February 2023 Exchange Security Updates
On February 14, 2023, Microsoft released new security updates rated ‘Important’ for:
- Exchange 2019...
What a year we have had! Who would have thought at the beginning of 2025 that Exchange administrators would be sweating so much? Even though much of it could have been avoided.
Between surprise announcements, nerve-wracking deadlines, and constant concerns about compliance and security, IT teams faced real challenges. Microsoft's introduction of Exchange Server Subscription Edition (SE) in the middle of the year marked an important turning point for the future of on-premises Exchange. In April, Microsoft had a surprise for us. The introduction of a dedicated hybrid app and the depreciation of the Exchange Online shared service principle for authentication.
What lies ahead is a period of upheaval. Especially for administrators who have not actively shaped the change, the upcoming months might bring some surprises. Therefore, it is worth taking a closer look and approaching the next steps with a clear head and a little more composure. At least Microsoft has published some clarity regarding the products following the Modern Lifecycle Policy. The earliest possible end-of-support date for Exchange Server SE is December 31, 2035.
Microsoft has introduced a new servicing approach for the Subscription Edition. In what is known as Modern Servicing, only the current cumulative update is the supported product release. The "N-1" approach, which was valid in the past and treated the current and previous cumulative updates as supported product releases, is now obsolete.
For Exchange administrators, regularly applying updates is crucial to maintaining compliance with current security standards and functional requirements. This is especially important when managing a hybrid Exchange organization. A hybrid Exchange organization has needed the latest updates installed for years.
But what do we know about the upcoming cumulative updates for Exchange Server SE?
With CU1's launch planned for the first half of 2026, Microsoft is not only enhancing stability in Exchange Server SE but also actively pushing forward platform modernization. The adoption of Kerberos for server-to-server authentication further strengthens security within the Exchange infrastructure. TLS 1.3 was already part of Exchange Server 2019 CU15, and therefore Exchange Server SE RTM.
A significant advance is the new Admin API, which was developed specifically for automation scenarios. Administrators benefit from powerful tools that enable them to manage their Exchange environment more efficiently and flexibly.
Equally important is the switch to the C++ 2022 library. The old dependencies on the C++ libraries from 2012 and 2013 caused many administrators and compliance officers headaches.
The discontinuation of Outlook Anywhere was also announced for CU1. Due to customer objections, Outlook Anywhere will remain in place for the time being. We do not yet have any new information on when Outlook Anywhere will finally be discontinued. The complete deactivation of Outlook Anywhere would be an essential step toward a modern and secure Exchange platform. Outlook Anywhere had its time.
CU2 will finally end the transition phase from Exchange Server 2016/2019 to Exchange Server SE.
If the Exchange Server SE CU2 installation routine finds information about older Exchange Server editions in Active Directory, the installation will be aborted. This also applies to subscribed Edge Transport Servers. These must also be updated to Exchange Server SE and resubscribed for the installation of Exchange Server CE CU2.
We do not yet have any further information about new features. The switch to dedicated Exchange Server SE license keys is supposed to take place with Exchange Server SE CU2.
As of October 14, 2025, Exchange Server 2016 and 2019 will be considered permanently discontinued. The risk is considerable: security gaps will remain open, and Microsoft could restrict or block communication with Exchange Online in hybrid scenarios. In addition, the chances of GDPR violations will increase. Alarming is Microsoft's announcement that SMTP connections could be throttled on outdated on-premises servers. These throttling measures are already in place for Exchange Server 2013 and older versions. Microsoft has not yet published a schedule for when exactly they will throttle hybrid connections from Exchange Server 2016/2019 last release builds. The blog post Update on Transport Enforcement System in Exchange Online does not provide reliable details. But these throttling measures are coming.
An active Extended Security Update (ESU) subscription continues to provide security updates for Exchange Server 2016/2019, but will end in April 2026.
Product support for Exchange Server SE will continue until at least December 31, 2035. But you must have active Software Assurance to get updates.
Here's an overview to help you understand your upgrade options for Exchange Server SE.
Effective monitoring is crucial for Exchange SE. Given the complexity of modern environments, hybrid setups, and new update approaches, proactive monitoring becomes necessary. ENow provides a unified Exchange Server Monitoring tool with extensive features, including a central dashboard for visibility, proactive check tools, remote probes, and detailed reports. Early identification of issues helps prevent disruptions and outages, ensuring users and the help desk are not impacted.
The upcoming updates for Exchange Server SE represent a decisive turning point: they are not just routine patches, but mark the definitive end of support for older versions of Exchange. Organizations that continue to use Exchange Server 2016 or 2019 are facing an urgent need for action. The switch to Exchange Server SE, ideally based on Windows Server 2025, not only offers a future-proof platform with enhanced security and performance features, but also complies with Microsoft's current recommendations.
Another important aspect is monitoring: Monitoring the Exchange environment remains essential even after migrating to SE. ENow provides a comprehensive solution that enables high transparency and early problem resolution through central dashboards, proactive checking mechanisms, and detailed reporting. This allows potential disruptions to be detected in good time and serious failures to be prevented.
Additional Microsoft Resources for Exchange Server Support:
Exchange Server SE introduces new servicing requirements, tighter security expectations, and more frequent update cycles. You need full visibility into your hybrid environment to avoid outages, performance degradation, and compliance problems.
See how ENow Exchange Monitoring gives you proactive alerting, health dashboards, and hybrid visibility that keeps your organization protected. Get a Demo of ENow Exchange Monitoring >>
Thomas Stensitzki is a Microsoft MVP, certified Exchange Server Master, and founder of Granikos GmbH & Co. KG, where he helps organizations modernize messaging, collaboration, and cloud security with Microsoft 365 and hybrid solutions. Alongside decades of deep technical expertise, Thomas has recently turned his focus to connecting technology with real-life conversations. He co-hosts the German-language podcast Cloudchroniken (https://cloudchroniken.de/), exploring the stories behind cloud technology, AI, and digital transformation. He also drives Discuss At Ease, an initiative inspired by his 2024 lymphoma diagnosis, creating open dialogue around illness, resilience, and well-being. A prolific speaker and trainer, Thomas shares insights at events like Experts Live and Exchange Summit. He contributes regularly to the Granikos blog, where his “Cumulative Update” series demystifies the latest in Exchange, Microsoft 365, Teams, and Copilot.
On February 14, 2023, Microsoft released new security updates rated ‘Important’ for:
On January 10, 2023, Microsoft released new Security Updates for Exchange 2013 CU23, Exchange 2016...