sources, geopolitical tensions, trade restrictions, tariffs, transportation disruptions, supplier financial distress, natural disasters, public health events, instability in regions important to our or our suppliers’ supply chains, or other reasons, we may not obtain timely replacement supplies, resultingor may be able to obtain supplies only by entering into long-term purchase commitments, price commitments, paying prices above prevailing market rates, or other arrangements on terms that are less favorable than prevailing market terms. Any delay or inability to obtain necessary equipment, hardware, or components on acceptable terms and timelines could delay infrastructure deployments, result in reduced salessales, higher costs, or Item 1A inadequate datacenter capacity to support the delivery and continued development of our products and services. Component shortages, excess or obsolete inventory, or price reductions resulting in inventory adjustments have and may increase our cost of revenue. Datacenter servers, Xbox consoles, Surface devices, and other hardware are assembled in Asia and other geographies that may be subject to disruptions in the supply chain, resulting in shortages which could adversely affect our business, operations, financial condition, and results of operations.

OurIn hardwareaddition to infrastructure, other products such as XboxXBOX consoles, Surface devices, and other deviceshardware weare designsimilarly subject to supply chain challenges and marketdisruptions, are highly complex. Failure to prevent, detect, or address defectsresulting in design, manufacture, or associated software could result in recalls, safety alerts, or product liability claims,shortages which could adversely affect our businessbusiness, operations, financial condition, and results of operations.

The following Management’s Discussion and Analysis of Financial Condition and Results of Operations (“MD&A”) is intended to help the reader understand the results of operations and financial condition of Microsoft Corporation. MD&A is provided as a supplement to, and should be read in conjunction with, our consolidated financial statements and the accompanying Notes to Financial Statements (Part II, Item 8 of this Form 10-K). This section generally discusses the results of our operations for the year ended June 30, 20252026 compared to the year ended June 30, 2024.2025. For a discussion of the year ended June 30, 20242025 compared to the year ended June 30, 2023,2024, please refer to Part II, Item 7, “Management’s Discussion and Analysis of Financial Condition and Results of Operations” in our Annual Report on Form 10-K for the year ended June 30, 2024 and our Form 8-K filed on December 3, 2024.2025.

Microsoft is a technology company committed to making digital technology and artificial intelligence (“AI”) available broadly and doing so responsibly, with a mission to empower every person and every organization on the planet to achieve more. We create platforms and tools,applications, powered by AI, that deliver innovative solutions that meet the evolving needs of our customers.

XboxMicrosoft content365 andCommercial servicescloud revenue increased 16%.17%.

Search advertising (formerly Search and news advertising) revenue excluding traffic acquisition costs increased 20%.12%.

MicrosoftWe and OpenAI maintainhave a long-term strategic partnership with OpenAI which was originally established in 2019. In October 2025 and April 2026, we extended this partnership and continue to build on our shared vision to advance artificial intelligence responsibly and make its benefits broadly accessible. Microsoft is a major investor in OpenAI,OpenAI and thewill companiescontinue haveto reciprocalreceive revenue-sharing arrangements.payments. We hold rights to OpenAI’s intellectual property, including models and infrastructure, for integration into our products. The OpenAI API is exclusive to Azure, runs on Azure, and is available through the Azure OpenAI Service. We also have a right of first refusal on OpenAI's new capacity needs.

The investments we are making in cloud and AI infrastructure and devices will continue to increase our operating costs and may decrease our operating margins. We continue to identify and evaluate opportunities to expand our datacenter locations and increase our server capacity to meet the evolving needs of our customers, particularly given the growing demand for AI services. Our datacenters depend on the availability of permitted and buildable land, predictable energy, networking supplies, and servers, including graphics processing units (“GPUs”) and other components. Our devices are primarily manufactured by third-party contract manufacturers. For the majority of our products, we have the ability to use other manufacturers if a current vendor becomes unavailable or unable to meet our requirements. However, some of our products contain certain components for which there are very few qualified suppliers. Extended disruptionsor atunforeseen disruptions, or limited availability of components from these suppliers could impact our ability to operate our datacenters and manufacture devices on time to meet consumer demand.

