Feature
The approaching end of extended support for Microsoft Exchange Server 2016 and 2019 on Oct. 14, 2025 marks a critical juncture for organizations relying on these platforms.
After this date, Microsoft will cease providing security updates, technical support and bug fixes, leaving systems vulnerable to cyber threats, compliance risks and operational inefficiencies. While the servers will remain operational, the absence of updates significantly heightens the risk of data breaches and service disruptions, particularly as unpatched vulnerabilities become prime targets for attackers.
What Options Do Microsoft Exchange Customers Have?
Organizations must now evaluate their options to ensure business continuity and security. Microsoft recommends migrating to either Exchange Online, part of Microsoft 365, or the upcoming Exchange Server Subscription Edition (SE), set to launch later in 2025. These options provide enhanced features, ongoing updates and robust security measures. Delayed action could expose businesses to security risks but also lead to potential non-compliance with regulations like GDPR or HIPAA. The transition is an opportunity for organizations to modernize their email infrastructure while mitigating future risks.
For most people the end of support, however, is principally a security issue.
At this stage, many organizations have already moved on from Exchange 2016 and 2019, but hold outs remain.
While most businesses have migrated to more modern servers, the nuanced requirements mean a small subset of mailboxes could still be on premises or on a legacy hybrid server architecture and have yet to decommissioned, ISG Director Jake Giffin told Reworked. As complicated as such a migration might be, he said organizations in this situation retire their outdated servers before the end of extended support to avoid unnecessary security risk.
Worth noting is a number of other Microsoft tools and applications will also be coming to an end-of-life at the same time, including Microsoft Office 2016, Microsoft Office 2019, Outlook 2016, Outlook 2019, Skype for Business 2016, Skype for Business 2019, Skype for Business Server 2015, Skype for Business Server 2019 and Windows 10.
A 5 Step Migration Process
Email remains a core application in the workplace, so unsecured email can open up a number of issues. Companies that still don’t have a plan in place have several progress steps to move to alternatives, Hubstaff CTO Alex Yarotsky told Reworked. Those measures include:
- Security policies: Organizations should focus on updating security policies, revisit the password protocol and ensure some form of multi-factor authentication is in place.
- Communicate: Inform the team well in advance. He says the entire process will be a steep learning curve and will require considerable adjustment for individual users. “By giving them visibility and advance notice they'll be more prepared to navigate the process,” Yarotsky said.
- Mobile work: People's mobile devices will also need to be reconfigured. He recommends creating documentation to teach users how to do this step themselves.
- Workforce options: Organizations then need to vet what options are best for the workforce. This may be a good time and opportunity to cut over to Google Workspace.
- Costs: Finally, look at the costs involved in migration and ensure enough resources are allocated to cover license costs for each individual user.
An Opportunity to Reevaluate Workplace Practices
The Exchange end of life is an opportunity to reevaluate your big picture strategy around on-premises Exchange, EnVista’s cloud architect Joe Jacir said. “This upgrade is a significant shift in how Exchange is supported and administered, and companies need to use this time to consider if on-premises email management is still a requirement or if a full move to the cloud is in order,” he said.
Jacir said a cloud-native approach could be a good move for companies upgrading from Exchange 2016/19, especially if they don't require syncing active directory identities into Microsoft Entra ID and no longer need to relay email for on-premises devices and software. In this case, a cloud native approach is probably ideal.
"If you're preparing for the upgrade from Exchange 2016/19 to the new version of Exchange coming out later in the year, it is important to keep in mind three things — your backups of Exchange and Active Directory, the potential resource footprint of on-premises Exchange and your options for licensing on-premises Exchange going forward," he said.
Failure rate can be high when upgrading Exchange, so test backups and make sure the organization is prepared to roll things back if necessary, he continued. The upgrade will change your active directory schema, so back up active directory ahead of time. Two other considerations will impact cost:
1. Memory Footprint
Memory footprint can be a big cost contributor in an upgrade. Exchange requires the installation of the mailbox management role, but if you don't need to manage your mailboxes on-premises, they can reduce their footprint and cost by reducing the memory size of the on-premises Exchange install significantly.
2. Licensing Options
He also advises organizations consider licensing options to align their choice with organizational and business needs. If mailboxes are in the cloud, and the organization is only using Exchange for management and internal relay, Jacir suggests a hybrid license may be your best option.
“Upgrades come with their own challenges, like high failure rates, impactful and long downtime and a high memory footprint,” he said. “Plan for downtime, especially in internal mail relay and if you have on-premises mailboxes, to reduce any negative impact on the business during the upgrade.”
As a final thought, Rajiv Taori, COO of Prowler, said businesses need to treat this migration as more than an IT project — it’s a security risk if not handled properly.
Conference
Sep
16
HR Tech Conference Las Vegas 2025
Register
Conference
Oct
27
Gartner HR Symposium/Xpo Orlando 2025
Register
Rushed transitions or misconfigurations, he said, can expose organizations to data breaches, phishing, and other cyber threats. A security-first approach is critical: assess risks upfront, enforce strong authentication and maintain continuous monitoring throughout the process. “Cybercriminals thrive on gaps in migration plans —companies that take proactive steps now will be the ones that stay resilient,” he said.