News

Microsoft Offers Support Extensions for Exchange 2016 and 2019

Microsoft has introduced a paid Extended Security Update (ESU) program for on-premises Exchange Server 2016 and 2019, offering a crucial safety cushion as both versions near their Oct. 14, 2025 end-of-support date.

The plan, announced by the Exchange Team this week, ensures organizations can continue receiving critical security updates beyond standard support periods. Available through volume licensing, ESU is aimed at customers who are in the midst of migrating either to the forthcoming Exchange Server Subscription Edition (SE) expected in late 2025 or to the cloud via Exchange Online. Microsoft emphasized that while this stopgap helps, long-term upgrades or migrations remain the preferred path

"With both Exchange 2016 and 2019 going out of support in October 2025, we have heard from some of our customers that they have started their migrations to Exchange Subscription Edition (SE) but might need a few extra months of Security Updates (SU) for their Exchange 2016 / 2019 servers while they are finalizing their migrations," said Microsoft.

Nearly a decade old, Exchange 2016 still hosts services in many enterprise environments, particularly on-premises or hybrid deployments. While migrating to Exchange 2019 or Exchange Online is the optimal path, ESUs aim to provide critical vulnerabilities are patched in the interim. Further, Microsoft has encouraged migration to cloud-based or newer on-premises systems, even offering free ESUs for Server 2008 running in Azure.

Per Microsoft:

This program is intended only for customers who are unable to finalize their migrations to Exchange SE before end of support lifecycle for Exchange 2016 / 2019, already use Exchange 2016 CU23 or Exchange 2019 CU14/CU15, and still need Critical and Important security coverage for the older servers still in operation.

About the Author

Chris Paoli (@ChrisPaoli5) is the associate editor for Converge360.

Featured

  • Microsoft Dismantles RedVDS Cybercrime Marketplace Linked to $40M in Phishing Fraud

    In a coordinated action spanning the United States and the United Kingdom, Microsoft’s Digital Crimes Unit (DCU) and international law enforcement collaborators have taken down RedVDS, a subscription based cybercrime platform tied to an estimated $40 million in fraud losses in the U.S. since March 2025.

  • Sound Wave Illustration

    CrowdStrike's Acquisition of SGNL Aims to Strengthen Identity Security

    CrowdStrike signs definitive agreement to purchase SGNL, an identity security specialist, in a deal valued at about $740 million.

  • Microsoft Acquires Osmos, Automating Data Engineering inside Fabric

    In a strategic move to reduce time-consuming manual data preparation, Microsoft has acquired Seattle-based startup Osmos, specializing in agentic AI for data engineering.

  • Linux Foundation Unites Major Tech Firms to Launch Agentic AI Foundation

    The Linux Foundation today announced the creation of a new collaborative initiative — the Agentic AI Foundation (AAIF) — bringing together major AI and cloud players such as Microsoft, OpenAI, Anthropic and other major tech companies.