Our international operations provide a significant portion of our total revenue and expenses. Many of these revenue and expenses are denominated in currencies other than the U.S. dollar. As a result, changes in foreign exchange rates may significantly affect revenue and expenses. Fluctuations in the U.S. dollar relative to certain foreign currencies increased reported revenue and did not have a material impact on reported revenue and expenses from our international operations in fiscal year 2025.2026.

We report our financial performance based on the following three segments: Productivity and Business Processes, Intelligent Cloud, and More Personal Computing. The segment amounts included in MD&A are presented on a basis consistent with our internal management reporting.

Revenue increased $36.6$50.1 billion or 15%18% withdriven by growth acrossin eachMicrosoft of our segments.Cloud. Intelligent Cloud revenue increased driven by Azure. Productivity and Business Processes revenue increased driven by Microsoft 365 Commercial cloud. More Personal Computing revenue increaseddecreased driven by XBOX (formerly Gaming), andoffset in part by growth in Search and news advertising.

Microsoft Cloud grossGross margin percentage decreased to 69%slightly driven by thecontinued impactinvestments of scaling ourin AI infrastructure,infrastructure and growing AI product usage, offset in part by efficiency gains inacross Azure.the Microsoft Cloud.

Operating income increased $19.1$26.7 billion or 17%21% withdriven by growth acrossin eachProductivity ofand ourBusiness segments.Processes and Intelligent Cloud.

Microsoft 365 Commercial products and cloud services revenue increased $10.8$14.2 billion or 14%.16%. Microsoft 365 Commercial cloud revenue grew 15%17% with growth in revenue per user driven by Microsoft 365 Copilot and Microsoft 365 E5. Microsoft 365 Commercial seatseats growth ofgrew 6% driven by small and medium businesses and frontline worker offerings, as well as growth in revenue per user.offerings. Microsoft 365 Commercial products revenue grew 7%13% driven by growth in the Windows Commercial on-premises components of Microsoft 365 suite salessales, andas well as an increase in Office 2024 transactional purchasing with the launch of Office 2024.purchasing.

Microsoft 365 Consumer products and cloud services revenue increased $756$1.8 millionbillion or 11%.24%. Microsoft 365 Consumer cloud revenue grew 11%28% driven by growth in revenue per user and Microsoft 365 Consumer subscriber growth of 8% to 89.0 million, as well as growth in revenue per user from the price increase announced in January 2025.7%.

Dynamics products and cloud services revenue increased $996$1.2 millionbillion or 15% driven by growth in Dynamics 365, offset in part by a decline in Dynamics on-premises products.365. Dynamics 365 revenue grew 19%18% with growth across all workloads.

OperatingCost expensesof revenue increased $1.5$2.6 billion or 7%12% driven by investments in cloudAI infrastructure to support Microsoft 365 Copilot seat and AIusage engineering.growth.

Gross margin increased $3.5$16.6 billion or 13%17% withdriven by growth acrossin allMicrosoft businesses.365 Commercial cloud. Gross margin percentage increased withslightly improvementprimarily acrossdriven allby businesses.efficiency gains in Microsoft 365 Commercial cloud, offset in part by continued investments in AI infrastructure and growing AI product usage.

We are investing in artificial intelligence (“AI”) across the entire company and infusing generative AI capabilities into our consumer and commercial offerings. AI technology and services are a highly competitive and rapidly evolving market, and new competitors continue to enter the market. We will bear significant development and operational costs to build and support the AI models, services, platforms, and infrastructure necessary to meet the needs of our customers. To compete effectively we must also be responsive to technological change, new and potential regulatory developments, and public scrutiny.

