Microsoft Tightens Exchange Server Security Requirements: Are You Impacted?
If your organization is running Exchange Server 2016 or Exchange Server 2019 and uses a hybrid connection with Microsoft 365, this announcement may affect your email environment. Microsoft has announced that beginning in September 2026, Exchange Online will enforce a newer minimum supported Exchange Server update level for certain hybrid deployments. Organizations running outdated Exchange servers could experience email throttling or message delivery issues if required updates are not installed.
Who Is Impacted?
This change primarily affects organizations that:
Run Exchange Server 2016 or Exchange Server 2019 on-premises
Maintain a hybrid Exchange environment with Microsoft 365
Send email to Exchange Online using an On-Premises inbound connector as part of their hybrid mail flow configuration
Organizations that rely on Exchange Server for mail routing, management, or hybrid identity integration should review their environment to determine whether they are running supported Exchange updates.
What Is Changing?
Microsoft is raising the minimum Exchange Server version allowed to send email to Exchange Online through hybrid connectors. Beginning in September 2026, Exchange servers must be running at least the final publicly available Exchange 2016/2019 update released in October 2025 to avoid throttling or blocking.
Microsoft also stated that future enforcement updates will require versions newer than any publicly released updates, meaning organizations may eventually need to move to:
Exchange Server Subscription Edition (SE)
Microsoft's Extended Security Update (ESU) program
A cloud-first migration strategy
Why Is Microsoft Making This Change?
Cyber threats targeting email systems continue to increase, and Microsoft is taking additional steps to reduce risks associated with outdated Exchange infrastructure. Microsoft emphasizes that servers not running current security updates remain vulnerable to known security issues, even if they appear to be functioning normally.
What Could Happen If You Do Nothing?
Organizations running older Exchange versions may experience:
Slower email delivery
Throttled message flow to Microsoft 365
Potential email delivery blocks in the future
While these controls initially apply only to servers using specific hybrid connectors, Microsoft notes that enforcement scopes could change over time.
Recommended Next Steps
We recommend that organizations using Exchange Server 2016 or 2019:
Verify current Exchange patch levels
Confirm hybrid mail flow configurations
Review Microsoft's latest Exchange update requirements
Develop a modernization roadmap for Exchange infrastructure
Evaluate migration options before future enforcement deadlines
How RMON Can Help
RMON is actively helping organizations assess Exchange environments, validate compliance with Microsoft's latest security requirements, and plan for long-term email modernization. If you're unsure whether your Exchange deployment is impacted, our team can perform an Exchange Health and Hybrid Configuration Assessment and help develop a roadmap that aligns with Microsoft's evolving support model.
Concerned your Exchange environment may be affected? Contact RMON today to schedule an Exchange Security and Hybrid Readiness Review.