Most small offices moved their email to Microsoft 365 years ago and haven’t thought about it since. That’s a good place for it to be. This post is for the few that still run their own Exchange mail server, often a box in the comms cupboard that was set up a long time ago and that nobody wants to touch while it’s working.
What’s ending
Exchange Server 2016 and 2019 reached end of support on 14 October 2025, US time, according to Microsoft’s 2025 end of support list. Some businesses paid for Extended Security Updates to keep receiving fixes while they finished moving off.
That paid cover came in two blocks. The first ran from October 2025 to April 2026. In April the Exchange team announced a second period from the start of May to the end of October 2026, and said there would be no further extensions after that. Businesses had to buy the second period again, even if they’d paid for the first.
In July the Exchange team repeated the message: once October 2026 ends, there are no further updates for Exchange 2016 or 2019, even for businesses that paid for the second period.
So from November, an Exchange 2016 or 2019 server gets no security fixes at all.
Why a mail server is different
An old copy of Word on one PC is a risk to that PC. A mail server is different. It has to be reachable from the internet all day, because that’s how email arrives, and it holds every mailbox in the business. That combination is why an unpatched mail server deserves more urgency than almost anything else on an old software list.
There’s a practical problem too. Microsoft’s April post notes that Exchange Online can throttle or block email from on-premises Exchange servers that are well out of date. An unpatched server can end up with mail to Microsoft 365 users being slowed or refused.
Your own server or Microsoft 365?
Plenty of owners don’t know which one they have, and there’s no reason they should. A few quick ways to find out:
- Ask whoever looks after your IT: “Is our email in Exchange Online, or on our own Exchange server?” It’s a one-line answer.
- Sign in to Outlook on the web at outlook.office.com with your work email. If your mailbox and recent messages are there, your email is hosted in Microsoft 365.
- Look at what you pay for. If your users have Microsoft 365 plans that include email, and nobody is looking after a mail server for you, you’re very likely already in the cloud.
There’s also a third possibility: email hosted on an Exchange service run by a web or domain company. That isn’t your server, but it’s worth asking the provider what version they run and what their plan is for November.
What we’ve seen
Over the 12 months to 18 August 2026, our service desk logged 4 Exchange-related tickets across 4 businesses. None of them was about an on-premises Exchange server. One was a July 2026 move from a hosting company’s Exchange service into the client’s own Microsoft 365, which is exactly that third case.
What a move looks like for a small office
For most small businesses the destination is Exchange Online, part of Microsoft 365. Microsoft’s Exchange team also points businesses that must stay on-premises towards Exchange Server Subscription Edition. That’s a supported path, but it’s still a server you have to run and patch.
A move for a small office usually goes in this order:
- List every mailbox, shared mailbox and distribution list, and how much mail each one holds.
- Choose the Microsoft 365 plan for each person.
- Copy the mailboxes across while the old server keeps running.
- Switch the domain’s mail records to Microsoft 365, then set up Outlook and phones.
- Keep the old server read-only for a short while, then retire it properly, including its backups and the data on its disks.
The part that catches people out is what else talks to the old server. A scanner that sends scans by email, a line of business app that emails invoices, a website contact form. Find those first, or they’ll quietly stop working on the day you switch.
With about five weeks left, a small office can still do this properly. There isn’t much slack.
This week
Ask your IT provider which one you’re on. If the answer is “our own Exchange server”, ask for a written plan with a date before the end of October.
If you’re not sure who to ask, get in touch and we’ll help you find out.