Acquisitions, joint ventures, and strategic alliances could have an adverse effect on our business. We expect to continue making acquisitions and entering into joint ventures and strategic alliances as part of our long-term business strategy. For example, in October 2023 we completed our acquisition of Activision Blizzard, Inc. WeAdditionally, we have a long-term strategic partnership with OpenAI, and in October 2025 we announced a significant update to this partnership.OpenAI. Acquisitions and other transactions and arrangements involve significant challenges and risks, including that they do not advance our business strategy, that we get an unsatisfactory return on our investment, that they raise new compliance-related obligations and challenges, that we have difficulty integrating and retaining new employees, business systems, and technology, that they distract management from our other businesses, or that announced transactions may not be completed. If an arrangement fails to adequately anticipate changing circumstances and interests of a party, it may result in early termination or renegotiation of the arrangement. We also have limited ability to control or influence third parties with whom we have arrangements, which may impact our ability to realize the anticipated benefits. The success of these transactions and arrangements depend in part on our ability to leverage them to enhance our existing products and services or develop compelling new ones, as well as the acquired companies’ ability to meet our policies and processes in areas such as data governance, privacy, digital safety, responsible AI, and cybersecurity. It may take longer than expected to realize the full economic benefits from these transactions and arrangements, such as increased revenue or enhanced efficiencies, or the benefits may ultimately be smaller than we expected, which could cause an impairment of goodwill or intangibles.

We have recorded, and may in the future be required to record, a significant charge in our consolidated financial statements during the period in which any impairment of our goodwill or amortizable intangible assets is determined, negatively affecting our results of operations. In addition, anthese acquisitiontransactions and arrangements have been and may be subject to challengelegal evenand afterregulatory it has been completed.challenge. These events could adversely affect our business, operations, financial condition, and results of operations.

Cyberthreats are constantly evolving and becoming increasingly sophisticated and complex, increasing the difficulty of detecting and successfully defending against them. Threat actors may also utilize emerging technologies,technologies such as AI and machine learning.learning to, among other things, increase the speed and scale of attacks by generating and refining malicious content and code, automate reconnaissance and targeting, and rapidly iterate on attack techniques, which can broaden the scope, intensity, and sophistication of campaigns and reduce the time we have to identify and mitigate emerging threats. Our current capabilities may not detect certain vulnerabilities or new attack methods, which may allow them to persist in the environment over long periods of time. It may be difficult to determine the best way to investigate, mitigate, contain, and remediate the harm caused by a cyber incident. Such efforts may not be successful, and we may make errors or fail to take necessary actions. It is possible that threat actors may gain undetected access to other networks and systems after establishing a foothold on an internal system. Cyber incidents and attacks can have cascading impacts that unfold with increasing speed across our internal networks and systems, as well as those of our partners and customers. In addition, it may take considerable time for us to investigate and evaluate the full impact of incidents, particularly for sophisticated attacks. As a result of these and other factors, we may not be able to provide prompt, full, and reliable information about the incident to our customers, partners, regulators, and the public. Breaches of our facilities, network, or data security can disrupt the security of our systems and business applications, impair our ability to provide services to our customers and protect the privacy of their data, result in product development delays, compromise confidential or technical business information, result in theft or misuse of our intellectual property or other assets, subject us to ransomware attacks, require us to allocate more resources to improve technologies or remediate the impacts of attacks, or otherwise adversely affect our business. In addition, actions taken to remediate an incident could result in outages, data losses, and disruptions of our services.

Our internal environment continues to evolve. Often, we are early adopters of new devices and technologies. We embrace new ways of sharing data and communicating internally and with partners and customers using methods such as social networking and other consumer-oriented technologies. Increasing use of generativeAI, AIincluding modelsmodels, algorithms, copilots, and autonomous or semi-autonomous agents, in our internal or third-party systems may create new attack surfaces or methods for adversaries. Our business policies and internal security controls may not keep pace with these changes as new threats emerge or the emerging cybersecurity regulations in jurisdictions worldwide.

