Exchange Server SE and EWS Retirement: Status After 1 October 2026

Three Microsoft clocks define the position, and two of them have already struck.

If you still run Exchange 2016 or 2019, the decision is no longer "SE or Exchange Online before October" but how to leave the unpatched state that begins on 1 November 2026 before CU2 closes the coexistence window. The running list of dates is on our Microsoft deadlines page.

Microsoft's Learn page states that EWS "starts to be disabled globally for all organizations in October 2026" and "is fully disabled in April 2027". The rollout is phased, and the mechanism is the same everywhere:

• A tenant that had never set the organization-level EwsEnabled value had it set to false on 1 October 2026; Microsoft's hybrid guidance for Skype for Business says so in those words. Every EWS call into such a tenant now fails.
• A tenant that had set EwsEnabled to true stays open only to applications on its application ID allow list. Microsoft's "EWS Deprecation Is Here" post describes the list (EWSAllowedAppIDs) as required, pre-populated from the application IDs seen using EWS in the previous 60 days, and enforced in the worldwide cloud from 10 October 2026.
• Cross-tenant free/busy, MailTips and calendar sharing keep working until 1 April 2027 as long as EwsEnabled is true, with no allow-list entries, and are moving to the Microsoft 365 cross-tenant access policy.
• On 1 April 2027 the setting stops mattering; Microsoft calls the date firm. The retirement applies to Exchange Online only, not to EWS on an Exchange Server.

Run Get-OrganizationConfig | Format-List EwsEnabled now, read the allow list on the same object, and name every entry. Then compare it with everything that touches mailboxes: CRM connectors, archiving and backup agents, signature tools, room booking and scripts on the EWS Managed API. A pre-populated list tends to miss anything that ran less than once in the 60-day window and anything a vendor hosts in its own tenant; each needs the vendor's application ID added or a Graph-based version installed. For software you maintain yourself, our Microsoft Graph API integration service ($175 per hour) does the per-application rewrite.

Period 2 of the Extended Security Update program runs from the start of May 2026 to the end of October 2026. Enrollment was a separate purchase, Microsoft did not commit to releasing any update during it, and its mid-2026 reminder adds that once October 2026 ends there will be no further updates for Exchange 2016 or 2019, even for organizations holding a Period 2 ESU. The ESU is Microsoft's charge, on your bill.

Microsoft did release the October 2026 security update; the version 2 package for Exchange 2016 CU23 is dated 2 October 2026 (KB5129958), and its article states that enrolled organizations are eligible for released updates until the end of October 2026. Install it on every 2016 and 2019 server before 31 October 2026, because nothing follows it.

From 1 November 2026 every remaining 2016 or 2019 server is an internet-facing system with no future patches. If it cannot be gone by then, write a containment position rather than drift into one:

1. The October 2026 update installed and the Exchange Health Checker findings closed.
2. Extended Protection enabled, with its certificate and load balancer prerequisites checked.
3. The Exchange admin center and remote PowerShell not published to the internet.
4. A dated exit: the SE upgrade or the migration below, with the month the server leaves.

Out-of-Support Exchange Server Risk Containment ($2,950 per project) is that list, done and documented.

Exchange Server Subscription Edition, released in July 2025, is licensed as an entitlement you keep current. Microsoft's Exchange licensing FAQ gives two routes:

• Server licenses and client access licenses with active Software Assurance through Volume Licensing. A Standard CAL is always required; an Enterprise CAL adds features. If Software Assurance lapses, the right to run SE lapses and what remains is the right to run Exchange 2019, which is out of support.
• Cloud subscription licenses for every user and device that accesses the server. Microsoft names Microsoft 365 E3 and E5, and states that Exchange Online Plan 1 and Plan 2 provide CAL equivalency.

Microsoft's forum answers on E3 and E5 bought through a Cloud Solution Provider have not been uniform, so have the entitlement stated in writing against the program you buy through before you schedule the upgrade. Microsoft list prices, October 2026 price list, per user per month on an annual term: Exchange Online Plan 1 $4.00, Exchange Online Plan 2 $8.00, Microsoft 365 E3 $39.00, Microsoft 365 E5 $60.00. SE server licenses and on-premises CALs are Volume Licensing items not on the online price list and are quoted on request through our Microsoft Volume Licensing review.

SE is supported on the current cumulative update and the one before it; Managed Exchange Server SE Administration and Patching ($395 per server) owns the next update if nobody else does.

Microsoft's upgrade guidance, updated 22 May 2026, lists Exchange Server SE CU2 for the first half of calendar year 2027 and states that CU2 Setup blocks coexistence with Exchange 2013, 2016 and 2019. No month is published, so plan for every 2016 server to be uninstalled before CU2 arrives rather than around a date that does not exist. The Exchange Server SE Upgrade Readiness Assessment ($1,950 per project) checks the licensing route, build levels, hybrid configuration and application inventory, and returns a dated plan for whichever path applies.

For many of the organizations asking us about SE, the cheaper answer is not to run an Exchange server at all.

