Decide hybrid feature by feature, on a supported Subscription Edition farm, before the wizard runs

Microsoft describes SharePoint Server hybrid as a way in which "productivity services in SharePoint in Microsoft 365 can be integrated with on-premises SharePoint Server", built on "trusted communications" between the two (Hybrid for SharePoint Server, checked on 13 November 2026). It connects a farm to a tenant. SharePoint Server Subscription Edition stays an on-premises product: you install it, patch it and back it up, and nothing in this guide turns it into SharePoint Online.

Is this farm, with this tenant and these identities, ready for hybrid, and which hybrid features are worth the trust they require?

The decision this chapter leads to is a recorded architecture decision: the hybrid features the farm will run, each with the need it serves, or the recorded decision to run none, taken before anybody runs the Hybrid Configuration Wizard.

What this chapter settles

It settles whether the farm, the tenant and the directory meet what Microsoft documents as prerequisites, which features are still available for which version, and what stops the work. It is the first chapter, so it takes nothing from earlier ones. It leaves the per-feature procedures to the chapters that own them: identity and the trust to Chapter 2, search to Chapter 3, OneDrive and sites to Chapter 4, taxonomy and content types to Chapter 5, security to Chapter 6, operations to Chapter 7 and the way out to Chapter 8.

It does not cover prices, Exchange or Teams hybrid, or the design of directory synchronisation.

Applies to

Sources: Subscription Edition lifecycle, servicing policy for Subscription Edition, servicing policy for 2019 and servicing policy for 2016, all checked on 13 November 2026.

The date renders two ways. The servicing policy pages give 14 July 2026. The lifecycle pages for 2019 and 2016, as we read them on 13 November 2026, carry "7/15/2026 6:59:59 AM" beside the note that "Support dates are shown in the Pacific Time Zone (PT)". The value looks like the end of 14 July in Pacific time written in UTC, but the page does not say so. We would use 14 July 2026, because the servicing policy and Microsoft's prose pages agree on it. Either way both versions are out of support today, and the lifecycle tool keeps the dates current.

Subscription Edition has a rule instead of a date. "Starting with the January 10, 2023 PU for SharePoint Server Subscription Edition, each PU build will be supported for one year from its release date", and "Support for a PU build ends on the second Tuesday of the same month of its release in the following year" (servicing policy for Subscription Edition). The newest build listed on the day we checked is KB 5002945, 16.0.20326.20278, of 10 November 2026 (SharePoint updates, checked on 13 November 2026). By our arithmetic from the rule, not by a date Microsoft prints, a farm still on the build of 11 November 2025 left support on 10 November 2026, and one on the build of 9 December 2025 leaves it on 8 December 2026.

Architecture

Why a farm stays, and why it connects

An organisation keeps a farm because something on it cannot move, or cannot move yet. We would accept reasons of this kind: content that a contract or a regulator ties to premises the organisation controls; integrations with line-of-business systems that only reach the internal network; farm solutions and add-ins nobody has budget to rewrite; and capabilities the farm has and the service has not. Microsoft documents some of the last group. Business Connectivity Services is retired in Microsoft 365 while "Microsoft has no plans to retire Business Connectivity Services in SharePoint Server Subscription Edition at this time" (BCS retirement, checked on 13 November 2026). Add-ins ended in SharePoint Online on 2 April 2026, while "SharePoint Server Add-ins deployed through an on-premises app catalog are not retired by this change" (Azure ACS retirement, checked on 13 November 2026).

It connects the farm because people work in both places. Without hybrid, "by default there's no integration between the two" (hybrid sites and search, checked on 13 November 2026): two OneDrives, two profiles, two search boxes, two term stores. Microsoft also presents hybrid as "a staged migration path" (Hybrid for SharePoint Server). Both uses are legitimate. Neither moves a document: "When redirection is used, existing data in SharePoint Server is not automatically migrated" (hybrid sites and search).

