Recent Discussions
Reference Architecture for an On-Premises AI Assistant for Microsoft Exchange.
Bringing Secure AI Capabilities to On-Premises Microsoft Exchange Many organisations continue to operate Microsoft Exchange within their own data centres because of regulatory requirements, data-residency policies, security considerations, operational dependencies, or the need to maintain complete control over sensitive email information. At the same time, users increasingly expect Artificial Intelligence to help them manage growing email volumes, understand long conversation threads, locate information quickly, analyse attachments, and prepare relevant responses. This creates an important question: Can organisations introduce AI-assisted email capabilities without migrating their on-premises Exchange environment or sending email data to public AI services? With the right architecture, the answer is yes. The opportunity for AI in on-premises Exchange Users spend a significant amount of time reading lengthy email chains, searching for previous discussions, identifying action items, reviewing attachments, and preparing responses. An AI-powered email assistant can help reduce this effort while continuing to operate within the organisation’s controlled infrastructure. Such a solution can be integrated with Microsoft Exchange through an Outlook Web App, or OWA, Add-In. The Add-In provides AI-assisted capabilities within the familiar Outlook Web interface and can be centrally deployed to selected users or Active Directory groups by the Exchange administrator. The purpose is not to replace Exchange or change the way emails are managed. Instead, it introduces an intelligence layer that helps authorised users interact more efficiently with the email information they are already permitted to access. Key capabilities of an AI-powered Exchange Email Assistant 1. Email and conversation summarisation The assistant can summarise an individual email or an entire conversation thread. Instead of reading every message in a long chain, the user can receive a structured summary covering: The purpose of the conversation. Important decisions and commitments. Key action items. Deadlines and pending responses. Relevant information available in attachments. The summarisation process can consider both incoming and sent messages so that the complete context of the conversation is preserved. 2. Contextual draft reply generation The assistant can prepare a suggested response based on the complete email thread and the user’s instructions. Users may select an appropriate tone, such as: Formal. Neutral. Technical. The generated response is placed in the user’s Exchange Draft folder or displayed for review within the OWA Add-In. A critical control is that the AI assistant does not independently send the email. The user remains responsible for reviewing, editing, approving, and sending the response. This human-review approach helps organisations adopt AI while retaining accountability over external and internal communications. 3. Natural-language mailbox search Traditional mailbox search generally depends on exact keywords, sender names, subjects, or date filters. An AI-enabled search experience allows users to search their mailbox using natural-language questions, such as: “Find emails received last month regarding the infrastructure renewal.” “Show unread emails from the finance team that require my approval.” “Find the discussion where the customer confirmed the delivery date.” “Summarise emails from a particular sender concerning the purchase order.” The solution can combine semantic search with traditional keyword-based search to improve the relevance of results. Users can also apply filters such as sender, subject, date range, read or unread status, and conversation thread. 4. Attachment analysis and OCR Important information is often contained within email attachments rather than the email body itself. An on-premises AI assistant can process supported documents, including: PDF files. Microsoft Word documents. Microsoft Excel files. Scanned documents. Image-based attachments. Optical Character Recognition, or OCR, can be used to extract information from scanned or image-based documents. The extracted content can then support email summarisation, contextual draft generation, and mailbox search. For example, a user may ask the assistant to prepare a response based on the commercial terms or delivery date mentioned in an attached document. Maintaining strict mailbox privacy Mailbox privacy is one of the most important architectural considerations for an enterprise AI email assistant. Each user must only be able to access and process emails from their own authorised mailbox. Information retrieved from one user’s mailbox must never become available to another user. This isolation should be enforced across every layer of the