Microsoft Plans On-Premises Baseline Security Mode and Automatic Patching for Exchange, SharePoint and Skype Servers

If you run any of those three, this affects your 2027 change calendar. Some of it exists today, some of it is planned for next month, and some is aimed at the first quarter of 2027. That split matters, so this piece keeps the shipped features and the promised ones clearly apart.

Why Microsoft is doing this now​

Microsoft's reasoning is simple. On-premises servers are business-critical and attractive targets. The company also argues that AI helps less-skilled attackers analyse software, build malicious tools and repeat attack workflows faster and at greater scale. That shrinks the time between a flaw becoming known and someone exploiting it.

The post also admits a problem. Microsoft says its deployment data shows that many Exchange Server deployments aren't running the current security update, and that a "substantial share" are on unsupported versions. It gives no counts, percentages or method, so read this as Microsoft's own description rather than an independently measured figure. Anyone who has inherited an Exchange 2016 box that "just works" won't be surprised.

The support status explains why this matters. Microsoft's Exchange Server supportability matrix says Exchange Server 2016 and Exchange Server 2019 reached end of support on October 14, 2025, and lists Exchange Server Subscription Edition (SE) as the supported version. The new baseline work applies to supported workloads, so servers still running 2016 or 2019 aren't in scope.

Section summary: Microsoft says attackers are moving faster and many Exchange servers are behind on patches. Its answer is to put more of the security posture into the products themselves.

The three pillars: Understand, Reduce, Secure​

The initiative is built around three pillars:

• Understand: Find the most important on-premises risks and prioritise what to do now.
• Reduce: Move workloads to Microsoft 365 where possible, for its cloud security, resilience and continuous updates.
• Secure: Harden the critical workloads that have to stay on-premises and cut the manual work needed to keep them secure.

Guidance for the initiative will be published through Secure Now. Microsoft says Secure Now already includes its AI readiness checklist in Microsoft Security Exposure Management and guidance on foundational security. The Exchange, SharePoint and Skype for Business teams plan to publish more detail on existing protections, upcoming features and actions customers can take now. Microsoft is also presenting the initiative at Ignite in a session called "Secure your on-prem estate" (BRK215).

Microsoft is open about its preference. It "continues to recommend" moving workloads to Microsoft 365 wherever possible. That's a reasonable security position, and it also happens to suit Microsoft's business. Both are true. Many organisations keep Exchange or SharePoint on-premises for real reasons: data residency, regulated environments, line-of-business integrations or air-gapped networks. For them, the useful part of this announcement is the Secure pillar, not the migration pitch.

Section summary: Microsoft wants customers to move what they can to the cloud and harden what stays. The hardening is where the engineering news is.

What On-Premises Baseline Security Mode is​

The name will sound familiar. Microsoft deployed Baseline Security Mode across Microsoft 365 tenants as a dashboard in the Microsoft 365 admin center that centralises recommended security settings for Office, SharePoint, Exchange, Teams and Entra. It was announced at Ignite 2025 as an opt-in feature. Reporting from CyberSecurityNews says the cloud version blocks legacy protocols such as basic auth, Exchange Web Services and IDCRL, and requires phishing-resistant MFA for admins.

The on-premises version has the same goal for your own servers. According to Microsoft, On-Premises Baseline Security Mode is designed to make the default security posture stronger, reducing the number of recommended security settings administrators must configure and maintain manually. Microsoft also says it:

• Starts from a validated, tested secure-by-default configuration at initial deployment
• Keeps administrator control in place
• Gradually establishes and maintains more of the recommended posture through the products themselves
• Changes the baseline over time as threats and Microsoft guidance change

There's one important difference from the cloud version. Microsoft hasn't published a list of on-premises settings yet. The cloud version has a documented set of policies. The on-premises version, for now, has a roadmap and three headings: Patch, Configure and Protect.

Patch: faster releases, then automatic installation​

Today: Microsoft says that since September 2026 it has released Important security updates, not just Critical ones, outside the normal Patch Tuesday schedule when faster action is needed. If your change process assumed on-premises server updates would only arrive on the second Tuesday, that assumption is now out of date.

Next (target): In Q1 calendar year 2027, Microsoft is targeting automatic application of security updates after a fixed period following release in connected SharePoint Server, Exchange Server, and Skype for Business Server environments.

This is the biggest change in the announcement, and the one with the most unanswered questions. Microsoft hasn't said:

• How long the "fixed period" is
• What counts as "connected"
• Which versions or builds qualify
• What opt-out, deferral or maintenance-window controls admins will get

Auto-patching Exchange is a sensitive topic. Exchange cumulative and security updates have broken things before: OWA quirks, transport issues and add-in problems. A fixed delay suggests Microsoft wants to give admins time to test or defer, but that's an inference, not something Microsoft has stated. Until the workload teams publish details, plan for automatic installation as a likely 2027 reality without assuming how it will work.

Configure: from finding drift to enforcing defaults​

Today: Tenant Configuration Management can help customers assess supported SharePoint, Exchange, and Skype for Business Server environments and identify where permissions are broader than intended.

