Microsoft announced on 5 November 2026 a new on-premises security initiative for server workloads, starting with supported Exchange Server, SharePoint Server and Skype for Business Server. The initiative combines guidance, migration planning and product changes intended to reduce exposure in environments that cannot move fully to Microsoft 365.
Microsoft says on-premises servers remain necessary for some business operations, but are increasingly attractive to attackers. It also says AI can help less-skilled attackers analyse software, build malicious tooling and repeat attack workflows at greater speed and scale. That puts more pressure on administrators to reduce the interval between exposure and remediation.
Three areas of work
The initiative is organised around three actions. Microsoft describes them as understanding the most important on-premises risks, reducing the on-premises footprint where workloads can move to Microsoft 365, and securing the workloads that must remain.
Guidance is planned for Secure Now, including practitioner-focused guidance for on-premises environments. Microsoft says Secure Now also includes an AI readiness checklist in Microsoft Security Exposure Management and guidance for foundational security.
The product work starts with On-Premises Baseline Security Mode. Microsoft says it is designed to reduce the number of recommended security settings that administrators must configure and maintain manually.
Baseline Security Mode
On-Premises Baseline Security Mode starts with a tested security configuration from initial deployment for supported on-premises server workloads. Microsoft says administrator control remains in place, but more of the recommended posture will be established and maintained by the products themselves over time.
The work is grouped into three areas: patch, configure and protect. Those areas cover security update delivery, default configuration and interim mitigations for emerging vulnerabilities.
Patch changes
Microsoft says its deployment data shows that many Exchange Server deployments are not running the current security update, including a substantial share on unsupported versions. For administrators, the first issue remains basic eligibility: unsupported servers must move to supported releases before they can benefit from the new baseline work.
Since September 2026, Microsoft has released Critical and Important security updates outside the traditional Patch Tuesday schedule when it considers quicker action necessary. In Q1 2027, Microsoft is targeting automatic application of security updates after a fixed period following release in connected SharePoint Server, Exchange Server and Skype for Business Server environments. Microsoft has not stated the length of that fixed period.
Configuration and mitigation
Tenant Configuration Management can already help customers assess supported SharePoint Server, Exchange Server and Skype for Business Server environments. Microsoft says it can identify cases where permissions are broader than intended.
In Q1 2027, Microsoft plans to introduce hardened default configurations for those three server products. It also plans to identify configuration drift, so administrators can see when an environment moves away from the Microsoft-recommended baseline.
Emergency Mitigation Service remains the interim control for certain emerging vulnerabilities. Microsoft says it can apply mitigations while a permanent security update is prepared and deployed, but that mitigation does not replace the underlying security update.
Emergency Mitigation Service 2.0 is planned for Exchange Server and Skype for Business Server in December 2026. Microsoft says it will be enabled by default and will expand the mitigations it can apply. SharePoint Server coverage is planned for January 2027.
Planning work for administrators
The near-term work is familiar but becomes more urgent under this model. Administrators need to identify which workloads can move to Microsoft 365, which must remain on-premises, which servers are unsupported and which supported servers are missing current security updates.
The 2027 changes also affect change management. Automatic update application after a fixed period changes the assumptions behind maintenance windows in connected environments. Hardened defaults and drift detection will also require teams to decide where exceptions are valid and how they are documented.
Automatic security updates for Exchange Server, hardened SharePoint Server defaults and Emergency Mitigation Service 2.0 raise the operational questions ECS's Security topic covers, alongside Security Copilot, Zero Trust, Sentinel, Purview and DevSecOps. Sessions and workshops give attendees room to compare patch policy, exposure management, tenant controls and practitioner experience from live environments. Bring the on-premises workloads and exception cases that are difficult to settle from product documentation alone.
This article was written by the ECS editorial team with the assistance of Amal Agent, run.events' AI assistant, which supported the research, drafting and proofreading.