This article was written with the help of AI. An AI assistant drafted it; we checked every date and claim against Microsoft's own pages, corrected what was wrong, and edited the rest. Sources are linked throughout and listed at the end.
Your Exchange server can look perfectly healthy. Outlook opens, the scanner sends its daily report, the shared calendar takes bookings. None of that means the server is supported, and for Exchange Server 2019 it no longer is.
Microsoft ended mainstream support for Exchange Server 2019 on January 9, 2024, and extended support on October 14, 2025, according to its Exchange Server 2019 lifecycle page. Since then, the only security fixes have come through a paid Extended Security Update (ESU) program, and that program is now over.
The Last Security Update Has Already Shipped
Microsoft sold Exchange 2016 and 2019 ESU in two six-month periods. Period 1 ran from October 2025 to April 2026. In April 2026 Microsoft announced Period 2, from the start of May through the end of October 2026, and said plainly: "There will be no further extensions of this program after that."
On October 13, 2026, the Exchange team released the October 2026 security updates and called them the final set for Exchange 2016 and 2019. From November on:
- Security updates are released for Exchange Server Subscription Edition (SE) only.
- Microsoft's update announcements and vulnerability notices stop mentioning Exchange 2016 and 2019. In Microsoft's words, that "does not mean that those versions are not vulnerable to future security issues."
- Microsoft stops testing Exchange 2016 and 2019 for vulnerabilities.
So the question for 2027 is not whether to renew ESU. There is nothing left to renew. It is how long you are willing to run an internet-facing mail server that will never be patched again, and what replaces it.
Keep It Patched Until You Move
Unsupported does not mean you stop maintaining it. Install the October 2026 Exchange update if you are entitled to it, and keep Windows Server patched.
One current problem to know about: Microsoft has warned that Exchange servers may become unstable after installing the October 2026 Windows updates (KB5133432). It affects Exchange SE, 2019 and 2016 on Windows Server 2016 through 2025. Symptoms include Outlook on the web failing to connect, mail queues growing through the day, and database availability group members losing contact with each other. Microsoft says not to uninstall the Windows update and gives a registry setting as a workaround. Have whoever runs your server follow that article exactly rather than guessing.
Your Real Options
Option 1: Move to Exchange Online (Microsoft 365)
For most small businesses this is the right answer. Microsoft runs the mail servers and patches them; there is no server in your closet to keep alive. Microsoft's October notice points out that Exchange Online customers were already protected from the vulnerabilities those final updates fixed.
It is still a real project. A typical move includes:
- Mapping user, shared, room and resource mailboxes, groups and contacts
- DNS, connector and mail-flow changes
- Reviewing licenses and who has access to what
- Testing scanners, printers and applications that send or read mail
- Checking archives, retention and search
- A pilot, the cutover, and support for staff afterward
Microsoft runs the platform. You still own the decisions about accounts, access, retention and the other systems that touch mail. Once you are there, our Microsoft 365 security checklist covers the settings to lock down first.
Option 2: Upgrade in place to Exchange Server SE
If you need mail to stay on your own server, Microsoft's supported on-premises version is Exchange Server Subscription Edition (SE), released July 1, 2025. Microsoft recommends upgrading Exchange 2019 CU14 or CU15 servers to SE in place, and describes SE's first release as having no major changes from 2019 CU15. Older 2019 builds have to reach CU14 or CU15 first.
This keeps you supported, but you are still running, patching, backing up and watching a mail server, now on a subscription license. Get the licensing cost in writing from whoever handles your Microsoft agreement before choosing this path.
Staying on Exchange 2019 is not an option to plan around
Mail will keep flowing. But every Exchange vulnerability found from now on stays open on your server for good, and Microsoft will not even say whether Exchange 2019 is affected. If you cannot finish a move right away, treat the old server as temporary: a written move date, a budget, and an owner for the project.
| Question | Exchange Online | Exchange Server SE |
|---|---|---|
| Where does mail run? | Microsoft's data centers | Your own server |
| Who patches it? | Microsoft | You or your IT provider |
| Main work | Mailbox migration, DNS, repointing devices and apps | In-place upgrade, then ongoing server upkeep |
| What drives the cost? | Per-user licenses and migration labor | Subscription licensing, hardware, backups and admin time |
Migration Readiness Checklist
Start with what depends on the server, not the number of mailboxes. A manufacturer in Stark County may have a shop-floor scanner emailing production reports. An Akron office may book rooms through resource mailboxes. A Cleveland medical practice may need years of retained mail to stay searchable.