The security of our products and services is important in our customers’ decisions to purchase or use our products or services across cloud and on-premises environments. Security threats are a significant challenge to companies like us, whose business is providing technology products and services to others. Threats to or attacks on our own infrastructure, such as the nation-state attack described in the prior risk factor, have also affected our customers and may do so in the future. The reliability of our cloud-based services and the protection of customer data depend on the security of our infrastructure, which includes hardware, software, and other elements provided by third parties. Adversaries tend to focus their efforts on the most popular operating systems, programs, and services, including many of ours, as well as customers with sensitive data, and we expect that to continue. In addition, adversaries can attack our customers’ on-premises or cloud environments, sometimes exploiting previously unknown (“zero-day”) vulnerabilities. Product vulnerabilities can persist even after we have issued security patches if customers have not installed the most recent updates, or if the attackers exploited the vulnerabilities before patching to install additional malware to further compromise customers’ systems. Adversaries will continue to attack customers using our cloud services as customers embrace digital transformation. Adversaries that acquire user account information can use that information to compromise our users’ accounts, including where accounts share the same attributes such as passwords. Inadequate account security practices may also result in unauthorized access, and user activity may result in ransomware or other malicious software impacting a customer’s use of our products or services. Weaknesses in our development processes can result in vulnerabilities in our products. Open-source software can also contain vulnerabilities that may make our products susceptible to cyberattacks as we increasingly incorporate open-source software into our products. Additionally, software, including features that rely on generativeor were generated by AI can be susceptible to security threats.cyberattacks.

Our customers operate complex systems with third-party hardware and software from multiple vendors that may include systems acquired over many years. They expect our products and services to support all these systems and products, including those that no longer incorporate the strongest current security advances or standards. As a result, we may not be able to discontinue support of our services for a product, service, standard, or feature solely because a more secure alternative is available. Failure to utilize the most current security advances and standards can increase our customers’ vulnerability to attack. Further, customersthe rapid evolution of AI technologies and use cases may outpace the development, deployment, and effectiveness of security products, controls, and industry standards, particularly in complex customer environments, increasing the risk that security measures will be insufficient to address newly emerging threats. Customers of widely varied sizes and technical sophistication use our technology, and consequently may still have limited capabilities and resources to help them adopt and implement state-of-the-art cybersecurity practices and technologies. In addition, we must account for this wide variation of technical sophistication when defining default settings for our products and services, including security default settings, as these settings may limit or otherwise impact other aspects of operations and some customers may have limited capability to review and reset these defaults.

To defend against security threats to our internal infrastructure, our cloud-based services, and our customers’ systems, we must take a complex and multifaceted approach. This includes continuously engineering more secure products and services, and enhancing security, threat detection, and reliability features.features, including through the deployment of AI-based and automated defenses. We must also escalate and improve our development processes and the deployment of software updates to address security vulnerabilities in our own products as well as those provided by others in a timely manner. In addition, we must develop mitigation technologies that help to secure customers from attacks even when software updates are not deployed, and maintain the digital security infrastructure that protects the integrity of our network, products, and services. Further, we must provide security tools such as firewalls, anti-virus software, and advanced security and information about the need to deploy security measures and the impact of doing so.

The cost of these measures to protect products and customer-facing services could reduce our operating margins. If we fail to do these things well, actual or perceived security vulnerabilities in our processes, products, and services, data corruption issues, or reduced performance could harm our reputation and lead customers to exercise contractual or other remedies against us, reduce or delay future purchases of products or subscriptions to services, or to use competing products or services. Customers and third parties granted access to customer systems may fail to update their systems, continue to run software or operating systems we no longer support, may fail to timely install or enable security patches, or may otherwise fail to adopt adequate security practices.practices, including in response to enhanced AI-based threats. Customers may also spend more on protecting their existing computer systems from attack, which could delay adoption of additional products or services. Customers in certain industries such as financial services, health care, and government have enhanced or specialized expectations and requirements to which we must develop and engineer our products and services. Any of these could adversely affect our reputation and results of operations. Actual or perceived vulnerabilities may lead to claims against us. Our license agreements typically contain provisions that eliminate or limit our exposure to liability, but there is no assurance these provisions will withstand legal challenges. At times, to achieve commercial objectives, we may enter into agreements with larger liability exposure to customers.

