HomeServicesManaged IT ServicesAI DeploymentSoftwareInsightsAnswersAboutFree Consultation
On-Premises Security

Microsoft Plans Stronger Security Defaults for On-Premises Servers

Published Nov 6, 20265 min read
By , Founder & Senior Architect | Company facts

Microsoft has announced a security initiative for supported on-premises servers, beginning with Exchange Server, SharePoint Server, and Skype for Business Server. The November 5 announcement describes changes to patching, secure configuration, and emergency mitigation. Most of the changes are planned, so administrators should prepare without assuming they are available today.

What to do now: inventory server versions and exposure, confirm support and current security updates, and review existing mitigation and recovery procedures. Microsoft recommends migrating workloads to Microsoft 365 where practical while securing the systems that must remain on premises.

What Microsoft announced

Microsoft calls the proposed approach On-Premises Baseline Security Mode. It intends to make recommended security settings easier to establish and maintain across supported workloads. The announcement describes a direction and target dates, not a complete deployment specification or guarantee of availability.

  • Patch: Microsoft targets automatic application of security updates after a fixed period in connected Exchange, SharePoint, and Skype for Business Server environments in the first quarter of calendar 2027. The announcement does not specify the interval or detailed controls.
  • Configure: Microsoft plans hardened default configurations and configuration-drift identification for those workloads in the first quarter of 2027.
  • Protect: Microsoft plans Emergency Mitigation Service 2.0 for Exchange and Skype for Business Server in December 2026, enabled by default, and plans to extend it to SharePoint Server in January 2027.

Microsoft says it has released Important as well as Critical security updates outside the normal Patch Tuesday schedule when faster action is needed since September 2026. An emergency mitigation reduces exposure while a permanent security update is prepared or deployed; it is not a substitute for that update.

Prepare your operating model

  1. Build a server inventory. Record each workload, version, update level, connectivity, external exposure, owner, and business dependency. Check the Microsoft product lifecycle for the exact release; the announcement refers to supported products and does not give a complete eligibility matrix.
  2. Close today’s gaps. Move unsupported workloads to supported releases or migrate them, apply current security updates, and review protections already available for each product. Track exceptions with an owner and expiry date.
  3. Review change and recovery procedures. Identify maintenance windows, application dependencies, backups, restore tests, and rollback owners. Automatic patching may change the timing of your existing process; wait for product-specific details before redesigning it.
  4. Monitor mitigation and configuration guidance. Assign someone to follow the Exchange, SharePoint, and Skype for Business product teams for prerequisites, rollout dates, controls, and any exceptions. Validate changes in a representative test environment when guidance is available.

Questions to resolve as details arrive

Which builds are eligible? How long is the fixed update period, and what control do administrators have over scheduling or exceptions? How will mitigation and configuration drift be reported? Microsoft has not answered these implementation questions in its initial announcement. Treat the dates as plans and keep your existing patching and monitoring process active.

Microsoft sources

Planning your next steps? Accred’s Microsoft 365 security team can help assess dependencies, security controls, and migration options.