What hybrid is made of

One layer is shared: a server-to-server trust in which "Microsoft Entra ID acts as a trusted token signing service and uses the STS certificate as the signing certificate" (plan connectivity, checked on 13 November 2026). On it sit the features, each switched on separately. Two bundles ease deployment: hybrid OneDrive (OneDrive and profiles) and hybrid sites features (OneDrive, site following, profiles and the extensible app launcher); "the hybrid search options are independent of these two bundles and are configured separately" (hybrid sites and search).

The features and their status

Sources for the table: minimum public update levels, hybrid sites and search, plan hybrid OneDrive, Hybrid Configuration Wizard, hybrid self-service site creation, plan hybrid taxonomy, plan cloud hybrid search, plan SharePoint Server hybrid, BCS retirement, hybrid auditing and new in Subscription Edition, all checked on 13 November 2026.

Where the banner and the body part company. Every hybrid page above carries an "Applies to" banner that ticks Subscription Edition. The bodies of the pages on OneDrive, profiles, site following, the app launcher, self-service site creation and taxonomy name only earlier versions, and the page of minimum update levels has sections for 2019, 2016, 2013 and 2010 and none for Subscription Edition. The one sentence that names it says the wizard "must be launched from an on-premises server with SharePoint Server 2013, SharePoint Server 2016, SharePoint Server 2019, or SharePoint Server Subscription Edition installed" (Hybrid Configuration Wizard). None of these features is on the list of what is deprecated or removed from Subscription Edition (checked on 13 November 2026). So their status on Subscription Edition is: applicable by banner, with no minimum build stated. We do not know how far each was tested there. The test is to configure the feature on a test farm at the production build and run the quick test its roadmap ends with.

Cloud hybrid search. The Search Content Service behind it "has been retired from June 30, 2025" (cloud hybrid search roadmap, checked on 13 November 2026); the planning page still announces that retirement, for the same date, as something to come. The two pages also give different floors. The planning page: "upgrade your SharePoint Server farm to SharePoint Server Subscription Edition (SPSE) Version 25H1 or later versions". The roadmap: "upgrade your SharePoint Server farm to SharePoint Server Subscription Edition July 2025 PU or later versions". Version 25H1 lists the upgrade under "Early release" (Version 25H1, checked on 13 November 2026), and the update of 8 July 2025 "Enables flight for the new Hybrid Search feature in the Standard release ring" (KB5002751, checked on 13 November 2026). We would follow the roadmap: it is the procedure page, it applies to Subscription Edition alone, and the update article agrees with it. On our arithmetic the question no longer bites, because every build still in support today is later than both floors. Without the upgrade, "all versions of SharePoint Server 2019/2016 and previous versions of SPSE can only search for on-premises and Microsoft 365 content separately through Hybrid Federated Search" (plan cloud hybrid search), although the page of minimum update levels still lists cloud hybrid search at RTM for 2019 and 2016; we would follow the dated retirement notice. Chapter 3 has the rest.

What needed Microsoft 365 to reach the farm is gone. Inbound federated search "has been retired as of September 2024", while outbound and cloud hybrid search "remain operational" (plan SharePoint Server hybrid). The retired BCS features include "Business Connectivity Services hybrid solutions" (BCS retirement). Duet Enterprise Online is still named among the solutions needing inbound connectivity, but Duet "can't be deployed with SharePoint Server 2016" (removed from 2016, checked on 13 November 2026), and no page we read mentions it for Subscription Edition. The configuration roadmaps page (checked on 13 November 2026) still lists the inbound search and BCS roadmaps with no notice: do not plan from that list alone.

B2B extranet. The wizard offers it as an option that "installs extra features you can integrate with an extranet site you create in Microsoft 365", yet "Hybrid extranet B2B collaboration sites have no on-premises components and thus have no PU requirements" (minimum public update levels). We do not know what the option installs on the farm. We would treat the extranet as a Microsoft 365 decision and not select the option to find out on a production farm.