solution, including: User authentication. Exchange access tokens. Application sessions. Search indexes. Vector embeddings. AI prompts and responses. Cache and temporary data. Audit logs. The backend should validate the authenticated user and verify mailbox ownership for every request made to Exchange. Where vector search is used, mailbox data should be stored in user-isolated collections, partitions, or namespaces. This helps prevent cross-user retrieval at the data layer rather than relying only on controls within the user interface. Operating without public cloud AI services For organisations with strict security or data-sovereignty requirements, the AI models and supporting components can be deployed within the customer’s infrastructure. A fully on-premises architecture may include: A locally hosted Large Language Model. An on-premises embedding model. A re-ranking model. A vector database. A keyword-search engine. A backend API layer. An OCR or document-intelligence service. A secured OWA Add-In. Integration with Active Directory. Audit, monitoring, and administrative controls. The entire solution can operate within an internal network without sending email content, attachments, prompts, or generated responses to public AI platforms. This model can also support air-gapped environments where internet access is either restricted or completely unavailable. Centralised deployment and administration The OWA Add-In can be deployed centrally through Exchange administration controls. Administrators can assign the Add-In only to selected users or security groups. Employees who are not assigned the solution will not see the AI assistant within their Outlook Web interface. Administrative controls may include: User and group assignment. Enabling or disabling individual AI features. Summarisation-only mode. Draft-generation controls. Attachment-size restrictions. Session and retention policies. Model and performance settings. Usage monitoring. Audit logs. Resource utilisation monitoring. These controls allow organisations to begin with a limited group of users and gradually extend the solution after validating performance, security, and user adoption. Security and governance considerations Introducing AI into an enterprise email environment requires more than deploying a language model. The complete solution should be designed around security, privacy, governance, and responsible AI principles. Important considerations include: Authentication and authorisation The solution should integrate with the organisation’s existing identity infrastructure, such as Active Directory, and enforce role-based access controls. Encryption Email content, attachments, indexes, logs, and other sensitive information should be encrypted both in transit and at rest. Data retention Organisations should clearly define whether AI prompts, generated summaries, and draft content are retained. In privacy-sensitive environments, generated content may remain available only for the active session and should not be permanently stored by the AI application. Auditability The system should record relevant operational events, such as the user identity, requested function, timestamp, and processing status. Depending on the organisation’s policy, the actual email or generated response content may be excluded from audit logs. Human oversight AI-generated responses should be treated as suggestions. The user must review and approve them before sending. The assistant should also disclose its limitations and avoid presenting uncertain outputs as confirmed facts. Performance and capacity On-premises AI processing depends on available compute, memory, storage, and GPU resources. The architecture should account for: Number of concurrent users. Average mailbox size. Volume and size of attachments. Expected response time. Model size. Search-index growth. OCR processing requirements. High availability and backup requirements. A practical adoption approach Organisations do not need to introduce all capabilities at once. A controlled proof of concept can begin with a limited number of users and a defined set of features. A practical implementation sequence may include: Phase 1: Email summarisation Start with individual email and conversation-thread summaries. This provides immediate value while keeping the initial architecture relatively focused. Phase 2: Contextual draft replies Introduce draft generation with mandatory user review and clearly defined tone controls. Phase 3: Attachment processing Enable OCR and document parsing for supported attachments. Phase 4: Intelligent mailbox search Index authorised mailbox content and introduce natural-language search with strict per-user isolation. Phase 5: Wider deployment After security testing, performance validation, and user feedback, extend the solution to additional departments or user groups. Conclusion