The Last Exchange Server: When a Hybrid Tenant Can Decommission On-Premises Exchange
Most hybrid Microsoft 365 tenants finished moving mailboxes years ago and still run one Exchange server that hosts nothing. Here is what it is doing, what Microsoft says can replace it, what still needs a server, and how to license it until it is switched off.
Why the last server is still there
The reason is identity, not mail. When Microsoft Entra Connect synchronizes users from on-premises Active Directory, Active Directory remains the source of authority for their Exchange attributes: proxy addresses, mail-enabled status, the remote mailbox that points at Exchange Online. Microsoft's end-of-support roadmap for Exchange 2016 and 2019 states the consequence directly: if you migrate mailboxes to Microsoft 365 but keep using Microsoft Entra Connect, you have to keep at least one Exchange server, because removing them all leaves you unable to change recipients in Exchange Online. The same roadmap points to the alternative, managing recipients with the Exchange management tools, covered below.
The calendar makes it urgent. Exchange Server 2016 and 2019 reached end of support on 14 October 2025; Microsoft's Extended Security Updates bridge ran in two six-month periods, and the second ends at the end of October 2026 with no third announced. From November, a last server on 2016 or 2019 is an unpatched Exchange server with a foot in your Active Directory.
A hybrid tenant in September 2026 has three paths: move the last server to Exchange Server Subscription Edition and keep it; replace it with the management tools; or contain it while the dependencies that block both are moved.
What the server is doing, and what still needs one
Inventory what the server does before deciding. Most last servers carry some of these:
- Recipient management. New starters are mail-enabled on-premises — Microsoft's Enable-RemoteMailbox cmdlet sets the attribute that directory synchronization turns into an Exchange Online mailbox — and shared mailboxes, groups and contacts are created the same way. Objects created directly in Exchange Online instead are a known source of hybrid faults.
- SMTP relay for printers, scanners, backup jobs and applications.
- Mail flow: centralized transport or transport rules never recreated in the cloud.
- Public folders still on-premises.
- Coexistence features from the migration that nobody turned off.
- Journaling or archiving products reading from the server.
Microsoft's roadmap lists the reasons an organization legitimately keeps a server: regulatory requirements, data residency, settings the cloud cannot meet, and managing cloud mailboxes while still using on-premises Active Directory. The first three are business decisions; the fourth is what the management tools address. Everything else above is a workload with a cloud replacement, and only when those are gone can the management tools take over.
Recipient management without a running server
Microsoft's supported answer is to install the Exchange management tools on a domain-joined machine and manage recipients from there, with no Exchange server running. The detailed article — "Manage recipients in Exchange Hybrid environments using Management tools" — is the one to read in full: it sets out the minimum version of the tools, the preparation steps and how the last server's objects are cleaned out of Active Directory, and those specifics change with cumulative updates.
Where it fits: every mailbox, including shared and resource mailboxes, is in Exchange Online; there are no public folders on-premises; no device or application needs an on-premises relay or protocol; and your team is comfortable managing recipients from PowerShell, because the tools give you the shell, not the admin center.
What it does not permit is editing Exchange attributes directly in Active Directory Users and Computers. That path is unsupported and surfaces months later as a user who cannot be found or a shared mailbox nobody can open.
The trade-off: an Exchange Server SE server keeps the familiar console, relay and transport, at the cost of a licensed, patched, internet-facing server. The management tools remove all of that and ask administrators to work from the shell. For most 20-to-500-seat organizations whose mailboxes have been in the cloud for years, the second is the smaller cost.
Exchange SE licensing until the last server goes
Exchange Server SE is an entitlement you keep current rather than a product you buy once: a server license and a CAL for every user or device that touches it, both with active Software Assurance, or cloud subscription licenses such as Microsoft 365 E3 or E5 in place of the CALs. If Software Assurance lapses, the rights fall back to Exchange 2019, which is out of support. Treat SE as a renewal line for as long as the server exists; our Microsoft Volume Licensing team can reconcile mixed or inherited agreements.
A hybrid-only server may qualify for the hybrid license instead, intended for eligible servers used only for hybrid configuration and recipient management, not for hosting mailboxes or workloads. The Hybrid Configuration Wizard applies it where the server is eligible; because the eligibility wording sits in Microsoft's licensing terms, confirm it with the current wizard and terms, and record why the server remains.
From Exchange 2019, SE is an in-place upgrade that Microsoft describes as cumulative; our Exchange 2019 to Exchange Server SE In-Place Upgrade is scoped for it. From Exchange 2016 there is no in-place path: SE servers are built alongside, and Microsoft's roadmap notes this is possible only before Exchange SE CU2 releases, expected in the second half of 2026 with no published date; our Exchange 2016 to Exchange Server SE Migration is that work at a fixed price. If the server cannot move before ESU ends, Out-of-Support Exchange Server Risk Containment is the interim.
