Microsoft has confirmed that security updates for Exchange Server 2016 and Exchange Server 2019 will permanently end after October 2026, ruling out another extension to the temporary Extended Security Update programme protecting organisations that have not yet completed their migrations.
The decision establishes a final deadline for businesses still operating either product. Once the programme expires, Microsoft will no longer release vulnerability fixes for Exchange 2016 or 2019—even for organisations that purchased the second period of ESU coverage.
Microsoft introduced the temporary programme after both server releases reached their formal end of support on October 14, 2025. It was intended to provide a short security bridge for organisations that could not move to Exchange Server Subscription Edition or Exchange Online before the lifecycle deadline.
The company initially offered six months of additional coverage, running from October 2025 through April 2026. In April, however, it announced a separately purchased second ESU period extending protection until the end of October 2026.
That second concession prompted questions over whether Microsoft might offer another extension. The Exchange Server team has now delivered an unequivocal answer.
“There will be no further extension of Exchange 2016/2019 ESU program timeline,” Microsoft said. “Once October 2026 ends, there will be no further updates for Exchange 2016/2019, even if you currently have a Period 2 ESU.”
Microsoft’s wording means customers should treat October as a hard security boundary rather than another negotiable migration milestone. The company’s official announcement says organisations must complete their transition to Exchange Server Subscription Edition or a supported Microsoft 365 service.
ESU was designed as a temporary safety net
Exchange Server 2016 and Exchange Server 2019 officially left support on the same date, despite being released several years apart.
Exchange 2016 entered general availability in 2015. Its mainstream support period ended in October 2020, followed by extended support until October 14, 2025. Exchange 2019 was released in October 2018, reached the end of mainstream support in January 2024 and exited extended support in October 2025.
Under Microsoft’s Fixed Lifecycle Policy, the end of support normally means the termination of security updates, non-security fixes, bug fixes, time-zone updates and assisted technical support. The servers do not stop running, but their continued operation creates increasing security and compliance exposure as newly discovered vulnerabilities remain unpatched.
Microsoft’s Exchange supportability guidance consequently lists Exchange 2016 and 2019 as unsupported products, with Exchange Server Subscription Edition now the company’s supported platform for organisations retaining on-premises email infrastructure.
The ESU programme did not reverse that lifecycle status. Instead, it gave eligible customers access to selected security fixes while they completed an upgrade or cloud migration. It did not restore full product support, provide feature development or include the broader range of reliability and functionality fixes normally delivered to a supported release.
Microsoft also did not publish Exchange 2016 and 2019 ESU packages through the ordinary public distribution process. Organisations had to enrol in the programme and follow Microsoft’s procedures to obtain applicable updates.
The first period covered vulnerabilities rated Critical or Important from October 14, 2025, until April 14, 2026. Period 2, announced in April 2026, was sold separately and runs from May through October 2026. Purchasing the first period did not automatically entitle a customer to the second.
Microsoft’s Period 2 announcement made clear that the programme was aimed at organisations already making progress towards Exchange Server Subscription Edition but requiring additional time to finish.
Unsupported Exchange servers will become an expanding liability
The end of updates is particularly significant because Exchange is a high-value target for state-sponsored groups, ransomware operators and initial-access brokers.
An on-premises Exchange server is closely integrated with an organisation’s identity, messaging and directory infrastructure. Depending on its configuration, a compromised server can expose email, address-book information, authentication material and sensitive business communications. It may also give an attacker a foothold from which to move further into the Windows domain.
Exchange vulnerabilities have repeatedly been exploited in widespread attacks, sometimes before organisations could complete normal patching cycles. Internet-facing servers are especially attractive because an attacker can potentially reach them without first compromising an endpoint inside the network.
The risk will change fundamentally after October 2026. While ESU-enrolled servers can presently receive fixes for qualifying vulnerabilities, an Exchange 2016 or 2019 vulnerability discovered after the programme ends may remain permanently unpatched on those platforms.
