Microsoft to bounce mail from outdated Exchange servers
Microsoft is tightening security enforcement for on-premises Exchange Server, warning administrators that outdated installations will soon be prevented from delivering email to Exchange Online. From the second week of September, Exchange Server 2016 and 2019 systems sending mail via an inbound "OnPremises" connector must be updated to the final public update baseline released in October 2025, or their messages risk being throttled or blocked entirely. The move is part of an ongoing push by Microsoft to ensure hybrid deployments run on patched, secure software, though it has caused frustration among some administrators.
Microsoft says the required update level has been available for almost a year and that all organisations should already have applied it, noting that any future baseline increase would effectively require enrolment in Extended Security Updates or migration to Exchange Server Subscription Edition. The restriction applies specifically to servers using the OnPremises inbound connector type, so other mail delivery routes remain unaffected, though Microsoft has hinted the scope "might change in the future". Microsoft Principal Project Manager Nino Bilic stressed that such changes would have occurred regardless of the advance announcement, adding that administrators must ensure Exchange updates are applied on schedule.
In short
- Unpatched Exchange 2016/2019 servers will be blocked from reaching Exchange Online
- Servers must meet the October 2025 update baseline from mid-September
- Only OnPremises inbound connector mail flow is affected, for now
Steelman: both sides, in good faith
The strongest fair case each way — we don't pick a winner.
The case for
Microsoft can argue that requiring a known, year-old security baseline helps protect Exchange Online and organisations connected to it from vulnerabilities in outdated servers. A clear deadline encourages administrators to patch or migrate, while advance notice gives them time to plan and reduces the risk that insecure systems remain a route into the wider service.
The case against
Administrators can argue that blocking or throttling business email creates operational risk, especially for organisations with limited staff, complex hybrid systems or difficulty scheduling upgrades. Even with advance notice, a fixed baseline can leave little room for unusual deployment constraints, and Microsoft’s hint that the restriction may expand makes long-term planning less certain.
Explained simply
Exchange Server is software that organisations can run on their own computers to manage email. Some organisations connect it to Exchange Online, Microsoft’s cloud email service, so staff and systems can send messages between the two.
Microsoft issues updates to fix security problems and keep Exchange servers supported. Organisations using older versions may need to update or move to newer software to keep their email systems secure and compatible.
The policy affects a particular route for sending mail from on-site Exchange servers to Exchange Online. It matters to administrators because a server that does not meet Microsoft’s update requirements could have its messages slowed or stopped.