Microsoft Expands ESU Program for Legacy Exchange and Skype for Business

Microsoft has committed to providing security updates for all old versions of Exchange Server and Skype for Business. This new phase of the Extended Security Update (ESU) program is designed for customers who need more time to migrate to supported versions of the products.

Microsoft’s Extended Security Update (ESU) program is a paid option that provides critical and important security patches for Microsoft products that have reached the end of their standard support lifecycle. It is intended as a temporary safeguard, which helps organizations reduce security risks while they finalize upgrades or migrations to supported versions, but without restoring full product support, feature updates, or long-term maintenance.

Second phase of ESU targets migration delays

Microsoft explained that this second phase of the ESU program is designed as a short-term safety net for customers who could not complete their migration to Exchange Server Subscription Edition (SE) before the first phase ended. It is not meant to replace upgrading or migrating, but to reduce security risk during the transition period.

“Starting today, customers can contact their Microsoft account team to get information about and purchase additional Period 2 Extended Security Update (ESU) for their Exchange 2016 CU23 or Exchange 2019 CU14/CU15 servers. Simply purchase the same product after today’s date. Your account teams will have information related to per server cost and additional details on how to purchase,” the Exchange team explained.

Six-month security extension through October 2026

According to Microsoft, this second phase provides six additional months of security coverage (from May 2026 through October 2026). Microsoft has clearly stated there will be no further extensions beyond this period. Moreover, organizations that bought the first phase of the ESU program must purchase the second phase separately. Enrollment is not automatic, and buying the first phase does not grant access to the second phase.

Microsoft notes that updates provided under the second program will not be available through Windows Update or public download channels. Microsoft delivers them directly to enrolled customers with specific instructions.

The program is intended for commercial customers with a Microsoft Enterprise Agreement (EA) who are still operating supported cumulative updates of Exchange 2016 or 2019 and need more time to complete migration. Microsoft emphasizes that ESU is a temporary bridge, not a long-term solution. Customers are strongly encouraged to complete their move to Exchange Server SE or Exchange Online as soon as possible.