Organisations operating on-premises Microsoft Exchange do not necessarily need to choose between maintaining control over their email environment and adopting AI-assisted productivity capabilities. A carefully designed on-premises AI email assistant can support email summarisation, contextual draft preparation, attachment analysis, and natural-language mailbox search while keeping sensitive information within the organisation’s infrastructure. The most important success factors are not limited to the AI model itself. Identity controls, mailbox isolation, human approval, auditing, infrastructure sizing, and data-governance policies are equally important. For organisations evaluating private, sovereign, or air-gapped AI, on-premises Exchange can become an effective starting point for introducing practical AI capabilities in a secure and controlled manner. Connect with us to implement this solution in your organization. About the Author Vinay Prakash is the CEO of Glorious Insight and an Ex Microsoft Employee. He works with organisations on Data, Artificial Intelligence, Microsoft cloud technologies, enterprise applications, and secure on-premises AI solutions. For technical discussions related to private or on-premises AI adoption, he can be reached at: Email: email address removed for privacy reasonsCross-Tenant Message Recall and Duplicate DDG Detection Enhance Exchange Online Messaging
Last week, the Exchange development team announced two interesting developments. Stopping duplicate dynamic distribution groups and cross-tenant message recall. Preventing tenants from creating duplicate DDLs saves service resources and might make tenants easier to manage. The real value is in cross-tenant message recall, which solves a problem by allowing users to recall messages delivered outside their tenant. The facility only works if the receiving tenant allows, but nothing can be done for messages delivered outside Microsoft 365. https://office365itpros.com/2026/07/15/cross-tenant-message-recall/How to Check Distribution Lists for Activity Over the Last 90 Days
The new Get-MessageTraceV2 cmdlet can fetch 90 days of message trace data, which means that we can check for inactive distribution lists using data for the last 90 days instead of being constrained to the last 10 days. This is done by running fetches for nine batches of traffic, each covering ten days. Distribution lists are still important to Exchange Online and Microsoft 365, and it’s good to know which distribution lists are in active use (and how much traffic they get) and which are not. All done with PowerShell. https://office365itpros.com/2026/07/09/inactive-distribution-list-2026/
Exchange Server to Exchange Online Migration: A Pre-Migration Readiness Checklist
Over the years, I have worked on numerous Exchange Server to Exchange Online migration projects alongside Exchange administrators, IT teams, and MSPs. One consistent pattern I have noticed is that most migration issues do not originate during the migration itself — they surface because of gaps in pre-migration readiness. This checklist reflects what I have found most useful before starting any Exchange to Exchange Online migration. Inventory and Assessment Before touching any migration tooling, run a full inventory of your on-premises Exchange environment. This includes the Exchange Server version (2013, 2016, 2019), the number of mailboxes, database sizes, public folders, shared mailboxes, archive mailboxes, and any resource mailboxes such as rooms and equipment. Many teams also forget to document their distribution groups, dynamic distribution groups, and mail-enabled contacts. All of these need to be accounted for before you begin. 2. Active Directory and Entra ID Readiness Check that your Active Directory is clean: no duplicate UPNs, no lingering objects, and no ambiguous legacy Exchange attributes. Verify that Microsoft Entra Connect (formerly AAD Connect) is installed, configured, and synchronizing without errors. Confirm the UPN suffix used in AD matches a verified domain in your Microsoft 365 tenant. Attribute mismatches between on-premises AD and Entra ID are one of the most common causes of post-migration issues with authentication and mail flow. 3. Mail Flow and DNS Document all current MX records and any third-party mail filtering (SEG, anti-spam appliances). Plan whether you will cut over MX during the migration or keep a hybrid mail flow via Exchange connector. Verify SPF, DKIM, and DMARC records are in place for each domain. Applications and devices that use on-premises SMTP relay also need to be identified early — these often get missed and cause disruption after the migration window. 