Exchange 2016 and 2019 end of support: what to do now

Exchange Server 2016 and 2019 left support on 14 October 2025. Organisations that bought extended security updates received them until October 2026, and Microsoft has said there will be no further extension. Servers still running either version no longer receive security fixes.

1. 1

   Confirm nothing is left on-premises

   Where: Exchange Management Shell on the last Exchange server (Start > Microsoft Exchange Server > Exchange Management Shell)

   Migrate or remove every mailbox and public folder. Check arbitration, audit log and archive mailboxes too, and any offline address book generated by a system mailbox, because they also block the uninstall. Microsoft recommends migrating public folders to Exchange Online rather than removing them.

   Set-ADServerSettings -ViewEntireForest:$true
   Get-Mailbox
   Get-Mailbox -Archive
   Get-Mailbox -PublicFolder
   Get-Mailbox -Arbitration
   Get-Mailbox -AuditLog

   You should see: All five Get-Mailbox commands return nothing.
2. 2

   Move Exchange attribute management to the cloud

   Where: Exchange Online PowerShell on your admin PC, connected with Connect-ExchangeOnline

   If the module is not set up yet, follow connect to Exchange Online PowerShell. For each directory-synchronised mailbox, set cloud-based management of Exchange attributes so you can edit them with Set-Mailbox in Exchange Online. IsExchangeCloudManaged covers mailboxes only: mail-enabled groups and mail contacts use a source of authority transfer through Microsoft Graph, as listed in Microsoft's procedure.

   Get-Mailbox -ResultSize Unlimited | Where-Object { $_.IsDirSynced -eq $true -and $_.IsExchangeCloudManaged -eq $false } |
       ForEach-Object { Set-Mailbox -Identity $_.Alias -IsExchangeCloudManaged $true }
   Get-Mailbox -Identity user@contoso.com | Format-List IsExchangeCloudManaged

   You should see: IsExchangeCloudManaged shows True for every synchronised mailbox, and groups and contacts have a planned or completed SOA transfer.
3. 3

   Point mail flow and Autodiscover at Exchange Online

   Where: Your public DNS host and internal DNS servers, then the Exchange Management Shell on the Exchange server

   MX should resolve to your mail.protection.outlook.com host and Autodiscover to autodiscover.outlook.com. Update internal and external Autodiscover DNS, then clear the Autodiscover SCP.

   Resolve-DnsName -Name contoso.com -Type MX
   Resolve-DnsName -Name autodiscover.contoso.com -Type CNAME
   Get-ClientAccessService | Set-ClientAccessService -AutoDiscoverServiceInternalUri $Null

   You should see: MX returns contoso-com.mail.protection.outlook.com, the Autodiscover CNAME returns autodiscover.outlook.com, and the SCP command completes without errors.
4. 4

   Turn off centralised mail transport

   Where: Hybrid Configuration Wizard on the Exchange server, or Exchange Online PowerShell

   Either re-run the wizard (see run the Hybrid Configuration Wizard) and clear Enable Centralized Mail Transport, or set the hybrid outbound connector so it no longer routes all mail through on-premises.

   Set-OutboundConnector -Identity "<Hybrid Outbound Connector name>" `
       -RecipientDomains "<accepted domains>" -RouteAllMessagesViaOnPremises:$False

   You should see: Get-OutboundConnector shows RouteAllMessagesViaOnPremises False, and outbound test mail from a cloud mailbox is delivered.
5. 5

   Find every device and app that relays through Exchange

   Where: Exchange Management Shell on the Exchange server

   Printers, scanners and line-of-business apps lose relay when Exchange is removed. List connectors that allow anonymous relay and re-point every sender first (see below).

   Get-ReceiveConnector | Where-Object { $_.PermissionGroups -match 'AnonymousUsers' } |
       Format-Table Name, Bindings, RemoteIPRanges -AutoSize

   You should see: A table of relay connectors and the IP ranges that use them; every IP in it is on your relay inventory with a new sending method.
6. 6

   Clean up the hybrid configuration

   Where: Exchange Management Shell on the Exchange server, and Exchange Online PowerShell

   Remove the hybrid configuration object (on-premises), the HCW intra-organisation connectors (in both shells), the hybrid inbound and outbound connectors in Exchange Online and the organisation relationship. Microsoft's procedure also lists optional federation trust, certificate, OAuth and Hybrid Agent cleanup steps; follow them if they apply to you.

