What a SharePoint 2016 or 2019 farm stops receiving

SharePoint Server 2016 and SharePoint Server 2019 reached the end of support on 14 July 2026. That date has passed: this was written on 6 November 2026, almost four months later. Nothing in Microsoft's lifecycle pages says the software stops working on that day. What ended is what Microsoft does for it: security updates, non-security fixes, assisted support and updates to the documentation.

Two facts make the position harder than "unsupported" suggests. The last updates either version will receive have already shipped, and their notes show what the end of fixes means in practice. And no paid programme is documented that buys any of it back: the Extended Security Update programme exists for other products, SQL Server 2016 among them, and not for these two.

So the question is no longer when support ends. It is what a farm that is still running has already lost, and what has to be decided while it runs. This analysis is for organisations in that position. Microsoft's documentation was read on 6 November 2026; no farm or tenant was accessed.

What ended on 14 July 2026

Microsoft's list of products ending support in 2026 puts SharePoint Server 2016 and 2019 on the same line, 14 July 2026, and says what that means: "Upon retirement or end of support, there will be no new security updates, non-security updates, free or paid assisted support options or online technical content updates" (ending support in 2026, checked on 6 November 2026). The Fixed Lifecycle Policy that governs both products says the same in a table with one more column: beyond the end of support, security updates are "Available via Extended Security Update Program", and paid support carries the note "Extended Security Update program required" (Fixed Lifecycle Policy, checked on 6 November 2026).

Sources for the table: the 2026 list and the Fixed Lifecycle Policy above, and the servicing policies for SharePoint Server 2016 and SharePoint Server 2019, both checked on 6 November 2026. The non-security row comes from the updates' own notes, which list such fixes, rather than from a policy page.

The last row deserves a sentence of its own. Both servicing policies give every build in their final row, "all future Public Updates" included, a support end date of 14 July 2026. Read literally, an update released after that date was out of support on the day it was released.

Two details about the date itself. The lifecycle pages for SharePoint Server 2016 and SharePoint Server 2019 print the extended end date as "7/15/2026 6:59:59 AM", in a table they say is shown in Pacific Time (both checked on 6 November 2026). The 2026 list and both servicing policies give 14 July 2026, and so does this article. And the shared date is deliberate. The 2019 policy says that "to ensure that SharePoint Server 2019 doesn't end support earlier than previous versions of SharePoint Server, SharePoint Server 2019 will align its extended support end date with the SharePoint Server 2016 extended support end date." A farm moved from 2016 to 2019 to gain time gained none; the editions comparison covers the rest of that choice.

The last updates have already shipped

Source: Microsoft's SharePoint update history, checked on 6 November 2026.

Both August packages are security updates, released four weeks after the end of support, and on both versions the vulnerabilities they resolve include remote code execution (KB5002905, KB5002894, checked on 6 November 2026). Since then Microsoft has released Subscription Edition updates on 8 September and 13 October 2026, and the history lists nothing for 2016 or 2019 on either date. None of the pages we read says why the August updates were released, or that anything will follow them. We plan as if nothing will: that is what the policy says, and the two monthly releases since have agreed with it.

The last two updates are worth reading together, because they show what the end of non-security fixes means in practice. The July 2026 update, the last one inside support, shipped with known issues (KB5002891 for 2016, KB5002883 for 2019, checked on 6 November 2026):

• Repeated sign-in prompts, on both versions. Farms with several front-end servers that use a trusted identity provider or forms authentication "may face repeated authentication prompts or multiple sign-ins". Microsoft's mitigation is sticky sessions on the reverse proxy, which it says "will address the majority of scenarios"; it advises against disabling SessionCookieTransformProtectionEnabled; and it wrote that "Microsoft is working on a fix in the subsequent product update".
• Workflow status links, on both versions, which fail on WrkStat.aspx.
• Office Online Server, on 2016 only, which may be unable to render or edit documents.

The August notes fix the workflow links on both versions and, on 2016, Office Online Server and a Distributed Cache failure after the July update. They do not list a fix for the repeated sign-in prompts, and no update has followed them.