4. Licensing and Tenant Configuration Confirm you have sufficient Exchange Online licenses assigned or ready to assign before the migration starts. Review your tenant for any conditional access policies that may block newly migrated users. Check the Microsoft 365 admin center for any service health issues that could affect the migration window. Also confirm your tenant's default accepted domains and any aliases that need to be added. 5. Coexistence and Hybrid Considerations If you are running a hybrid migration (which is the recommended approach for most organisations with more than a few hundred mailboxes), confirm the Hybrid Configuration Wizard has been run and that the hybrid connector tests pass. Free/busy lookup, OAB distribution, and cross-premises message tracking should all be tested before you move any mailboxes. A common oversight is failing to validate OAuth configuration for modern authentication in hybrid — this affects calendar sharing and delegate access after migration. 6. Data and Backup Before migrating any mailbox, verify that a recent backup of your Exchange databases exists and is recoverable. If you are running a DAG, confirm all database copies are healthy and no replay queues are building up. It is also worth checking the size and age of any archive mailboxes — large archives can significantly extend migration time and should be planned for separately. What patterns have you seen in your environments? Are there specific pre-migration steps that have saved (or cost) you the most time? Happy to discuss further.How to Check Distribution Lists for Activity Over the Last 90 Days
The new Get-MessageTraceV2 cmdlet can fetch 90 days of message trace data, which means that we can check for inactive distribution lists using data for the last 90 days instead of being constrained to the last 10 days. This is done by running fetches for nine batches of traffic, each covering ten days. Distribution lists are still important to Exchange Online and Microsoft 365, and it’s good to know which distribution lists are in active use (and how much traffic they get) and which are not. All done with PowerShell. https://office365itpros.com/2026/07/09/inactive-distribution-list-2026/Reporting Recent Distribution List Changes
A recent discussion about reporting changes to Microsoft 365 groups provoked the question about how to report distribution list changes. The answer is that the same structure can be taken in a PowerShell script to fetch and report data, including the audit records containing the information about the changes, but the actual code is very different. Distribution lists Exchange Online objects and not Entra ID groups… https://office365itpros.com/2026/06/02/distribution-list-changes/Exchange Online to Deprecate Legacy TLS for POP3 and IMAP4
Microsoft will start to refuse inbound IMAP4 and POP3 client connections using legacy TLS versions (1.0 and 1.1) in July 2026. The move is consistent with other projects to remove obsolete or insecure email protocols from Exchange Online to increase the overall security of the online email service. In this article, we examine some methods to understand the POP3 and IMAP4 usage within a tenant. https://office365itpros.com/2026/04/29/legacy-tls-removal/High Volume Email is Generally Available and Ready to Charge
On April 1, Microsoft announced the general availability for the High-Volume Email (HVE) solution together with details of the PAYG charges incurred to send email to internal recipients, which is all that HVE can do. Microsoft will enable HVE charging on June 1, 2026, Before then, you’ll need to create a billing policy and link it to a valid Azure subscription if you want to continue to use HVE. https://office365itpros.com/2026/04/23/hve-ga-charging/Microsoft Limits App Access to Sensitive Message Properties
Microsoft has announced details of a change to app permissions to restrict updates to sensitive message properties (like recipients) without consent for a new advanced mail access permission. If tenants have apps that interact with message properties, including apps developed by third parties, they should check whether the apps are updating sensitive properties. If so, the new permission must be assigned or the apps will stop working. https://office365itpros.com/2026/03/26/sensitive-message-properties-graph/Microsoft Rushes High-Volume Email to General Availability
Almost two years after it first previewed, Microsoft is making the High-Volume Email (HVE) solution generally available in March 2026. HVE runs on a pay-as-you-go basis, but Microsoft won’t start charging tenants for sending email until May 2026. Two months should be enough for people to decide if they want to use HVE for internal communications as it has no ability to send external email. https://office365itpros.com/2026/03/09/hve-ga/Measuring KPIs like Response Times for Shared Mailboxes