Our consumer services as well as our enterprise services may be used to find, generate, store, or disseminate harmful or illegal content in violation of our terms or applicable law. We may not proactively discover such content due to scale, the limitations of existing technologies, and conflicting legal frameworks. WhenThis discoveredcontent bymay usersnegatively affect users, and others, such content may negatively affect our reputation, our brands, and user engagement.engagement, or could result in legal liability. Regulations and other initiatives have been enacted to make platforms responsible for preventing or eliminating harmful content online.online and for taking actions against user accounts responsible for such content. At the same time, regulations and other initiatives regardingprotecting freedom of expression and user privacy may conflict with suchthese content moderationplatform regulations. Further, dutiesDuties to addressreduce risks to children are driving new obligations for ageeffective verificationage-assurance systems and parental controls across the online ecosystem, including within app stores and operating systems. The legal and regulatory environment in this area is complex and continuesis tonot evolveharmonized across multiple jurisdictions. As a result, there is considerable uncertainty regarding both current and future compliance obligations. Failure to comply with content requirements may subject us to enhanced regulatory oversight, civil or criminal liability, or reputational damage, which could adversely affect our business, financial condition, and results of operations.

We may experience supply or quality problems. There are limited suppliers for certain device and datacenter components. We continue to identify and evaluate opportunities to expand our datacenter locations and increase our server capacity to meet the evolving needs of our customers, particularly given the growing demand for AI services. Capacity available to us may be affected as competitors use some of the same suppliers and materials for hardware components. IfAs components are delayed or become unavailable or more expensive, whether because of supplier capacity constraint, industry shortages, legal or regulatory changes that restrict supply sources, or other reasons, we may not obtain timely replacement supplies, resulting in reduced sales, higher costs, or inadequate datacenter capacity to support the delivery and continued development of our products and services. Component shortages, excess or obsolete inventory, or price reductions resulting in inventory adjustments have and may increase our cost of revenue. Datacenter servers, Xbox consoles, Surface devices, and other hardware are assembled in Asia and other geographies that may be subject to disruptions in the supply chain, resulting in shortages which could adversely affect our business, operations, financial condition, and results of operations.

If our reputation or our brands are damaged, our business and results of operations may be harmed. Our reputation and brands are globally recognized and are important to our business. Our reputation and brands affect our ability to attract and retain consumer, business, and public-sector customers. There are numerous ways our reputation or brands could be damaged. These include product safetysafety, quality, or qualityaccessibility issues, our environmental impact and sustainability, supply chain practices, or human rights record. We may experience backlash from customers, government entities, advocacy groups, employees, and other stakeholders that disagree with our product offering decisions, public policy positions, or corporate philanthropic initiatives. Damage to our reputation or our brands may occur from, among other things:

Abrupt political change, terrorist activity, and armed conflict, such as the ongoing conflictconflicts in Ukraine,Ukraine and the Middle East, pose economic and other risks, which may negatively impact our ability to sell to and collect from customers, increase our operating costs, or otherwise disrupt our operations in markets both directly and indirectly impacted by such events. These conditions also may add uncertainty to the timing and budget for technology investment decisions by our customers and may cause supply chain disruptions for hardware manufacturers.disruptions. Geopolitical change may result in changing regulatory systems and requirements and market interventions that could impact our operating strategies, access to national, regional, and global markets, hiring, and profitability. Geopolitical instability may lead to sanctions and impact our ability to do business in some markets or with some public-sector customers. Any of these changes could adversely affect our results of operations. Changes in geopolitical conditions also increase the security risks described elsewhere in these risk factors.

Highlights from the secondthird quarter of fiscal year 2026 compared with the secondthird quarter of fiscal year 2025 included:

Windows OEM and Devices revenue increaseddecreased 1%.2%.

Search advertising (formerly Search and news advertising) revenue excluding traffic acquisition costs increased 10%.12%.

