SharePoint Server 2016 and 2019 End of Support: What Now

SharePoint Server 2016 and SharePoint Server 2019 reached end of support, the date most people call end of life, on July 14, 2026. As of October 2026 neither gets security patches, and Microsoft has announced no paid extension. You have three options: move to Microsoft 365, upgrade to SharePoint Server Subscription Edition, or keep running a file-and-intranet server that nobody is fixing anymore.

The third one isn't really an option. Here's what the other two involve.

The short version

• Support ended July 14, 2026. No patches, no bug fixes, no technical support for SharePoint Server 2016 or 2019.
• InfoPath and SharePoint Designer ended the same day. Their support stopped on July 14, 2026, Subscription Edition included, so old forms and workflows need a plan on either path.
• This class of bug is already being exploited. The 2025 ToolShell attacks hit on-premises SharePoint and skipped SharePoint Online entirely.
• Most SMBs should move to Microsoft 365. If you own Business Premium or E3, you're already paying for the replacement.
• Subscription Edition is the on-premises path, and it only makes sense for real line-of-business or data-residency constraints.
• Start with an inventory. It decides the scope, cost, and timeline of everything else.

What actually stopped in July 2026?

Security updates. Microsoft's lifecycle pages list the extended end date for both SharePoint Server 2016 and SharePoint Server 2019 as July 14, 2026. After that date there are no patches, no bug fixes, and no technical support.

The software keeps running. It just stops getting defended.

SharePoint Server 2019 actually left mainstream support back in January 2024. The last two and a half years were extended support, which meant security fixes only. Now even those have stopped.

SharePoint Server 2016 left mainstream support in July 2021, so it spent five years on security fixes alone. The two versions share one end date even though 2019 shipped more than two years later, so a 2019 farm had a much shorter life than its version number suggests.

Is an unpatched SharePoint server really that risky?

Yes, and there's a recent case that makes the point better than any warning could.

In July 2025, a SharePoint on-premises flaw tracked as CVE-2025-53770, nicknamed ToolShell, was exploited in the wild. CISA added it to the Known Exploited Vulnerabilities catalog as a "Microsoft SharePoint Server Remote Code Execution Vulnerability."

Microsoft reported that it "observed two named Chinese nation-state actors, Linen Typhoon and Violet Typhoon exploiting these vulnerabilities targeting internet-facing SharePoint servers." A third group used the same access to deploy ransomware.

Two details from Microsoft's write-up matter for the decision in front of you.

First: "These vulnerabilities affect on-premises SharePoint servers only and do not affect SharePoint Online in Microsoft 365." The customers who had already moved sat that one out entirely.

Second: SharePoint Server 2016 and 2019 were both affected, and both got a patch. That was the old arrangement. The next bug of this class won't come with a fix for either version, and your response will be to pull the server off the internet or hope your other controls hold.

There's a compliance angle too. If you're subject to HIPAA, NYDFS, PCI DSS, or a cyber insurance policy with a patching clause, "unsupported software holding client data" is the kind of finding that costs you a renewal. We wrote about the same problem when Exchange Server 2016 and 2019 hit end of support.

SharePoint Server vs SharePoint Online: what is the difference?

SharePoint Server is the version you install and run on your own servers. SharePoint Online is the same family of software, run by Microsoft as part of Microsoft 365. Since support for 2016 and 2019 ended on July 14, 2026, the only on-premises version Microsoft still supports is SharePoint Server Subscription Edition, so that is the fair comparison.

	SharePoint Server Subscription Edition	SharePoint Online (Microsoft 365)
Hosting	Your own servers running Windows Server 2019, 2022 or 2025, with SQL Server Standard or Enterprise holding the content	Microsoft's cloud; there is no server for you to run
Updates	Microsoft releases one cumulative update a month, and your team installs it across the farm. It follows the Modern Lifecycle Policy, so there is no fixed end date while you stay current	Microsoft updates the service for you
Licensing	A server license for each copy, plus a Client Access License for each internal user or device, with active Software Assurance or a subscription license	Per-user subscription, included in Microsoft 365 Business Basic, Standard and Premium and in E3 and E5
Customization	Full-trust farm solutions and server-side code still run, and SharePoint Framework works too	No full-trust code. SharePoint Framework is the supported model, and SharePoint Add-ins stopped working on April 2, 2026
Workflows	SharePoint 2013 workflows remain supported; support for SharePoint 2010 workflows ended July 14, 2026	SharePoint 2010 workflows were retired in 2020 and SharePoint 2013 workflows on April 2, 2026; Microsoft points customers to Power Automate
Storage	Limited by your own servers and SQL Server capacity	1 TB per organization plus 10 GB per license, up to 25 TB per site
Hybrid	Can be connected to Microsoft 365: OneDrive links that open in the cloud, one search index across both, shared profiles and a shared taxonomy	The same hybrid features, managed from Microsoft 365, for use during a migration or long term alongside SharePoint Server