Shared mailboxes are not CRM systems. However, many Microsoft 365 tenants use shared mailboxes to handle customer queries and then want to measure KPIs such as agent responsiveness to customer queries or the number of queries handled per agent in a month. As explored in this article, it’s possible to use the Microsoft Graph and PowerShell to extract some KPI-like data from shared mailboxes. https://office365itpros.com/2026/03/05/shared-mailbox-kpi/Exchange Online PowerShell Dumps the Credential Parameter
On February 12, Microsoft announced the deprecation of the Credential parameter for the Connect-ExchangeOnline cmdlet in the Exchange Online PowerShell module. The deprecation won’t affect interactive sessions (which should all be protected by MFA), but it might stop some background jobs running when Microsoft retires the server components that currently support the ROPC authentication flow. Time to check scripts! https://office365itpros.com/2026/02/16/exchange-online-powershell-ropc/The Final Countdown to Remove EWS from Exchange Online Begins
Microsoft announced the dates leading to the final retirement of Exchange Web Services from Exchange Online. If all goes well, the EWS retirement in the cloud will happen by May 2027. Challenges still exist. Microsoft must remove EWS from its own apps, including Outlook, and help tenants and ISVs make the leap to Graph APIs. Plans are in place and progress is being made, but will everyone be ready when Microsoft starts to remove EWS permanently from Exchange Online in April 2027? https://office365itpros.com/2026/02/06/ews-retirement-may-2027/Using the Exchange Online Message Trace API
January 22 saw the announcement of the beta version of an Exchange Online Graph-based message trace API. The API can retrieve message trace records and their details and offers equivalent functionality to the message trace cmdlets in the Exchange Online management PowerShell module. However, sometimes applications simply want to access data without going through a module, and that’s what this API delivers. The article includes a complete PowerShell script to demonstrate how to use the API. https://office365itpros.com/2026/01/27/message-trace-api/
Modern Auth EWS error 50199 when signing from Crestron Touchpanels
Good Afternoon, All I am having a difficult time nailing down this issue. I have a few Crestron TTS-770s that were, up to last week, working correctly by pulling Calendars data with EWS. They were configured with a service account signed into EWS using 'modern authentication'. This week, these panels have disconnected and report that 'Needs to be authorized' as the EWS status. I have verified that CA is not blocking sign in, the account is excluded from MFA policies, and is correctly licensed for Exchange Access. We do not use Intune for device management. When I attempt to re-register the device, I follow the prompts until I am prompted to close the browser window; The device spins, then fails to connect with the status above. I have attempted this with the service account and my own Admin account with MFA, to the same result. Entra Enterprise Apps Sign-in logs show a 'Successful' entry, then immediately after, a 'Failed' entry with an error '50199'. I had not made changes to any of the URIs before initial failure, and any additional entries or changes do not change the results of the error. Initial URI was configured to 'https://app.noop' (no idea, was configured before I got here, and I hadn't needed to change it), I have attempted combinations of our Tenant URI, ' https://login.microsoftonline.com/common/oauth2/nativeclient', and other 'fixes' I had found while GTS-ing. I additionally have set my 'legacy authentication' and 'legacy applications' CA polices to read-only for troubleshooting. I am working to disable OAuth2ClientProfile on Exchange Online temporarily for troubleshooting. Does anyone have any ideas? Please let me know if any additional information is needed, or if needed to post in another location. Thank YouMicrosoft Cancels Exchange Mailbox External Recipient Rate Limit
After considering customer feedback, Microsoft cancelled the mailbox external recipient rate limit for Exchange Online. The idea behind the new limit was simple – it makes life more difficult for spammers to use Exchange Online as a platform. Unhappily, customers didn’t like losing the ability to send relatively small amounts of external email for different reasons, and Microsoft didn't have a cost-free alternative to offer. C’est la vie. https://office365itpros.com/2026/01/08/mailbox-external-recipient-rate/Top 3 Myths about Exchange Server Subscription Edition