Identity, in one paragraph

Hybrid assumes the same people exist on both sides. Microsoft requires directory synchronisation with password synchronisation or with single sign-on, "but you must configure at least one of the two" (configure Microsoft 365 for hybrid, checked on 13 November 2026). Synchronisation is not single sign-on, and "Single sign-on is not a mandatory prerequisite to configure server-to-server authentication" (cloud hybrid search FAQ, checked on 13 November 2026). The trust authenticates servers; what a person may then see is authorisation, decided separately on each side. Which web applications can originate hybrid requests, where one page says NTLM and another "NTLM or Kerberos", and what that means for a farm that signs people in through OpenID Connect, is Chapter 2's subject.

Prerequisites

Sources: hybrid requirements, configure Microsoft 365 for hybrid, Hybrid Configuration Wizard and set up services for hybrid, all checked on 13 November 2026. contoso.com is Microsoft's example, and ours.

Farm topology and platform. Subscription Edition "supports the same farm topologies as SharePoint Server 2019" (hardware and topology requirements, checked on 13 November 2026). It runs on Windows Server 2019, 2022 or 2025, Standard or Datacenter (software requirements for servers, checked on 13 November 2026), with SQL Server "2019 Cumulative Update 5 (CU5) or later, SQL Server 2022, and any future version of SQL Server for Windows that supports database compatibility level 150" (software requirements for database servers, checked on 13 November 2026). None of these pages states a requirement specific to hybrid. The hybrid constraint on topology is the one in the table: a farm that consumes its services from another farm is not supported for hybrid. A server for cloud hybrid search needs at least "100 GB storage, 16 GB RAM, and four 1.8 GHz CPUs" (cloud hybrid search roadmap).

Licences, as the pages word them. One page asks for a tenant "with one of the following subscription plans: E1 supports Display hybrid federated search results in SharePoint Server only, E3, or E4" (hybrid requirements). The other says: "If you're planning to configure hybrid OneDrive, be sure to subscribe to a plan that includes OneDrive. All other hybrid SharePoint hybrid scenarios require an Enterprise plan that includes SharePoint in Microsoft 365" (configure Microsoft 365 for hybrid). The first names E4 and does not name E5; the second names no plan. We would follow the second, which describes what a plan must include, and we do not know from these pages whether any plan outside the three named qualifies. No farm test settles that: put the tenant's actual plan to Microsoft in writing before the design depends on it.

The Hybrid Allow List. "To use Hybrid features, contact Microsoft Support to add your tenant to the Hybrid Allow List" (Hybrid Configuration Wizard). The page gives no criteria and no lead time, and does not say whether a tenant already using hybrid is on it. We do not know. Open the support request first; the answer costs nothing and everything else waits on it.

Service applications. "SharePoint Server hybrid configurations all require the following services to be running on your farm: Managed Metadata service application / User Profile Service application / My Sites"; for OneDrive "these are the only services you need", and search and sites features add an App Management service application and "a Subscription Settings service application and proxy", which "must be created by using Microsoft PowerShell" (set up services for hybrid). The User Profile service needs "a synchronization connection with Active Directory Domain Services", the Work email property filled from Active Directory, and "the User Principal Name property must be mapped to the userPrincipalName attribute". The page gives the steps to turn on the Subscription Settings Service for 2013 and for 2016 and 2019, and none for Subscription Edition.

The wizard. It "requires the .NET Framework 4.6.2 in order to run"; Subscription Edition's own prerequisite is .NET Framework 4.8 (software requirements for servers). The person running it is "A member of the Farm Administrators group", "A service application administrator (Full Control) for the User Profile Service" and "A Microsoft 365 Global Admin, either with or without multi-factor authentication (MFA) enabled for the account", signed in to both from a farm server (Hybrid Configuration Wizard). Elsewhere Microsoft adds, for the farm account, the securityadmin role on SQL Server, db_owner on the databases to be updated and local Administrators, and a Domain Admins account for Active Directory, DNS and certificates (accounts needed for hybrid, checked on 13 November 2026).

