Exchange 2016 and 2019 end of support: migration plan

Exchange Server is still the heart of email in many organisations, especially in sectors where data cannot leave the company’s own data centre. And in October 2026 the last door closes. Exchange 2019 end of support, together with Exchange 2016, can no longer be postponed: the extended security update programme ends this month and Microsoft has confirmed there will be no further extensions.

Exchange 2019 end of support: what ends and when

The dates are worth putting in order, because they cause confusion:

• October 2025: end of extended support for Exchange 2016 and Exchange 2019. From then on, no free patches.
• October 2025 to April 2026: first period of the Extended Security Updates (ESU) programme, paid and limited to critical and important patches.
• May to October 2026: second ESU period, with separate re-enrolment and payment.
• October 2026: final end. Microsoft has explicitly said it will not extend the timeline again.

After that date, any new vulnerability in Exchange 2016 or 2019 will remain open forever. And Exchange is one of attackers’ favourite targets: it is exposed to the internet, handles credentials and concentrates sensitive information. The mass campaigns against Exchange servers in 2021 are a reminder of what happens when a mail server falls behind.

Why this is not just a technical problem

In regulated environments, keeping an unsupported server stops being an IT decision and becomes a compliance risk. NIS2 requires vulnerability management and up-to-date systems. DORA asks financial entities to control the risk of their ICT assets and providers. Spain’s ENS requires security to be maintained throughout the system life cycle.

An auditor who finds an Exchange server without security patches will not accept “we’ll migrate it next year” as a compensating control. I explained this in detail in the article on patch and vulnerability management under NIS2: unsupported software is a direct finding.

There is also a practical effect in hybrid environments. Exchange Online applies measures against outdated on-premises servers that send it mail: first it throttles them and, if nothing is fixed, it can end up blocking them. An unsupported server ends up affecting mail delivery too.

The three possible ways out

1. Exchange Server Subscription Edition

It is the only way to stay on-premises with support. From Exchange 2019 with the latest cumulative update (CU15), moving to Exchange SE is an in-place upgrade, very similar to installing one more CU. The licensing model changes: it becomes a subscription, with server and access licences that require an active agreement. In exchange, it no longer has a fixed end-of-life date.

2. Migration to Exchange Online

For many organisations this is the moment to move to the cloud for good. It removes the burden of patching servers, but demands a careful review of data location, contractual requirements and, in regulated sectors, provider risk analysis. It is not a decision to be made in a week.

3. Hybrid scenario

Many organisations will keep an on-premises server for identity management or for applications that send email, with mailboxes in the cloud. That on-premises server must also run a supported version, even if it hosts no mailboxes.

The Exchange 2016 case

Anyone still on Exchange 2016 faces the hardest path. There is no in-place upgrade: you have to deploy new servers, move mailboxes and decommission the old ones. Before you start, check Microsoft’s documentation for the coexistence combinations supported by the Exchange SE version you will install, because they change between updates.

A six-step migration plan

1. A real inventory. Servers, versions, installed CUs, connectors, applications sending mail over SMTP, multifunction devices and certificates.
2. Choice of target. Exchange SE, Exchange Online or hybrid, with risk analysis, three-year cost and regulatory requirements.
3. A verified backup. Before touching anything, a tested, restorable backup. To go a step further, consider immutable backups against ransomware.
4. A test environment. Validate the upgrade or migration with test mailboxes and critical applications.
5. Phased migration. Small user groups, agreed windows and a defined rollback.
6. Orderly decommissioning. Proper uninstallation of old servers, DNS and connector clean-up, and an updated asset inventory.

And if you do not make it in time

If the migration will not be finished this month, do not hide it: document the risk, isolate the server as much as possible, restrict access from the internet, strengthen monitoring and set a closing date approved by management. An accepted and controlled risk can be defended before an auditor. An ignored risk cannot.

The same pattern will repeat in January with another very widespread product, as I explained in the article on Windows Server 2016 end of support. The lesson is the same: software life cycle is a risk you plan for, not a surprise.

Conclusion: the last warning

Exchange 2019 end of support, like that of Exchange 2016, has been announced for years and can no longer be postponed. Anyone keeping these servers in production after October takes on a security and compliance risk that grows every month. There is a way out, and a reasonable one, but it requires a plan, testing and a management decision.

If you need to plan your email migration safely and without disrupting the business, I can help you lead the project. Let’s talk.

Frequently asked questions about Exchange end of support