Source: Microsoft Security Blog
Microsoft has outlined a new on-premises security initiative built around three pillars it calls Patch, Configure and Protect, and the headline change is a big one: beginning in the first quarter of calendar 2027, the company plans to automatically apply security updates in supported, connected Exchange Server, SharePoint Server and Skype for Business Server environments once a fixed period has passed after release.
What Microsoft is actually changing
The centrepiece is On-Premises Baseline Security Mode, a secure-by-default configuration that will start with supported Exchange, SharePoint and Skype for Business deployments. Instead of publishing guidance and relying on administrators to implement each setting, the products themselves will progressively maintain more of the recommended security posture as threats and guidance evolve.
On the patching side, Microsoft says it has already been releasing Critical and Important security updates outside the traditional Patch Tuesday schedule since September 2026 whenever faster action is warranted. Automatic installation is the next step, targeting supported deployments that are connected to the internet and to Microsoft services. On the configuration side, Tenant Configuration Management can already assess deployments and flag permissions that are broader than intended, and from the first quarter of 2027 Microsoft plans hardened default configurations plus drift detection that shows when an environment has moved away from the baseline.
Microsoft is also expanding its Emergency Mitigation Service. Version 2.0 is planned for Exchange Server and Skype for Business Server in December, followed by SharePoint Server in January, and it will be enabled by default with a broader set of temporary mitigations for emerging vulnerabilities while a permanent update is prepared.
Why this matters for your servers
Microsoft cited artificial intelligence as a driver: AI lowers the skill barrier for attackers, shortening the time between a vulnerability being exposed and being exploited. The company continues to recommend moving services to Microsoft 365 where possible, but for regulated workloads, legacy integrations and European organisations that must keep data on local infrastructure, servers will remain a reality for years.
Automatic patching narrows the window between release and deployment, but it also raises new questions that need answering before 2027 arrives. Which of your servers are actually on supported versions and meet the connectivity requirements? How will you test updates before they land on their own schedule, and what does your change management process look like when the vendor, not your team, starts pulling the trigger?
If you run on-premises Exchange, SharePoint or Skype for Business and want a clear readiness assessment before these changes arrive, contact the team at Excello Digital for patching strategy, server hardening and hybrid migration advice.