Microsoft announces a second period for the Extended Security Update program for Exchange Server 2016 and 2019.
Exchange 2016 and 2019 have been officially out of support since October 2025. Microsoft launched an initial ESU period at that time to give customers extra time for their migration. That first period expires at the end of April 2026, but some customers require more time. Companies that have not yet completed their migration to Exchange Subscription Edition can receive security updates until the end of October 2026.
New purchase required for period 2
The second ESU period runs from May through October 2026 and lasts six months. Companies already participating in the first period are not automatically enrolled. They must enter into a new contract via their Microsoft account team, with an Enterprise Agreement as a prerequisite.
Under the program, Exchange Server 2016 CU23 and Exchange Server 2019 CU14 or CU15 will receive security updates. Microsoft emphasizes that these cover critical and important updates, but does not guarantee that updates will actually be released. Updates are only issued if there are relevant security changes.
No full support
Microsoft makes it clear that the ESU is not an extension of the official support lifecycle. Companies cannot open support cases for Exchange 2016 or 2019 unless they are directly related to an ESU update. Technically, the servers remain legacy and out of support.
Customers whose servers are blocked or throttled when sending email to Exchange Online can resolve this by installing the October 2025 updates. An ESU subscription is not required for this. Microsoft advises organizations to migrate to Exchange SE instead of relying on the ESU program.
Migration remains the priority
Microsoft leaves little room for interpretation: there will not be a third ESU period. No further extensions are planned after October 2026. The company encourages customers to switch to a supported version as soon as possible.