Microsoft launches on-premises security initiative with baseline hardening for Exchange and SharePoint
- Severity
- Medium
- Sources
- 1
What happened
Microsoft says many Exchange Server deployments are not running current security updates, including some on unsupported versions, and that it now releases Important as well as Critical updates out of band since September 2026. It plans automatic application of security updates in connected SharePoint, Exchange and Skype for Business environments in Q1 2027, and hardened default configurations plus configuration drift detection in Q1 2027. Emergency Mitigation Service 2.0 is due for Exchange and Skype for Business in December 2026 and SharePoint in January 2027, and Tenant Configuration Management can already flag overly broad permissions. Defenders should patch promptly, review permissions and configuration now, and assess which workloads can move to Microsoft 365.
For security analysts · Written by AI from 1 source · Wrong?
What to do
- Check whether Exchange Server, SharePoint Server and Skype for Business Server are running the current security update and apply it promptly.
- Use Tenant Configuration Management to find permissions that are broader than intended in supported server environments.
- Assess which on-premises workloads could move to Microsoft 365 and which must stay on-premises and need hardening.
Written by AI from the sources, checked against them
Full story timeline · 1 update
Who reported · 1 outlet
Who and what is in it
Companies