SharePoint Server 2016 and 2019 End of Support: What Now

Support for SharePoint Server 2016 and 2019 ended in July 2026. If you're still running either one, it stopped getting security patches two months ago. You have three options: move to Microsoft 365, upgrade to SharePoint Server Subscription Edition, or keep running a file-and-intranet server that nobody is fixing anymore.

The third one isn't really an option. Here's what the other two involve.

The short version

• Support ended July 2026. No patches, no bug fixes, no technical support for SharePoint Server 2016 or 2019.
• This class of bug is already being exploited. The 2025 ToolShell attacks hit on-premises SharePoint and skipped SharePoint Online entirely.
• Most SMBs should move to Microsoft 365. If you own Business Premium or E3, you're already paying for the replacement.
• Subscription Edition is the on-premises path, and it only makes sense for real line-of-business or data-residency constraints.
• Start with an inventory. It decides the scope, cost, and timeline of everything else.

What actually stopped in July 2026?

Security updates. Microsoft's lifecycle pages list the extended end date for both SharePoint Server 2016 and SharePoint Server 2019 as July 2026. After that date there are no patches, no bug fixes, and no technical support.

The software keeps running. It just stops getting defended.

SharePoint Server 2019 actually left mainstream support back in January 2024. The last two and a half years were extended support, which meant security fixes only. Now even those have stopped.

Is an unpatched SharePoint server really that risky?

Yes, and there's a recent case that makes the point better than any warning could.

In July 2025, a SharePoint on-premises flaw tracked as CVE-2025-53770, nicknamed ToolShell, was exploited in the wild. CISA added it to the Known Exploited Vulnerabilities catalog as a "Microsoft SharePoint Server Remote Code Execution Vulnerability."

Microsoft reported that it "observed two named Chinese nation-state actors, Linen Typhoon and Violet Typhoon exploiting these vulnerabilities targeting internet-facing SharePoint servers." A third group used the same access to deploy ransomware.

Two details from Microsoft's write-up matter for the decision in front of you.

First: "These vulnerabilities affect on-premises SharePoint servers only and do not affect SharePoint Online in Microsoft 365." The customers who had already moved sat that one out entirely.

Second: SharePoint Server 2016 and 2019 were both affected, and both got a patch. That was the old arrangement. The next bug of this class won't come with a fix for either version, and your response will be to pull the server off the internet or hope your other controls hold.

There's a compliance angle too. If you're subject to HIPAA, NYDFS, PCI DSS, or a cyber insurance policy with a patching clause, "unsupported software holding client data" is the kind of finding that costs you a renewal. We wrote about the same problem when Exchange Server 2016 and 2019 hit end of support.

Should you move to Microsoft 365 or stay on-premises?

For most small and mid-sized businesses, Microsoft 365. If you're already paying for Business Premium or E3, SharePoint Online and OneDrive are in the license you own. Keeping a server to do what your subscription already does is paying twice.

Staying on-premises makes sense in a narrower set of cases. You have a line-of-business application that reads and writes to SharePoint directly and can't be repointed. You have a data residency or air-gap requirement that genuinely rules out cloud storage.

Or you have heavy customization (custom web parts, InfoPath forms, SharePoint Designer workflows) that would cost more to rebuild than to host.

If that's you, the destination is SharePoint Server Subscription Edition. It's the only on-premises version still supported, and Microsoft's lifecycle page lists it as in support under the Modern Lifecycle Policy. That means continuous updates instead of a fixed expiry date.

Budget for ongoing licensing your old server didn't have. And note that Subscription Edition was also affected by the ToolShell bugs, because on-premises still means you own the patching.

What does the migration actually involve?

Four phases, and the first one takes longer than owners expect.

Inventory. Find out what's actually in there. Site collections, document libraries, permissions that were set once in 2017 and never reviewed, workflows, custom code, and the mystery sites nobody has opened in five years. This step decides the size of the whole project.

Decide what moves. Not everything should. Dormant sites get archived rather than migrated, and duplicated content gets consolidated.

This is the cheapest time in the project to delete things.

Rebuild what doesn't port. SharePoint Designer workflows don't move to Power Automate on their own. InfoPath forms have to be rebuilt, usually in Power Apps or Microsoft Forms, and custom web parts need a modern equivalent.