Sources, all checked October 7, 2026: Microsoft's Subscription Edition server and database requirements, SharePoint update history, Subscription Edition lifecycle, SharePoint Server licensing guidance, full-trust code guidance, SharePoint Framework overview, Add-in retirement notice, SharePoint 2013 workflow retirement, SharePoint Online limits and hybrid OneDrive and SharePoint.

Should you move to Microsoft 365 or stay on-premises?

For most small and mid-sized businesses, Microsoft 365. If you're already paying for Business Premium or E3, SharePoint Online and OneDrive are in the license you own. Keeping a server to do what your subscription already does is paying twice.

Staying on-premises makes sense in a narrower set of cases. You have a line-of-business application that reads and writes to SharePoint directly and can't be repointed. You have a data residency or air-gap requirement that genuinely rules out cloud storage.

Or you have heavy customization, such as custom web parts and full-trust server code, that would cost more to rebuild than to host. InfoPath forms and SharePoint Designer workflows no longer count as a reason to stay: Microsoft ended support for InfoPath Forms Services, SharePoint 2010 workflows and SharePoint Designer 2013 in Subscription Edition on July 14, 2026, the same day InfoPath 2013 itself went out of support. Those pieces need rebuilding whichever way you go.

If that's you, the destination is SharePoint Server Subscription Edition. Both 2016 and 2019 upgrade to it directly with the database-attach method: you build a new Subscription Edition farm, copy the content and service databases across and upgrade them there, so there is no in-place upgrade of the old servers. It's the only on-premises version still supported, and Microsoft's lifecycle page lists it as in support under the Modern Lifecycle Policy. That means continuous updates instead of a fixed expiry date.

Budget for ongoing licensing your old server didn't have. And note that Subscription Edition was also affected by the ToolShell bugs, because on-premises still means you own the patching.

What does the migration actually involve?

Four phases, and the first one takes longer than owners expect.

Inventory. Find out what's actually in there. Site collections, document libraries, permissions that were set once in 2017 and never reviewed, workflows, custom code, and the mystery sites nobody has opened in five years. This step decides the size of the whole project.

Decide what moves. Not everything should. Dormant sites get archived rather than migrated, and duplicated content gets consolidated.

This is the cheapest time in the project to delete things.

Rebuild what doesn't port. Microsoft's SharePoint Migration Tool can convert SharePoint Designer 2010 and 2013 list and library workflows into Power Automate flows, but site workflows and workflow history don't come across, and every converted flow has to be activated and tested. InfoPath forms have to be rebuilt, usually in Power Apps or Microsoft Forms, and custom web parts need a modern equivalent.

Budget real development time here or the migration stalls at this step.

Migrate and cut over. Content moves in waves, usually by department, with a final delta sync over a weekend. Users keep working in the old system until their wave lands.

The permissions work is where projects go wrong. A ten-year-old SharePoint farm has permissions granted to people who left, to groups nobody maintains, and to "Everyone" more often than anyone wants to admit.

Copying that mess into SharePoint Online means copying it into a tenant where Copilot can read it. Fix it on the way over. We covered why in fixing SharePoint oversharing before you turn on Copilot.

How long does this take?

A small, clean farm (a few hundred gigabytes, no custom code, straightforward permissions) is usually four to eight weeks end to end. A farm with custom workflows, InfoPath forms, or a line-of-business integration runs three to six months, and most of that time is rebuilding, not moving files.

Support has already lapsed, so the useful question isn't how fast you can finish. It's how fast you can get the server off the open internet and the sensitive content into something patched. Those two things can happen well before the full migration is done.

What else is running on that server?

Check the database underneath it. SQL Server 2016 reached end of support on the same July 2026 Patch Tuesday.

Microsoft's SQL Server blog is blunt about it: "As of today, July 14, 2026, SQL Server 2016 has reached end of support." It warns that staying put "can increase security and compliance risk, especially for business-critical applications and regulated workloads."

Plenty of SMB SharePoint farms sit on SQL Server 2016. If yours does, you have two expired products in one rack, and the SharePoint migration is the natural moment to deal with both.

While you're in there, check the Windows Server version too. Windows Server 2016 is on its own end-of-support clock, and these three tend to age out together.

