Document generator

Generate the package

Describe the farm, then download the documents. Every answer can be left unknown: the documents say what was not established instead of guessing it.

Generated in this browser from your answers and from Microsoft's published documentation. Nothing you type is sent anywhere, stored by pH7x Systems, or reused. No farm is scanned, so no document says anything was found on it.

Organisation and project

Optional. It appears only in the files generated on this device.

The farm today
Which SharePoint Server version does the farm run?
How do users sign in to the content web applications?

Select all that apply.

Which service applications are in use?

Select all that apply.

Are My Sites in use?
Will there be a rehearsal farm, to run the upgrade on copies before production?
What Microsoft deprecated or removed
Which of these does the farm, or the people using it, still rely on?

Each is on Microsoft's list of what is deprecated or removed from Subscription Edition, or changed by its 2026 updates. What you leave unticked is recorded as not in use; choose Not sure if you cannot say.

Server-side customisations
How many farm solutions (.wsp) are deployed?
Which kinds of server-side component do they contain?

Select all that apply.

Is the source code, and a build that reproduces each solution, available?
Does any custom code run with more rights than the person using it?

For example SPSecurity.RunWithElevatedPrivileges, or opening a site with another account's token.

Elevated privileges
Where can elevated code be started from?

Select all that apply.

Does elevated code create, change or delete anything, or change permissions?
Before it elevates, does the code check that this person may ask for this action, beyond being signed in?
Before an elevated write, does the code validate the request's form digest?
Does the solution record who asked for each elevated action?

Separately from what SharePoint records about the change itself.

Does elevated code reach anything outside SharePoint: file shares, databases, other services?
The package
How much should the package contain?

The generator above builds the package from your answers. This reference sets out what it produces, what each document rests on, and what it does not do.

What the package contains

DocumentFormatQuick assessmentEngineering assessment
Subscription Edition Compatibility AssessmentWordYesYes
Subscription Edition Compatibility MatrixExcelYesYes
Risk, Issue and Blocker RegisterExcelYesYes
Applications and Customisations Inventory, with the elevated operations sheetExcelNoYes
Farm and Infrastructure InventoryExcelNoYes
Work Breakdown Structure and Task TrackerExcelNoYes
Test Cases and Evidence MatrixExcelNoYes
Database-Attach Migration RunbookWordNoYes
Elevated Privilege AssessmentWordNoWhen custom code elevates, or may

Every package also carries 00 Package Model.json: the answers and the model every file was generated from. Load it back into the generator to change an answer and generate the package again; it says which version of the rules produced it.

One model, one identifier per item

Each compatibility row (CMP-), risk (RSK-), task (TSK-) and test (TST-) has one identifier, and the same text and state in every file that names it. Each identifier is owned by one workbook: the compatibility matrix owns CMP-, the risk register RSK-, the task tracker TSK- and the test matrix TST-. A Word document names an identifier only if the workbook that owns it is in the package. Identifiers are fixed in the rules and never renumbered, so an item keeps its identifier when the answers change or when its place in the order changes; a gap in a sequence means the item does not apply to this farm.

The inventories start empty, with their columns, validations and identifiers to fill in. The generator does not scan anything, so it does not pretend to list what a farm holds.

States that are never promoted

  • Evidence is declared (entered here), imported (read from a file), verified (checked, with the evidence named) or unknown (not provided). The generator writes only declared and unknown; promoting either is a person's decision, made in the workbook.
  • Work is NOT STARTED, IN PROGRESS, BLOCKED, VERIFIED or NOT APPLICABLE. Every generated task and test starts NOT STARTED.
  • No percentage, score or grade appears in any file. The task tracker counts tasks by stage and state with formulas the workbook recalculates; a count bound to what it counts is a fact, and the same counts summed into one figure would not be.

What the documents rest on

The compatibility matrix carries every row of Microsoft's list of what is deprecated or removed from SharePoint Server Subscription Edition, with the 2026 update notes that changed some of them: the August 2026 notes announce that the SharePoint 2010 workflow feature will be disabled starting with the September 2026 update, and require a server debug flag to keep the classic Workflow Manager engine working. The September and October 2026 notes repeat the debug flag, and all three require a farm that runs SharePoint Workflow Manager to install that product's update KB5002799 before the Subscription Edition update.

The runbook follows the four phases Microsoft documents for a database-attach upgrade, which its pages say must be completed in order: create the farm, copy the databases, upgrade the service applications and upgrade the content databases. The web applications are not created with the farm: Microsoft places them after the service application databases are upgraded, as the first step of the content phase, followed by the customisations the sites depend on, all before any content database is attached. Test-SPContentDatabase is run for each database before it is attached.

Server-side code is not treated as incompatible by default. Microsoft documents farm solutions as code that calls the server object model and runs with full trust, supported on premises; each solution and component is decided on its own: keep, adapt, replace or eliminate.

The Elevated Privilege Assessment starts from Microsoft's guidance on elevation of privilege: RunWithElevatedPrivileges should be used with care, and should not give people with low privileges an uncontrolled way around the permissions they were granted. For every elevated operation it asks who invokes it, which permission the caller lacks, which identity acts on each resource, how the action is authorised, what is validated before a write, and what the audit trail records. It does not recommend replacing the elevated call with a service account: that changes which identity acts, and Microsoft notes that the service account is then the name recorded on the change.

Every row and every document lists the Microsoft pages it relies on.

What it does not do

  • It does not read, scan or connect to a farm, a tenant or anything else. What the documents say about the farm is what was declared, and the rest is listed as not established.
  • It does not decide for you. Likelihood, impact, owners, dates and dispositions are columns for the team.
  • It does not claim conformance with any project-management, architecture or service-management standard, or certification by Microsoft. The structure draws on common practice; the facts are Microsoft's, with links.
  • It does not store or send anything. The files are built in your browser, and organisation and project names appear only in the files you download. Closing the page leaves nothing behind.

Where this fits