Over the last few months, several myths about Exchange Server Subscription Edition (SE) have been circulating online. From what I have seen, the top 3 myths are: Exchange Server SE RTM includes new features. Exchange Server SE will be updated like the Cloud. Exchange Server 2016 customers must move to Exchange Server 2019 to upgrade to Exchange Server SE. None of these things are true, but unfortunately, they keep being repeated. Let's dive into each of them. Myth #1: Exchange Server SE RTM includes new features The first myth is that Exchange Server SE includes new features. This is not true, and Microsoft's documentation makes this clear. In fact, it was always our plan to intentionally not include any features in the RTM release of Exchange Server SE. In my book about Exchange Server SE and my talks about it at the Exchange Summit and NT Konferenca last year, I provided insight into the RTM release of Exchange Server SE, so I won't go into that here. But I will explain why Exchange Server SE RTM doesn't include new features (or any other substantive code changes). When we decided to move the release of Exchange Server SE RTM to the second half of 2025, we knew we were significantly reducing the overlap between supported versions to about 106 days. We also knew that even with in-place upgrade capabilities, customers still needed time to validate the release. To help make that validation as quick and easy as possible, our plan was to make the RTM release code equivalent to the last released update for Exchange Server 2019, with only necessary branding and licensing changes. Last released update meant the last Cumulative Update (CU) for Exchange Server 2019 plus any Security Updates (SUs) or Hotfix Updates (HUs) released after the last CU but before the SE RTM release. Internally, we described the SE RTM release as a "soft CU for Exchange Server 2019" to help business, engineering, support, and community stakeholders better understand what we were doing. Eventually, senior leadership approved our plan, which the engineering team then executed flawlessly. As a side note, because Exchange Server and Skype for Business Server are developed and released by the same engineering team, Skype for Business Server SE took the same approach with their RTM plans and release. In the end, we committed to the SE RTM release being the same exact code as Exchange Server 2019 CU15, plus the two post-CU15 updates released before SE RTM (namely, the April 2025 and May 2025 HUs). This meant that customers running Exchange Server 2019 with the May 2025 HU experienced only: A name change from Exchange Server 2019 to Exchange Server Subscription Edition; A new License Agreement file (License.RTF), which is shown only during the GUI version of Setup; and A new build number that was incremented using the Exchange Server 2019 numbering scheme. Aside from that, when compared to Exchange Server 2019 CU15 plus the May 2025 HU, there are no changes in Exchange Server SE. Despite making this clear in numerous blog posts and documentation, some authors have posted articles that list "new" features in Exchange Server SE, citing support for Windows Server 2025, TLS 1.3, and OAuth 2.0 (aka Modern Auth), and new certificate management capabilities. These "new" features were all available in Exchange Server 2019, and other cited features were available in Exchange Server 2016 and earlier versions. That said, there are only two other changes that apply to Exchange Server SE: Lifecycle Policy and Support Policy. Both are outside the product and they are related. Lifecycle Policy changes Previous versions of Exchange Server were covered under Microsoft's Fixed Lifecycle Policy, which has phases such as Mainstream Support and Extended Support as well as published (and fixed) dates for end of support (the Beyond End of Support phase aka End of Life). Exchange Server SE is covered under Microsoft's Modern Lifecycle Policy, which does not have any support phases or published end of support dates. Exchange Server SE will have at least a 10½-year lifecycle because Microsoft has committed to supporting Exchange Server SE (as well as SharePoint Server SE and Skype for Business Server SE) until at least December 31, 2035, a few months shy of the 40th anniversary of Exchange Server! Under the Modern Lifecycle Policy, Microsoft also commits to provide a minimum of 12 months' notice before ending support for Exchange Server SE (and it would not surprise me to see the Office Servers eventually added to list of products on the 3-Year Notification Subset). Support Policy changes Historically, Microsoft's support stance has been based on where a product is in its lifecycle. For example, when Exchange Server 2013 was in Mainstream Support, Microsoft supported N-1, where N is the latest CU and -1 is the immediately previous CU. When Exchange Server 2013 moved into Extended Support, only the latest CU was supported. Exchange Hybrid environments have always been an exception to this, as Microsoft supports only the current CU in Hybrid environments. The change from the Fixed Lifecycle Policy to the Modern Lifecycle Policy means that Microsoft's support stance is more fluid. The Modern Lifecycle Policy says: "Customers must stay current as per the