Microsoft (NASDAQ: MSFT) has outlined an on-premises security initiative that will add stronger baseline controls and, beginning in 2027, planned automatic security updates for supported Exchange Server, SharePoint Server and Skype for Business Server environments. For organizations that must retain local server workloads, the program targets a persistent operations problem: keeping patches, configuration and emergency mitigations current without relying entirely on manual administration.
The initiative combines guidance, migration recommendations and product changes under three areas Microsoft calls Patch, Configure and Protect. The company said it will initially focus on server workloads and continue to recommend moving appropriate services to Microsoft 365, while providing additional safeguards for critical workloads that remain on premises.
At the center of the product work is On-Premises Baseline Security Mode, which Microsoft said will begin with supported Exchange, SharePoint and Skype for Business deployments. The company describes it as a secure-by-default configuration that reduces the number of recommended security settings administrators need to establish and maintain manually. Rather than offering only guidance, the approach is intended to progressively maintain more of the recommended posture through the products as threats and Microsoft security guidance change.
The patching portion combines measures available now with planned automation. Microsoft said it has issued critical and important security updates outside the traditional Patch Tuesday schedule since September when faster action is needed. In the first quarter of calendar 2027, the company is targeting automatic application of security updates after a fixed period in connected Exchange, SharePoint and Skype for Business environments. The planned capability does not remove the need for teams to validate their infrastructure, but it could narrow the gap between an update’s release and deployment for servers that remain connected and supported.
Configuration management is the other operational focus. Microsoft said its existing Tenant Configuration Management capabilities can assess supported deployments and identify permissions that are broader than intended. In the first quarter of 2027, it plans to introduce hardened default configurations and identify configuration drift, giving administrators a way to see when an environment moves away from the recommended baseline. Those changes address a common security-operations challenge: a server can be fully patched while its permissions or settings no longer match the intended control model.
Microsoft also plans to expand its Emergency Mitigation Service, which can apply temporary mitigations for certain emerging vulnerabilities while a permanent update is prepared and deployed. Emergency Mitigation Service 2.0 is planned for Exchange Server and Skype for Business Server in December, followed by SharePoint Server in January. Microsoft said the updated service will be enabled by default and will support a broader set of mitigations.
The immediate value for IT security teams is a more product-driven approach to recurring server hardening tasks. Automatic updates and default configurations can reduce manual work, but they also raise the importance of inventory accuracy, supported software versions and change-management testing. Organizations that operate regulated, latency-sensitive or otherwise non-migratable workloads will still need to decide which systems can accept automated changes and which require a separate validation path.
Microsoft’s program does not make on-premises workloads equivalent to cloud services, and several elements remain planned rather than available today. Its significance is that the company is moving more of the recommended patch, configuration and mitigation work into supported server products. That shift could give security operations teams a more consistent way to reduce exposure across legacy environments that cannot yet move to the cloud.