SharePoint 2016 & 2019 End of Life: Dates & Options

For teams that run SharePoint Server on-premises, the SharePoint 2019 end of life date has already passed: support for both SharePoint Server 2019 and SharePoint Server 2016 ended on July 14, 2026. That is roughly three weeks ago at the time of writing, so any 2016 or 2019 farm still in production is now running without security updates. This page lists the verified dates, what stopped on that date, the documented attack record against on-premises SharePoint, and the three exit paths: an upgrade to SharePoint Server Subscription Edition (SE), a migration to SharePoint Online, or a hybrid configuration.

SharePoint 2019 end of life: the dates

Both versions followed the Microsoft Fixed Lifecycle Policy and reached the end of extended support on the same day. The dates below are taken from the Microsoft Lifecycle pages for SharePoint Server 2019 and SharePoint Server 2016.

SharePoint has no Extended Security Updates program. Unlike Windows Server or SQL Server, there is no paid bridge that keeps patches flowing after the date. The only supported on-premises version is SharePoint Server Subscription Edition, and the only fully managed alternative is SharePoint Online in Microsoft 365.

SharePoint 2016 and 2019 end of support: what ended, what still runs

A SharePoint 2016 or 2019 farm did not stop working on July 14, 2026. Sites render, documents open, search crawls continue. What changed:

• No security updates. Vulnerabilities found after the date are not patched on 2016 or 2019. Because SE shares a large amount of code with 2019, each SE security update effectively documents flaws that remain open on the older versions.
• No Microsoft support cases. Standard support paths for the product are closed. A content database that fails to mount or a search index that corrupts has no vendor escalation.
• No bug fixes or time zone updates. The monthly public-update cadence for 2016 and 2019 has ended entirely.
• Compliance exposure. PCI DSS requires vendor patches for known vulnerabilities; the HIPAA Security Rule requires protection against reasonably anticipated threats to ePHI. A document platform that holds business records and can no longer receive patches is difficult to defend in either framework, and cyber-insurance questionnaires ask about unsupported software directly.

The attack record on unpatched SharePoint

The risk is documented, not hypothetical. In July 2025, a critical deserialization vulnerability in on-premises SharePoint Server, CVE-2025-53770 (CVSS 9.8, part of the exploit chain publicly called ToolShell), was exploited in the wild against internet-facing farms before a patch existed. Microsoft published customer guidance confirming active exploitation, and CISA issued an alert and added the CVE to its Known Exploited Vulnerabilities catalog on July 20, 2025, with a one-day remediation deadline for federal agencies. The vulnerability affected SharePoint Server 2016, 2019, and Subscription Edition; SharePoint Online was not affected. CISA's required action for end-of-life SharePoint versions was to disconnect them from the network.

Two facts follow from that record. On-premises SharePoint is an actively exploited target class, with unauthenticated remote code execution as the observed outcome; and the fix pipeline that closed CVE-2025-53770 on supported versions in 2025 no longer exists for 2016 and 2019. Every SharePoint vulnerability disclosed after July 14, 2026 remains open on those farms permanently.

Option 1: upgrade to SharePoint Server Subscription Edition

SharePoint Server SE is the only supported on-premises version. It follows the Modern Lifecycle Policy, with feature and security updates delivered on a continuing cadence rather than a fixed retirement date. The upgrade path is the same mechanism from both starting versions, per the Microsoft upgrade documentation:

• From SharePoint 2019: database-attach upgrade. Build a new SE farm on Windows Server 2022 or later, detach the content databases from the 2019 farm, attach and upgrade them on the SE farm, then repoint users and retire the old servers. There is no in-place upgrade for SharePoint; the farm is always rebuilt.
• From SharePoint 2016: the same direct database-attach path. This is a change from every previous SharePoint upgrade cycle: SE accepts content databases from both 2016 and 2019 directly, so a 2016 farm does not need an interim hop through 2019. The database upgrade documentation covers both source versions in one procedure.

Plan the surrounding work honestly: custom farm solutions, workflow platforms, and InfoPath-era dependencies need testing on SE before the databases move, and licensing shifts to a subscription model. Version requirements, licensing, and the update cadence are covered in our SharePoint Server Subscription Edition overview.

Option 2: migrate to SharePoint Online / Microsoft 365

Microsoft's recommended destination is SharePoint Online, which is serviced by Microsoft with no customer-side patching or version management, and which was not affected by CVE-2025-53770. The standard tooling is the free SharePoint Migration Tool (SPMT), which moves site content, document libraries, lists, and file shares from 2016 and 2019 directly into the tenant; our SharePoint Migration Tool guide covers setup, scans, and batch runs. For scoping the full project, including permission mapping, information architecture, and cutover sequencing, see the SharePoint migration walkthrough.

Points specific to the post-deadline situation:

• End of support did not disable outbound migration. A 2016 or 2019 farm can still act as an SPMT source; the servers themselves simply receive no further fixes while the project runs.
• An internet-facing farm being used as a migration source should be moved behind a VPN or reverse proxy with authentication for the duration, given the exploitation history above.
• Workflows, custom web parts, and farm solutions do not migrate as-is; they are rebuilt on Power Automate and SharePoint Framework. This rebuild effort, not the content move, usually sets the project timeline.

Option 3: hybrid

Hybrid keeps a SharePoint Server farm on-premises, connected to SharePoint Online for unified search, OneDrive redirection, and shared profiles. It fits organizations with data-residency requirements or line-of-business systems bound to on-premises farms. The constraint is unchanged by the deadline: the on-premises half of a hybrid deployment must be a supported version. A hybrid farm running 2016 or 2019 is an unsupported farm with a cloud connection attached, so the hybrid path still starts with a database-attach upgrade to SE. Hybrid is a topology choice layered on Option 1, not a way around it.

Decision table

Timeline arithmetic

As of early August 2026, a SharePoint 2016 or 2019 farm is roughly three weeks past end of support, and the gap widens by one missed security-update cycle per month from here. Neither exit is instant: an SPMT migration for a small estate takes weeks once scoping is done; a database-attach upgrade to SE, including the new farm build, solution testing, and cutover, typically takes one to three months. A farm compromised through an unpatched vulnerability adds incident response, forensics, and rebuild time on top of either project. The projects do not get shorter by waiting; only the exposure window gets longer.

FAQ

When was SharePoint 2019 end of life?

July 14, 2026. SharePoint Server 2016 reached the end of extended support on the same date. Both versions now receive no security updates, bug fixes, or Microsoft support.

When was SharePoint 2016 end of support?

Also July 14, 2026. Mainstream support for 2016 had already ended on July 13, 2021, so its final five years were security-only servicing under extended support.

Is there an ESU program for SharePoint 2016 or 2019?

No. Unlike Windows Server and SQL Server, SharePoint has no Extended Security Updates program. The only supported states are SharePoint Server Subscription Edition on-premises or SharePoint Online.

Can SharePoint 2016 upgrade directly to Subscription Edition?

Yes. SE accepts database-attach upgrades from both SharePoint 2016 and SharePoint 2019 directly. This is the first SharePoint release to support a two-version jump, so 2016 farms do not need an interim upgrade through 2019.

Does SharePoint 2016 or 2019 still work after end of support?

The software keeps running and can still serve as a migration source for SPMT or a database-attach upgrade. What it no longer receives is security patches, which is the operative risk given the 2025 exploitation of CVE-2025-53770 against exactly these versions.