Exchange Server 2013 left support in April 2023. Exchange 2016 and 2019 followed on October 14, 2025. The replacement is Exchange Server Subscription Edition, usually shortened to Exchange SE. If you still run one of the older versions, you are on software that no longer receives security updates, on a product that attackers scan for constantly.
This post explains what changed, what Exchange SE actually is, and how to choose between staying on-prem and moving mail to Microsoft 365.
What end of support means in practice
Out of support means no more security patches, no cumulative updates, and no support case if it breaks. The software keeps running. The problem is that Exchange is exposed to the internet by design, and every new vulnerability found in the code base is unpatched forever on your version. Cyber insurers ask about this on renewal, and compliance frameworks treat unsupported internet-facing servers as a finding.
There is a second, quieter consequence. Microsoft's hybrid tooling and Exchange Online connectors are tested against supported versions. Over time, an old server struggles to run the current Hybrid Configuration Wizard or negotiate TLS with Exchange Online. Waiting makes the migration harder.
Get-ExchangeServer | Format-Table Name, AdminDisplayVersion, ServerRole
Get-Command ExSetup.exe | ForEach-Object { $_.FileVersionInfo.ProductVersion }What Exchange Server SE is
Exchange SE is the on-prem successor to 2019. The first release is very close to Exchange 2019 with the latest cumulative update: same system requirements, same architecture, same administration. The differences are in licensing and lifecycle. There is no perpetual license. You need server and client access licenses covered by an active subscription or Software Assurance, or a cloud subscription that includes on-prem rights, and you must stay on a current build to remain supported.
The intended path is that you upgrade a 2019 server in place to SE, the same way you would apply a cumulative update, and then keep applying SE updates on a rolling basis. Exchange 2016 does not support in-place upgrade to SE. From 2016 you install a new SE server, move mailboxes, and remove the old one, which is the classic legacy upgrade.
Microsoft has said that later SE cumulative updates will drop coexistence with 2016 and 2019. That gives a clear message: get everything off the old versions, then move forward with SE.
- Exchange 2019 on the latest CU: in-place upgrade to SE.
- Exchange 2016: new SE server, mailbox moves, decommission.
- Exchange 2013: not supported for coexistence with SE, so upgrade to 2019 first or migrate to Exchange Online.
- Every route: Windows Server and .NET at supported versions, third-party certificates renewed, backups tested before you start.
Stay on-prem or move to Exchange Online
For most small and mid-size companies, the honest answer is Exchange Online. The reasons are operational. An on-prem server needs patching within days of each release, a public certificate renewed on schedule, backups that can restore a database, a tight firewall rule set, and someone who knows what to do when the transport queue fills at 2 a.m. Exchange Online removes all of that.
There are real reasons to stay. Regulatory requirements that mail never leave a specific country or facility. Applications that depend on MAPI or on-prem transport agents and cannot be changed. Sites with unreliable internet where local mail delivery matters. If one of those applies, SE is a fine product and the upgrade from 2019 is an easy afternoon.
What does not hold up any more is staying on-prem because it seems cheaper. Count the subscription licensing, hardware refresh, backup licenses, certificate and labor, and the difference usually goes the other way.
The hybrid middle ground
Many organizations end up with one Exchange server left on-prem after moving mailboxes to the cloud, because Entra Connect still syncs Active Directory and Exchange attributes have to be managed somewhere. That last server also needs to be supported, which means it too has to become SE or be replaced with the management tools only approach that Microsoft added in Exchange 2019 CU12.
If you are planning the move to Exchange Online, build the end state into the plan: either upgrade the last server to SE and keep it as a management and relay host, or use the management tools install and remove the server entirely.
A short decision list
Work through these in order.
- Is there a legal or technical reason mail cannot live in Microsoft's data centers? If not, plan for Exchange Online.
- Do you already pay for Microsoft 365 licenses that include Exchange Online? Then you are paying twice today.
- Are you on 2019? Upgrade to SE now regardless, so the migration runs from a supported server.
- Are you on 2016 or 2013? Do not build a new on-prem server as a stopgap unless you are staying on-prem for years.
- Whatever you choose, patch to the latest available update this week.
Frequently asked questions
Can I upgrade Exchange 2016 directly to SE?
Not in place. Install SE on a new server alongside 2016, move the mailboxes and connectors, then remove the 2016 server. It is the same process as a 2016 to 2019 upgrade.
Does Exchange SE require a subscription even for a hybrid-only server?
The licensing terms for a hybrid or management-only server are set by Microsoft and have changed between versions. Check the current terms in the Hybrid Configuration Wizard and Microsoft's licensing documentation rather than assuming the free hybrid key still applies.
Is Exchange 2019 still safe to run if I patch it?
There are no new patches after October 2025, so any vulnerability found after that date stays open. Apply every existing update, restrict internet exposure, and treat it as a migration deadline rather than a steady state.
Takeaway
End of support is a forcing function, not a surprise. If you have a reason to stay on-prem, Exchange SE is the way to do it and the 2019 upgrade is easy. If you do not, this is the moment to move to Exchange Online and stop maintaining a server that the internet is constantly probing.