Exchange Server SE Licensing and Product Keys
It seems that there’s a lot of confusion about licensing and product keys for Exchange Server SE; not just here on the Tech Community, but also on LinkedIn, on Reddit, and in the general Exchange community. So, I thought I would write an article to try to clear up that confusion. Licensing Let’s talk about licensing first. Undoubtedly, changing the name of the product to Exchange Server Subscription Edition caused some of the confusion. Some mistakenly believed it meant that cloud connectivity would now be required for the first time in Exchange Server history. Others thought this meant that Microsoft would start updating on-premises Exchange servers the same way they update Exchange Online. Neither of these things are true—as with all previous versions of Exchange Server, cloud (or Internet) connectivity is not required for Exchange Server SE (although there are some features that do require cloud connectivity to be used, such as the Exchange Emergency Mitigation service and Feature Flighting). Despite the name change, though, the reality is that the https://www.microsoft.com/licensing/terms/productoffering/ExchangeServer/all (and distributions channels) for Exchange Server SE are exactly the same as Exchange Server 2019: there are three licensing options: Server licenses and client access licenses (CALs) that have active Software Assurance (SA); Exchange Online licenses; or CAL equivalency licenses. Purchasing server licenses and CALs with SA is the traditional approach and something that can be done with Exchange Server SE; however, some customers have chosen to purchase cloud licenses or equivalency licenses to modernize their license acquisition and to better manage their licenses. Qualifying cloud licenses that satisfy the Exchange Server SE CAL requirement include https://www.microsoft.com/microsoft-365/exchange/exchange-online, which provides a license equivalent to an Exchange Server Standard CAL, and https://www.microsoft.com/microsoft-365/exchange/compare-microsoft-exchange-online-plans, which provides a license equivalent to an Exchange Server Enterprise CAL, which gives you the right to use advanced features, such as In-Place Archive, In-Place Holds, Information Protection and Compliance, Custom Retention Policies, Per User/DL Journaling, Site Mailboxes – Compliance, Data Loss Prevention, Exchange Online Protection, and Cloud Voicemail. At the higher end of cloud licenses are Microsoft 365 E3 (ME3) and Microsoft 365 E5 (ME5), both of which include https://www.microsoft.com/licensing/terms/productoffering/Microsoft365 for on-premises Office servers, namely Exchange Server, SharePoint Server, and Skype for Business Server, depending on the type of agreement you have with Microsoft. For example, customers with an Enterprise Agreement and ME3 or ME5 licenses can “install any number of copies of” Office server software. In this scenario, though, all users and devices accessing the on-premises Office servers must have an ME3 or ME5 license. Note though that you don’t directly assign the license in this case; you simply need to purchase it. In addition, there are similar https://www.microsoft.com/licensing/terms/productoffering/Microsoft365/MCA available with Microsoft 365 A3 and A5 under the Microsoft Customer Agreement (MCA) program. As I mentioned earlier, these are the same requirements as Exchange Server 2019. So, if you are running Exchange Server 2019 and you have active SA, then you likely already satisfy the license requirements for Exchange Server SE, and you can deploy it in your environment without any additional licensing costs. If you are running an earlier version of Exchange Server and you have active SA or qualifying cloud licenses, then you also likely satisfy the license requirements for Exchange Server SE. But if you don’t have SA or cloud licenses (or a Volume License Agreement), then you will need to purchase qualifying licenses and sign the right agreement to be entitled to Exchange Server SE and updates. However, there is one key difference. Downgrade (aka previous version) rights are no longer available. This is simply because there are no other supported versions, so there’s nothing to downgrade to. So, if you don’t maintain a subscription, you lose the right to install updates and run the product. Product Keys Now let’s talk about product keys. As with previous versions of Exchange Server, there is no product key or license activation. You simply purchase the required licenses (or maintain your existing subscription) to get the rights to use the software and install updates. A product key validates that you have purchased a Standard