On 14 October 2025, Microsoft ended support for Exchange Server 2016 and 2019. Organisations willing to pay could still get security updates through the Extended Security Updates (ESU) programme. That programme ends on 31 October 2026, and Microsoft has said it will not be extended. From November, no more updates will be released for these versions, not even for a fee.
Even so, many SMEs still have one of these servers in their server room. It runs, email arrives, and at first glance there’s little reason to change anything.
Why an unpatched Exchange server is risky
An Exchange server is reachable directly from the internet, otherwise Outlook at home and email on smartphones wouldn’t work. That is exactly what makes it a favoured target. In 2021, the vulnerabilities known as ProxyLogon were used to compromise tens of thousands of servers worldwide within a few days. Attackers scan for these systems automatically, and anyone who controls the mail server usually also finds a way into Active Directory.
If a new vulnerability is found after the end of October, it stays open on Exchange 2016 and 2019. Data protection is another factor: Swiss law requires appropriate data security, and a server without security updates is hard to justify. More on this in our article on IT measures under the Swiss Data Protection Act.
Option 1: Exchange Server Subscription Edition
Exchange Server SE has been available since 1 July 2025 and is the direct successor to Exchange 2019. Technically, the first release is largely identical to Exchange 2019 CU15. What’s new is the licensing model: on top of server licences and client access licences (CALs), you need active Software Assurance or subscription licences for all users. The server stays on your premises, and the licence costs recur every year.
The easiest route is from Exchange 2019 CU15 on Windows Server 2022 or 2025, where an in-place upgrade is possible. Exchange 2016 cannot be upgraded directly. It needs a new server, and the mailboxes are moved across.
One point matters for planning: the second cumulative update (CU2) for Exchange SE only installs if no older Exchange servers are still registered in the organisation. The old servers have to be uninstalled properly, switching them off isn’t enough.
Option 2: Microsoft 365
With Exchange Online, Microsoft takes care of operation and updates. This suits companies that already work with Teams, OneDrive or SharePoint. The migration usually runs through a hybrid configuration, moving mailboxes step by step so that users hardly notice. If an Exchange server stays on premises for management afterwards, Microsoft provides a free hybrid licence for it.
Data location is the point to consider. The data sits with a US provider, even though Microsoft runs data centres in Switzerland. Whether that suits your business depends on your industry and your customers. Background in our article on digital sovereignty.
Option 3: Zimbra
Zimbra is a platform for email, calendars and contacts that runs on your own Linux servers or with a Swiss hosting provider. There is an open-source edition and the paid Network Edition with vendor support. The Network Edition includes a connector that syncs email, calendars and contacts with Outlook, so your staff keep working in the program they know.
For SMEs that want to keep their data in Switzerland without Microsoft subscriptions, Zimbra is a proven alternative. The move takes a little more planning than Microsoft 365, because mailboxes, calendars and shares all have to be transferred.
How to proceed
- Take stock. Which Exchange version and CU are running on which Windows Server? How many mailboxes, how much storage, and which devices or programs send mail through the server, such as scanners or the ERP?
- Decide. Data location, budget and existing Microsoft licences usually set the direction.
- Bridge the gap. Until the migration, install the last available updates and make Outlook on the web reachable only via VPN.
- Migrate and clean up. After the move, uninstall the old server and check the DNS records for SPF, DKIM and DMARC.
We’ll plan the move with you
We look after Exchange, Microsoft 365 and Zimbra environments and know the pitfalls of all three routes. Together we work out which solution fits your business, and we migrate the mailboxes outside business hours. More under email security and servers & virtualisation. If you still run older Windows servers, see our article on the end of support for Windows Server 2016.
Frequently asked questions
Will our Exchange server keep working after end of support?
Yes. The server keeps running and mail is delivered. But no more security updates are released, and new vulnerabilities stay open.
Can we still buy Extended Security Updates?
No. The programme ends on 31 October 2026, and Microsoft has said it will not be extended.
Is Exchange SE worth it for a small business?
Rarely for very small companies, because licences, server and operation together usually cost more than a hosted service. Exchange SE makes sense when data has to stay on premises and Microsoft licences with Software Assurance are already in place.
How long does a migration take?
For an SME with 10 to 50 mailboxes, it usually takes a few days of preparation and one weekend for the switchover. The duration depends mainly on the amount of data.