servicing and system requirements published for the product or service." This means that Microsoft can change the support requirements for Exchange Server SE as needed, but you should not expect them to pull the rug out from under you. Rather, you should expect their changes to be to your benefit, as previously demonstrated by their support for both CU15 and CU14 while Exchange Server 2019 was in Extended Support. So, if Microsoft releases a CU that contains a large payload or other significant changes, they may opt to take an N-1 support stance to give customers plenty of time to test and deploy it. Conversely, it's also possible that Microsoft could require customers to deploy an update immediately to fix a critical security issue or a significant bug (for example, a bug known to cause data loss). Regardless of the changes to Microsoft's support stance, my general advice is to evaluate and deploy all updates (especially SUs) as quickly as possible. Don't skip testing or validation, but do make installing updates, keeping Windows and Exchange current, and monitoring your Exchange servers a top priority. Myth #2: Exchange Server will be updated like the Cloud The second myth has to do with how Exchange Server will be serviced by the engineering team (and updated by customers). The move to the Modern Lifecycle Policy includes some language that may be helping to perpetuate this myth: "The Modern Lifecycle Policy covers products and services that are serviced and supported continuously." Servicing generally means updating the code and providing release packages for customers to install. Serviced and supported continuously refers to the evergreen type of model now used by Exchange Server (and other Microsoft products) which simply means instead of major releases and version upgrades, Microsoft will simply service the product via periodic updates. In the past, Microsoft released a new major version of Exchange Server roughly every 2-4 years. With the release of Exchange Server SE, there are no more major version releases. Instead, Exchange Server will be maintained in an evergreen fashion. Code updates for Exchange Server include the following package types: CU - a full-product package containing a specific build (e.g., RTM, CU1, CU2, etc.). SU - a recommended security-related hotfix package HU - an optional non-security hotfix package IU - a customer-specific fix packaged as an Interim Update CUs, SUs, and HUs, are cumulative, so you need only install the latest package. HUs are optional updates, but I recommend always reviewing HU release articles to see if they might introduce features or fixes that might benefit your organization. When Microsoft releases one of these packages, they will announce it on the Exchange Team blog and provide download links, and update the tracking document of build numbers and release dates for Exchange Server. I think the use of the word continuously in Modern Lifecycle Policy is causing confusion. The reality is that Exchange Server SE uses the same servicing model that Exchange Server 2019, Exchange Server 2016, and Exchange Server 2013 have used since April 2022, and no changes to this model have been made (or are expected). Microsoft has already announced the general plan for the first two CUs for Exchange Server SE that will both release in 2026 (in H1 and H2, respectively). Security work always takes precedence over non-security work, and there have been many times when Microsoft has released only one Exchange Server CU per year (including in 2024, 2023, and 2022). So, no, Exchange Server SE won't be updated by Microsoft like the cloud (nor will it get most cloud features). Myth #3: Exchange Server 2016 customers must move to Exchange Server 2019 to upgrade to Exchange Server SE The third myth is about upgrading to Exchange Server SE from Exchange Server 2016. This myth is concerning but understandable. Concerning, because it might cause (and might have caused) some customers to waste time and money. Understandable, because in the past it was guidance from Microsoft; but that guidance is now out-of-date and no longer applies. Some background and detail will help explain why. Exchange Server 2019 reached general availability on October 22, 2018. Despite the many improvements and benefits, Exchange Server 2019 was not well-adopted, likely because at the time Microsoft was leaning heavily into a cloud-first world. In fact, you could make an argument that when Exchange Server 2019 was released, Microsoft did everything it could to make sure no one used it. If you look at the Exchange web page on Microsoft.com at that time, it didn't even mention Exchange Server 2019. This led a lot of customers to think that our goal was to kill Exchange Server, or at the very least, ignore it to death. In the aftermath of the Hafnium attacks against Exchange servers, we learned