Exchange 2016 Is Out of Support. Upgrade to Exchange SE or Move to Exchange Online?

Exchange Server 2016 and 2019 left support on October 14, 2025. Microsoft's first paid security-update window closed on April 14, 2026, and a final Period 2 program now runs only to the end of October 2026, sold through Enterprise Agreements with no further extension. For most small and mid-size companies, that means mail on either version today is an unpatched, internet-facing server holding your company's most subpoenaed data. You have two real options: move the mailboxes to Exchange Online, or move to Exchange Server SE. Doing nothing is the third option, and it is how breach stories start.

Where you actually stand

The dates matter because they change your risk math:

• October 14, 2025: Exchange 2016 and 2019 end of support. No more security updates on the normal channel.
• April 14, 2026: the first paid extended-security window ended. A final Period 2 program, sold only through Enterprise Agreements, runs to the end of October 2026, and Microsoft states plainly there will be no further extensions. After that, every new vulnerability stays open on your server.
• H1 2027 (targeted): Exchange Server SE CU2 is planned to refuse installation while any Exchange 2016 or 2019 server remains in the organization. That is the effective decommission deadline for the old versions.

Exchange has been the front door for some of the most damaging attacks of the last five years. Running it unpatched is a decision with a price attached, and what a breach actually bills a small company is that price.

Option one: move to Exchange Online

Consider Exchange Online when: the workload, integration, data-location and operating requirements fit the service. Seat count alone does not decide the destination. Confirm relay, recipient management, archives, public folders and recovery requirements before choosing the route.

• You may already own the licenses. Microsoft 365 Business Premium and E3 include Exchange Online. Many companies paying for those plans are running an on-prem Exchange server out of habit, paying twice for mail.
• Patching stops being your problem. No more security update weekends, certificate renewals, or backup testing for the mail role.
• The route is known. Mailbox moves, coexistence, and cutover are a well-worn path with a tested rollback at every step.

The honest costs: per-user subscription pricing for as long as you operate, and any printers, scanners, or line-of-business apps that relay mail through the server will need their SMTP path rebuilt. Both are knowable before you commit.

Option two: upgrade to Exchange Server SE

Exchange Server SE (Subscription Edition) shipped in July 2025 and is the only supported on-premises Exchange going forward. Three things to understand before choosing it:

• It is subscription licensed. Server and user licenses require active subscription coverage. The era of buying Exchange once and running it for a decade is over.
• It follows the Modern Lifecycle. There is no fixed end-of-support date anymore, which sounds good until you read the fine print: you are required to stay current with updates to stay supported. The patch treadmill is the product.
• There is no in-place upgrade from 2016. In-place upgrade to SE exists from Exchange 2019 only. From 2016, you build new servers and move every mailbox anyway.

That last point is the one most 2016 shops miss: if you are on Exchange 2016, both roads are migration projects. The effort of moving to SE and the effort of moving to Exchange Online are closer than the marketing suggests. The only question is the destination, so choose it on requirements, and that means the decision deserves ten minutes of honesty rather than a default.

Four traps that turn this into a rescue job

• Treating SE as the free option. Subscription licensing plus server hardware plus your time patching, renewing certificates, and testing backups is a real annual number. Put it next to the per-user math before deciding: the five-year arithmetic for owning a server versus renting the cloud equivalent works the same way for mail as it does for files.
• Migrating out from under holds, journaling, or an archive. Litigation holds have to be re-established in Exchange Online before the source retires, or you have broken preservation in the middle of a legal matter. Exchange Online cannot journal to one of its own mailboxes, so an existing journaling requirement needs a new destination. And a third-party archive such as Enterprise Vault leaves stubs in every mailbox that must be rehydrated or migrated with dedicated tooling. Any one of these turns a weekend cutover into a phased project.
• Decommissioning in the wrong order. Mail flow, autodiscover, and directory sync dependencies have to be unwound deliberately. Shutting the old server down before the sequence is verified is how mail silently stops.
• The last server question. If you sync identities from Active Directory, you may still need an Exchange management presence after every mailbox is in the cloud, because recipient attributes are edited on the directory side and synced up. Decide what happens to that server while the migration is still being planned. Discovering the dependency after the decommission means rebuilding what you just removed.

The honest decision checklist

Consider Exchange Online when: the workload, integration, data-location and operating requirements fit the service. Seat count alone does not decide the destination. Confirm relay, recipient management, archives, public folders and recovery requirements before choosing the route.

Stay on premises with Exchange SE only if: a regulator or data residency requirement names where mail must live, you run applications with hard on-premises mail dependencies that cannot be relayed, and you have staff who apply updates monthly without being reminded.

If you read both lists and the first one described you, you have your answer, and it is the one most consultants who sell servers will not lead with.

What the move costs, fixed

Straightforward Exchange Online migrations are delivered as one all-in package at a price agreed before any work begins. That single price covers the planning, the move, the validation and the handover: there is no separate readiness assessment to buy first.

A standard-scope cutover is the case that can be priced from a conversation rather than a paid review. Standard scope means all of the following:

• Exchange 2016 or newer
• Under 1 TB of mail, counting archives
• No mailbox over 100 GB
• No public folders
• No compliance holds or journaling requirement
• No third-party archive such as Enterprise Vault
• A single scheduled cutover, with no coexistence period

Miss any one of those and the environment is complex, which means a fixed implementation price would be guesswork. Those start with a separate planning engagement: the Migration & Cutover Plan counts every mailbox and archive, dates the batches and the cutover, maps the mail flow and the DNS records the old server quietly owns, writes the rollback rules before anyone needs them, and hands you a reconciliation sheet with the agreed checks and explicit exceptions. That plan is a fixed price agreed once scoped and runs about 15 business days. The implementation is then quoted from the completed plan. The planning fee is billed separately and is not credited against the move. The scope, how you know it is finished, and what the client owns are set out on the Exchange Server Exit & Cutover page, or talk through the problem and get a reply within one business day, carrying a fixed price where the scope is already clear.