The Final Countdown: Exchange 2016 & 2019 Security Updates End 31 October 2026
Nobody gets excited about an email server upgrade project. There is no launch event, no ribbon-cutting. And yet, for thousands of service providers and enterprises still running on-premises Microsoft Exchange, the next ten weeks are the most consequential infrastructure window of the decade.
On 31 October 2026, the final Extended Security Update (ESU) period for Exchange Server 2016 and Exchange Server 2019 ends. Microsoft has made clear that this is the final ESU period, with no further extension planned.
If you are still running Exchange 2016 or Exchange 2019 on-premises, this article covers exactly what changed, why the risk is not theoretical, and how to reach Exchange Server Subscription Edition (SE) without turning your migration into a fire drill.
The Timeline, Precisely
A lot of teams are still working from the earlier Exchange 2016 and Exchange 2019 lifecycle calendar. Here is where things actually stand:
| Date | Milestone |
| 13 October 2020 | Exchange Server 2016 reaches Mainstream Support End Date |
| 9 January 2024 | Exchange Server 2019 reaches Mainstream Support End Date |
| 14 October 2025 | Extended Support ends for Exchange Server 2016 and Exchange Server 2019 |
| October 2025 – 14 April 2026 | Period 1 ESU — paid enrollment, Critical and Important security updates |
| 1 May – 31 October 2026 | Period 2 ESU — final six-month security-update bridge |
| After 31 October 2026 | No further ESU period for Exchange 2016 or 2019 |
For Exchange Server 2016, the distinction between the two support dates matters. October 13, 2020 was the end of mainstream support, while October 14, 2025 was the end of extended support.
Exchange Server 2019 reached the end of mainstream support on January 9, 2024, followed by extended support ending on October 14, 2025.
Period 2 is therefore not a return to normal product support. It is a final security-update bridge for eligible organizations that need additional time to complete their migration.
What Period 2 does not give you
It is worth spelling this out, because the word “support” is doing a lot of misleading work here:
- You cannot open a general support case for Exchange 2016 or 2019. The only exception is a problem caused directly by an ESU update itself.
- No feature requests.
- No performance-tuning assistance.
- No non-security bug fixes.
Treat Period 2 as a temporary security bridge, not a return to normal Exchange support.
Is 31 October 2026 really the final Exchange 2016/2019 deadline?
Yes.
For organizations still running Exchange 2016 or Exchange 2019 on-premises, 31 October 2026 is the date that matters because it marks the end of the final ESU period.
The practical takeaway is simple:
Do not build your Exchange migration strategy around another extension.
Why an Unpatched Exchange Box Is Not a Passive Risk
Exchange sits on the internet edge with administrative reach across your entire mail environment. That combination is precisely why it has a documented, repeated history of becoming the initial access point for ransomware crews and espionage groups.
The ProxyShell lesson. ProxyShell is the name researchers gave to a chain of three flaws — CVE-2021-34473, CVE-2021-34523 and CVE-2021-31207 — discovered by researcher Orange Tsai during Pwn2Own 2021.
CVE-2021-34473 alone carries an NVD severity score of 9.8, and it lets an attacker holding zero credentials exploit the Exchange Client Access Service to gain SYSTEM-level backend access. Chain it with the privilege-escalation and file-write flaws that follow, and an outsider with no account on your network can write a web shell and run arbitrary commands.
CISA added CVE-2021-34473 to its Known Exploited Vulnerabilities catalog in November 2021, and ProxyShell remains an important reminder of what happens when internet-facing Exchange infrastructure falls behind on security updates.
Here is the part that should concern anyone tempted to run past the deadline:
A vulnerability does not become less dangerous simply because it is old.
Legacy Exchange servers do not get safer with age.
They get more thoroughly catalogued.
Your Path Forward: Exchange Server Subscription Edition
Microsoft’s answer for organizations that need to stay on-premises is Exchange Server Subscription Edition (SE) — a shift from the traditional fixed-version model to a subscription-based servicing model.
For organizations searching for an Exchange 2016 replacement, Exchange 2019 replacement, or a supported on-premises Exchange platform, Exchange Server SE is the destination to plan for.
Why SE is the right destination for on-premises Exchange
- Continuous updates. Regular cumulative updates deliver new features, bug fixes and security patches, reducing the need for large, disruptive version-to-version migrations.