What the wizard does:

• "For all options, the Hybrid Configuration Wizard configures a server-to-server trust between your SharePoint Server farm and Microsoft 365." That holds even for hybrid OneDrive, the one scenario the planning page says does not need the trust.
• It "updates the on-premises farm's authentication realm to match the Microsoft 365 organization context ID".
• "After the authentication realm is changed, existing SharePoint in Microsoft 365 add-ins fail to authenticate. The Hybrid Configuration Wizard attempts to fix this issue automatically." The FAQ gives the symptom: "users will get an HTTP 401 when they're redirected to the add-ins".
• For cloud hybrid search it performs "one of the steps", and "you must do the rest of the steps yourself".

What it never does: "The Hybrid Configuration Wizard doesn't uninstall features. If you run the Hybrid Configuration Wizard and deselect a feature that you previously installed, it remains installed."

What is not established about it: which browsers and operating systems it supports, and whether it runs on Server Core; which outbound addresses it needs; whether any role below Global Administrator is enough, although the same page says that role "should be limited to emergency scenarios"; whether its cloud hybrid search option performs the onboarding introduced in 2025; and which of the two entry points Microsoft gives, the link on run the wizard (checked on 13 November 2026) or More features in the SharePoint admin center, is current. We do not know any of these. A run on a test farm against a test tenant, with a network capture, answers the first two and the last.

DNS, proxy, TLS and connectivity. Outbound first, because everything that remains is outbound.

• Only cloud hybrid search has a documented list. Its servers must reach *.sharepoint.com, https://accounts.accesscontrol.windows.net, https://login.windows.net/common/oauth2/authorize, https://sts.windows.net/* and https://login.microsoftonline.com, with four more for dedicated search servers, and "always communicates with endpoints using port 443" (cloud hybrid search FAQ). The FAQ does not say whether the list was revised after the retirement of June 2025.
• The roadmap says the endpoints "are listed in the SharePoint in Microsoft 365 section of the article Microsoft 365 URLs and IP address ranges and are marked for use with Hybrid Search". On 13 November 2026 the SharePoint section of that article carried no such marking. We would allow the FAQ's list and prove it with a crawl, as Chapter 3 describes; the endpoints tool shows the current data.
• For the wizard, OneDrive, sites features, taxonomy and self-service site creation, Microsoft publishes no outbound list. We do not know what they need beyond the general Microsoft 365 endpoints: capture the traffic on a test farm.
• Behind a forward proxy, "it may be necessary to configure additional proxy settings" (cloud hybrid search roadmap), and the search service accounts need "unrestricted outbound internet access" or "system level proxy settings" (cloud hybrid search FAQ).
• The hybrid pages state no minimum TLS version for the farm's calls to Microsoft 365. A troubleshooting page says "Starting on June 30, 2021, the Search service will no longer accept connections that use TLS 1.1 or 1.0" (hybrid search failures, checked on 13 November 2026); its fixes name 2013, 2016 and 2019. Subscription Edition supports TLS 1.3 by default only "when deployed with Windows Server 2022" (TLS 1.3 support, checked on 13 November 2026). We would plan on TLS 1.2 or later outbound.

Inbound, Microsoft documents a reverse proxy with "SSL encryption and client certificate authentication", pass-through for OAuth 2.0, no rewriting of packet headers and "No ports other than TCP 443", plus a public domain, a public DNS A record for the external URL, and a wildcard or SAN certificate "issued by a public root certification authority" (hybrid requirements; plan connectivity). The pages that require it name inbound hybrid search, hybrid BCS and Duet, and carry no notice that the first two are retired. The only remaining mention is of a different kind: with cloud hybrid search, people outside the network open an on-premises result over VPN, or "you enable users to open such links by installing a reverse proxy device" (cloud hybrid search roadmap). That is people reaching the farm, not Microsoft 365 reaching it. We found no remaining feature that needs Microsoft 365 to call the farm, and would not build inbound connectivity for hybrid. If you publish the farm for people, the two pages list different devices, three on hybrid requirements and five on configure a reverse proxy (checked on 13 November 2026), which adds "Azure Application Proxy"; we would follow the second, the later of the two.

Decision criteria

Decide per feature. A feature earns its place when a named group of people needs it, the version supports it, and its owner accepts the trust that comes with it.

