Exchange Server SE or Exchange Online?
The in-place upgrade is narrower than it sounds.

Exchange Server 2016 and Exchange Server 2019 left support on October 14, 2025. Microsoft then created two paid Extended Security Update periods, and the second one ended with October 2026. On October 13, 2026, Microsoft released the final security updates for both versions, covering Exchange 2019 CU14 and CU15 and Exchange 2016 CU23, available only to organizations enrolled in the Period 2 program. The same announcement set out what happens next.

“After October 2026: Updates will be released for Exchange Subscription Edition (SE) only. Our update announcements and any CVEs released by MSRC will stop mentioning Exchange 2016 and 2019. This does not mean that those versions are not vulnerable to future security issues. We will stop testing Exchange 2016 and 2019 for vulnerabilities.”

Microsoft Exchange Team Blog, October 13, 2026

The last two sentences are the ones to read twice. When a future Microsoft advisory names only Exchange Server SE, the question for a 2016 or 2019 server stays open, because Microsoft has stopped testing those versions. An advisory that leaves your version out reflects where Microsoft looked.

Microsoft is keeping the Period 2 purchase open for a limited time, and it is precise about what that buys: “that will only get you current with security updates through this October 2026 release.” It catches a server up to the last update and stops there. The Exchange team had already ruled out a further extension in July.

“There will be no further extension of Exchange 2016/2019 ESU program timeline. Once October 2026 ends, there will be no further updates for Exchange 2016/2019, even if you currently have a Period 2 ESU.”

Microsoft Exchange Team Blog, July 20, 2026

Your servers keep running. Mail keeps flowing. What changed is that the vendor has stopped issuing fixes for the software and stopped testing it, which moves the exposure onto your own compensating controls and onto whatever your examiners, auditors, and insurers expect you to say about it. For a credit union, a bank, or a mortgage company, an internet-facing mail server with no remaining patch path is a question you will be asked.

Microsoft names two supported destinations: Exchange Server Subscription Edition on-premises, or Exchange Online inside Microsoft 365. With the October release, Microsoft noted that “Exchange Online customers are already protected from the vulnerabilities addressed by these SUs”. This page compares the two destinations, including the cases where staying on-premises is the right answer.

The headline that travelled furthest about Exchange Server SE is that you can upgrade to it in place, like installing a cumulative update, rather than migrating. That is accurate. The in-place upgrade is described as “identical to installing a CU”. In Microsoft’s own words Exchange SE RTM is “a branding update that introduces new lifecycle and support policies”, with no changes to server roles, editions, or prerequisites.

The part that travelled less far is who it applies to. Microsoft Learn states the boundary in one sentence.

“Legacy upgrades are necessary when moving from Exchange Server 2016 to Exchange Server 2019 or to Exchange Server SE, as well as when switching to new hardware or a newer version of Windows Server.”

Microsoft Learn, Upgrading to Exchange Server Subscription Edition

Read as a checklist, that gives three conditions. You qualify for the in-place upgrade only if all three hold.

If all three hold, Exchange Server SE is a straightforward upgrade and a sound choice. Move to the current cumulative update, run Setup, and you are on a supported version. That is a good outcome and it is available.

If any one of them does not hold, keep reading, because the shape of your project just changed.

“This method involves transitioning to a new major version of Exchange Server by adding the newer server to the organization, migrating all mailboxes and resources from existing servers to the new servers, and then uninstalling the previous servers.”

Microsoft Learn, describing a legacy upgrade

Stand up a new server. Move every mailbox. Decommission the old one. That is a mailbox migration project with a server build in front of it.

Compare that to what a move to Exchange Online asks of you: move every mailbox. The mailbox migration is common to both. What differs is everything on either side of it, and on the on-premises path you also design, license, build, secure, and then keep patching a mail server that faces the internet.

This is the pivot in the decision, and it is why so much of the published guidance feels like it is answering a different question than the one you have. Most of it compares an in-place upgrade against a cloud migration, which is a fair comparison for an Exchange 2019 shop staying on its hardware. If you are on Exchange 2016, yours is a migration against a migration, and the question becomes which destination you want to be running in five years.