What this costs

Moving to Microsoft 365 is mostly labor, not licensing, assuming you already own the licenses. Microsoft's SharePoint Migration Tool is free and supports SharePoint Server 2016 and 2019 as sources, so the tool isn't the expense either. The variables are how much content moves, how bad the permissions are, and how much custom development has to be rebuilt. NetSys quotes a migration as a project and runs the environment afterward for a flat monthly fee per user.

Staying on-premises means Subscription Edition licensing, new server hardware or Azure VMs if the current box is also aging out, and the same permissions cleanup. It's usually the more expensive path over three years, which is why the line-of-business justification has to be real.

Our breakdown of Microsoft 365 migration cost walks through what actually drives the number.

Frequently asked questions

What is a SharePoint server?

A SharePoint server is a Windows Server machine running Microsoft's SharePoint Server software, usually with a SQL Server database behind it, that a company installs and maintains itself to host intranet sites, document libraries and team sites. SharePoint Online does the same job as a service inside Microsoft 365, so there is no server to own. Since support for 2016 and 2019 ended, Subscription Edition is the only on-premises version Microsoft still supports.

When did SharePoint 2016 and SharePoint 2019 reach end of life?

Both on July 14, 2026. SharePoint Server 2016 left mainstream support on July 13, 2021, and SharePoint Server 2019 on January 9, 2024, and both then ran on security fixes only until the shared end date. As of October 2026 the supported choices are SharePoint Online in Microsoft 365 or SharePoint Server Subscription Edition.

Can I buy Extended Security Updates for SharePoint Server 2016 or 2019?

Microsoft has not announced an ESU program for either version. Windows Server and SQL Server have paid programs that buy you extra years of patches; don't assume SharePoint works the same way. Treat the July 2026 date as final unless Microsoft says otherwise on the lifecycle pages, and plan on migrating rather than buying time.

What happens to my SharePoint server on the day after support ends?

Nothing visible. It boots, users sign in, documents open. That's what makes this deadline easy to ignore. The change is that any vulnerability discovered from now on stays open permanently, and your compliance and insurance posture now includes unsupported software holding business data.

Do SharePoint Designer workflows migrate to SharePoint Online?

Partly. The SharePoint Migration Tool converts SharePoint Designer 2010 and 2013 list, library and content-type workflows into Power Automate flows, but not site workflows or workflow history, and each converted flow has to be activated and tested. Complex workflows usually still need rework, so plan this as development work rather than migration work. Most SMB farms have fewer live workflows than they think, so inventory them first. A good share are usually abandoned and can simply be retired.

Is SharePoint Online actually equivalent to what we have on-premises?

For document management, collaboration, and intranet sites, it's better: modern search, external sharing controls, versioning, and no server to patch. The gaps are in deep customization: full-trust server-side code has no equivalent, and some third-party add-ins never made the jump. Inventory your customizations early to find out which category you're in.

What's included in a SharePoint Server migration?

Done properly, five things: an inventory of sites, libraries, permissions, workflows and custom code; a decision on what to archive instead of moving; rebuilt permissions, so old access doesn't follow the content into Microsoft 365; the move itself in verified waves, with a final delta sync before cutover; and support after cutover while people find their way around. Our SharePoint migration work follows that order, and rebuilding forms and workflows is planned as its own piece of development work.

Who handles support and escalations after the move?

Microsoft runs SharePoint Online itself, so outages and service problems go to Microsoft through the admin center. Everything inside your tenant stays with you or your IT provider: permissions, sharing settings, site requests, lost files and user questions. If NetSys manages your Microsoft 365 environment, our help desk is staffed seven days a week, 4 a.m. to 11 p.m. Eastern, and vendor coordination with Microsoft is part of the managed service.

We're a 25-person company. Is this really a project, or can our IT person do it over a weekend?

If your content is small and clean, a competent admin can do it with a migration tool over a few weekends. What turns it into a project is customization, permissions debt, and integrated line-of-business applications. The inventory step tells you which situation you're in, and it takes days, not months.

Where to start

Run the inventory. You can't scope, price, or schedule any of this until you know what's on the server, and that's true whether you hand the work to us or do it in-house.

We handle SharePoint migrations and Microsoft 365 migrations on-site across New York City, Long Island, Westchester, the Hudson Valley, North Jersey and Fairfield County, CT, and remotely elsewhere. If you're still on 2016 or 2019 and want to know what the move looks like for your environment, book a call with an engineer. We'll talk through how to inventory the farm and which of the two paths actually fits.