Free tools Windows power users keep installed
One-click scans. No signup required.
The main difference is who operates the mail infrastructure. With Exchange Server on-premises, your organization must maintain the Exchange servers and supported Windows infrastructure, including keeping Exchange updated. Exchange Online is hosted by Microsoft, but your organization still manages important security responsibilities such as data, identities, endpoints, and access. A hybrid deployment keeps on-premises server work in scope while adding cloud integration.
At a glance: who maintains what?
| Area | Exchange Server on-premises | Exchange Online | Hybrid |
|---|---|---|---|
| Mail infrastructure | Your organization operates the Exchange server environment and its supported Windows infrastructure. | Microsoft operates the hosted service infrastructure; your administrators manage tenant settings and customer-side security responsibilities. | Both the on-premises environment and cloud tenant are in scope. |
| Product updates | Your administrators plan and apply Exchange updates, and must keep the deployment within its supported lifecycle. | Microsoft hosts the service. The sources cited here do not establish a complete customer-versus-Microsoft maintenance schedule. | Retained on-premises Exchange servers still need current updates; cloud integration adds configuration work. |
| Mailbox protection | Microsoft documents an add-on route for built-in cloud security features for on-premises mailboxes; architecture and licensing need checking. | Built-in security features are included for cloud mailboxes. Advanced Defender for Office 365 capabilities depend on the tenant’s plan or subscription. | Protection depends on the mailboxes’ architecture and the features licensed and configured for the environment. |
| Customer security work | Your organization controls the environment and must protect its data and access. | Provider-side controls do not replace customer responsibility for data, endpoints, accounts, and access. | Responsibilities span the retained servers, cloud tenant, and their integration. |
Which Exchange Server versions are supported?
As of October 7, 2026, Microsoft lists Exchange Server Subscription Edition as supported under its Modern Lifecycle Policy, with support beginning July 1, 2025. Exchange Server 2016 and Exchange Server 2019 reached end of support on October 14, 2025. Those lifecycle dates do not establish whether a specific installation is configured securely or meets its operational requirements.
As an Amazon Associate I earn from qualifying purchases.
Support status matters because Microsoft ties the availability of Exchange security updates to product support and update level. Organizations still running Exchange Server 2016 or 2019 should treat their out-of-support status as a maintenance and security concern, not assume they continue to receive normal product support. Check Microsoft’s current lifecycle and supportability information for the exact product and build before planning changes.
Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minuteWindows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallWhat maintaining on-premises Exchange involves
Plan for several kinds of Exchange updates
Microsoft’s Exchange Server update FAQ describes three update types:
#1 Best Overall
- Cumulative updates (CUs): Microsoft describes a twice-yearly cadence during mainstream support, without fixed release dates.
- Security updates (SUs): Released when needed. The product’s support status and CU level affect which SUs Microsoft releases.
- Hotfix updates (HUs): Used for feature changes that need to ship sooner than a CU.
Microsoft recommends keeping Exchange current and preparing to apply emergency security updates. Administrators should consult the live FAQ and release notes for the relevant build and remediation instructions rather than treating a general cadence as a guaranteed release calendar.
Maintain the operating system and validate follow-up actions
Keeping the Exchange application current is not the only maintenance task: Microsoft also advises keeping Windows current because operating-system vulnerabilities can contribute to attack chains. After relevant security updates, Microsoft recommends running Exchange Server Health Checker to identify required follow-up actions. Follow the guidance for the specific update and server build.
What Exchange Online changes—and what it does not
Included mailbox security is a baseline
Microsoft says each Exchange Online cloud mailbox includes built-in security features that are applied automatically, without setup for that baseline. The service description lists anti-malware, anti-spam, anti-phishing, and anti-spoofing capabilities; administrators can review filtering reports and adjust basic settings in the Microsoft 365 admin center.
Rank #2
That baseline is not the same as every advanced threat-protection capability. Microsoft describes features such as Safe Links, Safe Attachments, and advanced investigation capabilities separately under Microsoft Defender for Office 365; availability depends on the applicable plan or subscription. Check the tenant’s actual entitlements before assuming those controls are included.
Cloud hosting does not remove customer security duties
Microsoft’s general cloud shared-responsibility guidance assigns customers ongoing responsibility for data governance and protection, endpoints, accounts, and access management. In practice, provider-operated infrastructure does not fix weak credentials, excessive permissions, unmanaged devices, or poor retention and compliance choices. Microsoft’s guidance is general cloud guidance, not a complete Exchange-specific responsibility matrix.
Microsoft Service Assurance materials describe logical tenant isolation and controls for Exchange Online mailbox data storage and authorization. These descriptions explain provider-side controls; they do not establish that an individual tenant is configured correctly or replace the organization’s own compliance assessment.
Hybrid Exchange keeps server maintenance in scope
A hybrid deployment connects on-premises Exchange and Exchange Online, and can serve as a transition toward full migration or support an environment where mailboxes remain split. Microsoft’s hybrid overview says the deployment requires at least one on-premises Exchange server and current CUs or update rollups for the applicable version.
Recommended Free Tools
That requirement also applies when an on-premises server is retained only to manage Exchange-related objects: Microsoft says it still needs to be kept current. Installing updates alone does not require rerunning the Hybrid Configuration Wizard, according to Microsoft’s update FAQ.
Transport and application configuration need attention
Hybrid mail transport uses TLS to authenticate and encrypt messages between the on-premises Exchange organization and Exchange Online. Administrators must choose a routing design, including whether inbound internet mail goes through Microsoft 365 or the on-premises environment. Routing choices affect architecture and which components are exposed, but they do not remove the need to maintain retained servers.
Microsoft’s dedicated hybrid application guidance describes an Entra ID application for hybrid communication. It says Graph API permissions can replace EWS permissions in most hybrid scenarios starting with the May 2026 Hotfix Update. Confirm the applicable current guidance, supported builds, and application configuration for your environment.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Check Exchange Web Services dependencies in Exchange Online
In a September 19, 2023 announcement, Microsoft 365 Developer Greg Taylor said Microsoft planned to start blocking EWS requests from non-Microsoft apps to Exchange Online on October 1, 2026, and encouraged migration to Microsoft Graph. The announcement explicitly concerns Microsoft 365 and Exchange Online, not Exchange Server.
Do these 3 things before closing this tab:
1Clear out junk files and repair common Windows errors2Scan for outdated or missing drivers - takes under a minute3Repair Windows errors before they cause bigger problemsBecause October 1, 2026 has passed, treat that date as the start of an announced rollout—not proof that every tenant has already been blocked. Check current Microsoft guidance and tenant Message Center notices, and identify affected applications before relying on EWS. The announcement does not describe a corresponding change to EWS in Exchange Server.
How to choose between the operating models
- Consider Exchange Online if you want Microsoft to operate the hosted service infrastructure and want the included cloud mailbox security baseline. You still need to manage tenant security, customer data, identities, endpoints, and plan-dependent protection features.
- Consider supported on-premises Exchange if your organization needs to operate the mail server environment itself and can maintain supported Exchange and Windows infrastructure, apply updates, and handle the associated security work.
- Use hybrid deliberately when you need coexistence or a migration path. It combines cloud and server responsibilities rather than eliminating the latter, so account for ongoing updates and the additional transport and application configuration.
Microsoft’s cited materials do not establish comparative breach rates, a universal difference in patching effort or downtime, or a complete Exchange Online task-by-task responsibility split. The operating model alone is not evidence that one particular deployment is secure: lifecycle status, configuration, update practices, licensed controls, and customer access decisions all matter.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
