Exchange Server 2016 and 2019 end of support: what are your options?

If you still run Exchange Server 2016 or 2019 on premises, the support clock has already run out. Public security updates stopped in October 2025, and the paid extension Microsoft offered ends with October 2026. This guide sets out the dates, the three supported paths, and what each one means for spam filtering and the server that faces the internet.

All dates and program details here were checked against Microsoft's lifecycle pages and Exchange team posts at the time of writing (October 2026). Microsoft changes licensing and programs, so confirm with your Microsoft account team or licensing partner before you commit.

When did Exchange 2016 and 2019 support end?

Both versions follow Microsoft's Fixed Lifecycle Policy, and both share the same final date.

Microsoft's lifecycle pages show the end times in Pacific time, as 6:59:59 AM on the following day, which is the end of October 14, 2025 for both products.

Microsoft's own summary is blunt: "both Exchange 2016 and 2019 are out of support since October 2025" (Microsoft Tech Community).

What did the Extended Security Update program offer?

Microsoft ran a paid Extended Security Update (ESU) program for organizations that needed more time to migrate. It came in two periods:

The Period 2 announcement sets out the terms (Microsoft Tech Community):

• It covers "Exchange Server 2016 CU23 and Exchange Server 2019 CU14/CU15".
• It's intended "for customers with a Microsoft Enterprise Agreement (EA)", bought through the Microsoft account team.
• It isn't a lifecycle extension. The servers "are still out-of-support, and you will not be able to open support cases for them" except for issues with an ESU update.
• It delivers "Critical and Important updates" only if Microsoft needs to release them, and Microsoft says it is "not committing to actually releasing any SUs during the Period 2 ESU."

A later reminder from the Exchange team removes any doubt about a third period: "Once October 2026 ends, there will be no further updates for Exchange 2016/2019, even if you currently have a Period 2 ESU" (Microsoft Tech Community).

If you're reading this in October 2026 and still run 2016 or 2019, the ESU route is effectively closed. Plan for one of the paths below.

What are your supported options?

Option 1: Upgrade to Exchange Server Subscription Edition

Exchange SE is the on-premises successor. It follows the Modern Lifecycle Policy, which keeps a product in support as long as, among other conditions, "Customers must stay current as per the servicing and system requirements published for the product or service" (Microsoft Learn). In practice that means installing cumulative and security updates on schedule.

The upgrade path depends on what you run today (Microsoft Learn):

• From Exchange 2019 CU14 or CU15: an in-place upgrade. Microsoft says SE RTM "is code equivalent to Exchange Server 2019 CU15", except for the license agreement, the product name and the build number. New features start with SE CU1.
• From Exchange 2016: "In-place upgrades from versions of Exchange Server earlier than Exchange Server 2019 are not supported." You do a legacy upgrade, meaning new servers and mailbox moves, to Exchange 2019 CU14/CU15 or directly to SE.

On licensing, the Exchange team says "Exchange 2019 and Exchange SE licensing requirements are the same," and points to Microsoft's Exchange licensing FAQ (Microsoft Tech Community). SE needs subscription licenses or licenses with active Software Assurance, so confirm your entitlement with your licensing partner.

Choose SE if you have a firm reason to keep mail on your own hardware, such as a contract or regulation, and staff who will patch it every month.

Option 2: Move to Exchange Online

Moving mailboxes to Exchange Online, usually as part of Microsoft 365, hands patching and the internet-facing SMTP service to Microsoft. Small organizations often migrate directly. Larger ones use hybrid as the migration path.

Choose Exchange Online if nothing requires mail to stay on premises and you'd rather stop running an internet-facing server.

Option 3: Hybrid

Hybrid connects on-premises Exchange to Exchange Online so mailboxes can live in either place, with shared address lists and free/busy. It's the standard way to move larger organizations gradually. Any Exchange server you keep for hybrid is still an Exchange server you must patch, so to stay supported it needs to run SE.

Microsoft also documents a way out of hybrid for organizations that kept one server only to manage recipients. If all mailboxes and public folders are in Exchange Online and you sync from Active Directory, you can use the Exchange Management Tools and shut down the last server, but Microsoft warns "If you use your last Exchange server for any purpose other than recipient management (for example, SMTP relay), then don't shut it down" (Microsoft Learn). Scanners and apps that relay through Exchange need a new route first.

What does each option mean for spam filtering?