We have a long-term strategic partnership with OpenAI which was originally established in 2019. In October 2025,2025 and April 2026, we signed a new definitive agreement with OpenAI that extendsextended this partnership and continuescontinue to build on our shared vision to advance artificial intelligence responsibly and make its benefits broadly accessible. Microsoft is a major investor in OpenAI,OpenAI and thewill companiescontinue haveto reciprocalreceive revenue-sharing arrangements.payments. We hold rights to OpenAI’s intellectual property, including models and infrastructure, for integration into our products.

Our international operations provide a significant portion of our total revenue and expenses. Many of these revenue and expenses are denominated in currencies other than the U.S. dollar. As a result, changes in foreign exchange rates may significantly affect revenue and expenses. Fluctuations in the U.S. dollar relative to certain foreign currencies increased reported revenue and did not have a material impact on reported expenses from our international operations for the three and sixnine months ended DecemberMarch 31, 2025.2026.

Revenue increased $11.6$12.8 billion or 17%18% driven by Intelligent Cloud and Productivity and Business Processes, offsetgrowth in partMicrosoft by More Personal Computing.Cloud. Intelligent Cloud revenue increased driven by Azure. Productivity and Business Processes revenue increased driven by Microsoft 365 Commercial cloud. More Personal Computing revenue decreased drivenwith bylower hardware sales across Devices and Gaming, offset in part by growth in Search and news advertising as well as Windows OEM.advertising.

Gross margin percentage decreased slightly driven by continued investments in AI infrastructure and growing AI product usage, offset in part by efficiency gains across the Microsoft Cloud and sales mix shift to higher margin businesses.Cloud.

Operating expenses increased $1.6$3.1 billion or 5%7% driven by continued investments in research and development investments in compute capacity andcapacity, AI talent, asand welldata asto support product development across the portfolio, impairment chargesand other related expenses in our Gaming business.business, and higher Copilot advertising expenses. Total company headcount declined year-over-year.

Operating income increased $14.0$20.4 billion or 23%22% withdriven by growth acrossin eachProductivity ofand ourBusiness segments.Processes and Intelligent Cloud.

Microsoft 365 Commercial products and cloud services revenue increased $3.4$3.7 billion or 16%.17%. Microsoft 365 Commercial cloud revenue grew 17%19% with growth in revenue per user driven by Microsoft 365 E5 and Microsoft 365 Copilot. Microsoft 365 Commercial seats grew 6% driven by small and medium businesses and frontline worker offerings. Microsoft 365 Commercial products revenue grew 13% driven by Windows Commercial on-premises components of Microsoft 365 suite sales, as well as an increase in Office 2024 transactional purchasing.1%.

LinkedIn revenue increased $495$521 million or 11%12% driven bywith growth inacross Marketingall Solutions.lines of business.

Cost of revenue increased $541$680 million or 10%12% driven by growthinvestments in AI infrastructure to support Microsoft 365 CommercialCopilot cloud.seat and usage growth.

Gross margin increased $4.1$4.4 billion or 17%18% driven by growth in Microsoft 365 Commercial cloud. Gross margin percentage increased primarilyslightly driven by efficiency gains in Microsoft 365 Commercial cloud even with continued investments in AI infrastructure and growing AI product usage.

Operating expenses increased $424$795 million or 6%11% driven by continued investments in research and development investments in compute capacity andcapacity, AI talent, and data to support product development that benefits the entire portfolio, as well as higher Copilot advertising expenses.

EnterpriseMicrosoft 365 Consumer products and partnercloud services revenue increased $146$1.4 millionbillion or 8%27%. Microsoft 365 Consumer cloud revenue grew 29% driven by growth in Enterpriserevenue Supportper Services.user and continued growth in Microsoft 365 Consumer subscribers.

Cost ofLinkedIn revenue increased $4.2$1.4 billion or 44%11% driven bywith growth inacross Azure.all lines of business.

OperatingCost expensesof revenue increased $180$1.6 millionbillion or 3%10% driven by research and development investments in computeAI capacityinfrastructure to support Microsoft 365 Copilot seat and AIusage talent.growth.