Exchange Server SE Upgrade Readiness Assessment

A written readiness report, typically 8–12 pages: a per-server upgrade path, the coexistence window against Microsoft's current SE schedule, a licensing position with the gap stated, Active Directory, certificate, TLS, hybrid and identity findings, a third-party compatibility matrix with dated vendor statements, a backup verification, a blocker register, a dated upgrade plan and a fixed-price quote for the execution — plus a 60-minute walkthrough. One week end to end, for up to four Exchange servers.

Organizations whose real destination is Exchange Online. If you could move to Microsoft 365 and simply have not yet, this assessment answers the wrong question: the right engagement is the hybrid Microsoft 365 migration if you need coexistence, or the cutover Exchange Online migration if you do not. This page is for organizations that must keep Exchange on-premises — regulated, air-gapped, government-adjacent, or dependent on on-premises identity — and need to get there safely on Exchange Server SE.

No. Microsoft supports the in-place upgrade to SE only from Exchange 2019 at CU14 or CU15. An Exchange 2016 estate moves the way a 2016-to-2019 upgrade always did: new SE servers are built on a supported Windows Server version, mailboxes, public folders, connectors and client access move across, and the 2016 servers are removed. Microsoft's guidance at the time of writing is that SE RTM and SE CU1 coexist with Exchange 2016 at CU23 during that move, and that SE CU2 will not — so the whole sequence has to finish inside the window. Two things that surprise 2016 estates: Unified Messaging does not exist in SE, so voicemail needs a new home, and the Windows Server 2016 many of those servers run on leaves extended support on 12 January 2027, per Microsoft's product lifecycle, so the operating system refresh is coming either way. The execution for a 2016 estate is the Exchange 2016 to Exchange Server SE Migration, quoted from this report.

Mechanically, it is close: on Exchange 2019 CU14 or CU15 the SE setup runs like a cumulative update on the same server. Everything around it is where upgrades fail. The server must be on a Windows Server version SE supports, and Microsoft does not support upgrading Windows in place underneath Exchange, so an old operating system means a new server. Licensing changes: SE needs an active subscription or Software Assurance, and you need the SE product keys in hand before the change window. Hybrid, certificates, load balancer probes, backup agents and antivirus exclusions all have to be checked against SE. The assessment confirms each of those before anyone runs setup, which is why we can quote the execution as a fixed price.

An active subscription. Microsoft licenses SE either through SE server licences (Standard or Enterprise) and CALs with active Software Assurance bought through Volume Licensing, or through qualifying cloud subscriptions such as Microsoft 365 E3 or E5 covering every user and device that accesses the server. A Standard CAL is always required; an Enterprise CAL is an add-on for the advanced features. If the subscription or Software Assurance lapses, Microsoft states your rights revert to Exchange 2019 — which is out of support. The report counts your servers, users and devices against what you already hold and states the gap; the fees themselves are Microsoft's charges, billed to you by Microsoft or your reseller, not part of this engagement. The binding terms are Microsoft's Product Terms.

Microsoft has not published a fixed day, which is why we do not print one. Microsoft's Exchange Team has stated that SE CU2 will block coexistence with Exchange 2016 and 2019, and its published plan at the time of writing places CU2 in the second half of calendar 2026. Because Exchange security updates are released for the current cumulative updates, an organization still coexisting when CU2 is required is cut off from patches. The report states Microsoft's current timing on the day it is issued, with the source, and the plan is built to finish before it — not on it.

Yes, if your on-premises servers are behind on updates. Since February 2025, Exchange Online has reported on, then throttled — SMTP 450 delays — then blocked — SMTP 550 rejections — mail arriving from on-premises Exchange servers that are significantly out of date, on every version including 2019. Microsoft has announced that from the second week of September 2026 the oldest build it accepts from an Exchange 2016 or 2019 server over an on-premises inbound connector rises to the final public update of October 2025. Microsoft lets an administrator pause enforcement from the mail flow report for a limited period — up to 90 days per year at the time of writing — which is a bridge for the upgrade, not a way to avoid it. The report tells you what enforcement currently says about your servers and what changes when the baseline moves. If you need hands on the Exchange Online side while the on-premises work runs, Exchange Online Administrator on Demand covers that separately.

It is a bridge. Microsoft has offered a short, paid Extended Security Update program for Exchange 2016 and 2019 that Microsoft's own guidance positions as inferior to moving to SE, and third-party reporting places its end in October 2026 — confirm the current terms with your Microsoft account team, because they are Microsoft's to change. ESU does not reopen the SE coexistence window, does not satisfy Exchange Online's enforcement baseline by itself, and does not make the Windows Server underneath supported. If you need it to get through the plan, the report says so and sequences it; it is not a plan on its own. If the servers must keep running past the window, Out-of-Support Exchange Server Risk Containment is the interim measure.

No. Exchange View-Only Organization Management, read access to Active Directory and local read access on the servers is enough. If your policy does not permit any external access — normal in the estates this page is written for — your own staff run our collection scripts and Microsoft's Exchange Server Health Checker and return the output. Least access is how we work on every engagement, not a concession for this one.

Collection is read-only. It runs Exchange Management Shell exports, Microsoft's Health Checker script and Active Directory reads; it does not install anything, change configuration, run setup, or generate meaningful load. It can be run during business hours, and in a change-frozen environment it can be run by your staff under your own change control.

Then you have found it in a report instead of in a failed change window. The report states the blocker, the remediation and the effort — an Exchange 2013 server still in the organization, a 2019 server on a Windows Server version SE does not support, a journaling or archiving product whose vendor has no SE support statement, Unified Messaging still hosting voicemail, backups that have never been restored. Where a blocker makes a fixed price irresponsible, we quote the execution time-and-materials and say why.

No. The report is written to be actionable by any competent Exchange team, including your own. It is not a proposal with findings attached. If you do proceed with us, the execution is a separate fixed-price engagement quoted directly from the report.

Closely, for Exchange 2016 estates. Exchange 2016 runs on Windows Server 2012 R2 or 2016, and Windows Server 2016 leaves extended support on 12 January 2027, per Microsoft's product lifecycle. SE will not run on those operating systems, so the Exchange move and the OS refresh are the same project whether you planned it that way or not. If Exchange is one of several Windows Server 2016 workloads you have to deal with, the Windows Server 2016 End of Support Assessment and Roadmap covers the estate; this assessment goes deeper on Exchange than that one does, and the two are designed to be read together.

The standard fee covers up to four Exchange servers, DAG members included. Estates with more than four servers, multiple DAGs or a multi-site design are quoted per estate in writing before we start — the collection is the same, the analysis is not.

Because a free assessment is a sales call, and it produces a proposal rather than findings. Charging for it means we spend a week on your environment instead of an hour, and it means the report is yours — including the parts that say your vendor will not support SE, or that Exchange Online is the better answer after all. If you want a free conversation first, that is exactly what our 30-minute discovery session is for, and it will tell you honestly whether this assessment is worth $1,950 for your estate.