Changes planned from December
On November 5, 2026, Microsoft announced On-Premises Baseline Security Mode for supported Exchange, SharePoint and Skype for Business servers:
- December 2026: Emergency Mitigation Service (EMS) 2.0 for Exchange and Skype for Business, enabled by default.
- January 2027: EMS 2.0 for SharePoint.
- Q1 2027: automatic security updates in connected environments, hardened defaults and configuration drift detection.
These are planned dates. The delay between update release and automatic installation has not been specified.
Check existing Exchange protection
On Exchange Mailbox servers, use Test-MitigationServiceConnectivity.ps1 from V15\Scripts to check connectivity for the existing mitigation service. The script does not run on machines with management tools only.
Also check MitigationsEnabled at both organization and server level. Use Get-Mitigations.ps1 to inspect applied, blocked and failed mitigations. Service connectivity alone does not establish effective protection. Emergency mitigations can restrict functionality and do not replace security updates.
Prepare maintenance procedures
Use the current Exchange Health Checker to collect configuration and security findings for each Exchange server, address the findings and repeat the checks after changes.
To prepare for the announced capabilities, assign operational owners and define test systems, maintenance windows and recovery procedures. Document justified configuration exceptions so future drift reports can be assessed. For Exchange, functional checks should cover sign-in, mail flow and relevant integrations. Continue clearing existing patch backlogs; do not defer available updates because of the planned automation.