Microsoft ended extended support for SharePoint Server 2016 and SharePoint Server 2019 on 14 July 2026, and Microsoft lists no paid Extended Security Update program for either. If your farm runs one of them, it is already out of support: it keeps working, but Microsoft no longer fixes it.
That second point sets SharePoint apart from some other Microsoft server products, where you can pay Microsoft for extra years of security updates. Here the decision can't be pushed back by buying updates. It comes down to what is inside your farm and where each part of it should go.
- Extended support for SharePoint Server 2016 and SharePoint Server 2019 ended on 14 July 2026. Both are out of support now.
- Microsoft lists no paid Extended Security Updates for either version, so there is no way to buy more time from Microsoft.
- The routes are Subscription Edition on premises, SharePoint in Microsoft 365, or retiring and replacing parts of the farm.
- The custom code decides the move: farm solutions, web parts, workflows, InfoPath forms, integrations and permissions.
When did SharePoint 2016 and 2019 support end?
Both versions follow Microsoft's Fixed Lifecycle Policy, and both left extended support on the same day. The dates come from Microsoft's lifecycle pages for SharePoint Server 2016 and SharePoint Server 2019, both checked on 16 October 2026.
| Version | Lifecycle policy | Start date | Mainstream support ended | Extended support ended |
|---|---|---|---|---|
| SharePoint Server 2016 | Fixed | 1 May 2016 | July 2021 | 14 July 2026 |
| SharePoint Server 2019 | Fixed | 22 October 2018 | January 2024 | 14 July 2026 |
The on-premises version that is still supported is SharePoint Server Subscription Edition. Its lifecycle page, checked on 16 October 2026, shows it follows Microsoft's Modern Lifecycle Policy and is in support.
What end of support means for your farm
Nothing switched off on 14 July. Sites still load and documents still open.
What changed is what Microsoft will do for you. Microsoft's list of 2026 end-of-support products, checked on 16 October 2026, names SharePoint Server 2016 and 2019 among this year's retirements. It says that after the end date Microsoft provides no new security updates, no non-security updates and no assisted support options, paid or otherwise.
So every vulnerability found in SharePoint 2016 or 2019 from now on stays open on your farm. A SharePoint farm is rarely a quiet corner of the network, either. It is usually joined to your directory, holds documents from across the business, and is sometimes published to the internet for remote staff and partners.
No paid ESU for SharePoint
The same Microsoft page lists paid Extended Security Update years for SQL Server 2014 and for Windows Server 2012 and 2012 R2. It lists no ESU for SharePoint Server 2016 or 2019. There is no program to join and no price to negotiate.
Auditors and regulators ask about it
Unsupported software comes up in audits and in customer vendor-risk questionnaires. Some regulators now require firms to track the support expiration date of every asset. New York's DFS cybersecurity rule is the clearest example, covered in the risks of running end-of-life software. A SharePoint 2016 or 2019 farm goes on that list with a date already in the past.
What's inside the farm decides the move
Moving plain document libraries is not the hard part. Everything built on top of SharePoint over the years is. Before you choose a route, list these:
- Farm solutions. Full-trust code packages deployed to the servers. SharePoint in Microsoft 365 doesn't accept them, so each one has to be rebuilt, replaced or dropped.
- Custom web parts and pages. Server-side web parts usually arrive inside farm solutions, and modern SharePoint uses a different development model.
- Workflows. SharePoint Designer workflows and any third-party workflow tools. Note which business process depends on each one and who owns it.
- InfoPath forms. Forms that capture data for a process. Record which lists they write to and what reads that data later.
- Integrations. Line-of-business systems that read from or write to SharePoint, scheduled jobs, and anything calling the server's object model or older web services.
- Permissions. Broken inheritance, unique permissions on single items, and groups nobody can explain. Moving these badly exposes documents to the wrong people.
A farm that is mostly document libraries and standard lists has an easy decision. A farm with years of farm solutions, workflows and forms is a software project, and should be scoped like one. Server-side custom code for these versions is .NET Framework code, so the porting questions in our .NET Framework 4.8 article apply too. Audit it the way you'd audit any codebase before you estimate the move.
Your three routes off SharePoint 2016 and 2019
| Route | What it means | When it fits | What to check first |
|---|---|---|---|
| SharePoint Server Subscription Edition | Stay on premises, on the version Microsoft supports under its Modern Lifecycle Policy | Content must stay on your own servers, or the farm runs farm solutions you can't rebuild yet | Which customizations work on Subscription Edition, and Microsoft's upgrade guidance for your version |
| SharePoint in Microsoft 365 | Move sites and content to Microsoft's cloud service | You already use Microsoft 365, and most of the farm is documents and lists | Every farm solution, server-side web part and custom workflow |
| Retire and replace parts | Archive what nobody uses, and move each custom application to a better home | Some sites are really applications that outgrew SharePoint | Who uses each site, and what business rules sit in its code and forms |
A mix often works best: documents to Microsoft 365, and one heavily customized application kept on Subscription Edition while it's rebuilt. An on-premises farm full of custom code is one of the more common legacy system examples.
How to move off SharePoint 2016 or 2019
- Inventory the farm. Sites, content volume, farm solutions, workflows, forms, integrations and permissions, with an owner for each.
- Decide each customization. Rebuild it, replace it with a standard feature, or drop it. Usage logs and site owners tell you what is still used.
- Choose a route per part. One answer for the whole farm is rarely the right one.
- Contain the old farm while you move. Limit outside access and cut connections it doesn't need.
- Move in waves. Start with the simplest sites, and keep the old content read-only until each wave is signed off.
How the 30-day assessment helps
For a SharePoint farm, the hard part of any estimate is the custom code, and that is what the 30-day assessment looks at. It is fixed in scope, at a price agreed before we start. Over 30 days we go through the farm solutions, web parts, workflows, forms and integration code, and the architecture around them. We map how the farm fits together with the systems that depend on it, find the hidden architectural debt, and flag the security and compliance gaps, including the permissions model.
The report says in plain language what is broken and what it would take to fix it, item by item, so you can see which route each part of the farm needs. Your own team can carry out the move from there. Or we can do the work as a separate project with its own scope and price. The report is complete either way.