Microsoft to block emails from outdated Exchange servers
Unpatched Exchange 2016/2019 servers will soon be unable to send emails to Exchange Online.
1Microsoft's new security enforcement
Microsoft is implementing a new policy that will block emails from outdated Exchange Server 2016 and 2019 installations starting September 2024. Servers must be updated to the October 2025 public update baseline to maintain email functionality. This affects systems using OnPremises connectors to Exchange Online. Microsoft emphasizes this isn't a new requirement but enforcement of existing standards. The company notes all organizations should have already applied these updates, which were released nearly a year ago.
2Technical requirements explained
The policy specifically targets servers sending mail through inbound OnPremises connectors, leaving other delivery methods unaffected. Microsoft clarifies this doesn't impact all organizational servers immediately. However, the company warns this scope might expand in future updates. Only servers patched to the final public update baseline or enrolled in Extended Security Updates will remain compliant. This marks Microsoft's continued push to phase out outdated Exchange versions while supporting hybrid deployments.
3Administrator challenges
IT administrators face the delicate balance of applying security patches promptly while avoiding potential update-related issues - a concern given Microsoft's patch history. Some administrators expressed frustration, despite Microsoft having enforced similar policies for years against significantly outdated installations. The announcement provides advance notice for a change Microsoft claims would have occurred regardless. Principal Project Manager Nino Bilic emphasized this follows established patterns of silent enforcement.
4Historical context
Microsoft has gradually increased its 'oldest acceptable version' requirements over time. This update brings Exchange 2016/2019 to their final public update baseline. Future increases would leave only ESU-enrolled customers or those migrated to Subscription Edition compliant. The move reflects Microsoft's broader strategy to modernize its email infrastructure while maintaining support for hybrid environments that still require on-premises components for specific applications.
5Impact assessment
Organizations maintaining outdated Exchange servers risk email delivery failures to Exchange Online. While hybrid deployments remain supported, the policy specifically targets email flow through OnPremises connectors. Microsoft's approach allows gradual transition while pressuring updates. The announcement serves as both warning and justification, noting similar unannounced enforcement occurred previously. This creates urgency for administrators to prioritize Exchange updates amid competing infrastructure demands.
6Security implications
The enforcement underscores critical security considerations for email systems. Outdated Exchange servers represent significant vulnerabilities, as demonstrated by past exploitation campaigns. Microsoft's policy aims to reduce attack surfaces by eliminating obsolete versions. However, it creates operational challenges for organizations with complex dependencies. The phased approach balances security needs with practical migration timelines, though some administrators view it as disruptive.
7Future considerations
Microsoft's warning that 'this might change in future' suggests broader enforcement may come. Organizations should evaluate their Exchange infrastructure lifecycle management. The policy highlights the increasing costs of maintaining legacy systems versus cloud migration. While providing temporary relief for hybrid scenarios, the direction clearly favors modernized deployments. Administrators must weigh immediate update burdens against long-term strategic alignment with Microsoft's roadmap.
8Strategic recommendations
Administrators should immediately audit Exchange Server versions and update statuses. Organizations relying on outdated systems must either apply the October 2025 baseline updates or enroll in Extended Security Updates. For long-term planning, migration to Exchange Server Subscription Edition or cloud alternatives should be evaluated. Microsoft's policy change reinforces that timely updates are non-negotiable for maintaining business-critical email functionality in modern hybrid environments.