The End of On-Prem Exchange: Subscription Edition or a Move to the Cloud?

For businesses hosting their own Exchange, the calendar has run out: Exchange Server 2016 and 2019 stopped receiving security updates in October 2025 — the same day as Windows 10, but the two events do not carry the same weight. An office PC sits behind the firewall; a mail server is internet-facing by definition, because accepting email from the entire world is its job. The mass-exploitation waves that targeted Exchange in past years showed painfully how an unpatched mail server sits at the top of attackers' target lists. Running Exchange without support is therefore not "risky" — it is indefensible.

The Fork: Two Options Remain

Microsoft has ended Exchange's perpetual-licence era; the on-prem successor to 2016/2019 ships as Exchange Server Subscription Edition (SE) under a subscription model. The decision is no longer "buy a licence and run it for a decade" versus cloud — it is between two subscriptions: do you operate the subscription on your own hardware, or in Microsoft's data centre?

Option 1: Exchange Online (Microsoft 365)

Mailboxes move to Microsoft's infrastructure; server maintenance, patch schedules, disk growth and version migrations cease to be your problems. Security patching stops being your night shift. At SMB scale the total cost usually lands below on-prem operation, because the honest calculation includes not just licences but server hardware, backup, power and cooling — and the most expensive line of all, specialist time.

Option 2: Staying On-Prem with Exchange SE

Estates with data-residency obligations, integrations that cannot move, or very specific compliance requirements can continue on-premises. The move from 2019 to SE is technically smooth (in-place upgrade logic); coming from 2016 requires an intermediate step. But it must be a conscious choice: patch discipline, hardening of internet-facing services and mail backup responsibility remain entirely yours.

The Decision Table

Criterion	Exchange Online	Exchange SE (on-prem)
Patching and security responsibility	Microsoft's	Yours — a critical load on an internet-facing server
Hardware/infrastructure cost	None	Server + storage + backup continue
Data-residency control	Limited to region selection	Full control — the main reason for those who need it
Downtime/version-migration burden	Invisible, in the background	Planned off-hours work, on you
Economy of scale (5–100 mailboxes)	Strong	Weak — fixed costs divided by few mailboxes
Custom integrations / legacy application ties	Sometimes a constraint	Flexible

If Migration Is the Decision: the Healthy Sequence

• 1. Mailbox inventory: mailbox counts and sizes, shared mailboxes, distribution groups, and the systems that send mail from applications (scanners, ERP notifications, web forms) — these machine accounts are migration's most forgotten line.
• 2. Domain and DNS records: plan the MX cutover; re-verify SPF/DKIM/DMARC against the new infrastructure — your sending reputation on migration day depends on those records.
• 3. Staged moves: start with pilot mailboxes; schedule move waves off-hours and manage the coexistence period where old and new run side by side.
• 4. Retiring the old server: when migration completes, decommission the on-prem Exchange properly — not "switch off and forget"; leaving no internet-facing remnant services is part of the security work.

What "Carrying On Without Support" Really Means

We do not pretend the "let's stretch it a little longer" option is off the table; it exists in the field, and its picture is precise: an internet-facing, unpatched server holding the entirety of your corporate correspondence. A large share of ransomware incidents begin with email; when the target is the mail server itself, the attacker's path shortens by a full step. Operating with that picture is not an IT decision — it is a board-level risk acceptance, and it should not continue without one in writing.

Yamanlar Bilişim's Role in This Transition

Exchange projects start with a photograph of the current estate: version, mailbox inventory, internet-facing services, integrations. The decision meeting receives a cost-and-risk table for both scenarios specific to you; if migration wins, the move waves, record changes and the old server's safe retirement run as a single project. Where staying on-prem has a genuine justification, the SE transition and hardening are planned instead. Email infrastructure is a standing checklist item in our maintenance agreements.

FAQ