that there were hundreds of thousands of servers around the world running unsupported builds, or supported but old and vulnerable builds, and that a very small percentage (~5%) were running Exchange Server 2019. Of the supported versions, patching levels were all over the place, with literally every build we had released still in use somewhere, including RTM builds of each major version. After Hafnium, we spent more than a year figuring out what to do with the next version of Exchange Server, and it was during that time that an entirely new plan for Exchange Server SE was developed (along with a new codename: Quantum Lobster). During planning, we intentionally went radio silent on the next version of Exchange Server (aka Quantum Lobster), making the announcement at Microsoft Ignite in September 2020, the last that anyone outside of Microsoft heard about the next version of Exchange Server for almost 2 years. During those 2 years, we continued telling customers that wanted to run Exchange Server to move to Exchange Server 2019. Not because it was the latest version, but because that's where we were still investing in security and features (such as custom configuration backup and support for Windows Server 2025 and TLS 1.3). Eventually, on June 2, 2022, we broke radio silence on the next version of Exchange Server, and among other things, we repeated our multi-year call-to-action to move to Exchange Server 2019, telling customers that once on Exchange Server 2019 they would be able to do a quick and easy in-place upgrade to Exchange Server SE RTM. In other words, Microsoft had been telling customers for years to move to Exchange Server 2019 to enable a quick and low-risk in-place upgrade to Exchange Server SE RTM when it releases. This message was further refined to focus on Exchange Server 2016 customers for two reasons: Exchange Server 2013 reached end of support, and as an Awareness Action, we changed Setup in CU15 to prevent installation if Exchange Server 2013 was present in the organization; and Exchange Server 2016 had a notable (and for a brief time, the largest) percentage of the visible install base. Circling back to the What's New article I mentioned earlier, this section has an Important note about upgrading that says: "In-place upgrades from versions of Exchange Server earlier than Exchange Server 2019 are not supported. You must first perform a legacy upgrade to Exchange Server 2019 CU14 or CU15 before upgrading to Exchange Server Subscription Edition (SE). Alternatively, a legacy upgrade to Exchange Server SE is also supported." It seems that some may have read the first two sentences in the note and ignored the rest, as there are a lot of articles and posts that state that to move from Exchange Server 2016 to Exchange Server SE, you must first do a legacy upgrade from Exchange Server 2016 to Exchange Server 2019, and then do an in-place upgrade to Exchange Server SE. But that guidance was rendered obsolete with the SE RTM release and should no longer be followed. There is absolutely no reason to do two upgrades (legacy + in-place) when a single upgrade (legacy) from Exchange Server 2016 to Exchange Server SE can be done. In fact, the legacy upgrade process from Exchange Server 2016 to Exchange Server 2019 or Exchange Server SE is exactly the same! The Exchange setup and migration guides (aka the Exchange Deployment Assistant) are helpful when performing a legacy upgrade from Exchange Server 2016 to Exchange Server SE. If you're still running Exchange Server 2019 or earlier, I encourage you to remediate that as quickly as possible (even if you are in the Extended Security Update program) by upgrading to Exchange Server SE or by moving to Exchange Online. Conclusion Hopefully, you now understand the truth behind the top three Exchange Server SE myths discussed in this article and why they are myths. But as I said in the beginning, these aren't the only myths being perpetuated. What else have you seen/read? What other myths would you like busted? Drop a comment and let me know!The Exchange EnforcedTimestamps Mailbox Property
While examining mailbox properties, I noticed that the EnforcedTimeStamps property held some information that I just couldn’t explain. Google search was no help, but Microsoft Copilot told me that the information related to the management of compliance holds. Basically, the data are guardrails to help the Managed Folder Assistant do the right thing, which is nice, even if no documentation exists. https://office365itpros.com/2025/12/30/enforcedtimestamps/
Recent Blogs
- Customers still using Exchange 2016 or 2019 should read this update about oldest version of Exchange Server allowed to send email to Exchange Online over the OnPremises connector.Sep 02, 2026
- We wanted to ask how you use Guid, SamAccountName, and DistinguishedName in Exchange Online.Aug 27, 2026
