Exchange 2016 CU23 SU22 EOL: 6 Months to Oct 14, 2025

Six Months Until Exchange 2016 CU23 SU22 Is End of Life

On October 14, 2025, Microsoft Exchange 2016 Cumulative Update 23 Security Update 22 (build 15.1.2507.69) reaches end of life (EOL). If your organization still runs this version, you have roughly six months to decide what comes next. Active support for Exchange 2016 itself ended on October 13, 2020; only the latest cumulative update and security update have received patches since then. This is not a long-term servicing (LTS) release, so there is no extended support option from Microsoft.

The Realistic Migration Timeline

A straightforward on-premises migration from Exchange 2016 to Exchange 2019 (or to Exchange Online) typically takes three to four months of planning, testing, and execution — and that’s under ideal conditions. Break down the remaining six months:

• Weeks 1–4 (April–May): Discovery, inventory, and stakeholder alignment. Determine target environment (on-premises or cloud) and begin procurement if new hardware or licensing is needed.
• Weeks 5–8 (May–June): Build pilot environment, run synthetic migrations, and test mail flow, public folders, and client access. Address any application dependencies.
• Weeks 9–12 (June–July): Full staging and user acceptance testing. Document rollback procedures. Apply change freezes common in many organizations during late summer or end-of-quarter.
• Weeks 13–16 (July–August): Begin phased migration. Each batch of users requires careful coordination, directory synchronization, and cutover.
• Weeks 17–20 (August–September): Complete all user migrations, decommission old servers (or at least isolate them), and validate hybrid configurations if moving to Exchange Online.
• Weeks 20–24 (September–October): Buffer for unforeseen issues, user re-training, and post-migration cleanup.

Any delay in procurement, a failed proof of concept, or unexpected application incompatibility can push you past October 14. And if your organization has a change freeze in the last quarter of the year (common in finance, retail, or healthcare), the window shrinks even further.

Risks of Running Past October 14 Without Support

After the EOL date, Microsoft will no longer provide security updates, hotfixes, or non-security patches for Exchange 2016 CU23 SU22. Without a support contract:

• Unpatched vulnerabilities — New CVEs targeting the Exchange Server attack surface will not be addressed. Attackers actively scan for unpatched Exchange instances.
• Compliance exposure — Regulatory frameworks (PCI DSS, HIPAA, GDPR) often require patch management. Running unsupported software can trigger audit findings.
• No SLAs or technical assistance — If a corruption or database failure occurs, there will be no vendor escalation path.
• Third-party integrations — Many backup, archiving, and security tools eventually stop validating integrations against EOL software.

These risks remain regardless of whether you eventually migrate. The longer you delay, the more exposure you accept.

What Third-Party Support Can Do for You

Third-party maintenance from providers like Third Party Support can keep Exchange 2016 CU23 SU22 running safely even after its vendor EOL date. Here’s how that changes your timeline:

• No deadline pressure — Instead of racing to migrate by October 14, you can lock in a support contract now and move on your own schedule. Migrate in six months, twelve months, or not at all — the decision is yours.
• Security patches — Third-party support vendors analyze Microsoft’s published updates and develop equivalent patches for your version, often with shorter deployment windows.
• Break-fix support — You retain access to certified engineers who can troubleshoot database issues, transport problems, and configuration errors.
• Cost control — You avoid the capital expense of new licensing or hardware while support costs remain predictable.

With a contract in place, you also gain flexibility: if your organization later decides to migrate, you can plan it as a strategic initiative, not a fire drill.

Your Decision Point

Six months sounds like a reasonable runway — until you account for procurement, testing, change freezes, and the inevitable hiccup. The organizations that handle this best act before the final quarter.

If you are not ready to migrate by October 14, securing third-party support is a proven way to maintain security and compliance while you evaluate your next move. Contact us to discuss a custom support plan for your Exchange 2016 environment.