If you are running SharePoint Server 2016, the system probably still works. Documents flow in and out, permissions hold, users rarely complain. Maybe it was upgraded from 2010 or 2013 once before. Maybe it sits quietly in a server room that nobody on the executive team thinks about week to week.
Microsoft ended support for that system on July 14, 2026. The same date applied to SharePoint Server 2019. There is no Extended Security Updates program, and Microsoft has been clear that one will not be offered.
If your organization is still running SharePoint 2016 or 2019, this article is for you. It covers what unsupported status actually means day to day, the four realistic migration paths, where these projects stall, and the three things worth doing this week regardless of which path you choose.
Key takeaways
- Support for SharePoint Server 2016 and 2019 ended on 14 July 2026. No security patches, no vendor support, no compliance updates.
- Four migration paths exist, and each fits a different organizational reality. The decision is not “which is best” but “which is right for our compliance, customizations, and operational appetite.”
- Most migrations stall on organizational issues, not technical ones. The first three weeks of any path are spent on inventory, regulatory exposure, and information architecture. Skip those and the rest of the project pays for it.
What unsupported means in practice
Microsoft has withdrawn the following for SharePoint Server 2016 and 2019:
- Security patches for newly discovered vulnerabilities
- Vendor support, paid or free
- Compatibility updates as standards evolve
- Compliance attestations from Microsoft for the product version going forward
For organizations handling regulated data (HIPAA, SOC 2, FERPA, state nonprofit grant compliance), operating an unsupported document management platform is difficult to justify to auditors without strong compensating controls and a documented near-term remediation plan. Cyber insurance carriers are also tightening expectations around unsupported software in the production stack.
The risk is not theoretical. SharePoint 2013 reached end of life in April 2023; since then, every CVE discovered in that codebase has remained unpatched. The same pattern now applies to 2016 and 2019. The exposure compounds: every month past end of support adds another set of unpatched vulnerabilities to an installation attackers already know will stay unpatched.
A second deprecation worth noting: the classic SharePoint Add-in model and Azure Access Control Service authentication were retired on 2 April 2026. If your environment relies on cloud-hosted add-ins via ACS, those scenarios are already broken or fragile. SharePoint Designer 2013 and InfoPath 2013 reached final end of support on the same July 2026 date.
Your four migration paths
Most mid-market organizations and operating nonprofits choose between four options. Each has a different cost, complexity, and time-to-completion profile.
1. SharePoint Online via Microsoft 365
The most common path. SharePoint Online is part of Microsoft 365, bundled with OneDrive, Teams, and Exchange. Licensing typically runs $12 to $36 per user per month at list pricing, with substantial nonprofit discounts available for qualifying organizations.
Best for: organizations that want cloud-first integration with Teams, modern security controls, and access to Microsoft 365 Copilot. Typical project length runs 3 to 9 months for a 100 to 500 user environment, longer if significant customizations are present.
What moves cleanly: document libraries, lists with versions and metadata, modern client-side customizations, most permissions structures.
What requires rework: full-trust farm solutions, SharePoint 2010 workflows, InfoPath forms, PerformancePoint, complex line-of-business integrations using server-side code. These need to be rebuilt in Power Automate, Power Apps, SPFx, or removed entirely.
2. SharePoint Server Subscription Edition
Still on-premise. Subscription Edition is the supported successor to 2016 and 2019, licensed on a subscription basis rather than perpetually.
Best for: organizations with regulatory or data residency constraints that block full cloud adoption, or organizations with significant on-premise customizations they need time to modernize. Typical project length runs 2 to 4 months because SharePoint supports a database-attach upgrade directly from 2016 to Subscription Edition.
Limitations: no Microsoft 365 Copilot. Many cloud-only capabilities remain unavailable. Hardware and infrastructure costs continue. Subscription Edition requires staying within two versions of the current release to remain supported, which means more ongoing patching discipline than the 2016 era.
3. Hybrid Subscription Edition + SharePoint Online
Some workloads on-premise, others in the cloud. This makes sense when regulatory constraints apply to some content but not all, or when closing the unsupported-platform gap quickly matters more than reaching the end-state architecture in one move.
The trap with hybrid: organizations that intend it as a transition state often get stuck running both indefinitely. The operational cost compounds. Two governance models, two sets of policies, double the patching surface. Hybrid should have an explicit end date and a written plan for getting there.
4. Migration to an alternative platform
Google Workspace, Box, Dropbox Business, or a specialized document management system. This becomes rational when your organization is already heavily invested in another ecosystem, or when SharePoint has become a poor fit for how you actually work.
The license cost is rarely the binding constraint. The cost of rebuilding SharePoint-specific applications, workflows, and integrations in a new platform usually is. A direct file move is simple. Recreating a working business process is not.
Where these projects stall
We see five failure patterns in the field. They are not technical. They are organizational.
Insufficient discovery. Teams skip the inventory of customizations, workflows, and integrations. The project ships into production before someone realizes a critical workflow needs a full rebuild in Power Automate. Discovery is the cheapest part of the project to do well and the most expensive to skip.
Underestimated customizations. Many SharePoint 2016 farms started life as 2010 or 2013 installations. They carry years of accumulated workflow, InfoPath forms, and full-trust code. None of that moves cleanly to SharePoint Online. Some of it cannot move at all without redesign.
Lift-and-shift information architecture. Moving the 2016 site structure into the cloud as-is produces clutter, poor search, and a system users dislike. The cost shows up six months later in a second migration project to fix what should have been redesigned the first time.
Weak change management. The migration is technically successful, but adoption lags. Users cannot find files, do not understand the difference between SharePoint, Teams, and OneDrive, and revert to email attachments. The platform investment fails to deliver the productivity gain.
Permissions and identity complexity. Orphaned users, nested AD groups, broken inheritance, and overly granular item-level permissions. Mapping cleanly to the new environment takes longer than anyone estimates.
The pattern in all five: the project was scoped as an IT project. It was actually an organizational project that needed IT to execute.
What to do this week
Three concrete steps that move you forward regardless of which migration path you eventually choose.
Inventory what you have. Number of site collections. Content volume in gigabytes or terabytes. List of customizations, workflows, and integrations. List of integrations to other systems. Number of active users. This is the foundation for every estimate, every quote, every decision.
Assess regulatory exposure. Identify which content has compliance implications (HIPAA, SOC 2, FERPA, state nonprofit reporting, grant compliance, board governance records). This determines whether full cloud is feasible, whether Subscription Edition is required, or whether a hybrid model fits.
Get an outside read. A senior advisor with migration experience can review your inventory and exposure in a single conversation and tell you which paths are viable, which are not, and what your realistic timeline looks like. The cost is small relative to the cost of choosing the wrong path or running unpatched indefinitely.
The decision behind the decision
Most organizations frame SharePoint migration as an IT project. It is a decision about how your organization handles documents, collaborates, and proves compliance for the next five to ten years. The platform choice ripples into every downstream decision: which Microsoft 365 licenses you buy, what your Teams and Copilot investment looks like, how your security controls evolve, what your vendors integrate with.
Every month on an unsupported platform adds risk that does not go away on its own. The next best time to decide is this week.
If you are running SharePoint Server 2016 or 2019 and would benefit from a senior advisor’s read on your situation before you commit to a path, let’s talk.