Next (planned, Q1 2027): Microsoft plans hardened default configurations for all three server products, so that Microsoft-recommended security settings are applied by default instead of only being flagged. It also plans configuration-drift detection, so admins can see when an environment moves away from the baseline.

Drift is a quiet risk on long-running servers. A temporary permission granted during a migration, an exception added for a vendor or a protocol re-enabled for one old scanner can stay in place for years. Detecting drift alone would help. Hardened defaults could also break compatibility, and Microsoft hasn't said which settings will be hardened or whether existing deployments will get them automatically.

The cloud version gives a hint of what to expect. Microsoft's documentation for the Microsoft 365 version warns that server-side sync between Dynamics on-premises and Exchange Online doesn't work with this setting, and that Certificate Based Authentication for Exchange ActiveSync currently doesn't work when baseline security mode settings are enabled. Expect on-premises hardening to have similar trade-offs, and start listing your legacy dependencies now.

Protect: Emergency Mitigation Service 2.0​

Today: Emergency Mitigation Service can automatically apply temporary mitigations for certain new vulnerabilities while a permanent update is prepared and deployed. Microsoft is clear that a mitigation reduces the immediate risk and the security update fixes the underlying flaw.

Next (planned):

Microsoft hasn't published prerequisites, supported versions or the expanded mitigation types for 2.0. What's documented is how the current Exchange service works, which is the best available guide to the starting point.

Microsoft's Exchange documentation says:

• The service runs as a Windows service on Exchange Mailbox servers. It isn't installed on Edge Transport servers, and using it is optional.
• Every hour it checks Microsoft's cloud-based Office Config Service for mitigations. It downloads them as signed XML files and checks the issuer, Extended Key Usage and certificate chain before applying anything.
• It can apply three kinds of mitigation: IIS URL Rewrite rules that block malicious request patterns, disabling a vulnerable Exchange service, or disabling a vulnerable app pool.
• Its published list includes mitigation M2 for CVE-2026-42897, a URL Rewrite configuration covering Exchange SE, 2019 and 2016 up to the June 2026 security update.

The documentation already sets the MitigationsEnabled organisation and server values to $true by default. Microsoft hasn't explained exactly what "enabled by default" adds in 2.0. One possibility is that the service gets deployed or turned on in places where it's currently missing or switched off, but that isn't confirmed.

What Exchange admins can check today​

None of this needs to wait for 2027. Based on Microsoft's current Exchange Emergency Mitigation service documentation:

1. Test connectivity. Run Test-MitigationServiceConnectivity.ps1 from the V15\Scripts folder on a Mailbox server (it doesn't run on a Management Tools-only machine). The server needs outbound access to officeclient.microsoft.com on port 443.
2. Exclude that endpoint from SSL inspection. Microsoft warns that firewall or antivirus SSL inspection can break the service's certificate validation. The service also needs to reach certificate revocation list (CRL) endpoints, and Microsoft recommends letting Windows maintain the Certificate Trust List via ctldl.windowsupdate.com on port 80.
3. Configure the proxy correctly. If you use one, set it with Set-ExchangeServer -Identity <ServerName> -InternetWebProxy <proxy URL> and also in WinHTTP with netsh winhttp set proxy <proxy:port>.
4. Review current status. Get-ExchangeServer | Format-List Name,MitigationsApplied,MitigationsBlocked shows what's applied and what's blocked across the organisation. Get-Mitigations.ps1 gives more detail, including failed mitigations.
5. Know how to back out. If a mitigation breaks something important, block it with Set-ExchangeServer -Identity <ServerName> -MitigationsBlocked @("M1") and then remove it manually using the published rollback steps.
6. Watch the logs. Events 1005 and 1006 from "MSExchange Mitigation Service" record successful actions. Event 1008 records errors, such as failing to reach the Office Config Service.
7. Clean up after patching. Microsoft notes that server-level URL Rewrite mitigations can stay in place after a cumulative update and have to be removed manually once they're no longer needed.

Doing this now gives you a clean starting point before 2.0 arrives with its default-on behaviour. Note that these details are documented for Exchange only. They aren't confirmed requirements for the SharePoint or Skype for Business versions.

Analysis: a real change, with details still missing​

Microsoft describes this as a move from handing customers guidance and tools to building the recommended posture into the products. That's a fair description, and it follows the direction Microsoft has taken in the cloud. The Exchange patch problem Microsoft describes shows that leaving everything to admins hasn't worked well enough.

There are reasons for caution, though:

• Most of the timeline is still a target. December 2026, January 2027 and Q1 2027 are stated plans, not shipped features.
• Automatic patching affects change control. Organisations with strict change-approval processes will need clear deferral and exclusion controls, and Microsoft hasn't described any yet.
• Running unsupported versions keeps you out. Servers on Exchange 2016 or 2019 aren't covered. The first step is getting onto a supported release.

Microsoft's own short checklist is a good place to start. Decide which workloads can move and which must stay. For the ones that stay, move to supported releases, assess exposure, install current security updates and turn on the protections already available. And if you were planning to deal with that unsupported Exchange 2016 server "next quarter," this announcement is a good reason to do it sooner.