What happens on 14 October 2025
On 14 October 2025, extended support ends for Exchange Server 2016 and Exchange Server 2019. The date is set out in Microsoft’s lifecycle page for Exchange Server 2019; Exchange 2016 ends on the same day.
Your servers will keep running afterwards – mailboxes, calendars and Outlook will work on 15 October just as they did the day before. But in its announcement from April 2025, Microsoft is clear about what stops on that date:
- no security updates for newly discovered vulnerabilities,
- no bug fixes and no time zone updates,
- no technical support from Microsoft.
So far, Microsoft has explicitly ruled out extending the lifecycle. If you are still running Exchange 2016 or 2019 in the autumn, you are running a mail server whose security holes nobody will fix.
Why this matters so much for Exchange
Exchange is rarely a server that sits quietly on the internal network. For mobile mail, Outlook on the web (OWA) and remote access to work, many organisations make it reachable directly from the internet. Those very services have been the target of large-scale attack waves in recent years.
The scale of the problem is already visible today. In March 2024, Germany’s Federal Office for Information Security (BSI) reported (in German) that around 45,000 Exchange servers in Germany were openly reachable from the internet and at least 37 per cent of them were vulnerable to critical flaws – roughly 12 per cent were so outdated that no updates existed for them at all. There is no comparable public count for Austria, but the picture is unlikely to be very different.
For businesses, law firms and tax advisers there is a further point: mailboxes hold contracts, client correspondence and personal data. The GDPR requires appropriate technical safeguards that reflect the state of the art, and a server without security updates is hard to square with that. If you are unsure which obligations apply to you specifically, check with your legal adviser or professional body.
Your options
1. Exchange Online / Microsoft 365
Microsoft recommends moving fully to the cloud. Mailboxes then live in Exchange Online, Microsoft applies the updates itself, and you no longer run your own mail server. For most small and medium-sized businesses this is the simplest route. The main things to settle are licensing, where your data is stored, mailbox backup and sign-in security (multi-factor authentication). More on our Cloud & Microsoft 365 page.
2. Exchange Server Subscription Edition (SE)
If you need or want to keep email in-house, the successor is Exchange Server Subscription Edition. According to Microsoft it is due in July 2025 and will be technically very close to Exchange 2019 CU15. Three points from Microsoft’s upgrade guidance matter most:
- From Exchange 2019 (CU14 or later) you can upgrade in place on the same server – much like installing a cumulative update.
- From Exchange 2016 there is no direct upgrade. You need new servers, move the mailboxes across and then decommission the old server.
- Licensing: Exchange SE requires subscription licences, or server and client access licences with active Software Assurance. Buying once and using it for years is no longer an option.
As SE is expected only a few months before end of support, the window for the move is tight – especially if you are on Exchange 2016.
3. Hybrid
Many organisations use a mix: mailboxes sit in Exchange Online, but users are still managed in the on-premises Active Directory. That often means an Exchange server or the Exchange management tools remain on site. That server, too, needs to be on a supported version after 14 October 2025. For servers used purely for hybrid management, Microsoft continues to provide a free licence.
How to approach it now
Five months sounds like plenty, but it isn’t: ordering licences, providing new servers, moving mailboxes and reconnecting phones all take time – and none of it should clash with the summer holidays or year-end.
Checklist:
- Take stock: Exchange version and CU level, number and size of mailboxes, shared mailboxes and distribution lists
- Record dependencies: scanners and multifunction printers that send via SMTP, line-of-business software with mail integration, archiving
- Check exposure: are OWA or ActiveSync open to the internet? If so, lock them down until the move (current patches, access via VPN where possible)
- Decide on the target: Exchange Online, Exchange SE or hybrid
- Sort out licensing (Microsoft 365, or SE with Software Assurance)
- Make sure mailboxes are backed up before and after the migration
- Set a timeline with a buffer – aim to finish well before 14 October 2025
- Decommission the old server cleanly once the migration is done
A realistic plan for a smaller business: inventory and decision in June, licences and preparation in July, migration in August and September, old server retired by early October.
How IT United can help
We assess your current Exchange environment, set out the right option along with its ongoing costs, and carry out the migration including mailbox backup. If you choose the cloud, we also handle the move to Microsoft 365 and secure sign-in. Until then, we help you harden your existing servers (IT security) – and for law firms, with client confidentiality in mind.
Still running Exchange 2016 or 2019? Book a free initial consultation and we will work out together which route is achievable for your business before October.
