Exchange Server 2016 and 2019 support ended: what to do now

What actually stopped

Three things ended together on October 14, 2025: security updates for newly discovered vulnerabilities, bug fixes, and technical support from Microsoft. The server keeps routing mail, which is exactly why the deadline is easy to postpone. The problem is specific to Exchange: it is internet-facing by design and has a track record of actively exploited vulnerabilities such as ProxyLogon and ProxyShell. An unpatched Exchange box is not a quiet legacy system in a corner, it is an exposed target holding your organisation's email. For the wider picture, see how unsupported software affects compliance and insurance.

The ESU bridge, and why it is already closed

Unlike the multi-year ESU programs for Windows, the Exchange 2016 and 2019 bridge was deliberately short: a single six-month paid program, running from end of support to April 14, 2026, delivering only Critical and Important security updates to enrolled customers. It was a runway to finish a migration already in flight, not a way to keep Exchange on-premises for years. That runway has now run out, so there is no supported way to receive Exchange 2016 or 2019 security updates today.

Your options, honestly compared

• Migrate to Exchange Online (Microsoft 365). Microsoft's recommended destination. It removes the patching and server-maintenance burden entirely and is usually the least-effort long-term answer for most organisations.
• Move to Exchange Server Subscription Edition (SE). The on-premises continuation, released in mid-2025. Exchange 2019 (on the required cumulative update) can perform an in-place upgrade to SE; the licensing model becomes a subscription. Right if you have a firm reason to keep mail on-premises.
• Adopt a hybrid setup. Common as a transition: keep an Exchange SE server for management while mailboxes live in Exchange Online. Plan it as a stepping stone, not a permanent home for legacy versions.
• Decommission it. If mail already moved and the old server is only still running for historical reasons, retire it. A forgotten Exchange box left online is pure risk.

Note the upgrade path: there is no in-place jump from Exchange 2016 to SE. From 2016 you either move to Exchange Online or step to Exchange 2019 or SE first.

Do not forget the box underneath

An Exchange 2016 or 2019 server almost always runs on Windows Server 2016 or 2019, which are themselves approaching end of support (Windows Server 2016 leaves extended support on January 12, 2027) on hardware that may be near its own end of service life. That is often three overlapping deadlines on one machine: the mail application, the operating system, and the server hardware. Solve them as one project. Treating all of it as a single lifecycle management problem is what stops these from stacking into an emergency.

A plan for a deadline that has already passed

• Now: confirm whether any Exchange 2016 or 2019 server is still reachable from the internet, and restrict or firewall it off until it is migrated. An exposed, unpatched Exchange server is the urgent case.
• This month: pick the destination, Exchange Online or Exchange Server SE, and confirm mailbox counts, connectors and any third-party integrations that depend on the current server.
• Next quarter: run the migration, then fully decommission the old server rather than leaving it powered on "just in case". Record the new platform's support dates on day one.
• Ongoing: capture the operating system and hardware end-of-support dates for the same servers, so the next expiry does not surprise you.

Related deadlines worth noting

The same platform generation is retiring together: SQL Server 2016 ended on July 14, 2026, Windows Server 2016 leaves extended support on January 12, 2027, and on the desktop Windows 10 ended in October 2025. The full, continuously updated view sits on the IT end-of-support calendar.