   # Exchange Management Shell
   Remove-HybridConfiguration
   # Exchange Management Shell and Exchange Online PowerShell
   Get-IntraOrganizationConnector | Where-Object { $_.Name -like 'HybridIOC -*' } | Remove-IntraOrganizationConnector -Confirm:$false
   # Exchange Online PowerShell
   Get-InboundConnector | Where-Object { $_.ConnectorSource -eq 'HybridWizard' } | Remove-InboundConnector
   Get-OutboundConnector | Where-Object { $_.ConnectorSource -eq 'HybridWizard' } | Remove-OutboundConnector
   Get-OrganizationRelationship | Where-Object { $_.Name -like 'O365 to On-Premises*' } | Remove-OrganizationRelationship

   You should see: Running the Get- commands again returns no hybrid connectors or O365 to On-Premises relationship.
7. 7

   Uninstall Exchange

   Where: The Exchange server: Command Prompt as administrator in the Exchange setup folder, or Control Panel > Programs and Features > Microsoft Exchange Server > Uninstall

   Uninstall rather than just switching off. Uninstall removes all receive connectors, so relay must already be moved. Do not uninstall if you rely on the Exchange Management Tools approach.

   Setup.exe /m:Uninstall /IAcceptExchangeServerLicenseTerms

   You should see: Setup completes without errors and Microsoft Exchange Server no longer appears in Programs and Features.
8. 8

   Tidy Exchange Online

   Where: Exchange Online PowerShell on your admin PC

   Check for leftovers, remove the orphaned on-premises organisation and migration endpoints, and consider setting your domain from InternalRelay back to Authoritative.

   Get-OnPremisesOrganization | Remove-OnPremisesOrganization
   Get-MigrationEndpoint | Remove-MigrationEndpoint
   Set-AcceptedDomain -Identity contoso.com -DomainType Authoritative
   Get-AcceptedDomain

   You should see: Get-OnPremisesOrganization and Get-MigrationEndpoint return nothing, and Get-AcceptedDomain shows the domain as Authoritative.

Make a list of every device and application that sends mail through Exchange, then choose a method for each one. Microsoft describes three main options for sending from devices and apps through Microsoft 365.

Use the inventory template to record each device, its owner, the method you chose and the test result.

1. 1

   List your EWS apps

   Where: Microsoft Entra admin center (entra.microsoft.com) > App registrations and Enterprise applications > each app > API permissions

   Look for apps granted the Office 365 Exchange Online permissions EWS.AccessAsUser.All (delegated) or full_access_as_app (application). Microsoft also asks admins to review the EWS usage reports in the tenant. Then ask vendors of add-ins, CRMs, backup, archiving and signature tools which API they use.

   You should see: A list of every app that uses EWS, with its application (client) ID, owner and vendor contact.
2. 2

   Ask each vendor for a Graph version

   Where: Your risk register, one row per app

   Apps must move to Microsoft Graph. Record the vendor's date for a Graph release in your risk register.

   You should see: Every EWS app has a Graph release date, or a replacement or retirement plan, before 1 April 2027.
3. 3

   Allow only what you must, temporarily

   Where: Exchange Online PowerShell on your admin PC, connected with Connect-ExchangeOnline

   Admins can keep EWS working for named apps by adding their app IDs to the tenant-level EWSAllowedAppIDs list in the organisation configuration. Setting the list replaces the existing list, so include every app you still need, and allow up to 24 hours for changes. This ends on 1 April 2027 regardless. Check the current list with the command below.

   Get-OrganizationConfig -RetrieveEwsOperationAccessPolicy | Format-List EwsAllowedAppIDs

   You should see: EwsAllowedAppIDs lists exactly the app IDs you intend to allow, and nothing else.
4. 4

   Test before the shutdown

   Where: A pilot group of mailboxes, using each app's Graph release

   Run each replacement against a pilot group well before April 2027, then remove the app ID from the allow list once it works on Graph.

   You should see: Each app works for the pilot group with its app ID removed from the allow list.

Subscription Edition is the supported on-premises version. Before planning an upgrade, confirm with Microsoft or your licensing partner:

• which server licences and client access licences you need, and whether Software Assurance or a subscription is required
• whether you need it only for hybrid management, and whether cloud-based attribute management removes that need
• the supported upgrade path from your current version and cumulative update