Security controls such as web application firewalls, network segmentation, endpoint detection and response, restricted administrative access and Microsoft’s Exchange Emergency Mitigation Service may reduce particular risks, but they are not substitutes for vendor-supported security updates.
Temporary mitigations can also be incomplete or specific to one exploitation technique. They cannot guarantee protection against every future vulnerability affecting an obsolete codebase.
Running unsupported Exchange software may create additional governance difficulties. Organisations in regulated industries could have to explain why a critical messaging system no longer receives vendor security fixes. Cyber-insurance requirements, customer security questionnaires, contractual obligations and internal risk policies may also prohibit or severely restrict unsupported infrastructure.
The end of ESU therefore affects more than patch availability. It may require changes to risk registers, audit documentation, business-continuity plans and incident-response procedures.
Exchange Server Subscription Edition becomes the on-premises destination
For organisations that must retain Exchange on their own infrastructure, Microsoft’s preferred migration target is Exchange Server Subscription Edition, commonly shortened to Exchange Server SE.
Exchange SE became generally available on July 1, 2025. Rather than following the traditional model of releasing a new numbered Exchange version every several years, SE operates under Microsoft’s Modern Lifecycle Policy.
The product has no predetermined retirement date as long as customers remain licensed, run supported configurations and install required updates. Microsoft describes it as an evergreen release that will receive cumulative and security updates without another planned year-based Exchange Server successor.
According to Microsoft’s Exchange SE availability notice, the change is intended to provide continuous support for organisations with on-premises, cloud and hybrid email environments.
The licensing model is also different. Organisations must maintain qualifying subscription rights rather than treating Exchange SE as a conventional perpetual release that can remain unchanged for years.
That continuous servicing approach places greater emphasis on update discipline. Remaining supported will depend on installing cumulative updates within Microsoft’s required timeframes and maintaining compatible operating systems, .NET Framework versions, Active Directory environments and other prerequisites.
Exchange 2019 offers the simplest in-place route
The migration process depends heavily on the version and configuration currently deployed.
Exchange Server 2019 CU14 and CU15 support an in-place upgrade to the initial Exchange Server SE release. Microsoft designed this transition to resemble the installation of a cumulative update, allowing administrators to retain the existing server, configuration and databases where all prerequisites are satisfied.
Although technically less disruptive than a traditional version migration, it should not be treated as a routine patch. Administrators must confirm that each server runs a supported Exchange 2019 cumulative update, verify operating-system compatibility, review third-party integrations, back up critical data and test recovery procedures.
Microsoft recommends using the latest available cumulative and security updates before beginning. Organisations should also run the Exchange Health Checker and resolve unsupported or insecure configurations rather than carrying them into the new installation.
The in-place route does not include an in-place operating-system upgrade. Microsoft explicitly states that upgrading Windows Server between major versions while Exchange is installed is unsupported. If an organisation must move to a newer operating system or replace ageing hardware, it will generally need to deploy a new Exchange SE server and perform a traditional migration.
Microsoft provides a detailed Exchange SE upgrade guide covering both supported methods.
Exchange 2016 requires a legacy migration
Exchange Server 2016 cannot be upgraded to Exchange SE by simply running the SE installer over the existing installation.
These environments require what Microsoft calls a legacy upgrade. Administrators deploy a new server running Exchange SE—or, depending on their selected route and existing environment, introduce Exchange 2019 first—then move mailboxes, connectors, certificates, transport functions and other services before retiring the older system.
A direct legacy migration from a properly updated Exchange 2016 organisation to Exchange SE may be possible by adding new SE servers to the organisation and transferring workloads. This is different from an in-place upgrade: the Exchange 2016 server itself does not become an SE server.
Organisations choosing an Exchange 2019 intermediate step must first deploy Exchange 2019 on supported hardware and Windows Server, migrate away from Exchange 2016 and then upgrade the Exchange 2019 servers to SE.
Exchange 2013 presents an additional problem. Exchange Server SE RTM does not support coexistence with Exchange 2013, which reached the end of support in April 2023. Any remaining Exchange 2013 servers must be removed through a supported migration sequence before Exchange SE can be introduced.
