Exchange 2016 and 2019 end of security updates arrives at the close of October 2026, and Microsoft has stated there will be no Period 3. Mainstream support for both versions finished in October 2025. The Extended Security Update program carried them through a first period that ended in April 2026 and a second period running from May to the end of October 2026. After that, a mail server reachable from the internet stops receiving fixes for whatever is found next. We are writing this in mid September, which leaves roughly six weeks, and that is enough time for a clean cutover only if the decision gets made in the next fortnight rather than in late October.
The Five Things That Decide How Bad This Gets
We ask clients these five questions before we talk about migration paths at all.
- Is the server reachable from the internet? An Exchange box publishing Outlook Web Access or ActiveSync to the world is the high-risk case, and it is also the most common one.
- Is it hybrid, or is it the whole mail system? A hybrid server kept only for attribute management is a different job from a full mailbox migration.
- What else authenticates against it? Line of business applications sending mail through the server are what turn a two-week project into a six-week one.
- Has the ESU actually been applied? Buying the program and installing its updates are separate acts, and we find gaps between them regularly.
- Who is watching the box after October? If the answer is nobody, the risk is not the missing patch, it is that the compromise runs for months unnoticed.
Why an Unpatched Exchange Server Is Not Like Other Unpatched Software
An unpatched Exchange server is worse than most end-of-life software because of what it holds and where it sits. Every other legacy system we are asked to keep alive tends to be internal, narrow, and dull to an attacker. Exchange is none of those. It holds the organization’s mail history, it authenticates against the directory, and in most deployments it answers requests from the public internet so that phones and laptops can reach it from anywhere.
That combination has made Exchange a favorite target for years. Our team has cleaned up after several of these, and the pattern is consistent: the initial access comes through the mail server, the attacker reads mail for a while to learn who approves payments, and the financial loss arrives weeks later through a convincing email rather than through anything that looks like an intrusion. The server was the door, not the prize.
What Actually Stops on October 31
What stops is the supply of fixes, not the software. Your Exchange server will run perfectly well on November 1. It will accept mail, serve mailboxes, and answer ActiveSync exactly as it did the day before. Nothing switches off, no licence expires in a way anybody notices, and no warning appears in the console.
That is precisely why this deadline gets missed while a hardware failure never does. There is no event. The change is that the next vulnerability disclosed in Exchange, whenever it lands, has no patch coming for your version, and the disclosure itself is what tells attackers where to look. Historically the gap between an Exchange disclosure and mass scanning has been measured in days.
The reasonable counterpoint is that a well-segmented, internally-facing Exchange server with no external publishing is genuinely lower risk, and some organizations in that position can accept a few months of exposure while a proper migration runs. We agree with that as a temporary position, with two conditions: the external surface is actually gone rather than assumed gone, and the migration has a date on it. An acceptance with no end date is a decision to stay.
Why the ESU Extension Taught the Wrong Lesson
The second ESU period taught many teams that this deadline moves. In April 2026 Microsoft announced a Period 2 running from May through October, after the first period had been expected to be the end of it. A team that had planned a spring migration, watched the date slide, and quietly deprioritized the work has now been rewarded once for waiting.
Reading it charitably, that was rational behavior. Migrations are expensive and disruptive, the extension was real, and deferring work that the vendor itself deferred is not negligence. Plenty of competent teams made exactly that call and were right for six months.
The position has changed, though, and the specific language matters. Microsoft has said there will be no further extension of the Exchange 2016 and 2019 ESU timeline, and that once October ends there are no further updates even for organizations currently holding a Period 2 subscription. That is about as explicit as vendor communication gets. We covered the same dynamic around Windows Server 2016 end of support, where the teams that moved early had ordinary projects and the teams that waited had emergencies.
The Hybrid Server Nobody Remembers
The hybrid server is the one that catches organizations that believe they already migrated. When you move mailboxes to Microsoft 365 through a hybrid configuration, one on-premises Exchange server usually stays behind so that directory-synchronized objects can still be managed. Mailboxes are in the cloud, users see nothing on premises, and the server drops out of everybody’s mental model of the estate.
It is still an Exchange server. It still runs the same code, often still publishes an endpoint, and it still falls under the same end of support. We find these during discovery constantly, usually running an older cumulative update than anybody expected because nothing prompted an upgrade once mail moved.
Microsoft has provided a supported route to remove the last hybrid server in favor of a management tool that does the same attribute work without a full Exchange installation. That path takes planning and is meaningfully simpler than a mailbox migration. If your only remaining Exchange is a hybrid management server, this is a smaller project than you are probably assuming, and it should be scheduled first because it is the quick win.
Choosing Between the Three Paths That Actually Exist
Three paths exist, and the right one depends far more on your line of business applications than on your mailbox count. We walk clients through them in the same order every time, because the sequence of questions saves rework.
Path one is Microsoft 365. Mailboxes move to Exchange Online and the on-premises servers are decommissioned. This is the destination for most organizations under 500 people and the one we recommend by default. Path two is Exchange Server Subscription Edition, the current supported on-premises release, for organizations with a genuine requirement to keep mail in their own datacenter. Path three is a staged approach where mailboxes move first and a hybrid server remains temporarily, which is a real plan only when it carries a removal date.
What Makes a Mail Migration Run Long
What makes a mail migration run long is almost never the mailboxes. Mailbox moves are well understood, they run in the background, and the tooling is mature. The time goes into everything else that has quietly come to depend on the mail server over the past decade.