- Modern security. Exchange SE incorporates current security capabilities and supported protocols.
- Modern Lifecycle Policy. Exchange SE follows Microsoft’s subscription-based servicing model rather than the traditional fixed-version lifecycle.
The supported Exchange SE upgrade paths
From Exchange Server 2019 → The simplest path is an in-place upgrade to Exchange Server SE. Microsoft supports an in-place upgrade from Exchange 2019 CU14 or CU15.
From Exchange Server 2016 → A legacy upgrade is required. Exchange 2016 cannot simply be upgraded in place to Exchange SE. Microsoft supports a legacy upgrade directly to Exchange SE or a legacy upgrade to Exchange 2019 CU14/CU15 followed by an in-place upgrade to SE.
Still running Exchange 2013? Exchange Server SE does not support coexistence with Exchange Server 2013. Those servers need to be addressed as part of the migration before moving to the supported SE environment.
What is the difference between an Exchange 2016 and Exchange 2019 migration to SE?
Exchange 2019 can follow an in-place upgrade path. Exchange 2016 requires a legacy migration.
That distinction matters when planning an Exchange 2016 to Exchange SE migration versus an Exchange 2019 to Exchange SE upgrade, because the infrastructure, coexistence and mailbox/resource migration requirements are different.
For organizations with a large Exchange estate, this is why migration planning should begin well before the October 2026 deadline.
If you want to understand how MachSol approaches Exchange SE readiness and migration, see our earlier guide on preparing for Exchange Server Subscription Edition.
What This Means Specifically for Service Providers
For an enterprise, this is one migration.
For an MSP, hosting provider or managed service provider running multi-tenant Exchange, it is dozens or hundreds of simultaneous migrations — each with its own mailbox counts, DAG topology, transport rules, branding and billing arrangements.
Sequencing matters more than the deadline itself.
This is where orchestration stops being a nice-to-have.
Manage Exchange Across Multiple Tenants
MachPanel Automation Module for Microsoft Exchange
MachPanel provides a multi-tenant control panel and orchestration platform for hosted Microsoft Exchange, supporting Exchange Server Subscription Edition, Exchange 2019, Exchange 2016 and Exchange 2013 environments. It provides provisioning, management, self-service, monitoring, migration utilities and billing capabilities for Exchange service providers.
Key capabilities include:
- True multi-tenancy with tenant segregation through Microsoft’s Exchange framework.
- Built-in migration tools for importing and migrating existing Exchange environments.
- ADSync integration for directory synchronization and identity management.
- Self-service portals for providers, resellers, customers and AD users.
- Exchange mailbox, domain, distribution group and public folder management.
- DAG and multiple Exchange deployment support for high-availability environments.
- Exchange Email Signature Automation for centralized signature and disclaimer management.
- SSO, MFA and passwordless authentication for stronger access control.
- Monitoring, reporting and auditing across the Exchange environment.
For service providers, this is more than an Exchange 2016/2019 end-of-support migration.
It is an opportunity to modernize how Exchange is provisioned, managed and delivered across multiple tenants while moving the underlying infrastructure to Exchange SE.
Exchange Email Signature Management
One area often overlooked during an Exchange migration is email signature management.
MachPanel provides centralized Exchange email signature management, including tenant-level signature assignment, department-based signatures, Active Directory-driven attributes, disclaimers and policy enforcement.
Learn more about MachPanel Exchange Email Signature Management
Active Directory Synchronization
For service providers managing customer identities across environments, ADSync can also be part of the broader Exchange service-delivery architecture.
Learn more about MachPanel ADSync
For organizations that need standalone Active Directory synchronization, MachSol also offers MachSync, which supports synchronization between Active Directory environments.
Learn more about MachSync Active Directory Synchronization
Let MachSol Run the Exchange SE Migration
These upgrades are complex and time-consuming, particularly at service-provider scale. They demand careful planning, deep technical knowledge and a genuine commitment to minimising downtime.
MachSol Professional Services handles the entire process end to end:
- Pre-migration assessment — we analyse your existing Exchange environment to identify the optimal upgrade path and surface potential blockers.
- Planning and design — a detailed, customised migration plan built for minimal disruption.
- Execution — our engineers stand up the new Exchange Server SE infrastructure and migrate mailboxes and public folders.
