First, exhale
Nothing shut down on July 15
SharePoint Server 2016 and 2019 reached end of support on July 14, 2026. There is no kill switch. Your farm still runs, your users still work, nothing was switched off. What stopped is the stream of fixes: no security patches, no bug fixes, no Microsoft support. The risk is not sudden; it compounds. One door, though, is genuinely shut: unlike Windows Server and SQL Server, SharePoint has no paid Extended Security Updates programme. You cannot buy another year of patches. So the only real moves are to harden what you have and plan the move out. This guide does both, in order.
| Item | What it means |
|---|---|
| July 14, 2026 | SharePoint Server 2016 and 2019 reached end of support. No more security or bug fixes, and no Microsoft support. |
| No kill switch | The farm keeps running and users keep working. End of support stops the fixes, not the software. |
| No paid extension | SharePoint has no Extended Security Updates programme. Unlike Windows or SQL Server, there is no way to buy more time. |
| Already gone | SharePoint Add-ins and their sign-in stopped working for all tenants on April 2, 2026. If add-in features broke earlier, that is why. |
| Still supported | SharePoint Server Subscription Edition is the one on-prem version still updated. Microsoft commits to it through at least 2035. |
| The real clock | Your next cyber-insurance renewal, not July 14, is often the date that actually forces a decision. |
How this guide works
- 1Stabilize the farmharden it so it can run safely while you plan
- 2Choose your destinationthe cloud, or a supported on-prem version
- 3Plan the movea realistic, compressed migration timeline
Section one
What is at risk, and when
The risk is real, but it is not all due at once. Knowing what is urgent and what is a slow burn lets you act in the right order instead of panicking (or freezing).
- Urgent Anything internet-facing. An unsupported, internet-exposed farm is an active target. SharePoint had unauthenticated remote-code-execution flaws exploited in the wild in 2025, and now flaws like those get no patch, ever. This is an incident risk, not a someday risk.
- Urgent Your cyber-insurance renewal. Renewal questionnaires now ask whether you run unsupported software. A renewal landing after July 14 can mean a premium increase, an “unsupported software” exclusion carved out for the farm, or a declined policy. Find your renewal date. It may be your real deadline.
- Fast burn Compliance and audit. An auditor or regulator (for a credit union, law firm, or municipality) will write up an unsupported system as a finding, breach or no breach. It surfaces at the next audit cycle.
- Slow burn Compatibility drift. Browsers, Windows Server, and Office clients keep moving; the farm slowly strands itself. Real but gradual. This one rewards a calm plan, not an all-nighter.
Read it this way: the two genuinely urgent items are external exposure and your next insurance renewal. Close those first. The rest is a slow burn that a sequenced plan handles comfortably.
Section two
Stabilize the farm, buy safe time
7 steps
You cannot finish a migration overnight, and you should not have to. These steps harden an unsupported farm so it can run safely for the weeks a proper migration takes. Do them in order. The first two carry most of the protection.
- Apply the final cumulative update Microsoft ever shipped for your version. It is the last free security ground you will get; take all of it.
- Get the farm off the public internet: no web front-end directly internet-facing. Put any remote access behind a VPN or Microsoft Entra application proxy.
- Segment the network: isolate the farm in its own VLAN with tight firewall rules, so a compromise cannot spread.
- Enforce MFA on every SharePoint and farm-admin account. Move off Basic authentication, and trim the farm-admin list.
- Verify your backups actually restore. Keep one immutable, offline copy beyond the reach of ransomware.
- Turn on and centralize logging. You are now watching for trouble you can no longer patch away.
- Reduce the attack surface: disable unused service applications, web apps, and old custom solutions you do not need.
Hardened this way, a farm can run for the eight to twelve weeks a focused migration takes. Stabilizing is not the plan. It is what buys you the time to run one calmly.
Section three
Choose your destination
There are two supported destinations. Pick one deliberately. The wrong reason for staying on-premises means paying for the migration twice.
| Destination | When it is the right move |
|---|---|
| SharePoint Online (Microsoft 365) |
Microsoft runs and patches the platform: no servers, no SQL, no patching, ever again. Lower total cost for most small and mid organizations, and Canadian data residency is available. The right destination for the large majority. |
| SharePoint Server Subscription Edition | The one on-premises version still supported. The right move only when a genuine, documented requirement keeps content on infrastructure you control. You still run and patch servers, and you reach it by upgrading your current 2016 or 2019 farm. |
The honest decision. For most small and mid Ontario organizations, SharePoint Online is the destination. It ends the patch treadmill for good. Subscription Edition is right only when a real on-premises requirement exists; chosen just to delay the cloud, it means migrating once to Subscription Edition and again later. And note the trap: Subscription Edition does not rescue InfoPath, SharePoint 2010 workflows, or SharePoint Designer 2013. Those were supported there only to the same July 14, 2026 date.
The one move no organization should make is to stay on unpatched 2016 or 2019 with no plan. That is the only option the lifecycle (and the insurance market) have genuinely closed.
Section four
The compressed migration plan
A focused small or mid organization can be off the old farm in roughly eight to twelve weeks. Heavy customization, InfoPath forms, or legacy workflows extend it, but the shape of the plan does not change.
| Weeks | What you do |
|---|---|
| Weeks 0–2 | Run the stabilize steps in Section 2. Inventory site collections, content size, customizations, workflows, and forms. Pull the cyber-insurance policy and find the renewal date. |
| Weeks 2–4 | Decide the destination. Provision the target tenant or farm. Pilot-migrate one low-risk site and confirm the approach works. |
| Weeks 4–10 | Migrate in waves, by department or site collection. Rebuild customizations and forms as you reach them. Tell users their cutover dates. |
| Weeks 10–12 | Run a final delta sync, cut over, and lock the old farm read-only. Validate, then decommission or fully isolate the legacy servers. |
Missing the deadline is recoverable. What is not recoverable is letting a stabilized farm drift back into “we will get to it”. The plan only works if it has an end date.
If you need hands on it
A missed deadline is recoverable, with a plan and the hands to run it.
Stabilizing the farm buys time; it does not migrate anyone. If your team does not have eight clear weeks to inventory, decide, and move in waves while still running the place, that is the work TenantCraft does: hardening unsupported farms and landing them, calmly, in SharePoint Online. A discovery call is free, 25 minutes, and ends with a written scope and a date, not a sales pitch.
- Web
- tenantcraft.ca
- hello@tenantcraft.ca
- Discovery call
- Free · 25 minutes
Guide last reviewed May 16, 2026. SharePoint Server 2016 and 2019 reached end of support on July 14, 2026; there is no Extended Security Updates programme for SharePoint. The right response to a missed deadline is a stabilized farm and a dated migration plan, not another year of waiting.