The usual list: a scanner that sends PDFs by SMTP relay, a line of business application that sends invoices, a backup product authenticating with a service account, a public folder structure somebody still uses, and a set of firewall rules and certificates nobody has touched since the last upgrade. Each item is small. Collectively they are the project. We wrote about the same pattern in the hidden cloud migration steps SMBs overlook and in avoiding the pitfalls of a cloud migration.
Public folders deserve their own mention, because they are the item most likely to stall a cutover late. Organizations that adopted them a decade ago often still have a handful in daily use by one department, nobody senior knows they exist, and the migration path for them is slower and fussier than mailbox moves. Find out on day one whether you have any and whether anybody still writes to them. If the answer is a small number of read-only archives, the job is easy. If a team is actively working out of them, that single fact reshapes the schedule.
The discovery for that list takes about a week and it is the highest-value week in the project. Run a message trace on the server and look at what is actually sending, rather than asking around. Applications that send mail rarely have an owner who remembers doing it. Our cloud migration team treats that trace as the real project plan.
What to Do If You Cannot Finish by October
If you cannot finish by October, reduce the attack surface rather than accepting the risk as it stands. This is the position a lot of organizations will be in, and there is a meaningful difference between exposed and unpatched, and internal and unpatched.
Concretely: remove external publishing of Outlook Web Access and ActiveSync, require VPN or a reverse proxy with modern authentication for any remote access, restrict which internal systems can reach the server, and make sure the server sits in a segment that does not allow it to reach the rest of the network freely. Each of those is a firewall change rather than a project, and together they take the most likely attack path away.
The honest caveat is that this is mitigation and not a fix. A determined attacker inside the network still finds an unpatched Exchange server, and the mitigations decay as people request exceptions. Set a review date, keep the migration item open, and make sure your network security monitoring covers the server specifically rather than generically.
Watch the Server Harder Once the Updates Stop
Watch the server more closely from November, because detection is the only control left once patching ends. This is the step organizations skip, and it is the one that decides whether an incident is contained in a day or discovered in a quarter.
There is a fair argument that monitoring an end-of-life server is money spent propping up something you have already decided to remove. We hear it, and the counterweight is timing. The window where the server is unpatched and still holding live mail is exactly the window where detection matters most, and it is usually the window that lasts longest, because migrations slip and decommissions get scheduled after the next quarter’s priorities land. Paying for eyes on the box for three months is far cheaper than the alternative, and the alerting you set up transfers to whatever replaces it.
The signals worth alerting on are narrow and cheap. New or modified transport rules, mailbox forwarding rules created outside normal hours, unexpected files appearing in the web-accessible directories, service account authentication from unfamiliar addresses, and any change to the Exchange configuration made outside a change window. Those five cover the way these compromises usually present. Our managed security services team applies the same list, and the mailbox rule detection also catches the business email compromise pattern described in the email security gaps SMBs miss.
Frequently Asked Questions
Will Exchange 2016 stop working after October 2026?
No. The software keeps running normally, and only the supply of security updates ends. That is what makes the date easy to miss, since nothing visibly changes on the server itself.
Can we buy another year of Extended Security Updates?
Microsoft has stated there is no Period 3 for Exchange 2016 and 2019, so there is no further ESU to purchase. Organizations holding a current Period 2 subscription receive nothing after October ends.
Does a hybrid-only Exchange server still need to be dealt with?
Yes, and it is usually the easier job. A supported path exists to remove the final hybrid management server and handle directory attribute management without a full Exchange installation, which is considerably less work than a mailbox migration.
Is Exchange Server Subscription Edition a real alternative?
It is, for organizations with a genuine reason to keep mail on premises such as a regulatory or connectivity constraint. It is a supported current release rather than a stopgap, and the upgrade path from 2019 is well documented. Most firms under 500 people are better served by Exchange Online.
What is the single most useful thing to do this week?
Run a message trace and list every application and device sending mail through the server. That list determines the length of the project, and producing it does not require any decision to have been made yet.
Who Is Behind This Advice
Our team has run Exchange migrations for firms between 10 and 500 employees for more than a decade, through every version transition since 2010, and the thing that separates a calm project from a painful one has never been technical. It is whether the dependency discovery happened early. The organizations that hand us a list of what sends mail through the server finish weeks ahead of the ones that discover it during cutover.
Matt Rosenthal, who leads Mindcore, has pushed our practice to treat end-of-support dates as planning triggers rather than as emergencies, which in practice means starting the conversation a year out. This article exists because that window has closed for Exchange 2016 and 2019, and the advice changes when six weeks is what you have.
Put a Date on Your Exchange Decision
Exchange 2016 and 2019 end of security updates is a fixed date with an unusually clear statement behind it, and the organizations that struggle in November will be the ones that treated the April extension as evidence of a pattern. Six weeks is not enough for a relaxed migration of a complicated estate, and it is comfortably enough to make the decision, run the dependency discovery, remove external publishing, and get a hybrid management server out of the picture. Start with the message trace, because it tells you the size of the job without committing you to anything. Decide between Exchange Online and Subscription Edition on the strength of what that trace shows rather than on preference. If the full move lands after October, shrink the attack surface first and put monitoring on the box that survives. If you want a second opinion on which path fits your estate, or help running the discovery before the calendar decides for you, book a free strategy call and we will map it out with you.
