Exchange SE is a service migration, not just a software upgrade
Exchange Server Subscription Edition (SE) is the servicing path for organizations retaining on-premises Exchange. Exchange 2016 and 2019 reached end of support on October 14, 2025; updates available through the Extended Security Update program do not restore mainstream support. Minimize time on those releases while protecting mail flow and hybrid functions.
Installing the new server and moving mailboxes is only part of the job. SMTP relay devices, transport connectors, OAuth certificates, namespaces and application dependencies often remain tied to the old infrastructure. Success means mail delivers, calendar sharing works and recovery has been tested.
Pick the supported path first
Microsoft allows SE RTM to install over Exchange 2019 CU14/CU15 and join existing Exchange 2016 or 2019 organizations. That does not create a direct in-place path from Exchange 2016. Coexistence rules change with cumulative updates: Microsoft now distinguishes CU1 from CU2. Check the support matrix for the actual build and media rather than relying on an old release timetable.
If you also need a new Windows Server version or new hardware, plan a fresh SE server instead of upgrading the host OS underneath Exchange.
| Starting point | Baseline path | Watch for |
|---|---|---|
| Exchange 2019 CU14 or CU15 | In-place upgrade to SE RTM or new SE server with side-by-side migration | An in-place major OS upgrade with Exchange installed is unsupported |
| Earlier Exchange 2019 | Upgrade Exchange to an eligible CU, then SE; or plan a new server against the support matrix | Validate prerequisites, backup agents and free space at each step |
| Exchange 2016 CU23 | Introduce SE RTM into the organization and migrate resources; there is no direct 2016-to-SE in-place upgrade | Keep coexistence only as long as dependencies require it |
| Hybrid for recipient management only | Consider recipient management tools without a running server | Only when no on-premises feature still needs Exchange |
Inventory what the mailbox list cannot show
Map incoming and outbound mail paths and identify an owner for every dependency before changing anything. Include:
- Servers, DAG members, database copies, user, arbitration, discovery, audit and archive mailboxes; public folders and their consumers.
- MX, Autodiscover, internal and external URLs, load balancers, firewalls, NAT, TLS certificates and the current and next OAuth auth certificates.
- Send and receive connectors, relay IP allowlists, transport rules, accepted domains, journaling, printers and applications using SMTP.
- Hybrid Configuration Wizard (HCW), Exchange Online connectors, centralized mail transport if configured, migration endpoints, calendar sharing, and classic versus Modern Hybrid Agent.
- Application-consistent backups, isolated restore tests, monitoring, documented antivirus exclusions, storage capacity and change windows.
Read-only inventory commands
Run the applicable commands in Exchange Management Shell with authorized read permissions. Use the outputs as a before-and-after baseline, not as proof that hybrid traffic works. Keep exports in a secured workspace.
Get-ExchangeServer | Select-Object Name,Edition,AdminDisplayVersion,Site
Get-MailboxDatabase -Status | Select-Object Name,Server,Mounted,DatabaseSize
Get-MailboxDatabaseCopyStatus * | Select-Object Name,Status,CopyQueueLength,ReplayQueueLength
Get-Queue | Select-Object Identity,Status,MessageCount
# AdminDisplayVersion does not prove which SU/HU is installed.
(Get-Command ExSetup.exe).FileVersionInfo | Select-Object FileVersionGet-ExchangeCertificate | Select-Object FriendlyName,Thumbprint,NotAfter,Services
Get-AuthConfig | Format-List CurrentCertificateThumbprint,NextCertificateThumbprint
Get-SendConnector | Select-Object Name,AddressSpaces,SmartHosts,TlsAuthLevel
Get-ReceiveConnector | Select-Object Identity,Bindings,RemoteIPRanges,AuthMechanism
Get-HybridConfiguration | Format-List
Get-MigrationEndpoint | Select-Object Identity,EndpointType,RemoteServer
Get-OrganizationRelationship | Select-Object Name,Enabled,TargetSharingEpr
Get-IntraOrganizationConnector | Select-Object Name,Enabled,DiscoveryEndpointPrepare Active Directory, Windows and the SE server
Check the support matrix for the exact Windows Server build, domain controllers, forest functional level, .NET version, storage, ports and software integrated with Exchange. Windows Server 2019, 2022 and 2025 are listed for SE, subject to the documented combinations and updates. A forest using a Windows Server 2025 schema master has additional requirements; follow Microsoft's November 2025 cumulative-update prerequisite before preparing AD.
Schedule schema and domain preparation with the required permissions and replication checks. Protect the AD recovery path; a schema change is not reversed by simply uninstalling Exchange. For a side-by-side installation, confirm database and log capacity, DNS, network reachability, certificates and redundancy before moving a pilot user.