or Enterprise Edition server license for Exchange Server SE. Without a product key, a server is considered a Trial Edition. The Trial edition operates identically to a Standard Edition server and can be used to evaluate Exchange in a non-production setting for up to 180 days. To continue using the server beyond this period, you must enter a product key; otherwise, the Exchange admin center (EAC) will begin displaying reminders to enter a product key on the server, which you can do using the EAC or the Exchange Management Shell. Although the EAC will display a warning when the trial period expires, there’s no loss of functionality, and the software will continue to operate as if it were licensed (except for the warning messages). If you are doing an in-place upgrade of a running Exchange Server 2019 that has an existing valid product key, the RTM version of Exchange Server SE will continue to use that key. This was done on purpose to support a smooth in-place upgrade. If you are doing a fresh install of Exchange Server SE RTM (which includes legacy upgrades from Exchange Server 2016), you can also enter a product key Exchange Server 2019, which you can get from the Volume License page in the Microsoft 365 admin center (after you’ve signed your agreement with Microsoft). Exchange Server SE is available in four Editions: Enterprise, which supports a maximum of 100 mounted databases per server. Standard, which supports a maximum of 5 mounted databases per server. StandardEvaluation, which is a 180-day time-limited Standard Trial Edition. Coexistence (aka Hybrid Deployment), which maintains the hybrid relationship with Exchange Online. As an aside, a mounted database is a database that's in use (an active mailbox database that's mounted for use by clients or a passive mailbox database that's mounted for log replication and replay). While you can create more databases than the described limits, you can only mount the maximum number of databases that are allowed by the Edition of Exchange, as determined by the product key. Note that recovery databases don’t count towards these limits. When you enter a valid product key, the supported edition for the server is established. You can use a valid product key to move from the Trial Edition to either Standard Edition or Enterprise Edition. Again, no loss of functionality occurs after the Trial Edition expires, so you can maintain lab, demo, training, and other non-production environments beyond 180 days without having to reinstall the Trial Edition of Exchange or enter a product key. You can use a valid product key to move from Standard Edition to Enterprise Edition, but you can't use a valid product key to downgrade from Enterprise Edition to Standard Edition or revert to a Trial Edition. You can only do these types of downgrades by uninstalling Exchange, reinstalling Exchange, and entering the correct product key. Product keys also apply to Edge Transport servers. When you create an Edge Subscription, the Edition of Edge Transport server is captured (as determined by the presence or absence of a product key). Edge Transport servers support two Editions: Trial or Standard. Enterprise doesn’t apply because there are no Enterprise features or mailbox databases on Edge Transport servers. Hybrid doesn’t apply because you can’t use an Edge Transport server as a hybrid server. If you create an Edge Subscription for an Edge Transport server that is a Trial Edition, it will appear as unlicensed to the internal organization. If you then enter a product key on a subscribed Edge Transport server, the server will reflect the change to Standard immediately, but the internal organization will not. To update the internal organization information, you must remove and recreate the Edge Subscription. If you don’t, the internal organization will continue to see the Edge Transport server as unlicensed, which is only cosmetic in nature (e.g., no changes in functionality). However, for compliance, auditing, etc., it is considered a best practice to recreate the Edge Subscription. As in previous versions, the Hybrid Configuration Wizard (HCW) provides the license for Hybrid servers, so it is expected that you have not entered a product key on the server. To obtain the Hybrid server license, click license this server now in the HCW and authenticate to your tenant. The HCW will update the product key on the server and refresh the page, and depending on replication latency, it might not update the Version from StandardEvaluation Edition to Coexistence Edition (Hybrid Deployment). However, you can verify the license using Get-ExchangeServer or simply toggle between the two on-premises server options in the HCW, which triggers detection and should choose the same server with updated properties. Final Note Although the Exchange Server 2019 product keys work with Exchange Server SE RTM, it is expected that new product keys specific to Exchange Server SE will be made available with Exchange Server SE CU1, which is expected in H1 of 2026. When the new keys are issues, they will be available from the Volume License area of the Microsoft 365 admin center, along with the CU1 download. I hope this clears up any confusion regarding licensing and product keys for Exchange Server SE.Exchange database dismounted due to NTFS file extent limit reached – unexpected outage
