Anyone who built a company network between 2008 and 2016 remembers it: the Exchange server was the most important box in the server room. Sometimes more important than the ERP. It held email, shared calendars, the company address book, meeting rooms and the public folders where purchasing filed supplier quotes. It was tied to Active Directory, so a new hire got a mailbox the moment they got a login. When smartphones arrived, it became the door through which work left the office.
In many small and mid-sized companies that server is still there. One request keeps coming back to us these weeks: an on-premises Exchange, sometimes 2013, sometimes 2016 or 2019, that still works and that nobody quite knows how to switch off. This article is about what switching it off really involves: what changes for the people using email, what changes for whoever runs IT, and what you gain in security.
In short
On-premises Exchange was the right choice for twenty years, and for most SMBs it no longer is. Exchange 2013 has received no fixes since 11 April 2023, Exchange 2016 and 2019 since 14 October 2025, and even the new on-premises release is sold only as a subscription. Moving to Exchange Online, inside Microsoft 365, removes an internet-facing server from your network and hands patching, spam filtering and availability to Microsoft. In exchange, the user account becomes the thing to protect, with multi-factor authentication, and backing up your mail remains your job.
Why Exchange mattered so much
Before the cloud, serious company email meant Exchange. The alternatives did email and not much else. Exchange did teamwork: a colleague’s calendar one click away, a shared mailbox for accounts, bookable meeting rooms, one address book for everyone. With ActiveSync, from 2003 on, it reached phones, and for years it was what turned a BlackBerry or an iPhone into a work tool.
The price was administration. An Exchange server needed cumulative updates every few months, and some of them came with surprises. It needed valid certificates, on-premises spam filtering, backups with tested restores, and disks that always filled up sooner than planned. Larger companies ran two or three servers in a cluster so they never stopped. Smaller ones had a single server, and when it stopped, email stopped.
What changed
Three things, in a few years.
The first is security. A mail server has to accept connections from the internet, which is why it became a favourite target. In 2021 the ProxyLogon flaws hit Exchange 2013, 2016 and 2019, and within days servers were compromised worldwide. In August 2025 the US cybersecurity agency CISA ordered end-of-life Exchange servers to be disconnected, after a vulnerability that lets an attacker who controls the on-premises server move into Microsoft 365.
The second is Microsoft’s calendar. Exchange 2013 left support on 11 April 2023. Exchange 2016 and 2019 followed on 14 October 2025. Out of support means no more fixes: every flaw found after that date stays open.
The third is the licensing model. Exchange Server Subscription Edition, the on-premises successor to 2019, has been available since July 2025, but it needs server licences, CALs and an active subscription to keep receiving updates. Even companies that want to keep email in-house now pay a recurring fee, and the gap with Exchange Online gets much smaller.
What changes when you move to Microsoft 365
For the people using email, very little. Same mail, same shared calendars, Outlook is still Outlook. With a hybrid migration, mailboxes move in batches while people keep working and Outlook reconnects by itself. With a cutover migration, which suits small environments, Outlook profiles have to be recreated on every PC: about half an hour per machine, to be scheduled.
For whoever runs IT, quite a lot:
- Identity: Active Directory users are synchronised with Microsoft Entra ID, the cloud directory. From that moment a user’s password opens their mailbox from anywhere in the world, which is why multi-factor authentication stops being optional.
- DNS: the MX and Autodiscover records change, and SPF, DKIM and DMARC have to be redone. Get this wrong and your company’s mail lands in customers’ spam folders.
- Printers and business software: scanners, ERP, phone systems and alarms often send email through the Exchange server without authenticating. Switch the server off and they go silent. They need to be listed beforehand and moved to one of the sending methods Microsoft supports.
- Backup: Microsoft guarantees the service runs, not that you can recover everything. A permanently deleted email can be recovered for 14 days, extendable to 30. Beyond that, you need a separate backup.
- Costs: you move from a capital purchase every five or six years (server, licences, storage, admin time) to a monthly fee per user.
What you gain in security
This is where the change is clearest.
There is no longer a mail server on your network with a port open to the internet. Microsoft patches its own servers, with no maintenance windows to negotiate. Every Exchange Online plan includes Exchange Online Protection, Microsoft’s managed anti-spam and anti-malware, so there is no on-premises filter to maintain. Since October 2022 Exchange Online has also switched off basic authentication for Outlook, phones and the other protocols used to read mail: it was the old method that let attackers try passwords endlessly through legacy clients. It survives only for sending from printers and applications, and from the end of 2026 it is off by default there too.
Microsoft 365 Business Premium adds three tools that would cost far more on-premises: Defender for Office 365, which checks links and attachments before users open them; Conditional Access, which can block a sign-in from abroad or from a non-company PC; and device management, to wipe company mail from a lost phone.
The risk does not disappear, it moves. With on-premises Exchange the attacker went after the server. With Exchange Online the attacker goes after the account: stolen passwords, phishing, fake sign-in prompts. That is why, for us, a migration does not end when the last mailbox is copied. It ends with multi-factor authentication on for everyone, DMARC in place and backup running from day one.
If you are still on Exchange 2013
A few practical notes, because the paths out of 2013 are narrower.
- There is no in-place upgrade. Exchange 2019 CU15 and Exchange SE will not install while an Exchange 2013 server is still in the organisation.
- A hybrid migration may still work on 2013, but Microsoft no longer supports that version. If the wizard gets stuck, nobody will fix it.
- For small environments there is cutover migration, which Microsoft recommends for up to 150 mailboxes.
- Tools such as CodeTwo and MigrationWiz can start from Exchange 2013. They rely on EWS, though, which Microsoft began disabling in Exchange Online on 1 October 2026, tenant by tenant, and will switch off completely on 1 April 2027 (on-premises Exchange is not affected). Today they only work if EWS stays enabled and the app is allowed in the tenant. If you have public folders to move to the cloud, do not wait for spring.
What to ask your IT person this week
- Which version of Exchange do we run, and at which update level?
- How many mailboxes do we have and how big are they, shared mailboxes and public folders included?
- What sends email through the server: printers, ERP, phone system, alarms?
- Are our users already in Microsoft 365, even just for Teams?
- When did we last test restoring a mailbox from backup?
With those five answers it takes half an hour to see which path fits and how much work there really is.
What it costs
At Microsoft’s Italian list prices (checked on 20 September 2026, per user per month, annual commitment, excluding VAT) Exchange Online Plan 1 costs €3.50, Microsoft 365 Business Basic €6.07, Business Standard €12.13 and Business Premium €19.06. Fifty mailboxes on Business Basic come to about €3,640 a year. Shared mailboxes up to 50 GB need no licence.
The migration project is quoted after the assessment, because it depends on mailboxes, devices to reconfigure and the tools needed. On timing, Microsoft’s own figures say a mailbox up to 10 GB copies in a day in the typical case: for a few dozen mailboxes the copy usually takes one or two weeks, while people keep working.
How we do it
An assessment of the server and everything around it. A pilot group of a few mailboxes to measure real copy speed. Batched moves, DNS changes in the evening or at the weekend, printers and business software reconfigured, multi-factor authentication, DMARC and backup switched on. Then the old server is decommissioned safely.
Our approach to Microsoft 365 is on the digital workplace page.
If your Exchange server is still in the server room, get in touch: we start from the five questions above and tell you which path makes sense, with timing and costs.