If you run Exchange in your own building, 2026 comes with a fixed date. Exchange Server 2016 and 2019 have had no regular support since 14 October 2025. The last grace period of paid security updates ends on 31 October 2026. After that, a vulnerability stays open as soon as it becomes known.
The dates
- 14 October 2025: end of support for Exchange 2016 and Exchange 2019.
- October 2025 to April 2026: first period of Extended Security Updates.
- May 2026 to 31 October 2026: second and final period. Anyone using it had to purchase it again, even if the first period was already paid.
Extended updates contain security updates rated critical and important only. New features, bug fixes and support for new clients do not come through this channel. Microsoft has stated there will be no third period.
The path to Exchange SE
Exchange Server Subscription Edition has been available since July 2025 and is the only self-hosted version that is still maintained.
From Exchange 2019. With CU14 or CU15 the upgrade runs in place. The first release of Exchange SE is code-equivalent to Exchange 2019 CU15, only the licence text and version number differ. The risk is correspondingly low.
From Exchange 2016. There is no in-place upgrade. New servers with Exchange SE or Exchange 2019 CU15 join the organisation, mailboxes move, and the old servers are removed afterwards. That is a planned project, not weekend maintenance.
Licensing. Exchange SE follows a subscription model. Server and client access licences need active Software Assurance or are purchased as subscriptions. Exchange 2019 licences bought without Software Assurance cannot be made eligible by adding it later. Your licensing partner can clarify the details.
What this means for email security
The mail path itself does not change. A send connector to the gateway and the MX stay as they are. Three places still deserve a look before the upgrade.
Add-on software in the transport service
Many on-premises products for signatures and rules run as a transport agent inside Exchange. Exactly this product group is shrinking. Exclaimer discontinued Signature Manager Exchange Edition, support ended on 30 September 2024. CodeTwo lists Exchange Rules Pro as discontinued, the program was designed for Exchange 2016 and 2019. If you run such software, confirm before the upgrade whether a maintained version for Exchange SE exists.
How a transport agent works and where the risks lie is covered in the article on the Exchange transport agent.
Outlook and add-ins
The new Outlook for Windows does not support mailboxes on your own Exchange. If you stay in-house, plan with Outlook classic and Outlook on the web.
Add-ins face a second limit: Exchange Server SE only accepts manifests up to API version 1.5, and sign-in through Entra ID does not exist without Microsoft 365. Many add-ins from the Microsoft store fail on that. The article deploying Outlook add-ins on Exchange Server SE shows the paths that remain.
Internal mail
Messages between two mailboxes on the same server never reach a gateway. That was true on Exchange 2019 and stays true on Exchange SE. If internal mail has to be encrypted, the background is in why internal email in Exchange never reaches a gateway.
Checklist before the upgrade
- Check the current state: which servers, which CU, which roles.
- Clarify licensing: Software Assurance or subscription for servers and client access licences.
- List add-on software in the transport service with
Get-TransportAgentand have each vendor confirm support for Exchange SE. - Inventory Outlook clients. The new Outlook is not an option for in-house mailboxes.
- Review add-ins that currently require sign-in through Microsoft.
- Document the mail path: send connectors, smart hosts, receive connectors, MX.
Exchange SE with Conbool
Conbool works with Exchange Server SE without Microsoft 365: filtering and encryption at the gateway, signatures with fields from local Active Directory, a transport agent for internal mail and five Outlook add-ins with a dedicated manifest for Exchange Server. From the cloud or in your own data centre. The overview is on securing Exchange on premises, the technical connection is described in the Exchange on-premises documentation.
