2016 and 2019 installations must meet the October 2025 baseline to reach cloud-hosted inboxes
Microsoft is upping the ante on Exchange Server security, warning that outdated on-premises systems will soon be blocked from sending email to Exchange Online.
From the second week of September, Exchange Server 2016 and 2019 machines that send email to Exchange Online through an inbound connector of the OnPremises type must be patched to the final public update baseline released in October 2025, according to Microsoft.
"This update level was released almost a year ago," Microsoft stated, "and all organizations should have updated to it."
Microsoft has been advancing its "oldest acceptable version" for some time, but this change takes the baseline to the final public update for Exchange 2016 and 2019. Any subsequent increase would leave only customers enrolled in the Extended Security Update (ESU) program or those who have migrated to Exchange Server Subscription Edition able to meet it.
Organizations may retain on-premises Exchange servers to support hybrid deployments, applications, or other systems that depend on them for email.
According to Microsoft, throttling and blocking apply only to servers sending email to Exchange Online through an inbound OnPremises connector. Other delivery methods are unaffected, and the policy does not necessarily cover "all servers in your organization."
The company added: "This might change in the future," which doesn't sound sinister at all.
Administrators must balance the need to apply security patches promptly against the risk that an update introduces problems of its own – something Microsoft has, to put it delicately, caused in the past.
Some administrators responding to the announcement were more than a little perturbed, although Microsoft has applied throttling and blocking to "significantly out of date" Exchange Server installations for several years.
The announcement gives administrators advance notice of a change Microsoft says would have happened anyway. "With or without this announcement, the change would have been made (just as it was made in the past, without any announcement)," explained Microsoft Principal Project Manager Nino Bilic.
"The bottom line is that admins really need to understand that updating Exchange should be done on time." ®