Installing the August update is not neutral either. Its notes list "Disables file-backed Business Data Connectivity (BDC) model import by default to improve security", say that Exchange autodiscovery for the OWA web part "will be disabled starting with the August 2026 Public Update", and warn that orphaned remote event receivers, the ToolPane feature, ExecuteProxyUpdates and the SharePoint 2010 workflow feature might be disabled or blocked in the future, each with the cmdlet the notes name for it. A farm running SharePoint Workflow Manager installs KB5002799 first, and one on the classic Workflow Manager sets server debug flag 53601 to keep using it.

One detail matters for anyone checking a 2016 farm against the history. The history lists KB5002905 as version 16.0.5565.1001; the KB article says "This is build 16.0.5561.1001 of the security update package", the number both pages give the July update. The history is the page that tells the two updates apart, and which build the August package installs is not established from the two pages.

No programme buys the updates back

For customers who need more time, Microsoft offers one thing: the Extended Security Update programme, in its FAQ's words "a last resort paid option for customers who need to run certain legacy Microsoft products past the end of support", with Critical and Important security updates for up to three years and no technical support beyond the original support timeline (end of support overview, ESU FAQ, both checked on 6 November 2026). The Fixed Lifecycle Policy routes both security updates and paid support beyond the end of support through it.

Microsoft documents no such programme for SharePoint Server 2016 or 2019. The FAQ's table of products lists Windows Server 2012 and 2012 R2 and Windows 10. The lifecycle pages for the two SharePoint versions list one support row each and no Extended Security Update year, and a search of Microsoft Learn returns no programme for either.

The counter-check. The FAQ's table is not a complete register, so its silence alone would prove little: it does not list SQL Server either, and SQL Server has a programme. SQL Server 2016 is the useful comparison. It follows the same Fixed policy, it sits on the same 14 July 2026 line of the same list, and its lifecycle page lists Extended Security Updates Year 1, Year 2 and Year 3, the third ending in July 2029 (SQL Server 2016 lifecycle, checked on 6 November 2026). Where a programme exists, the product's lifecycle page shows it. The two SharePoint pages show none.

That is a statement about the documentation, and it is the strongest one the documentation supports. Whether a particular agreement can include anything the pages do not describe is a question only Microsoft can answer for that agreement, and the 2026 list says to "contact your Microsoft Account Representative" with questions about support. If a plan depends on the answer, get it in writing before the plan relies on it, as chapter 5 of the Field Guide says.

Two more sentences from the same FAQ close the obvious workarounds. A programme bought for something under the farm does not reach SharePoint: the programme "covers only the named product and the components that shipped with it". And protection placed around the farm does not stand in for the updates: "Third party application control solutions are not a replacement for product security fixes."

The rest of the farm

• Project Server 2016 and 2019, SharePoint Designer 2013 and InfoPath 2013 are on the same 14 July 2026 line of the 2026 list.
• Workflow Manager. SharePoint Workflow Manager "follows the support timeline of the parent product", and Microsoft Workflow Manager 1.0, as a component of SharePoint Server, was supported until that version's end "or until July 14, 2026, whichever comes first" (SharePoint Workflow Manager, Workflow Manager 1.0, checked on 6 November 2026). On a 2016 or 2019 farm, both ended with the farm.
• The database and the operating system. SQL Server 2016 ended on the same day, with the programme described above. A farm still on Windows Server 2012 or 2012 R2 lost the third and last year of that system's Extended Security Updates on 13 October 2026, according to the ESU FAQ, and Windows Server 2016's extended support ends in January 2027 (Windows Server 2016 lifecycle, checked on 6 November 2026). The Microsoft end of support tool carries the SQL Server 2016 and Windows Server 2016 dates beside the SharePoint ones.
• The Office clients. Microsoft's page on Microsoft 365 Apps says they can be used "with supported versions of Exchange Server or SharePoint Server that are installed on-premises" (About Microsoft 365 Apps, checked on 6 November 2026). Since 14 July 2026, 2016 and 2019 are not supported versions. The page states no consequence, and nothing we read says the clients stop working with them.

What to decide now

These are our recommendations, not Microsoft's. The first two can be done this week, and they make the rest honest.