• A cutover migration to Exchange Online moves every mailbox in one pass, usually over a weekend: Microsoft-sponsored where the tenant is eligible, otherwise $2,500 plus $35 per mailbox.
• A hybrid migration (same pricing) suits larger estates or staged moves with shared free/busy during the move.
• Public folders are their own project ($114 per GB plus a $450 tenant fee).
• The last server is decommissioned through the supported procedure ($3,300 per project), not powered off, so no stale objects linger in Active Directory.

Mailbox licensing in Exchange Online, Microsoft list price, October 2026 price list, annual term: Plan 1 $4.00, Plan 2 $8.00 (100 GB mailbox, archive, litigation hold), Microsoft 365 Business Premium $22.00, Microsoft 365 E3 $39.00 per user per month; our plan comparison says which mailbox gets which.

Add basic authentication for SMTP AUTH client submission to the same spreadsheet. Microsoft's updated timeline, published in January 2026, leaves behavior unchanged through December 2026, disables basic authentication by default for existing tenants at the end of December 2026 (administrators can re-enable it), withholds it from tenants created after December 2026, and defers the final removal date to an announcement in the second half of 2027.

It is the same hunt as the EWS one: printers, scanners, alarm panels, backup jobs and small applications that send with a username and password. Pull the list from the SMTP AUTH clients report and message trace, then move each sender to OAuth, to SMTP relay through a connector, or to a modern client. Exchange Online Administrator on Demand ($175 per hour) is bought for exactly this. Microsoft's guidance for moving an Exchange SE hybrid's rich coexistence from EWS to Microsoft Graph belongs on the same list.

1. By 18 October 2026: read EwsEnabled and the allow list, name every entry, add the missing application IDs, and open a ticket with each vendor that has no Graph-based version.
2. By 31 October 2026: install the October 2026 security update on every Exchange 2016 and 2019 server; decide stay or leave once, for the organization; if nothing can move, write the containment position with its exit month.
3. By 30 November 2026: confirm the SE licensing route in writing, or book the migration and the decommission in one plan.
4. By 31 December 2026: finish the SMTP AUTH inventory and the OAuth or connector moves.
5. By 31 March 2027: every EWS dependency on Microsoft Graph. The allow list is a transition mechanism; on 1 April 2027 it stops meaning anything.
6. Before SE CU2, placed by Microsoft in the first half of 2027: every 2016 server uninstalled, every 2019 server upgraded in place, and the Software Assurance or subscriptions in force.

Is EWS already blocked in my tenant?

If the organization-level EwsEnabled value was blank on 1 October 2026, Microsoft set it to false and EWS is off. If it was true, EWS still works for applications on your allow list, enforced from 10 October 2026.

Can I turn EWS back on after 1 October 2026?

Yes, until 1 April 2027: set EwsEnabled to true and maintain the allow list. Microsoft calls 1 April 2027 firm, with no extensions or exceptions.

Does the EWS retirement affect Exchange Server on-premises?

No. Microsoft's notice applies to Exchange Online only; EWS on an Exchange 2019 or SE server keeps working.

Will there be another Exchange 2016 or 2019 security update after October 2026?

No. The Period 2 ESU ends at the end of October 2026, and Microsoft's reminder post states there will be no further updates after that, even for enrolled organizations.

When does Exchange Server SE CU2 ship?

Microsoft's upgrade guidance, updated 22 May 2026, places it in the first half of calendar year 2027 with no month given; CU2 Setup blocks installation while any Exchange 2013, 2016 or 2019 server remains.

• Deprecation of Exchange Web Services in Exchange Online — Microsoft Learn, checked 2026-10-11
• EWS Deprecation Is Here – what this means to you — Microsoft Tech Community, Exchange Team Blog, checked 2026-10-11
• Prepare for EWS retirement in Exchange Online (Skype for Business hybrid) — Microsoft Learn, checked 2026-10-11
• Cross-tenant Free/Busy, MailTips, and Calendar Sharing are moving to Cross-Tenant Access Policy — Microsoft Tech Community, checked 2026-10-11
• Announcing Period 2 Exchange 2016/2019 Extended Security Update (ESU) program — Microsoft Tech Community, checked 2026-10-11
• Reminder: Exchange 2016 and 2019 ESU Program Ends in October 2026 — Microsoft Tech Community, checked 2026-10-11
• Description of version 2 of the security update for Microsoft Exchange Server 2016 CU23, October 2, 2026 (KB5129958) — Microsoft Support, checked 2026-10-11
• Support for Exchange Server 2016 and Exchange Server 2019 ends today — Microsoft Tech Community, checked 2026-10-11
• Upgrading your organization from current versions to Exchange Server SE — Microsoft Tech Community, updated 2026-05-22, checked 2026-10-11
• Upgrading to Exchange Server Subscription Edition (SE) — Microsoft Learn, checked 2026-10-11
• Microsoft Exchange Online and Exchange Server Licensing FAQs — Microsoft, checked 2026-10-11
• Updated Exchange Online SMTP AUTH Basic Authentication Deprecation Timeline — Microsoft Tech Community, January 2026, checked 2026-10-11
• Update Your Exchange SE Hybrid On-premises Rich Coexistence to Graph — Microsoft Tech Community, checked 2026-10-11