Exchange 2016 to Exchange Server SE migration: coexistence, namespaces and decommissioning

Exchange Server 2016 reached end of support on 14 October 2025, and unlike Exchange 2019 it has no in-place route to Exchange Server Subscription Edition (SE). The way forward is what Microsoft calls a legacy upgrade: add SE servers to the same organization, run both side by side, move everything across and then remove 2016. Here's that sequence, with the commands and checks for each stage.

Prerequisites and how coexistence works#

• Upgrade path. SE supports an in-place upgrade only from Exchange 2019 CU14 or CU15 (see in-place upgrade from Exchange 2019). From 2016 you add new servers, migrate mailboxes and resources, and uninstall the old ones. Don't detour via Exchange 2019; it's out of support too.
• Exchange 2016 build. Coexistence with SE is supported only when every 2016 server, Edge Transport included, runs CU23, its final CU. Add the latest SU before you start.
• Exchange 2013. Any remaining 2013 servers must be removed before SE setup will run.
• Windows Server. SE supports Windows Server 2019, 2022 and 2025, and Microsoft recommends Server Core. Upgrading Windows in place under Exchange isn't supported, so build new servers.
• Active Directory. Check your domain controllers and forest functional level against the supportability matrix. If a Windows Server 2025 domain controller holds the schema master role, it needs the November 2025 or later cumulative update before PrepareAD.
• DAG. SE servers can't join an Exchange 2016 DAG, so build a new DAG for SE.
• Unified Messaging. The UM role doesn't exist in Exchange 2019 or SE; replace it before 2016 goes.
• Licensing. Microsoft's SE upgrade article says SE RTM doesn't need a new product key and that a future CU will introduce a new key requirement, so check it before you license the servers. My SE explainer covers the subscription side.

During coexistence the SE servers become the front door: once your namespaces point at them, they accept client connections for everyone and proxy requests for mailboxes still on Exchange 2016.

Step-by-step#

1. Prepare Active Directory with the SE media#

Use an account in Schema Admins and Enterprise Admins, on a machine in the schema master's Active Directory site, and let replication finish between steps:

.\Setup.exe /IAcceptExchangeServerLicenseTerms_DiagnosticDataOFF /PrepareSchema
.\Setup.exe /IAcceptExchangeServerLicenseTerms_DiagnosticDataOFF /PrepareAD
.\Setup.exe /IAcceptExchangeServerLicenseTerms_DiagnosticDataOFF /PrepareAllDomains   # multi-domain forests only

2. Install and configure the SE servers#

Install the prerequisites, SE and its latest SU, then run the Health Checker; the CU pre-flight checklist applies here too. Straight after setup, point each new server's Autodiscover SCP at your shared namespace. Otherwise domain-joined Outlook clients can find it under its own server name and show certificate warnings:

Set-ClientAccessService -Identity EXSE-01 `
  -AutoDiscoverServiceInternalUri https://autodiscover.contoso.com/Autodiscover/Autodiscover.xml

Next, import your existing SAN certificate and assign it to IIS and SMTP (see Exchange Server certificates), then copy the virtual directory URLs from 2016:

Get-OwaVirtualDirectory -Server EX2016-01 | Format-List InternalUrl, ExternalUrl
Set-OwaVirtualDirectory -Identity 'EXSE-01\owa (Default Web Site)' `
  -InternalUrl https://mail.contoso.com/owa -ExternalUrl https://mail.contoso.com/owa

Repeat for ECP, EWS, ActiveSync, OAB and MAPI (Set-EcpVirtualDirectory, Set-WebServicesVirtualDirectory, Set-ActiveSyncVirtualDirectory, Set-OabVirtualDirectory, Set-MapiVirtualDirectory) and set the host names with Set-OutlookAnywhere. Then create the SE DAG and databases.

3. Pilot before you switch anything#

Create a few test mailboxes on SE. Test OWA, Outlook, mobile devices and any EWS-based apps against the SE servers directly (a hosts-file entry on a test client is enough), and test between SE and 2016 mailboxes: free/busy, delegate access and mail flow.

