Exchange 2016 and 2019 end of support: your options before the last updates stop

What “end of support” actually means for your server

Nothing switches off. Your Exchange server will keep sending and receiving mail on 1 November 2026 exactly as it did the day before. That is precisely what makes this deadline easy to ignore, and expensive to have ignored.

What stops is everything that keeps the server safe to leave on the internet:

• No security updates. When the next Exchange vulnerability is published, there will be no patch for 2016 or 2019.
• No time zone or daylight-saving fixes, which matter more to a calendaring system than people expect.
• No support cases. If something breaks, Microsoft will not help.

That matters more for Exchange than for most server software, because Exchange is internet-facing by design: Outlook on the web, ActiveSync for phones, Autodiscover and SMTP all have to be reachable from outside. Exchange has been one of the most heavily targeted server products of recent years — the ProxyLogon and ProxyShell vulnerabilities in 2021 were exploited against tens of thousands of servers within days of disclosure. An unpatchable Exchange server is an open invitation.

The practical consequences UK businesses run into

Security is the headline, but these are the problems that tend to arrive first:

• Cyber Essentials. The scheme requires software to be supported and receiving security updates. An Exchange 2016 or 2019 server with no ESU cover will not meet that requirement, which puts the certificate — and any contract or insurance policy that depends on it — at risk at your next assessment.
• Cyber insurance. Proposal forms increasingly ask directly about unsupported internet-facing systems. Answering that question inaccurately is worse than answering it honestly.
• Mail to Microsoft 365 users. Microsoft has said it throttles, and can ultimately block, email sent to Exchange Online from on-premises Exchange servers it judges to be persistently vulnerable. Most of your clients and suppliers are on Microsoft 365, so this is not a theoretical problem.
• Client and supply-chain questionnaires, especially in the public sector, legal and finance, which ask about end-of-life software by name.

Where the Extended Security Update programme leaves you

Microsoft did offer paid Extended Security Updates for organisations that could not finish their migration in time. The first period ran from October 2025 to April 2026. In April 2026 Microsoft announced a second period running from May to the end of October 2026 — but with conditions that rule most small and medium businesses out:

• It is aimed at customers with a Microsoft Enterprise Agreement, bought through a Microsoft account team.
• It had to be purchased again; Period 1 customers were not carried over automatically.
• It covers only Exchange 2016 CU23 and Exchange 2019 CU14/CU15.
• Microsoft does not commit to releasing any updates at all during the period — only to providing them if critical or important fixes are needed.
• Microsoft has stated there will be no further extensions after October 2026.

Microsoft’s own Exchange team put it plainly in the announcement: they would be happy not to sell the second ESU period to anyone, and would rather customers migrated. If you are reading this in October 2026 and still running Exchange 2016 or 2019, there is no further extension to wait for.

Option 1: Upgrade to Exchange Server SE and keep running it yourself

Exchange Server Subscription Edition is Microsoft’s supported on-premises Exchange. It is the right choice for a minority of organisations with a genuine requirement to keep mail on their own hardware and the in-house skills to run it.

• The upgrade path depends on your version. An Exchange 2019 server on CU14 or CU15 can be upgraded in place to SE; earlier 2019 builds must be brought up to CU14 or CU15 first. Exchange 2016 cannot be upgraded in place — it needs a side-by-side migration, joining a new SE server and moving the mailboxes — and Microsoft requires Exchange 2016 to be decommissioned before Exchange SE CU2, planned for the first half of 2027.
• Licensing changes. SE requires an active subscription on top of the licences themselves: either cloud subscription licences for everyone who uses it (such as Microsoft 365 E3 or E5), or SE server licences and CALs with Software Assurance. The buy-once model is gone.
• You still own the work. Cumulative updates, security updates, certificates, backups, Windows Server patching, hardware refresh and the out-of-hours call when a database dismounts all stay with you.

If you have an Exchange-literate engineer, current hardware and a reason to keep mail in your own building, this is a perfectly sound option. For most SMEs, it is the most expensive way to keep doing the same thing.

Option 2: Move to Microsoft 365 (Exchange Online)

This is Microsoft’s preferred answer, and for many businesses it is the right one — particularly if you will genuinely use Teams, SharePoint and OneDrive rather than just the mailbox.

• Price. Since 1 July 2026, Microsoft 365 Business Standard is £10.80 per user per month on an annual commitment, ex VAT. Business Basic, which has no desktop Office apps, is £5.40. Our guide to the July 2026 price rise has the full table.
• Migration. Moving from on-premises Exchange to Exchange Online is well-trodden, but a hybrid migration is a project in its own right — directory synchronisation, mail flow, and cleaning up the on-premises server afterwards.
• Support. Day-to-day help comes from Microsoft’s global support channels or whichever partner you buy through.

Option 3: Hosted Exchange — keep Exchange, stop running it

The option most people do not realise exists. A hosted Exchange provider runs current, supported Exchange on its own infrastructure and gives you a mailbox, an organisation and the administrative controls — without the server.

For a business coming off on-premises Exchange, that has some particular advantages: your users keep exactly the Outlook experience they know, public folders carry across intact, shared mailboxes and delegate permissions behave as before, and the migration is Exchange to Exchange, which is the cleanest kind there is.

This is what we do. MyExchangeServer runs Exchange Server SE in UK data centres for £8.00 + VAT per 50 GB mailbox per month, with the SolidCP control panel so your own team can still create mailboxes and manage permissions, and with migration included free.

The three options side by side

If you are still on Exchange 2016 or 2019 today

A realistic plan for the next few weeks:

1. Confirm exactly what you are running — version and cumulative update — and whether you hold any ESU cover. If you are on Exchange 2016 or 2019 without ESU, you have already been without security updates since October 2025.
2. Reduce your exposure now. Make sure the server has every update it is entitled to, and review what is published to the internet. If nobody uses Outlook on the web, it does not need to be reachable.
3. Choose a destination using the comparison above. The decision is mostly about whether you will use Teams and SharePoint, and whether you want to keep running servers.
4. Book the migration. For a 25-mailbox organisation, an Exchange-to-Exchange move to hosted Exchange typically takes one to two weeks from audit to cutover, with the cutover itself done in a single evening.
5. Decommission the old server properly once mail has moved — not just switch it off — so it stops being an unpatched machine on your network.

Sources

• Microsoft Exchange Team: Announcing Period 2 Exchange 2016/2019 Extended Security Update (ESU) program (15 April 2026)
• Microsoft Exchange Team: Announcing Exchange 2016 / 2019 Extended Security Update program
• Microsoft Exchange Team: Upgrading your organization from current versions to Exchange Server SE
• Microsoft Learn: Exchange Server supportability matrix
• BleepingComputer: Microsoft Exchange 2016 and 2019 have reached end of support