Exchange Server SE Standard Review: On-Prem Mail After the 2019 Era

Fix it now

Exchange Server Subscription Edition is on-premises mail after the perpetual licence went away. The code is deliberately familiar; the change is commercial, because a supported deployment now needs active Software Assurance on Exchange Server licences or a qualifying Microsoft 365 subscription with Extended Use Rights. Standard is the same software as Enterprise with a five-database ceiling.

1. Buy it if regulation, contract or data residency genuinely requires mail to stay on hardware you control.
2. Buy it if you were running Exchange 2019, which reached end of support on 14 October 2025, and you are staying on premises.
3. Buy it if a single server with a handful of mailbox databases covers the organisation. Standard supports five mounted databases per server, and passive copies count.
4. Skip it if you have no compliance driver. Exchange Online removes the patch treadmill, the certificate work and the internet-facing attack surface, and that is worth real money.
5. Skip it if you cannot commit to staying current, because the entitlement that lets you run it is the same one that entitles you to cumulative updates.
6. Budget Windows Server licences and Windows Server CALs separately. They are not included and they are regularly forgotten.

If every mailbox lives in Exchange Online and the on-premises server exists only for recipient management, license it through the Microsoft 365 Hybrid Configuration wizard at no cost rather than buying a server licence for it.

If mail is staying in house and the database count fits, Standard is the licence. The next section is about what running it actually costs you in work rather than money.

Why it happens

The release was engineered to be uneventful, and that is the point. Exchange Server SE arrived code-equivalent to the final Exchange 2019 cumulative update, so an organisation already current on Exchange 2019 CU14 or CU15 can perform an in-place upgrade rather than building a new organisation and migrating mailboxes. Anyone on an older version, or on Exchange 2016, does a legacy upgrade instead: add the new servers, move mailboxes and resources, then uninstall the old ones. Administration, PowerShell, the transport pipeline and the database engine behave as they did.

The licensing model is where the change lands. Microsoft describes Exchange Server SE as an entitlement-based model: you need an active qualifying entitlement to install it, run it and stay current, which in practice means active Software Assurance on Exchange Server Standard or Enterprise licences, or a qualifying Microsoft 365 subscription with Extended Use Rights. Maintaining that entitlement is what keeps the deployment licensed and what entitles you to ongoing cumulative updates. It is not simply a renamed perpetual licence with a subscription bolted on.

One practical detail is changing under your feet, so plan for it rather than discovering it. Exchange Server SE RTM does not require a new product key and keeps working after a legacy or in-place upgrade, but Microsoft has stated that a future cumulative update will introduce a product key requirement. If your update process is a person following a runbook once a quarter, that runbook needs a line about where the key will come from.

The honest review of on-premises Exchange in 2026 is mostly about ownership. You own Windows patching, Exchange updates, certificate renewals, DNS records, SPF, DKIM and DMARC alignment, anti-spam and malware filtering, backup and restore, transport rules, and the mail queue when something upstream breaks. None of that is difficult in isolation. All of it together is a job, and it is a job with a security deadline attached.

Security deserves its own paragraph because internet-facing Exchange has a long history of serious vulnerabilities exploited quickly after disclosure. The Emergency Mitigation service is the mechanism Microsoft built for exactly that gap: it is enabled by default, checks the Office Config Service hourly, and applies interim IIS URL Rewrite rules, service mitigations and app pool mitigations until you can install the real security update. Leave it on. It is not installed on Edge Transport servers, and it is not a substitute for updating.

On capacity, Standard supports up to five mounted databases on a server and Enterprise up to a hundred. The subtlety that decides more designs than anything else is what mounted means: Microsoft defines it as a database in use, which includes a passive mailbox database mounted in recovery for log replication and replay. A design with two copies of every database halves what a Standard server can carry, and that is usually when Enterprise starts to look necessary.

Full reference

Standard against Enterprise

What has to be in place before you install

• Windows Server 2019, 2022 or 2025 for Mailbox and Edge Transport roles. Microsoft recommends Server Core.
• An Active Directory forest at the Windows Server 2012 R2 or Windows Server 2016 functional level.
• Windows Server licences for the hosts and Windows Server CALs for your users, which are separate purchases from the Exchange licensing.
• A filtering service in front of the server rather than the server exposed directly to the internet.
• A backup method that is Exchange-aware, and a restore you have actually tested.

Licensing: server, CALs and the hybrid exception

You need a server licence for the server and a CAL for each user or device that uses a mailbox, with the entitlement behind both kept active. The Standard CAL is always required; the Enterprise CAL is an add-on for the users who need the compliance features, and it is bought in addition to the Standard CAL rather than instead of it. Anonymous senders on the internet do not need CALs; people and devices in your organisation do.

There is one genuine exception worth knowing about. If every mailbox lives in Exchange Online and you keep a server on premises purely to manage recipients against your local directory, Microsoft licenses that server at no cost through the Microsoft 365 Hybrid Configuration wizard. It covers recipient management only, so it is not a route to running mailboxes on the quiet, but if that describes your situation you should not be buying a full server licence for it.

Sizing without guessing

Exchange likes memory and fast storage more than it likes raw processor speed, and oversizing a server does not help and can hurt. Use Microsoft’s sizing calculator with your real mailbox counts, message profile and copy layout rather than working from intuition or from a specification somebody used at a previous employer. The output tells you the server, and the copy layout tells you the edition.

1. Establish the number of mailboxes and the message profile.
2. Decide the copy layout: how many databases, how many copies of each, spread across how many servers.
3. Count the mounted databases that lands on each server, active and passive together.
4. If any server exceeds five, you are buying Enterprise for that server regardless of how modest the organisation is.
5. Feed the whole thing into the calculator before you order hardware, not after.

Operational routine, because this is the part people underestimate

• Cumulative updates are an operational routine with a deadline attached rather than a project you schedule when convenient. The entitlement that licenses the product is the one that entitles you to them.
• Leave the Emergency Mitigation service enabled so Microsoft can apply interim mitigations, and know that it is absent on Edge Transport servers.
• Keep AMSI integration on and keep a filtering service in front of the server.
• Track certificate expiry deliberately. An expired certificate on a mail server is a whole-company outage that arrives on a schedule you could have seen.
• Watch for the product key requirement arriving in a future cumulative update and know where your key will come from before update night.

Questions people ask about this