4. Move the namespaces#

Lower DNS TTLs a day ahead. Then point internal and external DNS, load balancer pools and firewall publishing for names such as mail.contoso.com and autodiscover.contoso.com at the SE servers. Confirm that the 2016 servers publish the same Autodiscover URL (Get-ClientAccessService | Format-Table Name, AutoDiscoverServiceInternalUri), then test again with mailboxes on both versions.

5. Move mail flow#

Set-SendConnector -Identity 'Internet' -SourceTransportServers EXSE-01, EXSE-02
Get-ReceiveConnector -Server EX2016-01 | Format-Table Name, Bindings, RemoteIPRanges -AutoSize

• Point inbound SMTP (firewall NAT, smart host or Edge) at SE.
• Recreate custom Receive connectors, such as relay and partner TLS, on SE and repoint devices and apps.
• Edge Transport: deploy SE Edge servers and create new Edge Subscriptions.
• Hybrid: re-run the Hybrid Configuration Wizard and select the SE servers and certificate (see Exchange hybrid mail flow).

6. Move the mailboxes#

Stop new mailboxes landing on 2016, move the system mailboxes first, then move users in waves:

Get-MailboxDatabase -Server EX2016-01 | Set-MailboxDatabase -IsExcludedFromProvisioning $true

Get-Mailbox -Arbitration -Server EX2016-01 | New-MoveRequest -TargetDatabase DBSE-01
Get-Mailbox -AuditLog -Server EX2016-01 | New-MoveRequest -TargetDatabase DBSE-01

Import-Csv .\Wave1.csv | ForEach-Object {
  New-MoveRequest -Identity $_.PrimarySmtpAddress -TargetDatabase DBSE-01 `
    -BatchName 'Wave1' -SuspendWhenReadyToComplete
}
Get-MoveRequest -BatchName 'Wave1' | Get-MoveRequestStatistics |
  Format-Table DisplayName, StatusDetail, PercentComplete -AutoSize
Get-MoveRequest -BatchName 'Wave1' -MoveStatus AutoSuspended | Resume-MoveRequest

Each wave copies data in the background and switches over when you resume it, ideally out of hours. Move public folder mailboxes with New-MoveRequest as well (list them with Get-Mailbox -PublicFolder).

7. Decommission Exchange 2016#

Before you uninstall, prove nothing still depends on 2016: no mailboxes of any type (check with the switches), no Send connector references, and quiet IIS and SMTP receive logs for a reasonable period. Then follow uninstalling an old Exchange server to remove the databases, the DAG and the servers. Only once the last 2016 server is gone are you clear of the CU2 coexistence block.

Verify#

Get-ExchangeServer | Format-Table Name, AdminDisplayVersion -AutoSize
Get-Mailbox -ResultSize Unlimited | Group-Object ServerName | Format-Table Name, Count -AutoSize
Get-Mailbox -Arbitration | Format-Table Name, ServerName -AutoSize
Get-ClientAccessService | Format-Table Name, AutoDiscoverServiceInternalUri -AutoSize
Test-ServiceHealth -Server EXSE-01

What good looks like: every mailbox, including arbitration, audit and public folder mailboxes, reports an SE server; every Client Access service publishes the shared Autodiscover URL; Microsoft's Remote Connectivity Analyzer tests pass from outside; and Health Checker is clean on each SE server. After decommissioning, Get-ExchangeServer lists only your SE servers.

Tips & gotchas#

• Exclude the 2016 databases from provisioning early, or automatic mailbox distribution can still place new mailboxes there.
• After a move, Outlook users may see "The Microsoft Exchange administrator has made a change that requires you quit and restart Outlook." That's expected; restarting Outlook is enough.
• Check that backup, archiving, antivirus and EWS-integrated products support SE before cutover.
• Keep the 2016 servers on their latest SU while they're still running, and keep the coexistence period short.

References#

• Upgrading to Exchange Server Subscription Edition (SE) (Microsoft Learn)
• Exchange Server supportability matrix (Microsoft Learn)
• Exchange Server 2019 and SE system requirements (Microsoft Learn)
• Exchange Server build numbers and release dates (Microsoft Learn)