- Post-migration support — ongoing assurance that the new environment is stable, secure and performing.
Explore MachSol Professional and Migration Services
MachSol’s professional services include enterprise migration services, turnkey services and training, giving organizations the option to engage MachSol for planning, implementation and migration assistance.
MachSol is a Microsoft Certified Partner, and MachPanel is a Microsoft-validated solution for hosted Microsoft environments.
Don’t Let the Exchange 2016/2019 Deadline Catch You Off Guard
Ten weeks is enough time to run a well-planned migration.
It is not enough time to run a panicked one.
If you’re running Exchange 2016 or Exchange 2019 on-premises, now is the time to assess your environment, determine the right Exchange Server Subscription Edition migration path, and start planning.
Ready to Plan Your Exchange SE Migration?
Whether you operate an enterprise Exchange environment or manage a multi-tenant Exchange hosting platform, MachSol can help assess your current environment and define the right path forward.
👉 Contact MachSol to book your free pre-migration assessment
Or learn more about the MachPanel Exchange Management and Automation Platform for multi-tenant Exchange service providers.
Frequently Asked Questions
When does Exchange 2016 end of support?
Exchange Server 2016 reached its Mainstream Support End Date on October 13, 2020 and its Extended Support End Date on October 14, 2025. The final ESU period for eligible organizations runs through October 31, 2026.
When does Exchange 2019 end of support?
Exchange Server 2019 reached its Mainstream Support End Date on January 9, 2024 and its Extended Support End Date on October 14, 2025. The final ESU period ends October 31, 2026.
When do Exchange 2016 and 2019 security updates end?
The final ESU period for Exchange Server 2016 and Exchange Server 2019 ends October 31, 2026.
Organizations still running these versions should plan their migration to Exchange Server Subscription Edition before the final ESU period expires.
Is Exchange 2019 still supported?
No. Exchange Server 2019 reached the end of its extended support lifecycle on October 14, 2025. Eligible organizations enrolled in the final ESU period can receive applicable security updates through October 31, 2026.
What happens to Exchange 2016 and 2019 after October 31, 2026?
The final ESU period ends. Organizations should plan to move away from Exchange 2016 and Exchange 2019 as their production Exchange platform and migrate to Exchange Server Subscription Edition.
Is there another ESU period after October 31, 2026?
No. Microsoft has confirmed that there will be no further extension of the Exchange 2016/2019 ESU program after October 2026.
Can Exchange 2016 be upgraded to Exchange Server Subscription Edition?
Yes, but not as an in-place upgrade. Exchange 2016 requires a legacy migration to Exchange SE. Microsoft also supports a legacy upgrade to Exchange 2019 CU14/CU15 followed by an in-place upgrade to Exchange SE.
Can Exchange 2019 be upgraded to Exchange Server Subscription Edition?
Yes. Exchange Server 2019 CU14 or CU15 supports an in-place upgrade to Exchange Server Subscription Edition.
What is Exchange Server Subscription Edition?
Exchange Server Subscription Edition (SE) is Microsoft’s current Exchange Server platform for organizations that continue to operate Exchange on-premises. It follows a subscription-based servicing model rather than the traditional fixed-version lifecycle.
What should MSPs and hosting providers do before Exchange 2016/2019 end of support?
MSPs and hosting providers should plan both the Exchange infrastructure migration and the service-delivery layer.
Multi-tenant provisioning, delegated administration, customer self-service, Active Directory synchronization, email signature management and automation should be considered alongside the Exchange SE migration.
Can MachPanel manage multi-tenant Exchange environments?
Yes. MachPanel provides multi-tenant management, provisioning, automation and self-service capabilities for Microsoft Exchange environments, including on-premises Exchange deployments.
Explore MachPanel for Microsoft Exchange
Ready to Plan Your Exchange SE Migration?
If your organization is still running Exchange 2016 or Exchange 2019, October 31, 2026 is no longer a date to watch. It is a date to plan around.
Whether you’re an enterprise, MSP, hosting provider or managed service provider, MachSol can help you assess your current Exchange environment and plan the transition to Exchange Server Subscription Edition.
👉 Book your Exchange migration assessment with MachSol
Official Microsoft Exchange Resources
For readers who want to verify lifecycle dates or review Microsoft’s technical migration guidance, these official resources provide additional information: