Exchange Server 2016 and the End of Mainstream Support

[The_Exchange_Team]

UPDATE 2/12/21

The Exchange Sustained Engineering Team continued servicing all customer issues for Exchange 2016 that were opened with Microsoft by the end of Mainstream Support, which was Oct 13, 2020. Some of these cases were being worked on by customers and Microsoft into the new year, with fixes being approved though the end of January. As such, not all fixes will be in the soon-to-be-shipped March update (CU20), as code stabilization and quality targets do not allow us to take changes that late in the shipping cycle. Therefore, we have decided to extend out one more CU and we will be shipping CU21 in June 2021. New cases are not being considered for CU21; this is only to complete our commitment to fix what was approved from the cases that were logged prior to the end of Mainstream Support. Microsoft encourages Exchange Server 2016 customers to adopt CU21 as soon as possible after it’s released in June, 2021 to ensure uninterrupted delivery of any future security related fixes. After June 15, 2021, only CU21 or its successors will receive updates. During the Extended Support phase, only the latest CU is eligible to receive updates once the standard 3 month transition period of the prior CU has lapsed.

----------------------------------------------------------------------------------------------

As hopefully many of you already know Exchange Server 2016 enters the Extended Support phase of its product lifecycle on October 14^th 2020. That’s just a few short months away.

During Extended Support, products receive only updates defined as by the Fixed Life Cycle. For Exchange Server 2016, Fixed Life Cycle will include any required product updates due to security and time zone definition changes. With the transition of Exchange Server 2016 to Extended Support, the quarterly release schedule of cumulative updates (CU) will end. The last planned CU for Exchange Server 2016, CU20, will be released in March 2021. This is a change from earlier blog notes because it became clear that CU19 in December 2020, was too close the end of Mainstream Support to process all of the cases that came in by Oct 13th.   

There is one more consideration for this change that we want to address here today, and that is the ongoing use of Exchange Server 2016 for recipient management for hybrid organizations that have moved all their mailboxes to the cloud.

As you probably also know we have historically provided a free license for these ‘management’ servers if their only use is to properly manage Exchange attributes when recipient objects are mastered on-premises. You also know that we never provided this free license type for Exchange Server 2019.

We want to assure you that we are still committed to delivering a solution that will allow these lingering servers to be removed, but it will not arrive before Exchange Server 2016 enters Extended Support.

For this reason, we want to make our recommendation for this scenario clear. Our broad recommendation is to keep Exchange Server 2016 in production use until such point as we release a solution that allows those servers to be removed. As explained earlier, Extended Support still provides security and time zone updates and so keeping them in production and ensuring they are properly patched does not increase your risk profile in any way.

If you can’t move your mailboxes to the cloud and you plan on keeping mailboxes on-premises, then you really should be moving to Exchange Server 2019, and using that for both mailboxes and hybrid connectivity. That way you get full support including non-critical bug fixes and get ongoing product improvements.

When we have a solution available to allow any management-only servers to be removed, it may require an update to Exchange Server 2016, and in that case we may release a future CU or patch. Currently there is no plan to release future updates for Exchange 2016, but we want to assure our customers that if we need to do this to support the removal of these ‘management only’ servers, we will.  

Microsoft encourages Exchange Server 2016 customers to adopt CU20 as soon as possible to ensure uninterrupted delivery of any future security related fixes. After March 16, 2021, only CU20 or its successors will receive updates. During the Extended Support phase, only the latest CU is eligible to receive updates once the standard 3 month transition period of the prior CU has lapsed.  

Updates will continue to be made available via Windows Update and the Microsoft Download Center. Additional lifecycle information for all Microsoft products is available on docs.microsoft.com.

We hope this update was informative and we look forward to hearing your feedback and answering any questions you may still have.

The Exchange Team

[Jpanski]

Great information. Thank you for the update.

We have just completed our migration from 2010 to cloud with a 2016 management server. In our case our 2016 management server has just the 8 system mailboxes left and is also used for internal applications to relay mail. In this case would the recommendation be to move to 2019, stay on 2016 or something else? We are not sure when we can move our internal applications to send using 365.

Thank you.

[halbp]

The issue with Hybrid is that there is a free license key available for 2016 but not for 2019. You need to update the HCW so we can use 2019 for Hybrid without paying for a license when it is just used for management.

