Microsoft unveils plan to harden on premises server security

Microsoft has announced a new on-premises security initiative aimed at reducing risk for server workloads, with initial focus on on‑premises ubiquity and the accelerating use of AI to assist attackers. The plan combines guidance, data migration considerations, and product investments to help organisations understand and prioritise risk, shrink their on‑premises footprint where possible, and harden critical workloads that must stay on‑premises.

Guidance will be available through Secure Now, including an AI readiness checklist in Microsoft Security Exposure Management and practical guidance for strengthening foundational security. The initiative emphasises understanding where to focus, moving workloads to Microsoft 365 where feasible to benefit from cloud‑based security, resilience and ongoing innovation, and strengthening remaining on‑premises workloads while reducing manual security toil.

Within the On‑Premises Baseline Security Mode, the Protect pillar aims to harden the products themselves for supported server workloads, starting with a validated secure‑by‑default configuration from initial deployment while preserving administrator control. Microsoft outlines three workstreams—Patch, Configure and Protect.

In Patch, Microsoft notes that since September 2026 it has released security updates outside the traditional Patch Tuesday schedule when faster action is needed, with a target in Q1 2027 to automatically apply updates after a fixed period in connected SharePoint Server, Exchange Server and Skype for Business Server environments. In Configure, hardened default configurations are planned for Q1 2027, with drift identification to help admins stay aligned with the baseline.

In Protect, Emergency Mitigation Service already reduces exposure during the window before a permanent update, with Emergency Mitigation Service 2.0 slated for December 2026 for Exchange Server and Skype for Business Server, expanding to SharePoint Server in January 2027. The initiative culminates in an emphasis on moving workloads to Microsoft 365 where possible and adopting the strengthened defaults as products evolve. Updated 5 November 2026.