Our Exchange Server Is Out of Support. What Are Our Options?

Exchange Server end of support occurred on October 14, 2025 for Exchange Server 2016 and 2019. For eligible organizations enrolled in Microsoft’s second paid Extended Security Update period, that temporary security-update coverage ends when October 2026 ends. Microsoft’s Exchange team has said there will be no further extension.

According to Microsoft’s Exchange Server 2019 and 2016 end of support roadmap, support for both versions ended on October 14, 2025. Microsoft later offered paid Extended Security Update periods so eligible enrolled organizations could receive Critical and Important security updates Microsoft released during the applicable period. In a July 2026 reminder from the Exchange Server team, Microsoft confirmed that updates stop for everyone once October 2026 ends. That includes customers enrolled in the second ESU period.

The Exchange Timeline at a Glance

• Standard support for Exchange Server 2016 and 2019 ended on October 14, 2025.
• The Extended Security Update program has been a temporary bridge, not continued support.
• Exchange Server 2016 and 2019 security updates released from May through October 2026 are available only to eligible organizations enrolled in the program’s second period.
• Microsoft has confirmed there is no extension past October 2026.
• Microsoft points to two destinations: Exchange Server Subscription Edition or Microsoft 365.

Why Exchange Server End of Support Differs From a Missed Update

A mail server that stops receiving updates supports a business-critical communication system without the normal vendor security-fix path. Its exposure depends on the organization’s design, gateways, and configuration. If an unsupported server remains in service, its role and exposure deserve review.

Microsoft’s Period 2 ESU announcement explains that Exchange updates are cumulative, but only eligible enrolled organizations receive applicable updates during the period. Exchange Server end of support is different from being temporarily behind because Microsoft no longer supplies the normal product fixes, and the second ESU period ends with October 2026. A vulnerability discovered after the final applicable update would not receive a vendor security fix for Exchange Server 2016 or 2019.

That does not mean an unsupported server will be attacked. It means Microsoft’s normal way of correcting a newly discovered product flaw is no longer available for those versions. Other safeguards or temporary mitigations may reduce exposure, but they do not restore product support.

Enrollment also matters. Microsoft’s September 2026 Exchange security update notes confirm that recent updates are available only to organizations enrolled in the program’s second period. A business that did not enroll has already been running without them.

Which Options Does Microsoft Point To?

The recommended destinations are narrower than many businesses expect. The right one depends on how your business uses email today.

Exchange Server Subscription Edition. This is the supported successor for organizations that keep their own mail server. Microsoft’s Exchange SE upgrade guidance describes an in-place upgrade from Exchange Server 2019 Cumulative Update 14 or 15. It installs much like a regular cumulative update. Whether your servers qualify is a question for whoever administers them.

Microsoft 365. Moving mailboxes to Microsoft 365 moves the Exchange Online service infrastructure to Microsoft. Some hybrid identity designs may still require Exchange management tools or an on-premises Exchange server, as Microsoft explains in its Exchange end of support roadmap. Your business still owns decisions about identities, access, devices, configuration, and connected applications. This is a migration rather than an in-place upgrade, and the effort depends on mailbox count, mail history, identity design, and what else connects to the server. Account security matters on either path, as covered in Could an Attacker Hide Inside a Compromised Microsoft 365 Mailbox?.

Exchange Server 2016. The in-place path is not available. The same Microsoft guidance calls for a legacy upgrade, which means adding a newer server and moving mailboxes and resources before removing the old server. Depending on the environment and timing, that destination may be Exchange Server SE directly or a supported Exchange 2019 step on the way to SE. A business on Exchange 2016 should allow for a different migration path than one already running an eligible Exchange 2019 build.

Why the Work Takes Longer Than the Date Suggests

The Exchange Server end of support date is a single day. The work behind it rarely is. Moving mailboxes is the visible part, and it is often not what sets the schedule. What extends a timeline is everything else attached to the mail server.

Think of the application that emails invoices, the copier that scans to email, and the alerting tool nobody has touched in years. Add any archive with a retention obligation, and the records that control mail delivery. Each dependency may require its own discovery, testing, owner, vendor, and lead time.

There is also a business decision here, not only a technical one. Keeping your own server and moving to Microsoft 365 differ in cost and in who carries the day-to-day work. They also differ in how much control stays in house. That choice deserves a deliberate answer rather than a default one.

Mail Server Questions to Answer Before November

You are not looking for perfect answers. You are looking for the ones nobody can answer yet.

1. Does your business run its own email server, or is mail already hosted?
2. If there is a server, is it Exchange 2016 or Exchange 2019?
3. Was your business enrolled in the second period of the Extended Security Update program?
4. Has anyone chosen between Exchange SE and Microsoft 365, and who made that call?
5. Beyond staff mailboxes, what else sends or receives mail through the server?

If No One Can Name the Mail Server Version

An unclear answer is common when Exchange Server end of support comes up. It is not evidence that anything was mishandled. Mail servers run quietly for years, so the knowledge often sits with one person or a past provider.

An unclear answer shows where to start. If nobody can name the version, the first step is an inventory. If the version is known but the destination is not, the next conversation is about cost and control. If both are known and there is no date, the gap is ownership.

One answer deserves prompt attention: not knowing whether the second period was purchased. If it was not, the server has not been eligible for updates Microsoft released since May 2026. The timeline is then shorter than the October date implies.

Frequently Asked Questions

When do Exchange 2016 and 2019 stop receiving security updates?

Microsoft’s Exchange Server team has stated that once October 2026 ends, there will be no further updates for Exchange 2016 or Exchange 2019, including for organizations enrolled in the Extended Security Update program.

Will our email stop working after that date?

Not necessarily. Microsoft says an installed Exchange 2016 or 2019 server may continue to run, but mail flow still depends on the environment’s configuration and health. What ends is Microsoft’s supply of security updates for those versions.

We bought the Extended Security Updates. Does that carry us past October?

No. Microsoft has confirmed there will be no further extension of the program, and enrolled customers also stop receiving updates once October 2026 ends.

What does Microsoft recommend instead?

Microsoft recommends Microsoft 365 as the simplest path for many organizations. It points organizations that must keep Exchange on premises to Exchange Server Subscription Edition. Which path fits depends on the environment.

We are on Exchange 2016. Is our path different?

Yes. Exchange 2016 cannot be upgraded in place. Microsoft’s guidance calls for a legacy upgrade that adds a newer server, moves mailboxes and resources, and then removes the Exchange 2016 server.

Talking Through Your Mail Server Options

Before the Exchange Server ESU period ends, knowing the version and what connects to the server makes every later decision easier. Businesses in Venice, Sarasota, and North Port can ask NUPC Technology whether its email and web security services or managed IT services fit their situation. Request an IT consultation or call (941) 888-4474.