Exchange 2016 Patch availability - can someone confirm that monthly patches are only for latest CU

[TwistNShout]

We are looking to upgrade an existing on premise Exchange 2010 organisation to Exchange 2016.

Reading the below, my highlight in bold

https://docs.microsoft.com/en-us/Exchange/new-features/updates?redirectedfrom=MSDN&view=exchserver-2...

"Exchange follows a quarterly delivery model to release Cumulative Updates (CUs) that address customer-reported issues and to possibly add new functionality and/or features. Critical product updates (packages that address a Microsoft-released security bulletin or contain a change in time zone definitions) are released as needed on a monthly basis for the most recently released CU and the preceding CU."

Which suggests to us that if we deploy CU14, CU15 will be released in December and CU16 in March 2020 – therefore after March 2020 we will need to upgrade because after that date monthly patches will no longer be released for CU14. This even though we will have been applying the monthly patches.

Before I set in place a process with our team that an update is required every quarter, can someone confirm that we are reading this correctly please?

Thanks in advance

[#2 · Accepted solution]

We only issue security patches for the current and previous CU. We also roll them in to the next CU.

Put it another way: If you install with CU14 and we have to issue a security patch, we'll release the patch for CU14 and CU13. When CU15 becomes available and if we have to issue a security patch we'll release it for CU15 and CU14.

A quarter later we release CU16, and again, some security issue. We will release security patches for CU16 and CU15 only.

If you are still on CU14, no patch for you.

So you should always try to be current, or worst case be one CU behind, or you won't get security patches.

Hope that's clear enough.

[#3]

@Greg Taylor - EXCHANGE 

Thanks Greg,

That confirms exactly how we read it, I was just hoping we had read it wrong ;)