[Greg Taylor - EXCHANGE]

@Jpanski - in your case I'd say just stick with 2016, keep it up to date with security patches and figure out how to move those apps. 

@halbp - did you read the article? We're not going to do that. You can keep using 2016. 

[Jpanski]

@Greg Taylor - EXCHANGE Thanks Greg.  I read the article to set up relay through 365, option 3, but it's so confusing.  There was also no mention if that scenario would work if our current situation required adding the ms-Exch-SMTP-Accept-Any-Recipient permission for anonymous relay.  If not, I don't know how we'll ever get off the on-premise server.  For now since we need that box anyway it hasn't been an issue but certainly could be once the management server is no longer needed.  Thanks again.

[halbp]

@Greg Taylor - EXCHANGE yes but why not just allow use of 2019 which will still be in mainstream support, given that it also supports hybrid? I don’t understand why 2016 would be free and 2019 wouldn’t be, it’s a pointless limitation.

[AnthonyNZ]

@Greg Taylor - EXCHANGE - Thanks for the update and clarification Greg.

Can you give us any insight into the development of the final "solution"?

How it's tracking, potential timeline, photo's of some poor geezer rocking back and forth under his desk in anguish?

I've not seen any mention of it in over a year, if you can link to a roadmap that would be fantastic.

Last mentioned here:

https://techcommunity.microsoft.com/t5/exchange-team-blog/faqs-from-exchange-and-outlook-booths-at-2...

[Kevin_Davis]

@Greg Taylor - EXCHANGE Thanks for the blog. Is there somewhere I can monitor for updates on this?

We have a number of sites with active directory and Azure AD Connect to sync user passwords with their MS365 business apps identity. A lot of these sites never had Exchange, they used a 3rd party email provider. We now want to add a mailbox to their MS365 account, but as soon as we tell the customer that in order to do so Microsoft expect them to provision a full blown Exchange 2016 server on-premise, with the hardware, installation and ongoing maintenance cost that brings just to manage a few AD user attributes, it becomes a deal breaker. None of them can remove on-premise active directory due to application software requirements, but one or two have reluctantly opted to remove Azure AD Connect - not an ideal 'solution'. 

The sites that did have a few Exchange servers in their estate are quite happy to reduce that to just one for management purposes - but they are coming from a completely different start point than those sites who never had Exchange.

Best,

Kevin

[Greg Taylor - EXCHANGE]

@Kevin_Davis Hi Kevin, this blog is the place to watch for news. And if you follow me on Twitter (@gregtaylor_msft) I'll usually tweet when we post new articles. RSS is so 1990's.  

[Jeremy Bradshaw]

@Greg Taylor - EXCHANGE is there some particular reason that Exchange 2019 doesn't get free hybrid keys?  It's a harsh 180 turn to suddenly take that away after having the option 3 Exchange versions in a row previously.  The only thing I've seen said about this in this blog and the comments is that the answer is "No" and that won't change.  Have not yet seen the reason for the decision.

[halbp]

@Jeremy Bradshaw I agree, we don't even know what the 'final' solution looks like, and it is likely that many organisations will need to keep using Exchange hybrid for quite some time anyway due to other reasons e.g. support processes, powershell scripts, mail relay etc. So why not let them keep using it, given that we've been forced to use it all these we may as well be allowed to use the current version in mainstream support.

[Greg Taylor - EXCHANGE]

@Jeremy Bradshaw  and @halbp  - let me try and add some context. I don't expect everyone will agree, but you wanted to understand the reason so I'll try and explain. The reason simply is that we chose to only distribute 2019 via VLSC and not via broad public download. Which means not everyone has access to the bits, which makes handing out a free key tricky. So that is the main reason for it, to support our change to distribution for 2019. Why did we choose to switch to distributing only via VLSC? We released 2019 and were very clear (I know, as I did the announcement) that we believe all our customers should be moving to the cloud, particularly the smaller companies who don't buy via a VL program, and this is one way to make that happen. We receive little to no feedback on ability to access the bits from customers. Meaning, those customers that are licensed and want to install it, can get it. 

What is also true is that if you are using 2016 or 2019 just for recipient management - there's no functional advantage to 2019. So there's no reason to deploy 2019, with its increased hardware requirements just for hybrid recipient management. Use 2016, it's free and 2019 only complicates things in that scenario. 