1. Install the last update, or write down why not. It carries the last security fixes either version has received, and it repairs part of what the July update broke. Microsoft's servicing policies recommend installing public updates "as soon as they become available". Read the notes first, for the prerequisites and changes above; take the full backup Microsoft's update procedure tells you to take; and confirm the result where Microsoft recommends looking, "the Upgrade and Migration page in Central Administration" (install a software update, checked on 6 November 2026).
2. Name who carries the risk, and until when. The farm is out of support today, not on a date to come. Record its build with the date it was read, as the register in chapter 7 does, and beside it the owner who accepts running it unsupported and the date that acceptance ends. A farm with no end date written beside it has not been accepted; it has been left.
3. Choose the destination on its constraints. Chapter 3 separates the facts that close a destination from the ones that only price it. Microsoft supports two ways forward.
   • Subscription Edition, by database attach. Both lifecycle pages link to upgrading to Subscription Edition as their migration guidance. From either version "you use the database-attach method", and "All databases must be upgraded to version 16.0.4351.1000 or higher" (overview of the upgrade process, both checked on 6 November 2026). Chapter 23 holds the method, and the scripts set out the sequence in PowerShell. Subscription Edition is "In Support" under the Modern Lifecycle Policy, will stay in support until at least 31 December 2035, and supports each update build "for one year from its release date" (lifecycle, additional support, servicing policy, checked on 6 November 2026). The move trades an end of updates for an obligation to install them at least once a year.
   • SharePoint Online, by copy. Microsoft's SharePoint Migration Tool lists SharePoint Server 2016 and 2019 among its sources (SPMT overview, checked on 6 November 2026). A copy is not an attach: chapter 8 verifies what actually moved, chapter 9 cuts over without losing what changed in the meantime, and migrating without stopping the business compares the interruption on each destination.
4. Price doing nothing as what it now is. In the business case, the baseline is a platform that receives nothing. Chapter 5 builds that baseline line by line, and leaves a risk without a defensible figure unpriced rather than invented.
5. Reduce exposure for the interval, and do not count it as a fix. Narrowing who and what can reach the farm, and switching off what nobody uses, removes paths to vulnerabilities that will now stay open. It closes none of them.

The list does not end at cutover. A source farm kept for rollback or reference is still a 2016 or 2019 farm, and it receives nothing either; the date it is switched off belongs in the same register.

What this does not settle

• Why the August updates were released after the end of support, and whether more will follow. None of the pages read says. The policy says none will, and none has since.
• Whether the August update fixes the repeated sign-in prompts the July update introduced. Its notes do not list the fix.
• Which build the August 2016 update installs. The update history and the KB article give different numbers.
• Whether a particular agreement can include updates or support the documentation does not describe. Only Microsoft can answer that, for that agreement.
• What "supported versions" means in practice for Microsoft 365 Apps against these farms. The page states the condition, not the consequence.

Where this fits

• SharePoint 2016, 2019, Subscription Edition and Online: what actually changes compares the destinations and the licensing that decides between them.
• The state of SharePoint in 2026 maps what else ended this year.
• Field Guide chapter 7 sets out the version register the second recommendation builds on, and chapter 5 prices the decision.
• The path to Subscription Edition orders the chapters, analyses and tools for that move.
• The Microsoft end of support tool and the SharePoint Compass give a first read of an estate.

Sources, checked on 6 November 2026

• Microsoft Lifecycle: ending support in 2026, Fixed Lifecycle Policy, end of support overview, Extended Security Updates FAQ
• Lifecycle pages: SharePoint Server 2016, SharePoint Server 2019, SharePoint Server Subscription Edition, additional support for Modern Lifecycle server products, SQL Server 2016, Windows Server 2016, SharePoint Workflow Manager, Microsoft Workflow Manager 1.0
• Servicing policies: SharePoint Server 2016, SharePoint Server 2019, Subscription Edition
• Updates: SharePoint update history, and the notes for KB5002891, KB5002883, KB5002905 and KB5002894
• SharePoint Server: install a software update, upgrade to Subscription Edition, overview of the upgrade process to Subscription Edition
• Overview of the SharePoint Migration Tool
• About Microsoft 365 Apps in the enterprise

Tags#sharepoint#migration#lifecycle#security