Many businesses in the Ruhr region have run their email on an in-house Exchange server for years, in the basement or a data centre. It quietly did its job, and that is exactly the problem now. Because Exchange Server 2016 and 2019 reached end of support on 14 October 2025. Since then there are no more security updates, no bug fixes and no technical support through the regular channels.
Updated 7 October 2026: ESU Period 2 ends on 31 October 2026, just a few weeks from now, and according to Microsoft it is intended for customers with an Enterprise Agreement. Microsoft has confirmed that there will be no further extension: from November 2026, Exchange 2016 and 2019 receive no more updates, even with ESU. The ESU advice in the text has been adjusted accordingly.
Note: This article explains the technical situation and does not replace individual legal or security advice. As of: June 2026.
Why "but it still runs" is dangerous here
A mail server without security updates is an open flank. Exchange servers have repeatedly been the target of large-scale attacks, and a central mail server is a rewarding target: whoever compromises it can read along, send in your name and often gains a foothold across the entire domain.
There is also a compliance angle: anyone processing personal data must take appropriate technical measures under GDPR. A provably unpatched, end-of-life system is hard to defend as "appropriate" if something goes wrong. So "it still runs" is not a viable strategy but a deferred risk.
The ESU bridge: short, expensive, not a permanent state
For Exchange 2016/2019 Microsoft offers a paid Extended Security Update (ESU) programme. It is important to understand: this is an emergency bridge, not a second life. The ESU deliver only security updates rated Critical and Important, but no support and no new features.
And the bridge is time-limited: after Period 1 (until 14 April 2026), Period 2 runs from May 2026 to the end of October 2026. After that it is definitively over. According to Microsoft, Period 2 is intended for customers with a Microsoft Enterprise Agreement (EA) and is purchased through the Microsoft account team. For most small businesses it is therefore not an option, and in early October 2026 only a few weeks remain anyway.
Where to migrate? Two sound paths
For the vast majority of businesses there are two destinations to choose from:
1. Exchange Online (Microsoft 365)
The standard route for small and medium businesses. Microsoft runs the mail server and handles updates, high availability, spam and virus protection. You pay per mailbox and month and are rid of operating your own server. For most businesses without an in-house IT team this is the most pragmatic and secure path, including an EU data option and a data processing agreement.
2. Exchange Server SE (Subscription Edition)
If you want to stay on-premises for good reasons (data sovereignty, specific industry requirements or integration with legacy systems), you use Exchange Server SE. SE has been available since 1 July 2025 and is the only on-premises edition of Exchange that is still supported. Technically, the first SE release is largely equivalent to a fully up-to-date Exchange 2019; the licensing model, however, has moved to an ongoing subscription.
There are two paths to SE:
- In-place upgrade: directly from Exchange Server 2019 (CU14 or CU15), comparatively lightweight.
- Legacy upgrade (transition): required if you are coming from Exchange Server 2016. Here SE is set up on new servers and the mailboxes are migrated. Microsoft explicitly recommends going straight to SE rather than installing new 2019 servers first.
A realistic roadmap
Whatever the destination, the sequence is similar:
- Take inventory: which Exchange version, which cumulative update, how many mailboxes, which dependencies (scanners, ERP, line-of-business software that sends via SMTP)?
- Pick a target: Exchange Online or Exchange Server SE, based on data protection, budget, available know-how and operational responsibility.
- Do not count on ESU: ESU Period 2 ends on 31 October 2026 and is intended for customers with an Enterprise Agreement. For small businesses it is hardly a buffer for a delayed migration any more.
- Migrate and decommission cleanly: move mailboxes, switch over SMTP applications, adjust DNS/Autodiscover, check SPF, DKIM and DMARC, and only switch off the old server after a controlled decommissioning.
- Document: what was migrated and secured, and when? You need this for audits, insurers and your own traceability.
What this means for businesses in Recklinghausen
If you still have an Exchange 2016 or 2019 in the house, it is now high time to act. Until the end of October 2026, ESU Period 2 still delivers security updates, but only for customers with an Enterprise Agreement; after that there are no more updates. A planned migration is always calmer and cheaper than a forced one. Smaller businesses in particular often gain more security and less maintenance effort from the move than they expect.
Are you still running your own Exchange server and unsure which path fits you? In a free initial consultation we look at your setup together and sketch out a realistic roadmap, level-headed and without sales pressure.
Note: The articles on this blog are produced with the help of AI and are editorially reviewed before publication. Editorial responsibility lies with Emre Yurtbay (see the legal notice).