Exchange Server Updates: Focus on Security and Phasing Out Legacy Versions
Microsoft is preparing significant changes to Exchange Server for the project's 30th anniversary. The main focus is on enhancing cybersecurity and transitioning to a single Subscription Edition (SE). Enterprise customers who prefer on-premise deployments will receive support until 2035, but with compatibility limitations.
History and Evolution of the Platform
Exchange Server debuted in 1996 as an integrated solution for email, calendars, and centralized directories. Support for SMTP and X.400 standards provided administrative control. Later integration with Active Directory improved automation, scalability, and reliability.
Today, the platform is positioned as Microsoft's first successful server product for enterprises. Expansion to Exchange Online doesn't negate the value of on-premises installations: customers retain control over their infrastructure. However, supporting multiple versions (up to three in one organization) complicated migrations and slowed innovation due to backward compatibility requirements.
Microsoft expects consolidation on Exchange SE as the single main branch. This will simplify development and architecture optimization.
Cybersecurity Priorities
Security remains a key focus. IT administrators are advised to check Exchange Server deployment configurations for vulnerabilities. Microsoft emphasizes the need for additional measures to protect on-premise installations.
Recent changes in Exchange Online illustrate the approach:
- Blocking connections from mobile devices on Exchange ActiveSync (EAS) below version 16.1 after March 1, 2026.
- Affects only native mail clients; Outlook Mobile doesn't use EAS and remains available.
- On-premises Exchange Server unaffected.
EAS is a protocol for synchronizing mail, calendars, contacts, and tasks. The change boosts security for cloud connections.
Shutting Down Legacy APIs
In April 2027, Microsoft will end support for Exchange Web Services (EWS) API in Exchange Online. After 20 years of service, this interface is outdated. Middle- and senior-level developers should migrate to modern alternatives like Microsoft Graph API.
Key consequences:
- EWS Managed API and EWS Java API will stop working in Online.
- On-premise versions will retain EWS longer, but with a recommendation to transition.
- Migration requires analyzing dependencies in legacy code.
- Graph API offers expanded functionality: OAuth 2.0, improved throttling, JSON support.
- Testing the migration is critical for enterprise applications.
Transition to Subscription Edition
Exchange SE will provide support until 2035. Customers can manage updates via subscription, minimizing risks from fragmented versions. Backward compatibility will simplify, accelerating new feature releases.
Recommendations for administrators:
- Assess the current Exchange version stack.
- Plan migration to SE.
- Strengthen security monitoring (e.g., via Security Defaults).
- Test EAS compatibility for mobile clients.
These changes reflect the trend toward unification and a security-first approach in enterprise email.
What Matters
- Support until 2035: Exchange SE is a long-term on-premise solution.
- EAS block: Mobile clients below 16.1 cut off from Online starting March 2026.
- EWS sunset: API closes in Online in April 2027 — migrate to Graph.
- Security focus: Additional checks for all deployments.
- Version consolidation: Phasing out multi-version coexistence.
— Editorial Team
No comments yet.