Go, when all of these hold: the farm is on Subscription Edition at a build inside its year; the tenant has the public domain registered and is on the Hybrid Allow List; the people who will use the feature are synchronised and licensed; the required service applications run on the farm itself; and the add-in estate is inventoried, with an owner for each add-in that must survive the realm change.

No-go conditions, each of which stops the work until it is removed:

• A farm on 2016 or 2019 that wants cloud hybrid search. It is removed for both. Upgrade first (the first guide's Chapter 23), or accept federated search.
• A farm on 2016 or 2019 at all. Both are out of support; we would not add a trust to a farm that no longer receives security updates.
• A Subscription Edition farm behind the supported window. "To remain supported, you must be running a supported build" (servicing policy for Subscription Edition). Patch first (the first guide's Chapter 42).
• No synchronised identities, or users whose UPN suffix does not match the registered domain.
• An add-in estate nobody has inventoried. The realm change is farm-wide and the wizard only "attempts" the repair.
• A farm with federated services, which Microsoft states is not supported for hybrid.
• A tenant not on the Hybrid Allow List.
• A design that depends on a retired feature: inbound federated search, hybrid BCS or hybrid auditing.
• Nobody willing to hold the Global Administrator role for the run, since Microsoft names no lesser one.

If no feature earns its place, the decision is no hybrid, and it is a complete answer.

Procedure

Microsoft documents no procedure for the decision itself. This is the order we would follow, and then the order of Microsoft's roadmaps.

The decision

1. Record the farm's version and build, and compare the build with the SharePoint updates page.
2. List the needs, each with the people who have it, and map each to one feature in the table above. Strike any that maps to a retired feature.
3. Read the farm's present state with the script below.
4. Check the tenant: registered domain, UPN suffixes, synchronisation, licences.
5. Ask Microsoft Support to add the tenant to the Hybrid Allow List.
6. Inventory the add-ins that authenticate against the farm, and name who retests each.
7. Confirm the service applications each chosen feature needs, on the farm itself.
8. Settle outbound connectivity with the network's owner.
9. Write the decision down, with what is still unknown stated as unknown.

# Farm server, Subscription Edition. Reads the trust's present state; changes nothing.
Write-Host "Writing the authentication realm, the STS configuration, the trusted token issuers and the feature release ring to hybrid-readiness.txt"
Get-SPAuthenticationRealm | Out-File .\hybrid-readiness.txt
Get-SPSecurityTokenServiceConfig | Format-List * | Out-File .\hybrid-readiness.txt -Append
Get-SPTrustedSecurityTokenIssuer | Format-List * | Out-File .\hybrid-readiness.txt -Append
Get-SPFeatureReleasePreference | Out-File .\hybrid-readiness.txt -Append

Parsed, not yet run: try it on a test farm first.

Keep the file. The realm it records is the value the wizard will replace.

The documented roadmap

Microsoft's roadmaps share their first steps, and "If you follow more than one roadmap, there's no need to repeat the steps that are the same" (configuration roadmaps).

1. Configure Microsoft 365: "Sign up for Microsoft 365. / Register your domain with Microsoft 365. / Assign UPN domain suffixes. / Synchronize accounts with Microsoft 365. / Assign licenses to your users." (configure Microsoft 365 for hybrid).
2. Set up the SharePoint Server services (set up services for hybrid).
3. Establish the trust. Microsoft recommends the wizard for it, with a manual procedure "If you are unable to use the Hybrid Configuration Wizard for any reason" (configure server-to-server authentication, checked on 13 November 2026). Chapter 2.
4. Configure the feature: Chapters 3, 4 and 5.

Everything in the first list is decided before step 3, because step 3 is the one that changes the farm for every web application at once.

Verify

Sources: Version 24H2 (checked on 13 November 2026), configure server-to-server authentication, Hybrid Configuration Wizard and accounts needed for hybrid. The wizard's check is only seen by starting the wizard: on a production farm, we would stop at the page that reports it.

When it fails

Feature-level failures belong to Chapters 2 to 5, and the running of a hybrid farm to Chapter 7.

