Security

On-Premises Security Initiative: Microsoft Hardens Servers

3 min read

Summary

Microsoft has announced a new on-premises security initiative focused on reducing risk for server workloads that must remain outside the cloud. The effort combines migration guidance, Secure Now recommendations, and product changes such as Baseline Security Mode, faster patching, hardened defaults, and expanded emergency mitigations for Exchange, SharePoint, and Skype for Business Server.

Need help with Security?Talk to an Expert

Introduction

Microsoft is increasing its focus on on-premises server security as attackers move faster and exploit gaps more quickly. For organizations still running critical workloads on-premises, this initiative matters because it aims to reduce manual security work while improving default protections across core Microsoft server products.

What’s new

Microsoft’s new on-premises security initiative is built around three priorities:

  • Understand: Help customers identify the most important on-premises risks and prioritize remediation.
  • Reduce: Encourage migration to Microsoft 365 where possible to benefit from cloud security and resilience.
  • Secure: Strengthen workloads that must remain on-premises.

A major part of this effort is On-Premises Baseline Security Mode, initially for supported:

  • Exchange Server
  • SharePoint Server
  • Skype for Business Server

This mode is designed to make these products more secure by default and reduce the number of settings administrators must manually configure and maintain.

Key investments across Patch, Configure, and Protect

Patch

Microsoft says it has already been releasing some Important security updates outside the normal Patch Tuesday cycle when needed. Looking ahead, in Q1 2027 it is targeting automatic application of security updates after a fixed period in connected Exchange, SharePoint, and Skype for Business Server environments.

Configure

Microsoft plans to introduce hardened default configurations in Q1 2027 for the same supported server products. It also plans to improve visibility into configuration drift, helping admins detect when environments move away from Microsoft’s recommended baseline.

Protect

The existing Emergency Mitigation Service will continue to help reduce exposure before permanent patches are deployed. Microsoft plans to launch Emergency Mitigation Service 2.0:

  • December 2026 for Exchange Server and Skype for Business Server
  • January 2027 for SharePoint Server

This updated service will be enabled by default and support broader mitigations.

Why this matters for IT admins

For security and infrastructure teams, this is a shift from guidance-only security to more secure-by-default product behavior. That should help reduce operational overhead, especially in environments where patching delays, unsupported versions, or configuration drift increase risk.

It also reinforces Microsoft’s direction: move what you can to Microsoft 365, and harden what must stay on-premises.

  • Inventory on-premises Exchange, SharePoint, and Skype for Business Server workloads.
  • Identify which workloads can be migrated to Microsoft 365.
  • Move remaining on-premises systems to supported releases.
  • Apply current security updates and review available protections.
  • Watch for upcoming Secure Now guidance and product-specific recommendations from Microsoft.
  • Review Ignite session BRK215: Secure your on-prem estate for more detail.

Microsoft’s message is clear: modernize where possible, and build stronger security into the on-premises workloads that remain.

Need help with Security?

Our experts can help you implement and optimize your Microsoft solutions.

Talk to an Expert

Stay updated on Microsoft technologies

Read the original article by Paul Lorimer
on-premises securityExchange ServerSharePoint ServerSkype for Business ServerMicrosoft Security

Related Posts

Security

Microsoft Security November 2026: Key Updates

Microsoft’s November 2026 security updates introduce new controls for AI agents, expanded least-privilege management in Intune, improved Defender Experts visibility, and simpler SQL Server protection in Azure Government. These changes help security and IT teams reduce risk, tighten access, and streamline operations across endpoints, identities, and AI workloads.

Security

Email Threat Landscape Q3 2026: Key Microsoft Trends

Microsoft reported 7.3 billion email-based phishing threats in Q3 2026, with September alone reaching nearly 3 billion detections. The latest threat data shows shifting attacker tactics across spoofed sender domains, CAPTCHA-gated phishing, QR code lures, and Microsoft Teams social engineering, giving IT teams clear areas to review in their defenses.

Security

Fake Download Campaign Delivers Trojanized Installers

Microsoft Threat Intelligence detailed a fake-download campaign that uses trojanized Inno Setup-style installers to silently deliver multiple monetization payloads in a single session. The activity matters to IT and security teams because it can turn devices into proxy, compute, or adware assets without informed user consent, increasing privacy, performance, and security risk.

Security

Microsoft Agent 365 Named Leader in Gartner 2026

Microsoft has been named a Leader in Gartner’s inaugural 2026 Magic Quadrant for AI Agent Management Platforms, highlighting momentum behind Microsoft Agent 365. For IT and security teams, the news underscores Microsoft’s push to bring identity, governance, discovery, and risk-based controls to enterprise AI agents across Microsoft and third-party ecosystems.

Security

Exploited Vulnerabilities: Key Patterns Defenders Must Know

Microsoft Security’s latest analysis shows that only about 0.5% of disclosed CVEs are exploited in the wild, but attackers consistently favor high-impact flaws such as remote code execution, privilege escalation, and authentication bypass. The findings matter for defenders because patching critical systems often takes weeks or longer, while weaponization can happen within days of disclosure.

Security

Claude Code Extension Attack: SSH Backdoor Findings

Microsoft Threat Intelligence analyzed a malicious Claude Code-branded extension briefly distributed through the Cursor marketplace that attempted to install an SSH backdoor, create reverse tunnels, and establish persistence. The incident appears limited to Cursor marketplace, but organizations should identify affected systems, preserve evidence, remove artifacts, and review endpoint and network telemetry for signs of compromise.