Microsoft’s own current guidance for organizations in this position is to skip the intermediate hop entirely: “you should not be installing new Exchange 2019 servers into your organization as a part of your upgrade to Exchange SE” because both 2016 and 2019 are already out of support, and “It is a best practice to migrate directly to Exchange SE.” If you find older advice telling Exchange 2016 shops to move to Exchange 2019 first, it predates the October 2025 end of support and Microsoft has moved past it.

Exchange Server SE is licensed on what Microsoft calls an entitlement-based model, and the obligation is continuous rather than one-time.

“Customers must maintain an active qualifying entitlement to install, run, and stay current with Exchange Server SE. That entitlement can come from one of the following: Active Software Assurance (SA) on existing Exchange Server Standard or Enterprise licenses. A qualifying Microsoft 365 subscription (such as Microsoft 365 E3 or E5) acquired through an Enterprise Agreement and including on-premises server-use rights.”

Microsoft, Exchange licensing FAQ

Read that second bullet carefully, because on its own it is narrower than Microsoft’s actual position and the correction sits a few lines further down the same page: “Extended Use Rights provide licenses to run on-premises Exchange Server SE, depending on your licensing program. They are not limited to Enterprise Agreements or Enterprise Agreement Subscriptions. Other programs such as Open License and Open Value may also include these rights.” Microsoft’s instruction is to check the Product Terms for your own program, and which program you buy under is exactly the sort of thing organizations are unsure about. The same check applies to Microsoft 365 bought through a Cloud Solution Provider, ABT included: confirm in the Product Terms that your subscription carries the on-premises server rights before you plan an Exchange Server SE build. Establishing it is part of the assessment below.

Client Access Licenses sit on top of that, and they carry the same condition. Microsoft: a Standard CAL “is always required”, an Enterprise CAL is an add-on “required for advanced features”, and “CALs must also be covered by active SA or by an equivalent qualifying Microsoft 365 subscription.” Letting any of it lapse has a stated consequence: “Maintaining active SA or a qualifying subscription is required to continue using Exchange Server SE and to receive ongoing cumulative updates.”

There is no partial-coverage version of this, and Microsoft closed that door explicitly.

“Important: Extended Use Rights apply only to users licensed with qualifying Microsoft 365 subscriptions. For example, you can’t license a single E3/E5 user and then run Exchange Server SE for additional unlicensed users. Every user accessing Exchange Server SE must have a qualifying license.”

Microsoft, Exchange licensing FAQ

Now put that beside one more line from the same Microsoft page, because the two of them together are the part almost nobody prices out before choosing.

“Exchange Online Plan 1 and Plan 2 licenses provide Client Access License (CAL) equivalency for Exchange Server SE on-premises servers. This means users licensed with Exchange Online Plan 1 or Plan 2 can access Exchange Server SE without needing separate CALs.”

Microsoft, Exchange licensing FAQ

Two different requirements are in play there and it is worth keeping them apart, because conflating them is how licensing plans go wrong. CAL equivalency answers only the CLIENT side: an Exchange Online Plan 1 or Plan 2 license means that user does not also need a separate CAL. It does not, on its own, give you the right to install and run the server. That right is the separate SERVER entitlement above, satisfied by active Software Assurance or by a qualifying Microsoft 365 subscription carrying on-premises server-use rights.

Where the two meet is the route worth noticing. Microsoft 365 E3 and E5 are named by Microsoft as qualifying for the server entitlement, and they also include a cloud mailbox. So an organization taking that route is buying, for every user, a subscription that already contains the thing it is choosing to run on-premises instead. That is a legitimate way to be compliant and plenty of organizations will choose it, often because they already hold the licenses. It is simply worth going in with your eyes open: on that route the cloud mailbox is not what you are avoiding by staying on-premises, it is part of what you are buying in order to stay there.