The decommission sequence
Turning the server off is not decommissioning it. Microsoft's article "How and when to decommission your on-premises Exchange servers in a hybrid deployment" is the reference; removal must leave Active Directory and Exchange Online consistent. The sequence we run:
- Inventory the dependencies from message tracking, receive connector logs and sign-in data, not memory. Add the applications calling Exchange Web Services against Exchange Online, which Microsoft begins blocking on 1 October 2026 and removes on 1 April 2027; the inventory is the same list.
- Move the last mailboxes, shared and resource mailboxes, and public folders, the latter as a separate public folder migration.
- Re-point relay and mail flow to Exchange Online, device by device, and recreate transport rules in the tenant.
- Retire the coexistence configuration — hybrid connectors, the organization relationship, the migration endpoint — in Microsoft's order.
- Install the management tools, verify that a starter can be mail-enabled from them, and document the runbook.
- Back up the server and the Active Directory state, then uninstall Exchange with Setup rather than deleting the VM, and run the Active Directory cleanup the management tools article describes.
- Validate: create a test recipient and confirm it appears in Exchange Online after synchronization, send from a relay device, and check the Exchange Online out-of-date-server report is empty.
Our Exchange Server Decommissioning service covers steps 4 to 7 at a fixed price; the hybrid migration or cutover migration covers the moves before it.
Frequently asked questions
Can I just shut the last Exchange server down and see what breaks?
No. Recipient management stops the moment it is off, and a deleted rather than uninstalled server leaves Active Directory in a state Microsoft does not support. Move the workloads, then uninstall with Setup.
Do I need a license for a server that hosts no mailboxes?
Yes: either the Exchange Server SE entitlement, or the hybrid license for eligible hybrid-only servers, confirmed through the Hybrid Configuration Wizard against Microsoft's current terms.
Is the management tools approach cheaper than keeping an SE server?
Usually. It removes the server entitlement, patching, certificates and internet exposure, and costs a small machine for the tools and a team that works from PowerShell — once relay, public folders and applications have moved.
We did a cutover years ago and never removed the old 2013 or 2016 box. Same rules?
Same rules, more urgency: a server out of support for years is a liability whether or not it hosts mail. Inventory what points at it, move that, and remove it properly.
Does removing the last server change anything about the EWS block?
No. The EWS retirement is an Exchange Online change — blocking from 1 October 2026, removal on 1 April 2027 — and does not touch EWS on an on-premises server.
Sources
- Microsoft Learn (troubleshooting): Exchange Server 2019 and 2016 end of support roadmap
- Microsoft Learn: Enable-RemoteMailbox (Exchange PowerShell cmdlet reference)
- Microsoft Learn (troubleshooting): Users in a hybrid deployment can't access a shared mailbox that was created in Exchange Online
- IT Partner deadlines register; IT Partner: Exchange Server 2016 and 2019 Are Out of Support; How to license and manage a Hybrid Exchange environment in 2026
The two Microsoft articles cited by title in the text are referenced from the roadmap; read them for version requirements and step order.
| Dependency on the last server | Replacement | Where it is done |
|---|---|---|
| Recipient management for synchronized users | Exchange management tools on a domain-joined machine, or a retained Exchange Server SE | Management tools install, or SE upgrade |
| SMTP relay for devices and applications | Relay through Exchange Online, tested per device | Decommissioning, step 3 |
| Hybrid mail flow and transport rules | MX and routing in Exchange Online; rules recreated in the tenant | Decommissioning, steps 3 and 4 |
| On-premises public folders | Exchange Online public folders, shared mailboxes or Microsoft 365 groups | Separate public folder migration |
| Applications on EWS or MAPI against the server | Rewrite on Microsoft Graph before 1 October 2026 | Application project, same inventory |
Key takeaways
- With Microsoft Entra Connect in place, Active Directory is the source of authority for recipients; Microsoft says keep one Exchange server or use the management tools.
- Exchange 2016 and 2019 have been out of support since 14 October 2025; the second ESU period ends at the end of October 2026 with no third announced.
- The management tools model fits when every mailbox is in Exchange Online and relay, public folders and application dependencies have been moved.
- Until the server goes it needs an entitlement: Exchange Server SE with Software Assurance or qualifying Microsoft 365 seats, or the hybrid license for eligible hybrid-only servers.
- Decommissioning means uninstalling with Setup after the dependencies are moved, not powering off a VM.
Our Exchange Server Decommissioning service inventories the dependencies, backs up the state, uninstalls the server with supported procedures and validates recipient management afterwards, at a fixed price. If mailboxes or public folders are still on-premises, the Hybrid Microsoft 365 Migration from your own Exchange Server moves them first, with the decommission in the same plan.
Questions this article didn’t answer?
Thirty minutes with Mike — our CEO, not a sales rep. Bring the hard version of the question.