Exchange Server Subscription Edition (SE)

Exchange has been on a slow consolidation curve toward Exchange Online for a decade, but Microsoft still has tens of thousands of customers who genuinely cannot move to the cloud — sovereign clouds, classified networks, regulated industries, regions with strict data-residency laws, and organisations whose business model assumes physical control of the mail platform. SE keeps a supported on-prem option for those scenarios while moving them off the perpetual model that has constrained Microsoft's investment in new features. SE will receive ongoing cumulative updates with new features as well as security updates, instead of the 'security only' posture that on-prem Exchange has had for several years.

Like 2019 before it, SE ships in Standard and Enterprise editions on the server side. Standard caps mailbox databases at five per server; Enterprise raises that to one hundred and is the right pick for any DAG-based deployment at scale. Both editions ship the same feature set — the difference is purely a database-count limit. Most production deployments above a few hundred mailboxes will use Enterprise simply to keep DAG database distribution flexible.

Server licences are now sold as a subscription, billed annually, with no perpetual buy-out. CALs follow the same model: Standard CAL covers core email; Enterprise CAL is additive (bought on top of Standard) and unlocks Data Loss Prevention, in-place archive, journaling and information rights management. Every user or device with a mailbox needs the corresponding CAL stack. For organisations already on Microsoft 365 E3 or E5 with the Exchange Online entitlement, the Exchange Server CAL is included via the dual-use rights baked into those SKUs — many customers do not realise that the on-prem Exchange CAL they would otherwise buy is already on their Microsoft 365 invoice.

SE installs as a Cumulative Update on top of an Exchange 2019 CU14 (or later) deployment. The upgrade preserves DAG membership, transport rules, send/receive connectors, certificates and mailbox locations — there is no schema rebuild and no database move. Microsoft strongly recommends running the latest Exchange 2019 CU and the most recent security update before initiating the SE upgrade, and treating the first server in a DAG as a pilot for at least a few days before rolling forward. Coexistence with Exchange 2016 in the same organisation is no longer supported; any 2016 servers must be decommissioned before SE goes live.

The free Hybrid Configuration Wizard continues to configure coexistence between SE and Exchange Online — shared address space, free / busy lookup between cloud and on-prem mailboxes, calendar federation, and TLS-secured mail flow. Microsoft offers free Hybrid Exchange Server keys for organisations whose only on-prem Exchange role is to manage attributes and route mail for a tenant whose mailboxes all live in Exchange Online; the hybrid server itself does not host production mailboxes and so does not consume a paid subscription.

Exchange Server SE is supported on Windows Server 2019, 2022 and 2025 — check the Exchange Server supportability matrix before you build. Recommended hardware is the same as 2019: plenty of RAM (DAG-aware sizing calculators apply), SSDs for the database volumes, and Exchange-aware backups via VSS. The security baseline is more important than ever — Exchange remains a frequent target for attackers, and SE turns on Extended Protection by default, requires TLS 1.2 minimum, and integrates more tightly with the Microsoft Exchange Emergency Mitigation Service that ships out-of-band defensive rules.

Exchange Server 2016 and 2019 reached end of support on 14 October 2025. They no longer receive security updates, so on-premises mail outside SE has no supported path and running them for production mail flow is a documented compliance issue. SE follows Microsoft's Modern Lifecycle Policy: it stays supported while you keep its subscription or Software Assurance current and install the latest cumulative updates.