Hi everyone, We experienced a serious outage on our Exchange 2016 server recently, and I wanted to share what we found during the root cause analysis – in case it helps someone else avoid the same scenario. Summary: After digging deep, we discovered that the issue was caused by the NTFS file system hitting its internal file extent limit on the .edb file. Once this threshold was reached, the database could no longer grow, and the system dismounted the database unexpectedly. No prior warning, just service interruption. Details: The .edb was around 1.2 TB in size. This isn’t a limit on database size itself — it’s about how fragmented the file is on disk. Once NTFS couldn’t track any more extents, the database stopped working. Microsoft doesn’t publish a clear fix for this; only scattered references to similar behavior in past cases. What we did: Created a fresh, clean database. Manually moved user mailboxes into the new DB. The old database couldn't be mounted anymore, so we brought the system live without historical mail – just to maintain continuity. We're now working on extracting data from the unmounted .edb using third-party tools. Looking for thoughts: Has anyone else hit the NTFS extent wall with Exchange? How do you monitor extent growth proactively? Did switching to ReFS solve this for you long-term? Open to any input or similar experiences – appreciate it in advance. Thanks!
OL client in-app link for getting OL for iOS or Android not working
Hello! Redirected to this forum from here: https://learn.microsoft.com/en-us/answers/questions/5617563/ol-desktop-link-broken-file-get-ol-app-for-ios-and See error description and attempt to solve it by following the link. For some reason, Windows clients in our organization can not follow the Outlook desktop client in-app link for getting Outlook for iOS or Android. (hybrid, no mailboxes in MS-cloud, only on prem) The link for getting the Outlook app for iOS and Android under File when logged into Outlook app does not seem to work. Clicking on it seems to send user to the URL: go.microsoft.com/fwlink/?LinkId=2112779 but quickly redirects and ends up with https://w2.outlook.com/l/mobile?WT.mc_id=Backstage**Win32**All**Hyperlink** https://learn-attachment.microsoft.com/api/attachments/cb7d456f-ac6e-4566-a4ef-ffa912500423?platform=QnAhttps://learn-attachment.microsoft.com/api/attachments/cb7d456f-ac6e-4566-a4ef-ffa912500423?platform=QnA We haven't been able to figure out why, but since the same two different accounts mentioned in the thread above works on a private device on a private home network, is seems like something in our environment is the cause.
Scoping application Crestron to access only room mailboxes of resourcetype Workspace
We got a requirement for to enable application Crestron to be able to access Workspace resourcetype Room mailboxes only. So, we thought of directly tieing the application to these mailboxes over the usual way of assigning it to a group because we had to create a group just for to maintain this delegation. Below are the steps we performed: #Create management scope Connect-ExchangeOnline New-ManagementScope -Name "Workspace Mailboxes" ` -RecipientRestrictionFilter "((RecipientTypeDetails -eq 'RoomMailbox') -and (ResourceType -eq 'Workspace'))" #Assign the management scope to Roles New-ManagementRoleAssignment ` -App "<AppID>" ` -Role "Application Calendars.ReadWrite" ` -CustomResourceScope "Workspace Mailboxes" ` -Name "MyApp-WorkspaceOnly" New-ManagementRoleAssignment ` -App "<AppID>" ` -Role "Application MailboxSettings.Read" ` -CustomResourceScope "Workspace Mailboxes" ` -Name "MyApp-WorkspaceOnly-Settings" #Verified the assignment via: Get-ManagementRoleAssignment -App "<AppID>" | ft Name, Role, CustomResourceScope Name Role CustomResourceScope ---- ---- ------------------- MyApp-WorkspaceOnly Application Calendars.ReadWrite Workspace Mailboxes MyApp-WorkspaceOnly-Settings Application MailboxSettings.Read Workspace Mailboxes Tested the scope of the assignment with a