Keep the two change paths separate
If on-premises mailboxes or public folders remain, include special-purpose resources and keep old databases available until validation. A non-application-consistent VM snapshot is not a substitute for a restorable Exchange backup.
- In place from 2019 CU14/CU15: health-check the server, drain traffic or components as appropriate, run setup with compatible SE media, apply the appropriate security update and validate services. Plan server restoration; uninstalling SE is not an instant rollback to 2019.
- Side by side from 2016 or for a Windows refresh: introduce SE into the existing organization, secure namespaces/certificates and mail paths, migrate mailboxes and dependencies in batches, and retire legacy servers only after full validation.
- For a DAG, change one member at a time and check copy health and failover. Do not combine all DAG changes and namespace cutovers in a single window.
- Before every step, confirm the actual security-update build: the CU reported by Get-ExchangeServer does not necessarily reveal installed SUs.
Hybrid: the dedicated app, OAuth and the Graph transition
Mail routing, mailbox moves and rich coexistence are separate mechanisms. Since October 31, 2025, the old shared service principal can no longer make the hybrid EWS calls required for features such as some availability lookups. Organizations relying on those features need a dedicated Microsoft Entra hybrid application on supported Exchange builds and an OAuth test. HCW may create the app, but enabling the Exchange feature is a separate step.
Since the May 2026 Exchange SE hotfix, the Microsoft Graph-based hybrid flow supports free/busy and profile pictures; MailTips supports automatic replies only, and Move to Archive is not supported through Graph. EWS remains necessary for unsupported scenarios. Confirm support in the applicable Microsoft 365 cloud: Graph hybrid is not uniformly available in sovereign clouds. Do not remove EWS permission reflexively.
Follow Microsoft's ConfigureExchangeHybridApplication.ps1 instructions using all-in-one or split execution when the server cannot reach Entra/Graph endpoints. Verify current and next OAuth certificates, application consent, permissions, URLs and logs. Once every affected server is supported and validated, remove old certificates from the shared service principal according to the official procedure. Running HCW again can add them back; re-check after changes.
$mailbox = 'pilot@contoso.com' # Replace with a real on-prem mailbox
Test-OAuthConnectivity -Service EWS -TargetUri https://outlook.office365.com -Mailbox $mailbox |
Select-Object ResultType,DetailProduction tests go beyond sending one message
Have application owners sign off on their scenarios; retain timestamps, sender, recipient and message identifiers. Empty queues do not prove calendar availability or SMTP relay from every subnet.
| Scenario | Test before and after the change |
|---|---|
| Internal, inbound, outbound, cross-premises, large message, transport rule and TLS | |
| Client | Autodiscover, Outlook, mobile, OWA, delegation and archive where used |
| Hybrid | Two-way free/busy, MailTips, photos, OAuth and a pilot mailbox move |
| Relay | A representative printer and application, source IP, message trace and queues |
| Resilience | DAG failover, monitoring, backup and a restore in an isolated environment |
The last hybrid server: do you need to keep it?
When all user mailboxes and public folders are in Exchange Online, no server is relaying mail and no other on-premises feature needs Exchange, recipient management tools may replace an always-on hybrid server in some synchronized environments. Test the management commands and recovery procedure before choosing this path.
Do not uninstall the final Exchange server just because mailboxes moved: Microsoft warns that doing so removes configuration objects needed for hybrid recipient management. If printers still relay through it or on-premises mailboxes remain, management-tools-only is not suitable. Confirm SE licensing, access rights and hybrid-license conditions against your agreement; do not assume mailbox hosting or relay is free.
A realistic migration and rollback plan
A side-by-side rollback might temporarily send a namespace or relay back to its former route, then move the pilot mailbox back if still eligible. Document and rehearse this before cutover. In-place upgrades and AD schema changes cannot be undone with one command: their recovery path depends on prepared backups and restoration.
The goal is not merely Exchange SE installed. It is working mail, calendars, devices, backups and emergency procedures on the new architecture.
- Gate 1 — baseline builds, paths and dependencies; test backups, AD recovery and relay recovery procedures.
- Gate 2 — prepare and patch SE without switching every URL or connector; test one pilot mailbox and relay source.
- Gate 3 — migrate in batches; monitor logs, certificates, queues, DAG health, hybrid availability and application errors; retain a workable old path during transition.
- Gate 4 — cut over namespaces, ingress and applications under change control; define stop conditions and an owner for every flow.
- Gate 5 — retire legacy servers only after resources and dependencies are inventoried as clear, backups are checked and owners approve.
About the author
Marc-Antoine Lambert
Montréal-based senior IT consultant and Team Lead specializing in architecture, cybersecurity, Microsoft infrastructure, networking and business continuity.
Discuss your environment →