@halbp if you are using Exchange on-prem in the long term for much more than just recipient management, for those things you listed, then expecting us to give you that server for free is where we will probably have to disagree - I think you should pay for that type of usage. If you just want a free mail relay, you don't need Exchange. If you want to use Exchange for features only Exchange can provide - and for more than just recipient management (for which we will ship code to negate the need for it) - you should buy a license for it. 

[Kevin_Davis]

@Greg Taylor - EXCHANGE thanks for the clarification, I assumed it was something to do with the long-term roadmap of moving to the cloud.

To give a little more context to the SME environment, we are looking at moving our own server infrastructure to be cloud based (lead by example) and have done most of it such as placing all our shared files on OneDrive or Sharepoint, and have MS365 for Office Apps and email. The next step in our plan is to remove on-prem Exchange, but for that we need to make our user accounts cloud based, and not synced via Azure AD Connect. Simple enough in itself to break the sync and recover the user from Deleted Users, but our on-prem ADDS is used to sync all sorts of other SSO integrations, such as LDAP to our MFA solution (WatchGuard AuthPoint) our RMM platform, client documentation platform, etc. It very quickly opens a can of worms to say "make the users cloud based", as I expect is the case with most SME's - certainly is with most of our clients with ADDS. Having in-cloud user accounts will also allow us to use that account to register new devices such as laptops during initial setup and login as the MS365/Azure account, instead of having to join the laptop to on-prem active directory, with all the associated remote working/VPN complications that brings.

We are now turning our attention to Azure ADDS (which it seems is different to the rather badly named "Azure AD"), so will see how that goes.

All of that means, for now, that we still have to rely on Exchange for MS365 tenants with Azure AD Connect, and are very keen to get to a point where on-prem Exchange with all the additional hardware and support costs, is no longer a requirement.

Best,

Kevin

[halbp]

Thanks for the response @Greg Taylor - EXCHANGE 

Yes I understand Exchange 2016 is fine for current hybrid, but my point was that companies have complex JML processes built around using Exchange on-prem to manage mailboxes, and whilst we have a few more years in support obviously the clock is ticking. We don't know what the new solution looks like, but hopefully it will offer a similar level of automation.

Also, I did not think that using Exchange hybrid for mail relay goes against the license terms, assuming there are no mailboxes? Yes we normally use another SMTP server, but for smaller environments if there is already an Exchange server it makes sense to use that.

[Jeremy Bradshaw]

@Greg Taylor - EXCHANGE yes, thanks for the response.

I do disagree with most of it but will save us all the bother and just forget about it.  I miss the good old days of Exchange already :crying_face:.  It was a good run.

[MichaelHess]

@Greg Taylor - EXCHANGE 

What's about a Hybrid Configuration with Exchange 2016 when you are using Exchange Online Archiving?

At the moment it's required that you are on the current or current-1 CU versions to be supported with Exchange Online Archiving.

When no new CU will be deployed, does that mean we'll be in an unsupported scenario for Hybrid? 

Best regards,

Michael

[Greg Taylor - EXCHANGE]

@Kevin_Davis - we want that last statement you made too. We're still working on making it a reality. 

@halbp - If you are using that last server for Hybrid recipient management it's ok to use it. But once you are not, you need to license the box. 

@Jeremy Bradshaw - we all do sometimes, it's ok. 

@MichaelHess - Not sure I understand. The primary mailbox is where? On-Prem? on 2016? Stay on the latest CU we issue, you'll be in Extended Support, but it's supported. 

[Jeremy Bradshaw]

@Greg Taylor - EXCHANGE thanks!

[MichaelHess]

@Greg Taylor - EXCHANGE , thanks for the response.

Our primary mailboxes are still OnPrem on Exchange 2016 but Hybrid setup is done and the migration to Exchange Online will be done in the future (during 2021). For the OnPrem mailboxes we have already started to deploy Exchange Online Archives in advance of the primary mailbox migration.

[omar_campos]

Hello, I wasn't sure exactly where to pose this question: We are currently running Exchange 2016 on prem in a hybrid environment with O365. Most of our mailboxes are in the cloud but we do have an on-prem database with some on-prem mailboxes. 

