Picture a hybrid setup where the mailboxes moved to Microsoft 365 some time ago, but an Exchange server stayed behind because it’s the way you change a user’s email address or edit a distribution group. A server like that is easy to forget about, which is why its end-of-support date deserves more than a glance. Microsoft’s lifecycle pages for Exchange Server 2016 and Exchange Server 2019 hold the end of extended support as 14 October 2025 Pacific in their data, although the page displays it as 6:59:59 AM on 15 October. The Exchange team’s blog says 14 October, so that’s the date we’d plan around. In late July 2025 it was under twelve weeks away.
What the date changes
Both versions sit under Microsoft’s Fixed Lifecycle Policy, which shows security updates continuing through extended support and, beyond the end of support, available only through an Extended Security Update programme. For these two versions there isn’t one. The Exchange team’s post on upgrading to Exchange Server Subscription Edition (SE) says Microsoft isn’t extending the end-of-life date and isn’t offering extended support or Extended Security Updates for either version. It adds that all Exchange Server customers are affected, “whether fully on-premises, in a hybrid state, or in a management tools only state (for recipient management)”.
So a flaw found after 14 October has no fix promised. The server carries on running and the mail carries on flowing, which is exactly why a date like this gets put off. It matters most in a classic hybrid deployment, because Microsoft’s hybrid prerequisites expect the Autodiscover address to sit in public DNS and the web services to be covered by a certificate from a public authority. In practice that usually means the server is published to the internet, which is where missing security updates would bite soonest. A Modern Hybrid configuration with a Hybrid Agent, which the management tools page also mentions, is arranged differently, so check which one you have.
Start with what the server still does
Before you pick a route, work out what your server is still used for, because the answer changes the options.
| What the server still does | What it means for the server |
|---|---|
| Hosts mailboxes | Move them to Exchange Online with remote moves, or take the server to Subscription Edition |
| Only manages recipients | Keep it on a version that gets updates, or use the Exchange Management Tools without a server if every condition is met |
| Relays mail, runs Edge Transport or holds public folders | Microsoft’s pages say not to shut it down until those jobs have somewhere else to go |
Your estate may be a mixture, and the third row is the easy one to miss. Microsoft’s page on managing recipients without a server says that if the last server does anything beyond recipient management, SMTP relay for example, you shouldn’t shut it down. A scanner or a line-of-business application that sends mail through the server only shows up when someone goes looking for it, so we’d start there.
Check the cumulative update level too, because the routes below depend on it. Microsoft’s build numbers page lists Get-ExchangeServer | Format-List Name,Edition,AdminDisplayVersion in the Exchange Management Shell as one way to see it. That command reports the cumulative update and not the security updates on top of it, so it won’t tell you whether a server is fully patched. The page recommends the Exchange HealthChecker script for that.
Finishing the move to Exchange Online
If mailboxes are still on-premises, moving them is the way out. Microsoft’s decommissioning guide lists remote move migrations in a hybrid deployment for organisations with more than 2,000 mailboxes that manage accounts on-premises. A smaller estate should look at the guide’s other rows, which cover cutover, staged and IMAP migrations.
Public folders need checking before anything moves. The guide has you confirm that PublicFoldersEnabled isn’t set to Remote (it gives Get-OrganizationConfig | Format-List PublicFoldersEnabled for the purpose) and says that if your users still need public folders and you can’t migrate them, you shouldn’t go ahead. Once every mailbox is in the cloud, the MX and Autodiscover records have to point at Exchange Online, and the guide tells you to update internal and external DNS together.
This is the migration work our Microsoft 365 and Azure page covers. What the guide can’t decide for you is directory synchronisation. If you keep it, the server question doesn’t go away. The last section covers what Microsoft documented for that case.
Staying on-premises with Subscription Edition
If you’d rather keep Exchange on-premises, Subscription Edition is the route built for it, and the release announcement records general availability on 1 July 2025. Its first build installs as a cumulative update on Exchange 2019 CU14 or CU15 and can join an existing 2016 or 2019 organisation. The Exchange team calls it code-equivalent to 2019 CU15 plus any later security or hotfix updates, with no new features, and describes the in-place upgrade as identical to installing a CU. According to the build numbers page, CU14 came out on 13 February 2024 and CU15 on 10 February 2025.
Two limits shape the planning. The in-place route works only from 2019 CU14 or CU15, and upgrading the Windows version underneath an Exchange server isn’t supported. On Exchange 2016 the team’s table gives two routes: a legacy upgrade from 2016 CU23 to 2019 CU15 followed by the in-place step, or a new SE server joined to the organisation, with the mailboxes moved across. We’d lean towards the second, since it avoids building a 2019 server only to upgrade it. The team’s FAQ, written before the release, favoured upgrading to 2019 first, so it depends on your licences and hardware.
There’s a deadline inside that route too. As at July 2025 the release table planned SE CU1 for the first half of 2026 and SE CU2 for the second half. CU1 can still coexist with 2016 and 2019, though they’ll be unsupported by then, while Setup in CU2 is documented to block them. So if you join an SE server beside a 2016 server, the old one has to be gone before CU2.
Licensing has changed shape, according to the Exchange team’s FAQ, though several of its answers are still written in the future tense, as if SE hadn’t shipped. Licence-only purchases are no longer offered, so SE needs an active subscription: qualifying cloud subscription licences for all users and devices that access it, or server licences and CALs with Software Assurance. A free hybrid licence is still issued through the Hybrid Configuration Wizard, but updates need Software Assurance or a qualifying cloud subscription, and that licence covers recipient management only. If the server hosts mailboxes, or you need an on-premises Edge Transport or SMTP relay server, you still need a full Exchange Server licence. Your licensing provider has to confirm where you stand, and we’d ask them before choosing a route, not after.
Whichever on-premises route you take, we’d want a restore that has been tried before anything changes on a mail server, which is the point of our backup strategy guide.
Keeping a server only to manage recipients
The awkward part is that on-premises recipients can’t be changed directly in Microsoft Entra ID or Exchange Online, so with directory synchronisation you’ve needed an Exchange server to do it. The management tools page describes an alternative. Install the updated Exchange Management Tools, using Setup from Exchange 2019 CU12 or later on any domain-joined computer, and domain admins and members of a Recipient Management EMT group can run the recipient cmdlets (Set-RemoteMailbox among them) with no Exchange server running.
It only applies if every condition holds. All mailboxes and public folders have to be in Exchange Online, and recipients have to be managed in Active Directory with cloud sync or Microsoft Entra Connect. It’s ruled out if you rely on the on-premises Exchange admin center or Exchange role-based access control, or need auditing or logging of recipient changes, and you have to be content with PowerShell alone. Shutting the server down stays optional. The page’s warning, in capitals, is not to uninstall the last server, though it gives no reason, so check with Microsoft before you remove it. The Exchange team adds that this route removes the need for a hybrid licence at all.
The page doesn’t say how the machine running the tools is treated once Exchange 2019 is itself out of support, so ask Microsoft or your licensing provider before you design around it.
The scanner that relays through the old server, the script that edits recipients and the public folders nobody remembers are all easier to find before the date than after. If you’d like help drawing up that inventory for your own estate, our contact page is the place to start.
