Your Last Exchange Server Just Got a Deadline

Microsoft doesn't usually tell anyone when Exchange Online raises the minimum version it accepts mail from. The bar has been creeping up quietly with every security update since 2023. On September 2 the Exchange team made an exception and wrote a blog post about it, and the reason they did is the interesting part.

Since the second week of September, an Exchange 2016 or 2019 server that hands mail to Exchange Online through the hybrid inbound connector has to be on the October 2025 security update. That happens to be the last update Microsoft ever released publicly for those two versions. Anything older is now out of date as far as Exchange Online is concerned, which means a report at first, delayed mail a month later, and after three months no mail at all. Microsoft's own comment on the deadline: "This update level was released almost a year ago, and all organizations should have updated to it." Fair enough.

What Happens, Day by Day

Nobody gets cut off overnight. Exchange Online uses the same transport-based enforcement system Microsoft built in 2023, and it turns the screw slowly. For the first 30 days after a server is flagged, nothing changes for anyone. The server just shows up in a report that most admins have never opened. After that it gets uncomfortable in ten-day steps: Exchange Online starts answering with a temporary 450 for five minutes every hour, then ten, then twenty. Your server queues the mail and tries again, so everything still arrives, just late, and the first ticket says something like "the scan took twenty minutes to show up".

From day 61 a permanent 550 joins in. Now the message doesn't wait in a queue, it bounces. And this is the part that bites in a relay setup: the bounce goes back to the sender, and the sender is a scanner in the copy room with a from-address nobody reads. The document is simply gone. From day 91, all of them are.

You can see which servers are affected in the Exchange admin center, under Reports > Mail flow > Out-of-date connecting on-premises Exchange servers. The same page has an Enforcement Pause link, and PowerShell does the same thing:

New-TenantExemptionInfo -BlockingScenario UnpatchedOnPremServer -NumberOfDays 30

Every tenant gets 90 pause days per calendar year, and you can split them however you like. Two things to know before you spend them. The days count from the moment you request them, so patching the next morning doesn't give them back. And a pause only ever buys time; it changes nothing about where this is heading.

Patching Buys Months, Not Years

Installing the October 2025 update takes you off the list, for now. But Microsoft was unusually open about what comes next. In several months, by their own estimate, the minimum version goes up again, and this time to a build that no public update reaches. From that day on only two kinds of servers can still hand mail to Exchange Online: the ones in the paid Extended Security Update program, whose second period ends in October 2026 with no third one planned, and Exchange Server Subscription Edition. If you're on Exchange 2019 CU14 or CU15, you can upgrade to SE in place. Exchange 2016 means a new server and a migration.

So the box that has hummed along in the server room for years without anyone touching it now needs a subscription, a migration project, or a plan to be switched off. There isn't a fourth option anymore, and that, more than the throttling itself, is the news in Microsoft's post.

About That One Server

We see the same picture at most hybrid customers. The mailboxes moved to Exchange Online years ago, and one Exchange server stayed behind with two jobs: it manages recipient attributes in Active Directory, and it relays mail for the printers, the scanners, the monitoring, the ERP, and whatever else in the building still speaks plain SMTP.

The first job hasn't needed a server since 2022. Since Exchange 2019 CU12, the Exchange Management Tools take care of recipient management on their own, and Microsoft's advice is to shut the last server down rather than uninstall it. Which leaves the relay. That's the one job keeping the server alive, and it's also, a little ironically, exactly the traffic this enforcement looks at, because everything the devices hand to that server leaves through the OnPremises connector Exchange Online is now checking.

What to Do This Week

1. Open the report and write down every server on it. If it's empty, that's either good news or a Partner-type connector; the enforcement only looks at the OnPremises kind, for now.
2. Compare the builds with Microsoft's list of build numbers and install the October 2025 update wherever it's missing. For one server that's an evening, not a project.
3. Keep the pause days for a real emergency. Ninety sounds like plenty until you've used sixty of them in the wrong month.
4. Decide what happens after the next bump: ESU until October, Exchange SE, or the off switch.

If the relay is the only reason that server still exists, the fourth decision is the easy one. We built Sendman for exactly that case, but that's a different post.

Sources

• Microsoft Exchange Team: Exchange 2016/2019: Throttling and Blocking up to the Final Public Update Baseline, September 2, 2026
• Microsoft Exchange Team: Throttling and Blocking Email from Persistently Vulnerable Exchange Servers to Exchange Online, May 2023
• Microsoft Exchange Team: How to pause throttling and blocking of out-of-date on-premises Exchange Servers
• Microsoft Exchange Team: Announcing Period 2 Exchange 2016/2019 Extended Security Update (ESU) program
• Microsoft Learn: Manage recipients in Exchange Hybrid environments using Management tools
• heise online: Alte Exchange-Server riskieren Mailblockaden
• CodeTwo: Exchange Online transport enforcement system explained, the minutes per stage in the figure