If you still run Exchange Server 2016 or 2019 in your building, you're now running email on software Microsoft stopped patching. Support ended October 14, 2025. No more security fixes, no more bug fixes, no more technical support (Microsoft's end-of-support notice). The server still turns on and mail still flows, which is exactly why this gets ignored. It shouldn't be.
Here's the short version: move to Microsoft 365, or upgrade the box to Exchange Server Subscription Edition. Doing nothing is the one option that gets you breached.
By Joe Laboy. The NetSys Group has delivered managed IT, cybersecurity, and cloud services since 1998. Our engineers hold degrees in electrical and computer engineering and are certified Microsoft and Cisco instructors, serving businesses across NY, NJ, CT, PA, and Southwest Florida.
What "end of support" actually means for your email
After October 14, 2025, Microsoft no longer ships security updates for Exchange 2016 or 2019. When a new vulnerability turns up in that codebase, and one will, there's no patch coming. Your mail server sits on the public internet with a known hole and no fix.
That's not a hypothetical. Exchange has been one of the most attacked pieces of business software of the last five years. Unpatched on-premises Exchange servers were the entry point for some of the biggest ransomware and email-theft campaigns since 2021. An unsupported server is a bigger target, not a smaller one.
Microsoft's own guidance is blunt. Your install "continues to run," but they "strongly recommend that you migrate from those versions as soon as possible."
Do I have to do anything if my email still works?
Yes. A working server and a supported server are not the same thing. Unsupported Exchange loses security patches, bug fixes, technical support, and time zone updates. The risk is invisible right up until a vulnerability drops and you're the one still exposed. Cyber insurance and compliance rules also increasingly treat unsupported software as an unacceptable risk, which can affect a claim.
Option 1: Move to Microsoft 365 (what most SMBs should do)
For most small and mid-sized businesses, the answer is to retire the on-premises server and move mailboxes to Exchange Online in Microsoft 365. No more patching a server, no more worrying about the next Exchange zero-day, no more hardware refresh every few years.
Microsoft supports a few migration paths depending on your size and setup: cutover migration for smaller organizations, and minimal or full hybrid migration for larger or more complex ones. Once mailboxes and public folders are moved, you decommission the old Exchange servers.
One trap to know about. If you use Microsoft Entra Connect to sync your on-premises Active Directory identities to the cloud, you're technically expected to keep at least one Exchange server for management, or move that identity management fully to the cloud. This is the part that catches teams who thought they were "done" after moving mailboxes. It's worth planning with someone who's done it before. Our Azure and Microsoft 365 migration team handles this end to end.
Option 2: Upgrade to Exchange Server Subscription Edition
Some businesses have a real reason to keep email on-premises: strict data-residency rules, an industry regulator, or an application that depends on a local Exchange server. For them, Microsoft's replacement is Exchange Server Subscription Edition (SE), the version that stays supported.
The upgrade path depends on what you're on now. Exchange 2019 servers that are fully patched can be upgraded to Exchange SE in place. Exchange 2016 can't upgrade directly; you introduce an Exchange SE server into the organization and migrate to it, then retire the 2016 boxes.
Exchange SE is a subscription, so it carries an ongoing licensing cost and still needs the server, the patching, and the maintenance that come with running your own mail infrastructure. For most SMBs that's more work and more risk than moving to the cloud. But the option exists, and for some regulated shops it's the right call.
What happens if I just leave it running?
You keep operating on borrowed time. The moment the next Exchange vulnerability is published, your server is exposed with no patch and no vendor support. Recovery from a mail-server compromise is expensive and slow, and it usually forces the migration you were avoiding, only now under crisis conditions with attackers already inside.
Running unsupported email software is also the kind of finding that shows up in a security assessment or a cyber-insurance renewal. It's a gap that's cheap to close on your schedule and painful to close on someone else's.
How long does an Exchange migration take?
For a typical small business, a move to Microsoft 365 runs a few weeks end to end: planning and mailbox sizing, the actual migration (often over a weekend or in batches to limit disruption), then decommissioning the old server and cleaning up DNS and mail flow. The complexity lives in the details, public folders, shared mailboxes, connectors, and identity sync, which is where a rushed self-service move tends to break. Plan it now, on your terms, rather than after an incident. Learn how our managed IT services handle migrations like this.
If you're weighing this alongside other aging infrastructure, our guide on the Windows Server 2016 end of support covers the same decision for your file and application servers, and our cloud migration FAQ walks through what moving to the cloud actually involves.
Frequently asked questions
When did Exchange Server 2016 and 2019 reach end of support?
Both reached end of support on October 14, 2025. After that date, Microsoft no longer provides security updates, bug fixes, technical support, or time zone updates for either version, though the servers keep running until you migrate.
Is Exchange Online the same as Microsoft 365?
Exchange Online is the cloud email service inside Microsoft 365. When you move mailboxes off an on-premises Exchange server, they land in Exchange Online, which Microsoft hosts, patches, and secures. Most Microsoft 365 business plans include it, so there's usually no separate email product to buy.
Can I keep running Exchange on-premises after end of support?
Only if you upgrade to Exchange Server Subscription Edition, the supported on-premises version. Staying on 2016 or 2019 means running email with no security patches, which is a serious risk. If you have a genuine reason to stay on-premises, SE is the path; otherwise moving to the cloud is simpler and safer.
Will an old Exchange server fail my cyber insurance or compliance audit?
It can. Unsupported software is a common finding in security assessments and cyber-insurance questionnaires, and some policies can deny or reduce a claim tied to a known-unpatched system. Retiring or upgrading Exchange removes that liability before a renewal or audit forces the issue.
What's the difference between a cutover and a hybrid migration?
A cutover migration moves all mailboxes to Microsoft 365 at once and suits smaller organizations. A hybrid migration links on-premises Exchange and the cloud so you can move mailboxes in stages and keep some services local, which fits larger or more complex environments. The right choice depends on your size, identity setup, and tolerance for downtime.
Get ahead of it
Exchange end of support is a deadline that already passed, and every month you wait adds risk without adding value. Whether the right move is Microsoft 365 or Exchange SE, the safest time to do it is on a plan, not in a panic. Contact The NetSys Group for a complimentary assessment of your Exchange environment and a migration plan that fits your business.
Turn insight into action.
Take a free cybersecurity or AI readiness assessment, or book a call with a NetSys engineer — no obligation, no runaround.