Two Microsoft deadlines land on hybrid senders this month. One has passed. The other has twelve days left.
From the second week of September, Exchange 2016 and 2019 servers that send to Exchange Online over an inbound connector of type OnPremises must be on the October 2025 security update. Anything older gets throttled, then blocked. Enforcement started inside your window, so if hybrid mail flow has felt sluggish this past fortnight, check the build number before you check anything else.
The symptoms are easy to misread. Throttling slows message acceptance and looks like ordinary congestion. The log entries are 4.7.230 and 5.7.230, and a pause can be requested from the mail flow report in the Exchange admin center. Get-InboundConnector | ft Name,ConnectorType tells you whether any of this applies to you.
Worth noting for anyone who reaches for authentication first: a message can pass SPF, DKIM and DMARC and still be rejected on the sending server’s version. This is transport enforcement, not an authentication rule.
October 2025 was the last public update for both versions, and support ended on 14 October 2025. The next time Microsoft raises the floor, meeting it will require the paid ESU programme or Exchange Server Subscription Edition. That is the actual message here.
EWS on 1 October
The second deadline is the EWS block. Any Exchange Online tenant with EWSEnabled still set to Null on 1 October has it flipped to False, which blocks EWS for every application in the tenant. Full deprecation follows on 1 April 2027.
The date that decides your outcome is earlier. Configure an AppID allow list and set EWSEnabled to True before the end of September and your tenant is excluded from the automatic flip. The EWS usage report in the Microsoft 365 admin centre, under Reports, Usage, Exchange, will tell you which apps still need it.
An allow list is a stay of execution, not a fix. Everything on it still has to be on Graph by April 2027.
