Skip to content

Microsoft 365

Exchange Server or Exchange Online: what actually changes

8 min read

The comparison is usually framed as cost. In practice the deciding factor is who is responsible for patching an internet-facing server on the day a critical vulnerability is published.

If you still run Exchange on a server in your building, the question is worth revisiting — not because on-premises is inherently wrong, but because the risk profile has changed considerably in the last few years.

The comparison, honestly

Exchange Server (yours)Exchange Online
Up-front costServer, Windows and Exchange licensing, CALsNone
Ongoing costHardware refresh, patching time, backup, powerPer user per month
PatchingYours, urgently, when one is publishedMicrosoft
Internet exposureYour server, reachable from anywhereMicrosoft's edge
Control over data locationCompleteRegion, not machine
Mailbox sizeWhatever you provisionPer plan, generally generous
AvailabilityYour hardware and your generatorMicrosoft's SLA
Recovery from failureYour backup and your weekendLargely absorbed

The factor that usually decides it

Not cost. Patch urgency.

An internet-facing Exchange Server has been the subject of several critical, actively exploited vulnerabilities where the window between disclosure and mass exploitation was days. Meeting that reliably means somebody who can patch a mail server at short notice, including on a holiday weekend.

Most small businesses do not have that, and discovering they do not have it during an incident is the expensive way to find out. That is the honest argument for Exchange Online: it moves an obligation you may not be able to meet to somebody who can.

When staying put is defensible

  • A regulatory or contractual requirement genuinely mandating data stay on specific infrastructure — genuinely, not as an assumption nobody has re-read.
  • An application integrated so deeply that migration is a project rather than a task, and the risk is being actively managed meanwhile.
  • Connectivity so poor that cloud mail would be worse. Rare now, and worth measuring rather than assuming.

If your Exchange Server is a version that no longer receives security updates, none of the above applies. That is not a hosting preference; it is an unpatched, internet-facing server, and it should be the most urgent item on your technology list.

The hybrid middle

You can run both during a migration, and most businesses do for a period. Where it goes wrong is when the temporary state becomes permanent — you then carry the complexity of both models and the benefits of neither. Hybrid is a bridge, and bridges should have a planned end.

Frequently asked

Is Exchange Online cheaper?

Usually, once you count the things that are easy to leave out: the server refresh, the Windows and Exchange licensing, the backup, and the hours spent patching. Against licence cost alone it can look closer than it is.

Do we lose control of our data?

You lose control of the machine, not the data. You keep ownership, retention policy, legal hold, export and audit. What you give up is choosing which physical server it sits on.

How long does a migration take?

For a typical small business, weeks rather than months, and most of that is survey and preparation rather than moving mail. The cutover itself is usually a scheduled evening.

Can we keep our email addresses?

Yes. You keep your domain and your addresses; what changes is where the mailboxes live and where your MX records point.

Ready to secure your business?

A free assessment: we review your network, backups, Microsoft 365 settings and exposure, then hand you the findings in writing — whether or not you hire us.

Call nowFree assessment