Key takeaways

  • Only Exchange Server Subscription Edition and the current cumulative updates are in a supported state. Exchange 2016 and 2019 reached end of support on October 14, 2025.
  • Patch on a fixed cadence: apply the latest cumulative update and security updates promptly, and keep the Exchange Emergency Mitigation Service enabled where it fits your policy.
  • Turn on Extended Protection for Windows Authentication, and publish OWA and ECP through a reverse proxy with multi-factor authentication, or remove them from the internet.
  • A database availability group protects against failure, not against an attacker. Pair it with offline or immutable backups.
  • Decide now whether to stay on-premises, go hybrid or move to Exchange Online, and set a date.

Start with the answer: on-premises Exchange is attacked constantly, and the 2021 ProxyLogon and 2022 ProxyShell families showed how fast a public mail server can become the entry point for ransomware. Hardening is a handful of repeatable controls. The harder question is whether you should keep running it at all.

1. Know your support status

Microsoft's lifecycle pages show that Exchange Server 2016 and Exchange Server 2019 reached end of support on October 14, 2025. Servers still on those versions may continue to run, but they should not be treated as a supported platform. Exchange Server Subscription Edition is the on-premises product that continues to receive updates. Confirm the exact build of every server using Microsoft's Exchange build numbers and release dates page, and write the result down.

2. Patch on a schedule, not when you remember

  • Apply the newest supported cumulative update (CU) and every security update released since, on every server, including the ones nobody logs in to
  • Test in a lab or on a non-critical node first, then roll through production one node at a time
  • Keep Active Directory schema and Exchange prerequisites current, since an update that cannot install is a hole in your plan
  • Keep the Exchange Emergency Mitigation Service on where policy allows, so Microsoft can push temporary protections for newly disclosed flaws
  • Subscribe to Microsoft's Exchange Team announcements and check the CISA Known Exploited Vulnerabilities catalog monthly for Exchange entries

Set a rule your team can keep, for example security updates within a fixed number of days of release and an emergency path for actively exploited flaws.

3. Turn on Extended Protection

Extended Protection for Windows Authentication, also called channel binding, ties a user's authentication to the secure channel it was made on. That blocks a class of relay and man-in-the-middle attacks against Exchange. Microsoft documents the prerequisites, which include a recent CU, TLS 1.2 or later configured consistently and care with load balancers that terminate TLS. Microsoft ships a script to turn it on. Test it first, because misconfigured TLS offloading is the usual cause of breakage.

4. Remove public OWA and ECP exposure

Outlook on the web and the Exchange admin center were the doors used in several major Exchange attacks. Choose one of these, in order of preference:

  • Do not publish OWA at all. Users on managed devices use Outlook over a VPN or a zero-trust access service
  • Publish through a reverse proxy or web application firewall that enforces multi-factor authentication before the request reaches Exchange
  • At minimum, block the Exchange admin center and PowerShell endpoints from the internet and restrict them to a management network

Also disable legacy protocols you do not use, such as basic authentication for POP, IMAP and Exchange Web Services, and review which accounts are exempt from conditional controls.

5. Build redundancy with a database availability group

A database availability group, or DAG, keeps copies of mailbox databases on up to 16 servers, so one server failing does not take mail down. Use at least two copies across separate hosts, and a witness in a third location where possible. Test a planned failover every quarter. Remember what a DAG is not: it replicates changes, including encrypted or deleted data, to every copy. It is not a backup. Keep an offline or immutable backup and prove you can restore from it. Our article on backups that restore covers the 3-2-1 approach.

6. Reduce what an attacker gets

  • Run Exchange servers with the Microsoft Defender or other endpoint protection that Microsoft's documentation supports, with the recommended antivirus exclusions only
  • Limit membership of the Exchange administrative groups, and review who holds Organization Management rights
  • Remove the Exchange permissions that allow broad Active Directory changes where your design allows, using Microsoft's split permissions guidance
  • Send IIS and Exchange logs to a central system and alert on web shell indicators, unexpected new files in Exchange directories and odd PowerShell activity
  • If you run a hybrid setup with Exchange Online, follow Microsoft's current hybrid guidance and keep the on-premises server patched, because it is trusted by your cloud tenant

7. Migration options, honestly compared

  • Stay on-premises with Subscription Edition: you keep control and data location, and you keep the patching, hardening, monitoring and backup work
  • Hybrid: mailboxes can sit in both places, which suits phased moves, and you still need a hardened on-premises server for as long as it exists
  • Move to Exchange Online in Microsoft 365: Microsoft runs the servers, and you still own identity, conditional access, mail flow rules, retention and backup of your tenant data
  • Move to another hosted mail platform: possible, but plan for calendar, delegate, shared mailbox and application relay dependencies

Microsoft Learn documents the mailbox migration paths, including cutover, staged and hybrid. Whichever you choose, inventory every system that sends mail through the server first, such as scanners, line-of-business applications and monitoring tools. Those are the items that surprise teams on cutover weekend.

Where to go from here

Start with a one-page inventory: server names, Exchange builds, who can reach them from the internet, and when each was last patched. Our Managed IT Services and Cybersecurity teams run Exchange assessments and migrations, and the Security category of our shop at the security section of our shop lists related protection services.

Sources

This article is general information. Confirm build numbers, support dates and prerequisites on Microsoft Learn before you change a production mail system, and test in a lab first. Last reviewed .

Keep reading

Need help with this?

We run your IT day to day so it stays secure: help desk, devices, Microsoft 365, Exchange, Active Directory, backups, networks and monitoring.

Managed IT Services