While both Exchange 2016 and 2019 are out of support since October 2025, some of our customers who needed more time to finalize migrations to Exchange Subscription Edition (SE) have opted to enroll into the Extended Security Update program. That ESU program started in October 2025 and is ending in April 2026 (“Period 1”).
As end of April 2026 nears, some of our customers told us that they needed additional time to finalize their Exchange 2016/2019 migrations.
Today we are announcing that we created a “Period 2” Exchange Server ESU program. This period will last from the start of May 2026 through the end of October 2026 (6 months). There will be no further extensions of this program after that.
Conditions of Period 2 Exchange ESU program
- Customers who wish to enroll into Period 2 program will have to re-purchase the Exchange ESU contract even if they were already enrolled into the Period 1 ESU program (October 2025 – April 2026). Period 2 is not an “extension” of current Period 1 Exchange ESU program (which ends in April 2026). Your organization does not automatically enroll into Period 2 – you will have to purchase the ESU again for additional 6-month coverage through October 2026 (in the same way that you purchased the original ESU).
- In Period 2, we plan to provide security updates for Exchange Server 2016 CU23 and Exchange Server 2019 CU14/CU15.
- Any Exchange Server ESUs purchased starting with today’s date (April 15, 2026) will automatically be considered Period 2 and will be valid from May to October 2026. Your organization will receive information on how to download updates released under Period 2 ESU (your original ESU program instructions will not work for ESU updates released after April 2026).
Starting today, customers can contact their Microsoft account team to get information about and purchase additional Period 2 Extended Security Update (ESU) for their Exchange 2016 CU23 or Exchange 2019 CU14/CU15 servers. Simply purchase the same product after today’s date. Your account teams will have information related to per server cost and additional details on how to purchase.
What does this mean?
- This ESU is not an “extension of the support lifecycle” (Microsoft Lifecycle Policy | Microsoft Learn) for Exchange 2016 / 2019. Those servers are still out-of-support, and you will not be able to open support cases for them (unless directly related to an issue with an update released to ESU customers during the ESU period).
- This Period 2 ESU is a way for customers who might not be able to finalize their Exchange 2016 or 2019 migrations to Exchange SE before the end of October 2026, to receive Critical and Important updates (as currently defined by Microsoft Security Response Center (MSRC) scoring) as security updates (SUs) that we might release during Period 2. If there are SUs that we need to release, we will privately provide such SUs to ESU customers only.
- We are not committing to actually releasing any SUs during the Period 2 ESU. Exchange Server does not necessarily receive SU updates every month on Patch Tuesday (2nd Tuesday of the month) as SUs are released only if there are Critical or Important security product changes. Therefore, if there are no SUs that we need to release during the time of ESU program, there will be no such updates provided. We will, however, confirm with ESU participants each Patch Tuesday whether an SU was provided or not.
- This Period 2 Exchange ESU will be valid until end of October 2026.
Who is Period 2 Exchange ESU for?
This program is intended for customers with a Microsoft Enterprise Agreement (EA) who are unable to finalize their Exchange 2016 or 2019 migrations to Exchange SE before end of April 2026 and still need Critical and Important security coverage for servers still in operation.
FAQs
Why does Microsoft require additional contract for Period 2 of Exchange ESU if our organization already has the original Exchange Server ESU?
Period 2 is a separate contract that lasts until the end of October 2026. Many of our original ESU customers are finalizing their migrations by end of April 2026. Those few that need additional time have an option of getting a new ESU contract. Our preference is that our customers finalize their migrations instead (honestly – we’d be happy to not sell Period 2 Exchange ESU to anyone; please migrate instead!)
Our organization did not purchase original Period 1 Exchange ESU (ending with April 2026). Can we purchase Period 2 ESU only?
Period 2 ESU is separate from original Period 1 ESU and can be purchased independently. Purchasing the Period 2 ESU does not require purchase of Period 1. But note that purchase of Period 2 ESU will only get you update packages released after Period 2 starts. You will not get access to update packages released during Period 1 ESU. Seeing that all our updates are cumulative, fixes for issues released during Period 1 ESU will be included in Period 2 updates (when / if released).
How is Exchange Server ESU licensed and how are updates distributed?
Updates released under Period 2 Exchange ESU will follow the same process as updates released under the Period 1 ESU program: once enrolled, your organization will be provided information on how to access any updates released under Period 2. There will be no special licenses or keys in the Microsoft 365 admin center or Volume Licensing. After purchase of Period 2 SKUs, you will receive a new ESU User Guide which will contain everything you need.
Our Exchange server is getting throttled or blocked when sending email to Exchange Online. How can Microsoft not make ESU updates available to all customers, so they can address this?
If your server is currently affected by Throttling and blocking of persistently vulnerable Exchange servers that indicates that the version currently running in your organization is roughly a year out of date. To resolve the throttling or blocking immediately, please install October 2025 (last publicly available) updates for Exchange 2016 or 2019. ESU updates are not required. There will come a day when October 2025 updates too will be throttled or blocked, but that is not currently the case. But note that even if you update to October 2025 updates your server is still out of support and out of date and you should migrate to a supported version ASAP.
Our organization has Microsoft Volume Licensing. Do we get the Exchange ESU automatically? Where can we buy Exchange ESU?
Exchange ESU program is a separate contract that each organization must explicitly purchase via their Microsoft account team (requires Microsoft Enterprise Agreement). Exchange ESU is not automatically included in Volume Licensing or Software Assurance.
Help! We purchased the ESU (Period 1 or Period 2) – but we do not know how to access the updates we paid for!
If you have already purchased the ESU and need information on accessing the latest Security Updates, please contact us by sending an email to ExchangeandSfBServerESUInquiry@service.microsoft.com. You are welcome to add your account team to the email also.
Please continue migrating to Exchange SE instead of taking advantage of this Period 2 ESU program. But if you really must, contact your Microsoft account team for more details on Period 2 ESU.
A similar program extension is available for our Skype for Business 2015 / 2019 customers. Please read more here.
The Exchange Server Team
