Exchange Online Is Now Throttling and Blocking Outdated Exchange 2016/2019 Hybrid Servers: Are You Below Baseline?

Since the second week of September 2026, Exchange Online has been actively throttling and, eventually, blocking mail from Exchange 2016 and 2019 servers that connect via a classic hybrid OnPremises inbound connector if they’re not patched to at least the October 2025 update baseline, the last public security update either version ever received before support ended October 14, 2025. If your organization still runs hybrid Exchange with an on-premises server below that baseline, mail delivery to Exchange Online is already degrading, or will be soon, and the failure mode is specifically designed to look like ordinary congestion at first.

The three-stage enforcement system

This isn’t a hard cutoff on a single date, Microsoft’s transport-based enforcement system for outdated on-premises Exchange servers works in three escalating stages:

1. Reporting: a report identifying affected servers appears in the Exchange admin center, the earliest signal, easy to miss if nobody’s specifically watching for it.
2. Throttling: mail flow from the affected server slows down. This stage is deliberately easy to misdiagnose, delayed delivery looks like ordinary network congestion or a transient issue, not an enforcement action, which means it’s genuinely easy to spend time troubleshooting the wrong thing.
3. Blocking: submissions from the affected server are rejected outright. This stage produces much more obvious, unambiguous errors, but by this point mail has already been failing to deliver reliably for a while.

This only applies to servers connected to Exchange Online through a classic hybrid setup using an “On-Premises” inbound connector type, if your organization has already fully migrated off hybrid or uses a different connector configuration, this specific enforcement doesn’t apply to you, but it’s worth confirming rather than assuming.

Why the October 2025 baseline specifically

October 2025 was the last month Exchange 2016 and 2019 received public security updates at all, support for both versions ended October 14, 2025. Microsoft is using that final patch level as the minimum bar for hybrid mail flow specifically because any server below it has been running with known, permanently unpatched vulnerabilities for nearly a year at this point. This is the same underlying logic behind Microsoft’s earlier “persistently vulnerable Exchange server” throttling system, extended to formally cover the end-of-support cutoff for these two versions.

What to check and do right now

# Confirm the build number of any on-premises Exchange server involved
# in your hybrid mail flow
Get-ExchangeServer | Get-ExchangeServer -Status | Select-Object Name, AdminDisplayVersion

# Cross-reference against the October 2025 update baseline for your
# specific version (2016 or 2019) via Microsoft's official build
# numbers reference, don't rely on memory for the exact build string

If you find a server below baseline, the real fix depends on your situation. If the server is only being kept around for hybrid management purposes (mailbox moves, free/busy, certain Microsoft 365 admin functions) rather than actively hosting production mailboxes, patching it to the October 2025 baseline is straightforward and should happen immediately, there’s no ongoing feature work to worry about breaking since the version is end-of-support either way. If the server is still hosting production mailboxes, this enforcement is a strong forcing function to accelerate whatever migration plan was already on the roadmap, since remaining on an unsupported, unpatched version was never a stable long-term position regardless of this specific enforcement mechanism.

The broader pattern: hybrid Exchange as a shrinking, more tightly enforced category

Exchange Server Subscription Edition (SE) is Microsoft’s current supported on-premises direction, Exchange 2016, 2013, and 2010 should not be treated as stable hybrid endpoints going forward. Organizations still needing on-premises mail flow for genuine business reasons should be planning toward either moving remaining mailboxes to Exchange Online where feasible, or deploying a supported Exchange SE-based hybrid server if hybrid services remain genuinely required, rather than continuing to run an end-of-support version and hoping enforcement mechanisms like this one stay lenient.

Frequently asked questions

We use hybrid Exchange but connect via a different method than the classic OnPremises inbound connector. Are we affected?
This specific enforcement targets the classic “On-Premises” inbound connector type specifically. Confirm your actual connector configuration in the Exchange admin center rather than assuming based on connector type, since hybrid configurations vary and it’s worth verifying directly.

Our server is already being throttled. How do we confirm that’s actually what’s happening rather than a network issue?
Check the Exchange admin center report specifically flagging outdated on-premises servers first, that’s the authoritative signal rather than inferring it from delivery delays alone, since throttling is deliberately designed to look similar to ordinary congestion. If the report confirms it, the fix is patching to baseline, not network troubleshooting.

If we patch to the October 2025 baseline now, does that fully resolve enforcement, or is more required long-term?
Patching to baseline resolves the immediate throttling/blocking enforcement, but Exchange 2016 and 2019 remain out of support entirely, meaning no future security updates regardless of this specific enforcement mechanism. Treat reaching the October 2025 baseline as buying time to complete a real migration plan, not as a permanent solution to running an unsupported Exchange version.