Exchange 2016/2019: Throttling and Blocking up to the Final Public Update Baseline

Platinum Contributor

Sep 02, 2026

Several years ago, we announced Throttling and Blocking Email from Persistently Vulnerable Exchange Servers to Exchange Online. Since then, we have been periodically updating the “oldest acceptable version” as we keep releasing more security updates for Exchange Server.

So far, these changes have been implemented silently. But, today, we are announcing that starting in the second week of September 2026, we will raise the oldest allowed version for Exchange 2016 or Exchange 2019 servers that connect to Exchange Online over an inbound connector type of OnPremises to at least the last available public update version, released in October 2025. This update level was released almost a year ago, and all organizations should have updated to it, since.

A very important implication of this change:

After going into effect, the oldest Exchange Server version allowed to send email to Exchange Online over the inbound OnPremises connector will be Exchange with October 2025 updates.
The next time we update the oldest allowed Exchange Server version for sending email to Exchange Online, the required version of Exchange Server 2016 or Exchange Server 2019 will be newer than any publicly available update.

When the next adjustment happens (we estimate in several months), only customers who were enrolled into our ESU program and customers who migrated to Exchange SE will have the required update versions to not be throttled or blocked when sending email to Exchange Online.

As a reminder, throttling and blocking of email from persistently vulnerable Exchange servers to Exchange Online:

Applies to servers that connect to Exchange Online over an inbound connector type of OnPremises.
DOES NOT apply to servers that send email to Exchange Online in other ways (different types of connectors etc.)
DOES NOT (currently) apply to “all servers in your organization”, but only to servers that connect to Exchange Online over an inbound connector type of OnPremises. This might change in the future.

Finally, we wanted to be clear that the fact that the “oldest version to avoid throttling and blocking in Exchange Online” is always older than the latest version available does not mean that we consider versions older than the latest security update “safe to use”. Anything older than the latest is vulnerable to everything we have fixed/released/announced since that older version. Especially in this calendar year, we have been releasing many security updates for Exchange Server and it is likely that we will continue to do so for the foreseeable future.

With a rapidly changing security landscape, no organization should consider it safe to run their organization's business email on an outdated version of Exchange Server. Please see Exchange Server update FAQ.

Additional reading: How to pause throttling and blocking of out-of-date on-premises Exchange Servers.

The Exchange Server Team

Updated Sep 02, 2026

Version 2.0

Platinum Contributor

Joined April 19, 2019

View Profile

Exchange Team Blog

You Had Me at EHLO.

19 Comments

greatquux
Brass Contributor
Sep 04, 2026
All my existing 2016 servers are up-to-date with October 2025 level (15.1.2507.61), and they're all firewalled off from the public internet and used only to manage Exchange and act as scanner/copier SMTP relays. I don't have ESU, so it is rather annoying that you're going to raise the level and force me to migrate them to an SE just to continue to have the usual management workflow and send a few mails from copiers. Please, hold off on that as long as you can, maybe until you have actual evidence some of these servers are being used to send spam, mmm?
- Nino_Bilic
  Microsoft
  Sep 04, 2026
  Can confirm that some of those compromised servers are used to send spam.
  - greatquux
    Brass Contributor
    Sep 04, 2026
    Well that's why my old ones are no longer on the public internet! But I guess not everyone is doing that.
VPofstuff
Tin Contributor
Sep 03, 2026
Wow great job guys you started actively blocking thousands of our emails when we are on a supported version.
Get a grip on things what is going on over there we all know there is no good reason for you to do this and blame it on security a reason.
To turn this on right before a holiday weekend is actually crazy too.
How about better communication before stuff like this goes into affect
joelsysadmin4242
Tin Contributor
Sep 03, 2026
We are running Exchange Server version 15.2.2562.20, which is listed as a compliant version in the "Connection on-premise Exchange Servers" report. We are seeing emails being blocked.

I have "paused" the enforcement for 30 days for now. But it looks like to me the emails should have never been blocked.
- Nino_Bilic
  Microsoft
  Sep 03, 2026
  You really need to update this server. We have released A TON of fixes for security vulnerabilities since August 2025!
  
  I'd ask you to open a ticket for this but the issue is that we will move up the throttling / blocking baseline to October 2025 anyway and you will fall under that anyway.
  - joelsysadmin4242
    Tin Contributor
    Sep 04, 2026
    I opened a ticket and support was not helpful. I escalated to our account team to see if they can give an explanation.
    Nino_Bilic do you know why compliant versions were being blocked?
joelsysadmin4242
Tin Contributor
Sep 03, 2026
We are running Exchange SE version 15.2.2562.20 and messages were being blocked until I paused it. From what I can see, it shouldn't have done that.
joelsysadmin4242
Tin Contributor
Sep 03, 2026
I'm running Exchange SE version 15.2.2562.20 ( yeah its a year behind) and I am getting messages blocked. Even though it is listed as compliant. I paused enforcement, but I shouldn't have had to.
andydavid1
Brass Contributor
Sep 02, 2026
Might be wise however to wait until after Labor Day week in the US. Just sayin' :)
- Nino_Bilic
  Microsoft
  Sep 02, 2026
  There is no immediate impact for anyone; this is only when the 90 day actions start; it is not until 60 days after that date that blocking stages start: Throttling and Blocking Email from Persistently Vulnerable Exchange Servers to Exchange Online | Microsoft Community Hub.
  - VPofstuff
    Tin Contributor
    Sep 03, 2026
    Your blocking our emails right now on a supported versions why not take a look and see what you changed no telling how many companies are impacted by this.
jeff-thompson
Copper Contributor
Sep 02, 2026
Does the "starting in the second week of September 2026" mean 9/6, 9/7 or 9/13, 9/14? In any case giving this short of notice of a potentially breaking change is crazy work. Fully aware of the enforcement pausing as linked above. But this forces non-compliant orgs to start burning those 90 days. Just my 2 cents.
Addendum:
Adding that stage 1 (no throttling/blocking) of enforcement is 30 days. Would be good to know if any notice to admins (GA?) is sent when this is enabled in their tenant. Message Center, email, carrier pigeon?
- Nino_Bilic
  Microsoft
  Sep 02, 2026
  Just to be clear: we never pre-announced the "moving the version higher" like we did today. So with or without this announcement, the change would have been made (just as it was made in the past, without any announcement). My expectation of the time of change is mid week next week. But it is a service change and nailing this down to exact day / time in a global service is hard.
  
  But yes - this forces organizations who are on versions older than October 2005 to start their 90 day countdown. Exactly the point of this change. Honestly, a really good argument could be made that we should move past October 2025 right now (seeing how much security payload we released this calendar year).
  
  The bottom line is that admins really need to understand that updating Exchange should be done on time.

Blog Post

Exchange 2016/2019: Throttling and Blocking up to the Final Public Update Baseline