1. Inventory the mail
- User, shared, room and resource mailboxes
- Distribution lists, contacts and mail-enabled groups
- Public folders still in use
- Service accounts and vendor or guest accounts
- Archive mailboxes and anything kept for compliance
- Every email address and alias the business still uses
Write down what each one is for. A shared mailbox that looks unused often turns out to be a scanner's destination or an old archive someone still needs.
2. Find every device and application that uses Exchange
- Scanners and multifunction printers
- Accounting, time-clock, point-of-sale and production software
- Backup appliances and archiving tools
- Scripts, macros, Outlook add-ins and automated flows
- Anything that signs in with old-style username-and-password mail connections
Check the Exchange logs, firewall rules, printer settings and your software list. Each item needs an owner and a test.
3. Decide what success looks like
Before anyone moves, agree on what must work afterward:
- Sending, receiving and searching mail, including old mail
- Shared mailboxes, calendars and room bookings
- Phones and tablets
- Scanner and application mail
- Archive access
4. Pilot, then move in stages
Move a small group first, including the hard cases, not just the easiest mailboxes. Freeze unnecessary changes before cutover. Change DNS and connectors only after the new path passes testing. Keep the old server available through an agreed fallback period; some integrations only show up when the next department starts its normal week.
5. Retire the old server on purpose
After the fallback period, remove the old DNS records, firewall rules, accounts and licenses, and document the final setup. Do not leave a forgotten Exchange server running on your network.
Budget It Line by Line
Ask for separate cost lines so nothing hides inside one number:
- Microsoft 365 or Exchange SE licensing
- Migration labor
- Fixing or replacing applications that depend on the old server
- Archive work
- Training and cutover-day support
If you are weighing a broader move to the cloud at the same time, our cloud migration guide covers costs and timelines.
Questions Owners Ask
- Will our Exchange 2019 server stop working?
- No. Mail keeps flowing. What stops is the fixing: after October 2026 Microsoft releases no more security updates for Exchange 2019, even to customers who paid for Extended Security Updates, and it no longer tests Exchange 2019 for new vulnerabilities.
- Can we buy more Extended Security Updates for 2027?
- No. Microsoft ran two six-month ESU periods, October 2025 to April 2026 and May to October 2026, and said there will be no further extensions. Buying Period 2 now only gets you current through the October 2026 release.
- Does moving to Exchange Online fix our scanners and other connected systems?
- No. Exchange Online replaces the mail server, not the settings stored in your scanners, apps and scripts. Each one has to be found, repointed and tested as part of the move.
- Do we have to move every mailbox on the same day?
- Usually not. A small pilot group first, then the rest in batches, finds problems while they are still small. The right grouping depends on your applications, not just the number of mailboxes.
- What happens to the old server after the move?
- Keep it until the new setup has passed testing and the agreed fallback period is over. Then retire it on purpose: remove its DNS records, firewall rules, accounts and licenses, and document what changed.
Our Recommendation
A mail move does not have to be a panicked weekend. It does need a decision, and the ESU safety net is gone. Inventory everything that touches Exchange, choose between Exchange Online and Exchange SE, pilot it, and set a date. For most small businesses we work with, the answer is Exchange Online, and we handle that move through our Microsoft 365 migration service.
Sources
- Microsoft Lifecycle: Exchange Server 2019
- Exchange Team Blog: Announcing Period 2 Exchange 2016/2019 Extended Security Update (ESU) program (April 15, 2026, updated October 13, 2026)
- Exchange Team Blog: Released: October 2026 Exchange Server Security Updates (October 13, 2026)
- Microsoft Support KB5133432: Exchange servers may become unstable after installation of October 2026 Windows updates
- Exchange Team Blog: Exchange Server Subscription Edition (SE) is now available (July 1, 2025)
