Your Email Server Gets Its Last Update in October

The office manager at a mid-sized distributor asked a simple question last month. Where does our email actually live? Nobody in the room knew. The owner thought it was "in the cloud." The controller thought it was "on the server." The answer turned out to be both, and neither was quite right.

That question matters more this month than it has in years. If any part of your company email still runs on a Microsoft Exchange server in your building, that server receives its last security update at the end of October. After that, Microsoft has said plainly there will be no further extension.

Plenty of small and mid-sized companies still run one. It was installed ten years ago, it works, and it has never been anyone's job to think about it.

What is actually ending

Exchange is the Microsoft product that runs company email on your own hardware. The two versions still in wide use, Exchange 2016 and Exchange 2019, left normal support in October 2025.

Microsoft then sold a paid extension that kept security fixes coming. It ran in two six-month periods and was extended once already. In July, the Exchange team announced that October 2026 is the end, with no further extension.

So there are two groups of readers. If your company paid for the extension, your server gets its final fix this month. If it did not, the server has been going without security fixes for about a year already.

Why an email server is different from an old desktop

An old computer in the back office is a risk. An old email server is a bigger one, for one simple reason. It has to talk to the internet all day, every day, because that is how mail arrives.

That makes it one of the first things attackers look for. In March 2021, a set of flaws in on-premises Exchange was exploited so widely that CISA (the federal agency responsible for civilian cybersecurity) issued an emergency directive ordering federal agencies to act immediately. Businesses of every size were hit in the same wave.

That was a supported product with a fix available. The next wave, on an unsupported server, will not come with a fix at all.

Your insurer is paying attention too. We covered what the renewal questionnaire actually asks earlier this month. Unsupported systems facing the internet sit near the top of it.

What actually goes wrong when companies move

Moving the mailboxes is rarely the hard part. The trouble is everything else that quietly uses the server to send mail. In the companies we look at, it is almost always some mix of these.

The copier. Scan-to-email on the office copier or plotter is usually pointed at the old server. Move the mail, and scanning stops working on the first morning.

The business software. Your ERP, accounting package, or dispatch system may send invoices, purchase orders, and job confirmations through that server. Nobody remembers setting it up. Customers stop getting invoices, and nobody notices for a week.

The alarms. Backup reports, battery backup warnings, building alarms, and equipment alerts often email out through the same box. When they go silent, it looks like good news.

The shared mailboxes nobody owns. The orders@, the ap@, the info@ address from the old website. Each one needs a home and an owner before the switch.

The half-finished move. Some companies moved to Microsoft 365 years ago but kept one Exchange server running "for management." That server still counts, and it still needs a plan.

What good looks like

A company in good shape here has a short, boring list. It answers three questions.

Where does our mail live? One answer, written down, that the owner and the IT provider agree on.

What sends mail through it? Every copier, system, and device, with a line beside each saying where it will point afterward.

Who owns each shared address? A name beside every mailbox that is not a person.

With that list in hand, the move itself is usually uneventful. For most companies under a few hundred people, that means moving email to Microsoft 365. Microsoft also sells a newer on-premises version, Exchange Subscription Edition, sold as an ongoing subscription rather than a one-time purchase. It suits a small number of companies with a specific reason to keep mail in the building. For most of the businesses we work with, that reason does not exist anymore.

If you are already on Microsoft 365 for everything and there is no Exchange server anywhere, this deadline does not apply to you. That is a perfectly good answer, and worth confirming rather than assuming.

What to do about it this month

Ask one direct question. Send your IT provider or IT person this: "Do we run any Exchange server, anywhere, including one kept for management?" Ask for a yes or no, with the version number if yes.

If the answer is yes, list what sends mail. Walk the building with whoever handles your IT. Copiers, the ERP, the accounting system, backup software, alarm panels. Twenty minutes of looking beats a week of missing invoices.

Decide on a date, not a direction. "We are moving to Microsoft 365" is a direction. "Mail moves the weekend of October 24, and scanning is tested the Monday after" is a plan.

Do not switch off the old server the day after. Keep it running, but closed to the internet, for a few weeks. Something always turns up that was still pointed at it.

If you cannot move before the end of October, reduce the exposure. Ask whether the server can be taken off the open internet while you plan. That is not a fix. It buys time without leaving the front door open.

The move itself is ordinary work for a cloud migration. The discovery beforehand is what separates a quiet weekend from a bad Monday.

Not sure where your email lives?

Most owners are not, and that is fine. It was set up long before anyone was asking.

Finding out is part of our free IT assessment. You get a plain answer to where your mail lives, a list of everything that sends through it, and a realistic plan with a date attached. It takes about two weeks and a few hours of your time.

What you do with it is your call. Hand it to us, to your current provider, or to whoever runs your day-to-day IT support. The point is to make this decision before the last update ships, not after.