The other route, Software Assurance on Exchange Server licenses and CALs, avoids that overlap and is often the better arithmetic for an organization with no appetite for Microsoft 365 subscriptions. Which one lands cheaper depends entirely on what you already own, how many users you have, and which CAL tier your feature set actually needs.

There are no prices on this page. Microsoft’s licensing FAQ states that “Pricing for Exchange Server SE and related licenses is not published directly in the FAQ” and refers you to your Microsoft account representative or official Microsoft licensing resources. Your actual number depends on your agreement, so a figure quoted on any vendor page is an estimate against somebody else’s terms, and it goes stale quietly. Working out the real number against your actual license position is the first thing ABT does in the assessment below.

For years the practical blocker to fully leaving on-premises Exchange was recipient management. If your identities sync from Active Directory, certain mailbox attributes were managed from an Exchange server, so organizations kept one running purely to hold the management tools. Microsoft addressed this alongside the SE release.

“you will be able to use PowerShell and the Exchange Management Tools to manage your recipients without the need for a running Exchange Server, thereby obviating the need for any Hybrid licenses.”

Microsoft Exchange Team Blog

That removes the most common reason for the last server. Some reasons remain, and the same Microsoft passage is careful about the boundary: the free hybrid license “is for the purposes of recipient management only. If you host mailboxes, need an Edge Transport or SMTP relay server on-premises, you still need an Exchange Server license.”

So the hybrid server is now a choice. If yours exists only to manage recipients, Microsoft says you can retire it. If it also relays mail from a line-of-business application, a scanner fleet, or a loan origination system, that requirement is real and it needs designing, because those relay paths are usually older than anyone still working there.

One more change worth knowing if you are counting on the free hybrid license: it now carries a maintenance condition. Microsoft notes that “unlike previous versions, you will need to either purchase SA for this license to get Exchange Server updates or have a cloud subscription license that satisfies the requirements.” The license is still free. Keeping it patched carries a condition.

Exchange versions have historically been able to coexist in one organization, including unsupported ones. Microsoft is ending that on a published schedule, and the cut-off now arrives with Exchange Server SE CU3.

Microsoft updated its release table on October 27, 2026, adding Exchange Server SE CU3 and moving the coexistence block to it. Exchange Server SE CU1, in the second half of calendar year 2026, and CU2, in the first half of calendar year 2027, both keep coexistence with 2016 and 2019 possible. CU3, listed for H1 / H2 CY 2027, is the release that ends it. Microsoft’s release table records it as: “No coexistence with Exchange 2013, Exchange 2016, or Exchange 2019 (installation blocked by CU3 Setup)”. Coverage written before October 27, 2026, including earlier versions of this page, names CU2 as the cut-off, because that was Microsoft’s schedule until then. The guidance beside the table is blunter still.

“to install Exchange SE CU3 (or later) you will have to first decommission and remove all older versions of Exchange Server from your organization.”

Microsoft Exchange Team Blog, updated October 27, 2026

Consider what that means for a common plan. An organization on Exchange 2016 stands up an Exchange SE server, moves the mailboxes it has time to move, and leaves the old server running for the awkward remainder: the shared mailboxes nobody owns, the public folders, the application that authenticates against it. The new server is current and the old one is still in the organization. Then CU3 arrives, Setup refuses to install while Exchange 2016 is still there, and the choice becomes finishing the decommission under time pressure or skipping a cumulative update on the product whose entire support model is built on staying current.

The block now sits one release later, and that time is best spent on the decommission. Microsoft’s own instruction reads: “Decommission Exchange 2016 before Exchange SE CU3.” Build it into the project plan from the start. This applies to the on-premises path specifically. A migration to Exchange Online resolves it as a side effect, because finishing the migration is the decommission.

The decision that goes wrong most often is choosing either path in the belief that the in-place upgrade is available, discovering in the build week that Exchange 2016 or a hardware refresh puts you on the legacy path, and then running a mailbox migration on a compressed timeline into a destination nobody re-examined.

Establishing which path you are on takes an inventory, and with the last update shipped, the inventory is the first job.