non-workspace mailbox and a workspace mailbox, the scope resulted false for non-workspace mailbox and true for a workspace mailbox. Later, admin consented for API permissions Calendars.ReadWrite, Mailboxsettings.Read & User.Read.All and generated an application secret with validity of 180 days to the application team and shared the secret key. ISSUE: When application team tested the access from Crestron application for a workspace mailbox it is resulting in Authentication Failed. This is the actual issue. In order to test whether this is happening because of scope , performed the below steps: $TenantId = "<TenantID>" $AppId = "<AppID>" $ClientSecret = "<ClientSecret>" $Body = @{ grant_type = "client_credentials" client_id = $AppId client_secret = $ClientSecret scope = "https://graph.microsoft.com/.default" } $TokenRequest = Invoke-RestMethod -Uri "https://login.microsoftonline.com/$TenantId/oauth2/v2.0/token" ` -Method POST -Body $Body $AccessToken = $TokenRequest.access_token $WorkspaceMailbox = "<email address removed for privacy reasons>" Invoke-RestMethod ` -Uri "https://graph.microsoft.com/v1.0/users/$WorkspaceMailbox/events" ` -Headers @{Authorization = "Bearer $AccessToken"} The expected results for this test was to receive Workspace mailbox → Returns events. Non-Workspace mailbox → Should return 403 Forbidden. However, it resulted events in both the cases, when dug further I realised that Graph API will override the management scopes created at Exchange level, so need guidance on how we can take this further.
Exchange SE product key Clarity
Hi All, After installing the Exchange SE server, the following parameters appeared when I ran the command. Can we leave these statuses as they are until Microsoft provides the new CU and product key ? Please confirm Get-ExchangeServer -Identity newse | fl fqdn,product*,*edition* Fqdn : NewSE.test.local ProductID : Edition : StandardEvaluation IsExchangeTrialEdition : True IsExpiredExchangeTrialEdition : False
What to do? SE or Decommission
I’ll start by outlining our current environment for context: Two standalone Exchange Server 2016 VMs. Primarily used for recipient management in a hybrid setup. Also functions as an anonymous relay for two LOB applications — one of which requires the mail service to reside on the same network as the application (as per vendor requirement). We have not opted for Extended Support (ESU) and installed the latest available Security Update last week. Management has been presented with the following options to move forward: 1) Perform a legacy upgrade — build two new servers and migrate from Exchange 2016 to Subscription Edition (SE). 2) Migrate LOB applications to another SMTP service — this would allow continued use of Exchange Management Shell for recipient management (by setting up a new server, preparing the schema for SE, and following Microsoft’s decommissioning process). 3) Migrate both LOB applications to another SMTP service and management to alternative platforms such as Easy365 or ManageEngine, removing the dependency on Exchange entirely. This post is mainly to gather some insights and general discussion around the best path forward. From a risk management perspective, since we’re effectively sitting on a time bomb without further Microsoft updates, I’m leaning toward option 2, especially given that all mailboxes have long been migrated to Exchange Online. What should I be watching out for with this approach? It seems many have taken a similar path — I’d appreciate hearing about any challenges or pitfalls you encountered and how you mitigated them during implementation.Issue with DnsConnectorDelivery
Background: We are currently migrating from Exchange 2016 to 2019 in a hybrid environment. We have 2 2016 servers both in our main datacenter, and 2 2019 servers, one in our main datacenter and one in our offsite datacenter. Backup datacenter has its own DCs that are replicas of our main datacenter's DCs. Exchange 2019 has been installed and updated to CU 11. Problem: When I run the hybrid configuration wizard and select all 4 servers to be included in the send and receive connectors, everything completes and no errors appear. However, mail gets stuck in the DnsConnectorDelivery queue on the server in our backup datacenter. The NextHopDomain for the stuck mail is our M365 domain, domain.mail.onmicrosoft.com As soon as I remove the server in the backup site from the send and receive connectors, mail flows correctly again. I've done a lot of internet searching and it seems the issue has something to do with our MX record, but both domains have the correct record in their DNS. What could be causing the issue? Any help is appreciated!
