Microsoft Targets On-Premises Security Risks With New Investments

Microsoft announced a new on-premises security initiative initially focused on server workloads, bringing together guidance, migration and product investments. The vendor said the initiative is meant to help customers understand and prioritize risk, reduce their on-premises footprint where possible and strengthen workloads that must remain. Microsoft attributes the effort to attackers, including less-skilled actors using AI, becoming more capable. Microsoft Security Blog report.

Microsoft Frames an On-Premises Risk Initiative

Microsoft has announced investments to reduce on-premises security risk. In its announcement, the vendor said such servers can be essential to business operations but are increasingly attractive targets, and that AI can help less-skilled actors analyze software, develop malicious tools and repeat attack workflows at greater speed and scale, shortening the window between exposure and exploitation.

The initiative is organized around three steps the vendor calls Understand, Reduce and Secure. Microsoft said guidance will soon be available through Secure Now, which also includes an AI readiness checklist in Microsoft Security Exposure Management and guidance on foundational security.

Hardened Defaults Planned Across Three Product Areas

Within the Secure pillar, Microsoft said it is hardening products through an On-Premises Baseline Security Mode, starting with supported Exchange Server, SharePoint Server and Skype for Business Server workloads.

Microsoft said the work advances across three areas it labels Patch, Configure and Protect. It described the intent as progressively establishing and maintaining more of the recommended security posture through the products themselves, adapting the baseline as threats and Microsoft security guidance evolve.

Patching, Configuration and Interim Mitigations

On patching, Microsoft pointed to its deployment data, stating that many Exchange Server deployments are not running the current security update, including a substantial share on unsupported versions. The vendor said that since September 2026 it has released Important as well as Critical security updates outside the traditional Patch Tuesday schedule when faster action is needed.

On configuration, Microsoft said Tenant Configuration Management can today help customers assess supported SharePoint, Exchange and Skype for Business Server environments and identify where permissions are broader than intended.

What Is Available Now Versus Planned

The announcement separates current capabilities from proposed ones. Available today, per Microsoft, are off-schedule Important and Critical updates since September 2026, Tenant Configuration Management assessments for supported environments, and Emergency Mitigation Service interim mitigations.

Microsoft characterized the combined investments as a shift from providing customers with security guidance and tools toward building the recommended security posture into the products themselves. It said the Exchange Server, SharePoint Server and Skype for Business Server teams will publish additional guidance on available protections, upcoming capabilities and actions customers can take now, and that practitioner-focused on-premises guidance is planned for Secure Now.

What This Means for Practitioners

For administrators, the announcement sets out a sequence Microsoft recommends: identify which workloads can move and which must remain on-premises; for those that remain, move to supported releases, assess exposure, apply current security updates and enable available protections. The vendor continues to recommend moving workloads to Microsoft 365 wherever possible, and frames the approach as modernizing where possible and strengthening what must remain.

The practical planning signal is to track which items are shipping versus targeted. Automatic update application, hardened defaults and drift detection remain planned for the first quarter of 2027, and Emergency Mitigation Service 2.0 is slated for December 2026 with a SharePoint extension in January 2027, dates Microsoft described as targets. Organizations weighing these changes should verify timelines and prerequisites against vendor documentation before adjusting deployment processes, and should treat security-posture improvements as vendor-stated intentions rather than guaranteed outcomes.