Security

The readiness decision already fixes three boundaries, and Chapter 6 examines each. First, the trust is farm-wide: the farm's STS certificate is the signing certificate, Microsoft Entra ID becomes a trusted token issuer, and the realm is the tenant's, for every web application and not only the one that uses hybrid. Second, the run needs a Global Administrator signed in on a farm server, a role Microsoft itself says "should be limited to emergency scenarios"; we would use a dedicated account for the run and remove the role afterwards. Third, cloud hybrid search sends index data to Microsoft 365, in words Microsoft does not fully define: "It's the metadata for the content that's indexed, and this metadata is encrypted when it's transferred" (learn about cloud hybrid search, checked on 13 November 2026). The retirement of Azure ACS in SharePoint Online "is not impacting any of the SharePoint on-premises use cases" (Azure ACS retirement), so the trust's mechanism stands; who may use it is the question Chapter 6 takes up. Security updates for SharePoint Server remain the farm's work throughout.

Rollback and recovery

Until the wizard runs, the decision costs nothing to reverse: change the record.

After it runs, there is no single undo. The wizard "doesn't uninstall features", and it "isn't designed to undo the changes once the wizard completes. ... After this is configured, re-running the wizard doesn't clean up the trust" (cloud hybrid search FAQ). Microsoft documents removal feature by feature: set hybrid OneDrive and sites features to None in Central Administration, which "also removes the Hybrid app launcher feature"; delete the cloud hybrid search content sources and then its Search service application, and "contact the support team" to remove every hybrid document from SharePoint Online results; stop taxonomy replication (removing hybrid scenarios, checked on 13 November 2026).

What we did not find documented is the return of the authentication realm to its earlier value, or what that does to add-ins repaired after the change. We do not know. The test: on a test farm with one working add-in, run the wizard, confirm the add-in, restore the realm recorded by the script, and confirm the add-in again.

Recovery by upgrade is not a way round this. A database attach upgrades "only the content for your environment and not the configuration settings" (create the farm for a database attach upgrade, checked on 13 November 2026); the page does not mention hybrid, so we do not know which hybrid settings a new farm keeps, and would plan to verify each one. Chapter 8 covers the exit in full.

Working documents

The Hybrid Architecture Advisor asks about the farm and generates these in the browser from your answers. What you did not answer is written as unknown, not filled in.

• Hybrid Readiness Assessment (Word): the farm's version and build, the tenant prerequisites, the service applications and connectivity, each stated as met, not met or unknown, with the source beside it. It gives no score.
• Architecture Decision Record (Word): the features chosen and refused, the need each serves, the no-go conditions checked, and the decision's owner and date.
• Prerequisites Matrix (Excel): one row per prerequisite in this chapter, with its owner, its evidence and its state.