The distinction is important because an incomplete or incorrectly sequenced upgrade can disrupt mail flow, client connectivity, hybrid integration and administrative functions.
Migrations involve more than moving mailboxes
An Exchange migration can appear straightforward when measured only by mailbox count, but production deployments frequently contain dependencies accumulated over many years.
Administrators must identify applications and appliances that submit mail through Exchange, including scanners, monitoring systems, business applications and multifunction printers. They must also review receive and send connectors, transport rules, accepted domains, certificates, namespaces, load balancers, antivirus integrations, journaling systems, archive platforms and backup products.
Public folders and arbitration mailboxes require particular attention. Hybrid environments must verify connectivity with Microsoft 365 and ensure that the Hybrid Configuration Wizard, OAuth configuration and mail-flow connectors remain correct after changes.
Client compatibility must also be examined. Older Outlook releases, mobile clients or line-of-business software may not behave as expected with the new environment.
Security settings should be reviewed rather than automatically duplicated. A migration provides an opportunity to remove obsolete protocols, restrict administrative interfaces, enable Extended Protection where supported and eliminate unnecessary internet exposure.
Organisations should also account for Active Directory. Exchange writes configuration data into the directory, so retiring the last legacy server without following Microsoft’s supported process can leave behind dependencies and complicate recipient management.
Exchange Online provides an alternative to maintaining servers
Microsoft is also encouraging customers to consider Exchange Online, either as a standalone service or as part of Microsoft 365.
A cloud migration transfers responsibility for maintaining the underlying Exchange server software to Microsoft. Customers continue to control identities, policies, data governance and service configuration, but they no longer patch the Exchange operating environment themselves.
Migration options include staged or cutover approaches for some smaller environments and hybrid migration for organisations requiring coexistence during a longer transition. The appropriate method depends on the existing Exchange version, directory configuration, number of mailboxes, identity model and operational requirements.
Moving to Exchange Online does not automatically mean that every Exchange-related server can be removed immediately. Organisations using Microsoft Entra Connect or retaining on-premises Active Directory may still need supported recipient-management arrangements. Administrators should follow Microsoft’s documented procedures instead of simply shutting down or deleting the final Exchange server.
A cloud move also requires assessment of data residency, compliance, retention, eDiscovery, backup, network capacity and third-party integrations. For some businesses, these considerations will justify keeping Exchange on premises. For others, eliminating responsibility for patching internet-facing email servers may significantly reduce operational risk.
Microsoft’s end-of-support roadmap directs customers towards Microsoft 365, Office 365 or Exchange Server SE and warns that unsupported installations no longer receive the ordinary protections delivered during the product lifecycle.
Organisations now have only months to complete the work
The October deadline leaves organisations with a limited migration window, especially where the project requires procurement, architectural changes or new server hardware.
A realistic migration may involve inventory and dependency discovery, licensing approval, infrastructure deployment, testing, change-control review, mailbox movement and the orderly decommissioning of legacy systems. Large or highly regulated organisations may also need disaster-recovery exercises, security assessments and formal business sign-off.
Administrators should begin by confirming every Exchange server and build present in the organisation. They should then establish whether each system is enrolled in the correct ESU period and verify that all available updates have been installed.
The next step is to select a destination architecture—Exchange SE, Exchange Online or a hybrid arrangement—and create a migration plan based on Microsoft’s supported upgrade paths.
Companies should not assume that an October migration can be postponed until the final security update arrives. Any deployment issue discovered late in the process could leave an organisation operating unsupported servers with no remaining vendor safety net.
The fact that Microsoft previously authorised a second ESU period may have encouraged some customers to expect further flexibility. Its latest announcement is intended to remove that ambiguity.
Exchange Server 2016 and 2019 will continue to function after October, but they will do so without future Microsoft security fixes. For organisations still relying on either platform, the remaining months represent the final opportunity to move before a temporary migration problem becomes a permanent security exposure.