Budget real development time here or the migration stalls at this step.

Migrate and cut over. Content moves in waves, usually by department, with a final delta sync over a weekend. Users keep working in the old system until their wave lands.

The permissions work is where projects go wrong. A ten-year-old SharePoint farm has permissions granted to people who left, to groups nobody maintains, and to "Everyone" more often than anyone wants to admit.

Copying that mess into SharePoint Online means copying it into a tenant where Copilot can read it. Fix it on the way over. We covered why in fixing SharePoint oversharing before you turn on Copilot.

How long does this take?

A small, clean farm (a few hundred gigabytes, no custom code, straightforward permissions) is usually four to eight weeks end to end. A farm with custom workflows, InfoPath forms, or a line-of-business integration runs three to six months, and most of that time is rebuilding, not moving files.

Support has already lapsed, so the useful question isn't how fast you can finish. It's how fast you can get the server off the open internet and the sensitive content into something patched. Those two things can happen well before the full migration is done.

What else is running on that server?

Check the database underneath it. SQL Server 2016 reached end of support on the same July 2026 Patch Tuesday.

Microsoft's SQL Server blog is blunt about it: "As of today, July 14, 2026, SQL Server 2016 has reached end of support." It warns that staying put "can increase security and compliance risk, especially for business-critical applications and regulated workloads."

Plenty of SMB SharePoint farms sit on SQL Server 2016. If yours does, you have two expired products in one rack, and the SharePoint migration is the natural moment to deal with both.

While you're in there, check the Windows Server version too. Windows Server 2016 is on its own end-of-support clock, and these three tend to age out together.

What this costs

Moving to Microsoft 365 is mostly labor, not licensing, assuming you already own the licenses. The variables are how much content moves, how bad the permissions are, and how much custom development has to be rebuilt.

Staying on-premises means Subscription Edition licensing, new server hardware or Azure VMs if the current box is also aging out, and the same permissions cleanup. It's usually the more expensive path over three years, which is why the line-of-business justification has to be real.

Our breakdown of Microsoft 365 migration cost walks through what actually drives the number.

Frequently asked questions

Can I buy Extended Security Updates for SharePoint Server 2016 or 2019?

Microsoft has not announced an ESU program for either version. Windows Server and SQL Server have paid programs that buy you extra years of patches; don't assume SharePoint works the same way. Treat the July 2026 date as final unless Microsoft says otherwise on the lifecycle pages, and plan on migrating rather than buying time.

What happens to my SharePoint server on the day after support ends?

Nothing visible. It boots, users sign in, documents open. That's what makes this deadline easy to ignore. The change is that any vulnerability discovered from now on stays open permanently, and your compliance and insurance posture now includes unsupported software holding business data.

Do SharePoint Designer workflows migrate to SharePoint Online?

Not on their own. Classic SharePoint Designer workflows have to be rebuilt, normally in Power Automate, so plan this as development work rather than migration work. Most SMB farms have fewer live workflows than they think, so inventory them first. A good share are usually abandoned and can simply be retired.

Is SharePoint Online actually equivalent to what we have on-premises?

For document management, collaboration, and intranet sites, it's better: modern search, external sharing controls, versioning, and no server to patch. The gaps are in deep customization: full-trust server-side code has no equivalent, and some third-party add-ins never made the jump. Inventory your customizations early to find out which category you're in.

We're a 25-person company. Is this really a project, or can our IT person do it over a weekend?

If your content is small and clean, a competent admin can do it with a migration tool over a few weekends. What turns it into a project is customization, permissions debt, and integrated line-of-business applications. The inventory step tells you which situation you're in, and it takes days, not months.

Where to start

Run the inventory. You can't scope, price, or schedule any of this until you know what's on the server, and that's true whether you hand the work to us or do it in-house.

We handle SharePoint migrations and Microsoft 365 migrations for businesses across New York, New Jersey, Connecticut, Pennsylvania, and Southwest Florida. If you're still on 2016 or 2019 and want to know what the move looks like for your environment, get in touch for a complimentary assessment. We'll inventory the farm and tell you which of the two paths actually fits.