Sources

• Hybrid for SharePoint Server, checked on 13 November 2026
• Hardware and software requirements for SharePoint hybrid, checked on 13 November 2026
• Hybrid Configuration Wizard in the SharePoint admin center, checked on 13 November 2026
• Run Hybrid Configuration Wizard, checked on 13 November 2026
• SharePoint Server hybrid configuration roadmaps, checked on 13 November 2026
• SharePoint hybrid sites and search, checked on 13 November 2026
• Plan SharePoint Server hybrid, checked on 13 November 2026
• Configure Microsoft 365 for SharePoint hybrid, checked on 13 November 2026
• Set up SharePoint Server services for hybrid environments, checked on 13 November 2026
• Accounts needed for hybrid configuration and testing, checked on 13 November 2026
• Plan connectivity from Microsoft 365 to SharePoint Server, checked on 13 November 2026
• Configure a reverse proxy device for SharePoint Server hybrid, checked on 13 November 2026
• Configure server-to-server authentication from SharePoint Server to SharePoint in Microsoft 365, checked on 13 November 2026
• Minimum public update levels for SharePoint hybrid features, checked on 13 November 2026
• Plan hybrid OneDrive, checked on 13 November 2026
• Hybrid self-service site creation, checked on 13 November 2026
• Plan hybrid SharePoint in Microsoft 365 taxonomy and hybrid content types, checked on 13 November 2026
• Plan cloud hybrid search for SharePoint in Microsoft 365, checked on 13 November 2026
• Configure cloud hybrid search - roadmap, checked on 13 November 2026
• Learn about cloud hybrid search for SharePoint in Microsoft 365, checked on 13 November 2026
• Cloud hybrid search service (Cloud SSA) FAQ, checked on 13 November 2026
• Hybrid search fails to crawl or return results, checked on 13 November 2026
• Removing SharePoint hybrid scenarios, checked on 13 November 2026
• Business Connectivity Services (BCS) retirement in Microsoft 365, checked on 13 November 2026
• Configure SharePoint Hybrid Auditing in SharePoint 2016 (Preview), checked on 13 November 2026
• Azure ACS retirement in Microsoft 365, checked on 13 November 2026
• What's deprecated or removed from SharePoint Server Subscription Edition, checked on 13 November 2026
• What's deprecated or removed from SharePoint Server 2016, checked on 13 November 2026
• New and improved features in SharePoint Server Subscription Edition, checked on 13 November 2026
• New and improved features in SharePoint Server Subscription Edition Version 24H2, checked on 13 November 2026
• New and improved features in SharePoint Server Subscription Edition Version 25H1, checked on 13 November 2026
• Description of the security update for SharePoint Server Subscription Edition: July 8, 2025 (KB5002751), checked on 13 November 2026
• Hardware and topology requirements for SharePoint Server Subscription Edition, checked on 13 November 2026
• Software requirements for SharePoint Servers for SharePoint Server Subscription Edition, checked on 13 November 2026
• Software requirements for Database Servers for SharePoint Server Subscription Edition, checked on 13 November 2026
• Transport Layer Security (TLS) 1.3 Support, checked on 13 November 2026
• Create the SharePoint Server Subscription Edition farm for a database attach upgrade, checked on 13 November 2026
• Updated Product Servicing Policy for SharePoint Server Subscription Edition, checked on 13 November 2026
• Updated Product Servicing Policy for SharePoint Server 2019, checked on 13 November 2026
• Updated Product Servicing Policy for SharePoint Server 2016, checked on 13 November 2026
• SharePoint Server Subscription Edition lifecycle, checked on 13 November 2026
• SharePoint Server 2019 lifecycle, checked on 13 November 2026
• SharePoint Server 2016 lifecycle, checked on 13 November 2026
• SharePoint updates, checked on 13 November 2026
• Microsoft 365 URLs and IP address ranges, checked on 13 November 2026

Related pages on this site

• Chapter 2 of this guide: identity, authentication and the trust the wizard creates.
• Chapter 3: cloud hybrid search and federated search, including the endpoints question.
• Chapter 6: the security boundaries named above.
• Chapter 8: coexistence and the exit.
• The Hybrid Architecture Advisor: the three documents of this chapter.
• Which hybrid features an estate keeps, the upgrade to Subscription Edition by database attach and keeping Subscription Edition supported, in the SharePoint Migration Field Guide.
• What changes between 2016, 2019, Subscription Edition and SharePoint Online and installing a Subscription Edition update without downtime.
• End of support dates, Microsoft 365 endpoints and the Subscription Edition migration pack.

Before you continue

• The farm is on Subscription Edition, and its build's release date is less than a year old
• Each hybrid feature kept has a named need and a named owner, and none depends on inbound search, hybrid BCS or hybrid auditing
• The tenant has the public domain registered, matching UPN suffixes, synchronised and licensed users, and its plan confirmed with Microsoft in writing
• Microsoft Support has confirmed the tenant is on the Hybrid Allow List
• The required service applications run on the farm itself, and the farm consumes none from another farm
• The add-ins that authenticate against the farm are inventoried, each with somebody to retest it after the realm changes
• The realm, the STS configuration and the trusted token issuers are recorded as they stand before the wizard runs
• The decision is written down, with every unknown stated as unknown, or the estate records that it runs no hybrid

Download chapter 1 (PDF)Same text, same tables, same sources as this page.