Microsoft Launches Initiative to Bolster On-Premises Server Security
Microsoft is introducing a new initiative to enhance the security of on-premises server workloads, focusing on reducing risks through improved configurations, faster patching, and automated mitigations.
Microsoft has announced a significant new initiative aimed at bolstering the security of on-premises server workloads, acknowledging their continued importance to business operations while recognizing their increasing attractiveness to attackers. The strategy centers on three key pillars: Understand, Reduce, and Secure. The 'Understand' component focuses on helping organizations identify and prioritize their most critical on-premises risks. 'Reduce' encourages the migration of workloads to cloud services like Microsoft 365, where security, resilience, and innovation are continuously managed. The 'Secure' pillar is dedicated to strengthening the security of essential workloads that must remain on-premises, with a particular emphasis on minimizing manual security administration.
A core element of the 'Secure' pillar is the introduction of 'On-Premises Baseline Security Mode.' This new feature is designed to establish a stronger, more secure default configuration for supported server products, including Exchange Server, SharePoint Server, and Skype for Business Server. The goal is to reduce the burden on administrators by pre-configuring many recommended security settings, while still allowing for administrator control. This mode aims to progressively enhance the security posture through the products themselves, adapting to evolving threats and Microsoft's security guidance.
The initiative breaks down the 'Secure' pillar into three actionable areas: Patch, Configure, and Protect. In the 'Patch' area, Microsoft is addressing the critical gap in timely security update deployment. Starting in Q1 of calendar year 2027, the company plans to automatically apply security updates to connected SharePoint Server, Exchange Server, and Skype for Business Server environments a fixed period after their release. This move aims to close known vulnerabilities faster than relying solely on manual patching.
For the 'Configure' aspect, Microsoft is working to make the adoption and maintenance of secure configurations easier. Currently, tools like Tenant Configuration Management help identify configuration drift. Looking ahead to Q1 2027, Microsoft plans to introduce hardened default configurations for Exchange, SharePoint, and Skype for Business Servers, shifting the focus from identifying risks to establishing recommended security settings by default. The system will also aim to identify when configurations drift away from this baseline.
The 'Protect' pillar addresses the need for rapid mitigations when threats emerge before a permanent patch is available. Microsoft's Emergency Mitigation Service, which currently provides interim fixes, is set to be enhanced. In December 2026, Emergency Mitigation Service 2.0 will be enabled by default for Exchange Server and Skype for Business Server, with expanded mitigation capabilities. This will be extended to SharePoint Server in January 2027, ensuring faster protection against zero-day threats.
These investments signify a strategic shift for Microsoft, moving beyond providing security guidance and tools to embedding recommended security postures directly into its products. This proactive approach aims to reduce the manual effort required from administrators and improve the overall security resilience of critical on-premises infrastructure. The initiative underscores Microsoft's commitment to helping organizations navigate the complex security landscape by modernizing where possible and strengthening what must remain on-premises.
The overarching goal is to provide customers with a more robust and automated security framework for their on-premises servers. By focusing on faster patching, easier configuration management, and quicker threat protection, Microsoft intends to significantly reduce the attack surface and the potential impact of security incidents on businesses that rely on these essential workloads. This comprehensive approach reflects the evolving threat landscape and the increasing sophistication of cyberattacks.