Released: July 2026 Exchange Server Security Updates

To see if the mitigation is still in place, you need to look in IIS.  I did this yesterday in our test environment and confirmed it worked as the article stated. I had installed the July SU and when I ran Get-ExchangeServer | fl Name, MitigationsApplied the M2 mitigation did not show, but I could see in IIS that the M2 mitigation (the IIS rewrite rule on the Default Web Site\OWA directory) still existed. I then ran the commands to remove the mitigation from https://learn.microsoft.com/en-us/Exchange/plan-and-deploy/post-installation-tasks/security-best-practices/exchange-emergency-mitigation-service#rollback-procedures-for-released-mitigations and then I viewed IIS and that IIS rewrite rule was removed.  So even though it doesn't show when running Get-ExchangeServer | fl Name, MitigationsApplied, it is still there in IIS until running the commands to remove it.