If your company still runs Exchange Server 2016 or 2019 on its own hardware, the server has been out of support for a year. Support ended on 14 October 2025. Since then the only fixes have gone to organisations that paid Microsoft for Extended Security Updates, and that programme stops when October 2026 ends. On 20 July 2026 the Exchange team said so in plain words: there will be no further extension, and after October there are no more updates even for customers who hold the current paid contract.
Nothing switches off on 1 November. Mail keeps flowing and Outlook keeps opening. What changes is that the next Exchange vulnerability, whenever it is found, stays open on your server for good.
The dates
| When | What happened or happens |
|---|---|
| 14 October 2025 | Exchange Server 2016 and 2019 reach end of support. The October 2025 updates are the last ones Microsoft published for everyone. |
| October 2025 to April 2026 | First paid Extended Security Update period. |
| May 2026 to end of October 2026 | Second paid period, bought as a separate contract. Microsoft said at the time it would be the last. |
| After October 2026 | No further updates for Exchange 2016 or 2019, with or without a paid contract. |
| Second half of 2026 | Exchange Server Subscription Edition (SE) gets its first feature update, CU1. |
| First half of 2027 | SE CU2. Its installer refuses to run while any Exchange 2016 or 2019 server is still in the organisation. |
Without an Enterprise Agreement, your server never had the paid updates
The Extended Security Update programme was not something you could buy from a reseller's price list. Microsoft sold it per server, through its own account team, to customers with an Enterprise Agreement. The updates were delivered privately to those customers. Microsoft also said it was not committing to release any update at all during the period, only to provide one if a Critical or Important fix was needed.
So if you are a 60-person manufacturer, a cooperative bank or a college with one Exchange 2016 box, and nobody signed a separate contract with Microsoft last year, your server has had no security fixes since October 2025. The end of October is not your deadline. It passed twelve months ago, and this month is when the last exception closes.
What actually goes wrong on an unpatched Exchange server
- The next exploit has no fix. Exchange faces the internet and holds everyone's mail, so attackers keep looking for new ways in. Until now a fix followed each discovery. From November it will not.
- Mail to Microsoft 365 users can be slowed, then refused. Exchange Online throttles and then blocks mail from Exchange servers that stay far behind on updates. Today a server with the October 2025 updates is not affected. Microsoft has said a day will come when it is.
- The audit question gets harder. "Is the mail server on a supported version?" has been a no since last October. After this month you can no longer answer that you are covered by a paid programme.
- You cannot upgrade around it later. Once SE CU2 arrives in 2027, a 2016 or 2019 server cannot sit alongside the new one. The old server has to be gone first.
Three ways out
1. Stay on Exchange: move to Subscription Edition
If you run Exchange 2019 on CU14 or CU15, this is an in-place upgrade. Microsoft describes it as the same as installing a cumulative update, and it works for servers in a DAG.
If you run Exchange 2016, there is no in-place path. You build a new SE server, join it to the organisation, move every mailbox across and retire the old server. Microsoft's own advice is to go straight to SE and not to install new 2019 servers on the way, because 2019 is out of support too.
The licence is the part that surprises people. Exchange SE needs server licences and CALs with Software Assurance, or a cloud subscription licence such as Microsoft 365 E3 or E5 for every user who touches the server. Either way, on-premise Exchange is now something you pay for every year. Ask your licensing partner for the figure before you plan the hardware.
2. Move the mailboxes to Microsoft 365
This is the route Microsoft prefers. Exchange Online comes with Microsoft 365 Business Basic, which is ₹170 per user per month in India on yearly billing, before GST (Microsoft's India price page, 2 October 2026). For 100 users that is ₹2,04,000 a year for the entry plan.
It ends the patching problem, and for many companies it is the right answer. It is a harder answer for the organisations that kept Exchange in their own server room on purpose: banks, NBFCs, PSUs, government departments and anyone whose auditor asks where the mailbox physically lives.
3. Keep email on your own servers, on a different platform
The third option is to replace Exchange with another mail server that is still supported and still runs on your hardware. This is what we build. XgenPlus Enterprise installs on your servers or private cloud under a per-user perpetual licence with an annual maintenance contract. Archiving, litigation hold and eDiscovery are included, and it connects to Active Directory or LDAP for sign-in and the address book.
What your users notice: Outlook stays on every desk, connected over IMAP and SMTP with calendars and contacts syncing, and phones connect over ActiveSync. Every address stays the same. Be clear-eyed about one thing: this is Outlook talking to a different server, so anything that depends on Exchange itself, such as an application that relays through it or a tool that uses Exchange Web Services, has to be listed and re-pointed. That list is the first thing we make.
If you do not need the server in your own building, the same product runs hosted in Indian data centres from ₹21 per user a month.
What to do this week
- Find out exactly what you run. In the Exchange Management Shell,
Get-ExchangeServer | Format-List Name,AdminDisplayVersiongives the version and build of every server. - Check the October 2025 updates are installed. They were the last public ones. A server that is behind even those is the first to be throttled by Exchange Online.
- Ask finance one question: do we have Software Assurance on our Exchange licences? The answer decides how expensive option 1 is.
- Count. Mailboxes, shared mailboxes, total storage, and every application, scanner or script that sends mail through the server.
- Pick the option and a date. Nobody finishes a migration in four weeks, and you do not have to. What matters is that the server stops being a permanent fixture.
If option 3 is on your list, this is how we run an Exchange migration: an inventory that produces a written scope and a fixed price, mailboxes moved in batches while Outlook keeps working against Exchange, and a cut-over on a date you pick. If you also run Microsoft 365, the EWS switch-off that began on 1 October is a separate deadline: read the October dates and the allow list.
Sources: Microsoft Exchange Team blog, "Reminder: Exchange 2016 and 2019 ESU Program Ends in October 2026" (20 July 2026), "Announcing Period 2 Exchange 2016/2019 Extended Security Update (ESU) program" (15 April 2026) and "Upgrading your organization from current versions to Exchange Server SE" (updated 26 August 2026); Microsoft 365 business pricing for India. Checked 2 October 2026. Microsoft can change dates and prices; confirm with your Microsoft partner before you commit.
