I'm helping a small nonprofit that handles sensitive medical information and currently hosts its email on-premises. We're considering upgrading from Exchange 2016, but Microsoft's requirements for Exchange 2019 list a much larger memory footprint—up to 128 GB for the Mailbox role. That seems excessive for an organization with fewer than 10 users. Is that requirement based on real-world needs, or is it mainly intended to encourage cloud adoption? If on-premises hosting remains necessary because of strict Italian, regional, or partner-imposed data-processing requirements, what would be a realistic minimum amount of RAM?
4 Answers
Don’t size the server purely from the headline memory requirement. Use Microsoft’s Exchange sizing calculator and account for mailbox databases, transaction logs, message volume, search indexing, antivirus, backups, and the operating system. A small deployment has been run successfully on 32–64 GB, but the official requirements and supportability should take priority over anecdotal examples.
Before committing to on-premises Exchange, verify the exact Italian and partner requirements with someone who understands healthcare data protection. Many organizations assume cloud hosting is automatically prohibited when the real issue is data residency, contractual processing terms, encryption, or specific service configuration. A properly contracted Microsoft 365 setup may satisfy those requirements and is usually safer and less expensive for a tiny organization than maintaining public-facing Exchange yourself.
Be very cautious about deploying a new on-premises Exchange environment for such a small organization. You would be responsible for patching, monitoring, backups, spam filtering, certificate management, incident response, and protecting an internet-facing server from compromise. Unless there is a documented legal or contractual reason that cloud email cannot be used, hosted mail is generally the more practical option.
If Exchange is ruled out, platforms such as Mailcow might be worth evaluating, but they still require serious administration and security work. Switching products does not remove the responsibilities of running mail infrastructure, so compare the total operational burden rather than just the server’s RAM requirement.
We’re in Italy, where additional rules can apply to medical information, including restrictions around data separation and third-party processing. I’m checking whether nonprofit Microsoft 365 licensing and the relevant contractual safeguards would be acceptable, but some partner requirements may still push us toward local hosting.