Exchange 2016/2019 Updates Have Ended: Three Paths Forward

In this post

On October 13, 2026, Microsoft released the last security updates for Exchange Server 2016 and Exchange Server 2019 under the Extended Security Update (ESU) program. Microsoft has said there will be no more. From here on, updates ship for Exchange Server Subscription Edition (SE) only. Microsoft will also stop testing Exchange 2016 and 2019 for vulnerabilities, and its security advisories will stop listing them. That doesn't make them safe; it means new issues in them won't be fixed.

If you still run either version, you now have three realistic paths: upgrade Exchange 2019 in place to SE, do a legacy upgrade from Exchange 2016 to SE, or move mailboxes to Exchange Online. Here are the dates, what each path involves and how to choose.

How we got here

October 14, 2025: Exchange 2016 and 2019 reached end of support.
October 2025 to April 2026: Period 1 of the paid Exchange ESU program.
May to October 2026: Period 2, a separate six-month program for customers with an Enterprise Agreement that had to be bought again. It covered Exchange 2016 CU23 and Exchange 2019 CU14 and CU15.
October 13, 2026: the final ESU updates were released, and Microsoft confirmed there will be no further extension.

ESU never extended the support lifecycle; it only bought time to finish migrations.

Step one: find out exactly what you run

Every path starts with an inventory. For each server, record:

The version and cumulative update. You can match build numbers against Microsoft's Exchange build numbers list.
The server's role in mail flow, client access and any database availability group.
Applications, devices and scanners that relay mail through it.
Certificates, accepted domains, connectors and Autodiscover settings.
Whether any mailboxes already live in Exchange Online through a hybrid configuration.

Path 1: Exchange 2019 CU14 or CU15, upgrade in place to SE

This is the shortest route. Microsoft supports an in-place upgrade from Exchange 2019 CU14 or CU15 directly to Exchange SE. Microsoft describes it as identical to installing a cumulative update. SE RTM is code-equivalent to Exchange 2019 CU15, and the server keeps its configuration and databases.

If you're on Exchange 2019 CU13 or earlier, update to CU15 first, then upgrade in place. Treat it like any production CU: back up, check health and upgrade one server at a time.

Path 2: Exchange 2016, legacy upgrade to SE

Exchange 2016 can't be upgraded in place. Microsoft's upgrade guidance calls for a legacy upgrade:

Bring Exchange 2016 to CU23 if it isn't there already.
Join new Exchange SE servers to the organization.
Move mailboxes, public folders and mail flow to the new servers.
Decommission Exchange 2016 before Exchange SE CU3. In its October 27, 2026 update, the Exchange Team says CU3 setup, targeted for 2027, will block coexistence with Exchange 2016 and 2019. Earlier guidance named CU2, so treat the date as a window that could move, not a reason to wait.

Microsoft advises against installing new Exchange 2019 servers as a stepping stone because 2019 is already out of support. Go directly to SE.

We've run this kind of move for a defence and aerospace organization in Canada, taking an on-premises Exchange 2016 environment to Exchange SE and validating each stage before cutover.

Path 3: move mailboxes to Exchange Online

If you have no strong reason to keep mail on premises, moving to Exchange Online removes the server upgrade cycle altogether. A hybrid configuration lets mailboxes move in batches while users keep working. Plan for any on-premises footprint you still need for recipient management and application relay rather than assuming every server disappears.

Check the licensing before you start

Exchange SE runs on a subscription model. According to Microsoft's Exchange licensing FAQ, you need one of two things:

Server licenses and CALs with active Software Assurance.
Qualifying cloud subscriptions, such as Microsoft 365 E3 or E5, for every user who accesses the server.

Without one, SE doesn't stay current. Confirm your entitlement first; it can change which option costs least.

Choosing a path

On Exchange 2019 CU14/CU15 and need on-premises mail: upgrade in place to SE.
On Exchange 2016 and need on-premises mail: do a legacy upgrade to SE on new servers.
No hard requirement to stay on premises: move to Exchange Online, keeping only the hybrid management you need.

Whichever path fits, the work goes best when it's validated in stages: inventory, coexistence, mailbox moves, cutover, then decommissioning.

Frequently asked questions

Will Exchange 2016 or 2019 get any more security updates?

No. The October 13, 2026 release was the final ESU update, and Microsoft has said there will be no further extension. New fixes ship for Exchange Server SE only.

Can I upgrade Exchange 2016 in place to Exchange SE?

No. Exchange 2016 needs a legacy upgrade: bring it to CU23, join new SE servers, move mailboxes and mail flow, then decommission the 2016 servers. Only Exchange 2019 CU14 or CU15 can upgrade in place.

Is there a deadline for removing Exchange 2016?

Yes. Exchange 2016 and 2019 can coexist with Exchange SE RTM, CU1 and CU2, but Microsoft says Exchange SE CU3 setup, targeted for 2027, will block coexistence with both. Every legacy server has to be uninstalled from the organization, not just switched off, before CU3 can be installed. No release date has been published.

Do Microsoft 365 E3 or E5 licences cover Exchange SE?

They can. Microsoft's licensing FAQ lists qualifying cloud subscriptions such as Microsoft 365 E3 or E5 for every user who accesses the server as one way to license SE; the other is server licences and CALs with active Software Assurance.

Talk to our team

If Exchange 2016 or 2019 is still running in your environment, talk to our team. We'll help you confirm what you have, choose between SE and Exchange Online, and plan a staged cutover. For other end-of-support deadlines on the same servers, see our posts on Windows Server 2016 end of support and SQL Server 2016 end of support.