The migration changes who receives mail from the internet, so it changes your filtering too.

Staying on premises with SE

Exchange's built-in anti-spam agents are still there, but Microsoft describes them as "relatively unchanged from Exchange Server 2010", managed only in the Exchange Management Shell (Microsoft Learn). Our guide to Exchange Server anti-spam agents covers what each one does. The same Microsoft page points to Microsoft's paid cloud add-on for on-premises mailboxes "For more antispam features and easier management".

Most on-premises organizations put a filter in front of Exchange instead: an Edge Transport server, an appliance, or a hosted gateway. A hosted gateway also means:

• Spam, malware and connection floods are handled before they reach your internet line.
• Mail can be held while your server is down for patching. That matters more with SE, because staying current means regular update windows.
• Port 25 on your server can be closed to everyone except the filter.

Our Exchange Server setup page shows the scoped Receive connector, the firewall lockdown and which anti-spam agents to turn off behind a gateway. For the wider trade-offs, see hosted vs on-premise spam filters.

Moving to Exchange Online

Microsoft says its built-in anti-spam, anti-malware and anti-phishing protection is included "in all organizations with cloud mailboxes" (Microsoft Learn). When MX moves to Microsoft 365, any on-premises filter or Edge server you used becomes redundant for inbound mail. Remove its trust settings and firewall rules once traffic stops; our decommissioning checklist covers the same steps for any filter.

If you want to keep a gateway in front of Microsoft 365, you'll need a Partner inbound connector and Enhanced Filtering for Connectors. Our Microsoft 365 gateway setup guide and the built-in vs gateway comparison explain when it's worth it.

During a hybrid migration

Where MX points decides which system filters first. If MX points on premises, Exchange Online sees mail after your on-premises path. Microsoft lists that routing as a case for Enhanced Filtering for Connectors, so cloud filtering still sees the original sender. If MX points to a gateway or to Exchange Online, the on-premises server only receives mail relayed to it. Pick one front door, keep it consistent, and make sure the other paths reject direct internet mail.

Why doesn't a spam filter make an old server safe?

A filter in front of Exchange stops malicious email reaching mailboxes. It doesn't protect the server itself. Exchange also publishes Outlook on the web, Exchange Web Services, ActiveSync and Autodiscover over HTTPS. Serious Exchange attacks have come in that way: in the 2021 HAFNIUM campaign, Microsoft described one of the exploited flaws, CVE-2021-26855, as one that "allowed the attacker to send arbitrary HTTP requests and authenticate as the Exchange server" (Microsoft Security Blog). An unpatched server on the internet stays exposed whatever sits in front of port 25.

There's also a mail flow consequence. Microsoft's ESU announcement notes that servers caught by Exchange Online's throttling and blocking of persistently vulnerable Exchange servers are running a version "roughly a year out of date". An on-premises server that falls that far behind can have the mail it sends to Exchange Online, as hybrid servers do, delayed or refused. Microsoft says installing the October 2025 updates resolves it for now, but warns those updates will also be throttled or blocked one day.

What does a migration checklist look like?

1. Inventory. List every Exchange server, its version and CU, its roles, and everything that relays through it: scanners, apps, monitoring, partners.
2. Choose the target: SE, Exchange Online or hybrid. Get licensing confirmed in writing.
3. Decide the front door for inbound mail after the move: Exchange Online directly, a gateway in front of Microsoft 365, or a gateway in front of SE.
4. Lower the MX TTL a day or more before any MX change. See how DNS TTL affects an MX change.
5. Migrate, then follow changing MX records without losing email for the cutover.
6. Lock down the new mail server so it only accepts internet mail from your chosen front door.
7. Decommission old servers properly. For hybrid, follow Microsoft's instructions rather than uninstalling the last server.

Next steps

1. Check your build numbers against Microsoft's lifecycle pages today, and write down which servers are 2016, 2019 or SE.
2. If you rely on Period 2 ESU, plan the cutover before the end of October 2026.
3. Look up where your mail enters now with the MX Lookup, and check your server's IP with the Blacklist Checker if it sends mail directly.
4. If you're staying on premises, read the Exchange Server setup page for running a hosted filter such as iBlockSpam in front of SE, with mail held for up to 5 days while the server is down for updates.

Whatever platform you move to, an MX-level filter can stay in front of it. iBlockSpam's pricing is per domain, so moving mailboxes between servers doesn't change what you pay.

More guides on switching and migration.