Exchange 2016 and 2019 no longer receive security updates. What regular Exchange support includes and your options: Exchange Server SE, Microsoft 365 or hybrid.
What needs to be done regularly and what your options are if you run an unsupported version.
Exchange is reachable from the internet: webmail (OWA), phones (ActiveSync) and Outlook connect to it from outside. That makes it a frequent target. In 2021 the vulnerabilities known as ProxyLogon were exploited on a large scale against servers that were not updated in time.
So with Exchange, updates are not postponed for months. They are planned and applied regularly.
After 14 October 2025 Microsoft no longer releases security updates for Exchange 2016 and 2019. The server keeps working, but every new vulnerability stays open.
| Option | What it means | Best for |
|---|---|---|
| Exchange Server SE | The new on-premises version with subscription licensing. From an up-to-date Exchange 2019 the move is an in-place upgrade. From 2016 it goes through a new server. | Companies that want mail to stay in-house |
| Microsoft 365 | Mail moves to Microsoft's cloud. No server to maintain, priced per user. | Companies that do not want to maintain a server |
| Hybrid | Some mailboxes in the cloud, some on the server, for a gradual transition. | Larger organisations migrating step by step |
If you are comparing other self-hosted options, see Zimbra or Microsoft 365 and how a migration to Microsoft 365 works.
Measured by the Exchange build against Microsoft's latest release
How we do it: we update on a schedule, with a backup first
Measured by alerts for certificate expiry and free space
How we do it: we monitor the server and renew on time
Measured by a written plan with dates and steps
How we do it: we review the server and propose Exchange SE or Microsoft 365
No. It keeps working, but it gets no security updates and new vulnerabilities stay open.
The new version of Exchange for your own server. It is licensed by subscription and receives updates.
With every new security update, in a planned window. Cumulative updates come out a few times a year.
Most often the domain's SPF, DKIM and DMARC records are missing or wrong. They can be checked and fixed quickly.
It depends. If nobody can maintain the server, Microsoft 365 is easier. If you want the data in-house, Exchange SE is the option.
We support Exchange servers, do new installations, monthly administration and migration to Microsoft 365. Start with a free review.
Head of IT Infrastructure & Security at Network Technology.