We are planning on upgrading to Exchange 2019 very soon. I was reading a detailed series of blog posts that talk about installing Exchange Server 2019, and they mention having to prepare Active Directory and extending the AD schema for Exchange 2019. Is this true even if we are running Exchange 2016? Do we still have to prepare AD and extend the schema, or does that only apply if you're installing Exchange for the very first time in your organization?

Thank you!

[AnthonyNZ]

@Greg Taylor - EXCHANGE 

@halbp 

I believe the statement made earlier is incorrect regarding the use rights of Hybrid licence key for mail relay and user management automation scripts.

The guidance has always been that the Hybrid licence key rights are fine so long as there are no Mailbox workloads hosted on the server.  

This statement is made in the licensing FAQ and the guidance has also been updated to reflect the fact that 2019 servers are not eligible, so it appears to be an active guidance.

Refer here:  https://www.microsoft.com/en-us/microsoft-365/exchange/microsoft-exchange-licensing-faq-email-for-bu...

"If you do not host any mailboxes on the servers used to connect to Microsoft 365 you can license them using the Microsoft 365 Hybrid Configuration Wizard (HCW) which you can find here. The HCW validates your Microsoft 365 subscription and installs the appropriate licenses on your servers. Note that the free Exchange Server license is not available for Exchange 2019 hybrid servers."

It is also worthwhile checking with your licence agreement provider, as you may already be entitled to run Exchange Server on-premises under some M365 licensing agreements.

Although I know this will not be of comfort to many smaller seat customers, if eligible it will provide a mail relaying solution in the future, if the Hybrid use licence becomes deprecated.

[Rakesh Chauhan]

Hi @Greg Taylor - EXCHANGE - don't worry, you can ignore my question : )

[Greg Taylor - EXCHANGE]

@Rakesh Chauhan - I didn't go yet. What potential solution are you referring to? Sorry, not clear to me. 

[TLS]

Hello 

My Current Exchange Version : EXCHANGE 2016 (CU17)

Single Server with Two DBs

I don;t have any test environment.

I am planning to upgrade directly to CU19.But i got reviews from customers there are the problems in CU18 and CU19, 

Also customers are reported to MS.

Now MS is going to release CU20 next month (March 16) with all fix including vulnerability.

What do you suggest to should i go for CU19 directly or await for CU20?

Please advise

[halbp]

Can we have an update on the new solution for Hybrid please, or at least let us use 2019?

[Thomas Stensitzki]

@TLS 
Exchange 2016 CU17 is not a supported cumulative update. If you want to operate your Exchange Org in a supported setup, I'd recommend updating to the most recent CU, and update to a future CU as soon as it's released.
-Thomas

[TLS]

Thank you Thomas,

Currently Exchange2016 CU19 is the latest patch can i proceed with CU19?

Any known issue in this latest CU19? after upgrading CU17 to CU19?

Please advise- Thanks

[FlySlinger2]

@Greg Taylor - EXCHANGE @The_Exchange_Team 

I recently stumbled onto this via multiple other links.  I would caution MS on it's aggressive approach to forcing everyone to the cloud and forgetting that there are MANY disconnected/air-gapped networks where MS products are the only approved tool.  I support 3 of those types of environments in my current role. I use 2 more for a total of 5. I just submitted design plans for a 6th totally disconnected network.

Cloud is NOT the end all be all. 

[wrahman]

@Lukas Sassl , kindly guide plesae

This article states

"After June 15, 2021, only CU21 or its successors will receive updates" but we have received SU July for CU 20 as well.

We are at CU 19 and looking to apply July SU's which we know are only applicable to CU20 and CU 21.

We currently do have third party applications which have not yet announced support for CU 21 and we have registered support cases with them for a time line.

My point is if we go for CU 20 and apply July SU's then according t this article only CU 21 will get any future security updates, so should we target 21 or go with CU 20, because not looking to perform another CU update repeat in few days, hence looking for advise.

Can we have at least support End date for CU20 anywhere? As per documentation (n-1) rule, CU20 was released on March 16th and CU 21 released on June 29th , so CU 20 will be supported till 29th September 2021, please assist if this is correct prediction for support end date for CU 20. This will help us to make a decision for CU 20 because for 21 need to wait for support announcements from vendors e.g. backup sofware vendor etc.

[Siegfried_Beitl1090]

I was under the impression that CU21 was the last CU but now we have CU22. Was CU22 the last cumulative update?