SP 2016 EOL July 14, 2026 — Last-Call Action Plan

The July 14, 2026 Deadline Is Real — And It’s Only 3 Months Away

Microsoft SharePoint 2016 will reach its end-of-life (EOL) date on July 14, 2026 (endoflife.date/sharepoint). After that date, Microsoft will no longer provide:

• Security patches
• Hotfixes or cumulative updates
• Non-security updates (e.g., performance fixes)
• Vendor-supported troubleshooting, SLA, or incident response

The product’s end of active support was July 13, 2021. That means for the last five years, SharePoint 2016 has been in extended support — a phase that ends definitively in July 2026. This is not an LTS release; there is no extended security update (ESU) program available for it.

The latest build in the SharePoint 2016 line is 16.0.5556.1005.

If your organization is still running SharePoint 2016, a full migration to SharePoint Server Subscription Edition, SharePoint 2019, or SharePoint Online is no longer realistic before July 14, 2026 for most estates — especially given the time required for planning, testing, data migration, custom solution remediation, and user acceptance testing. That’s the hard truth.

But there is still time to execute a disciplined, risk-reducing action plan. Here’s what you need to do in the next three months.

What Changes on July 14, 2026 — Exactly

Before diving into the plan, be clear on what the EOL date means operationally:

• No more security patches. Any newly discovered CVE in SharePoint 2016 after July 14, 2026 will go unpatched by Microsoft.
• No more hotfixes or QFEs. Even for critical bugs that cause data corruption or service outages.
• No vendor SLA. You cannot open a support case with Microsoft for SharePoint 2016. Existing cases will be closed.
• No compliance coverage. Auditors and cyber insurers will note the absence of vendor support. Expect heightened scrutiny during audits and potentially higher premiums or coverage exclusions.

Nothing breaks on July 14. The product will keep running. But it becomes an unsupported, static deployment with no safety net.

Week-by-Week Action Checklist

Weeks 1–2: Inventory & Scope

• Catalog every server. List all SharePoint 2016 farm servers: front-end web servers, application servers, database servers, search servers. Include OS versions, SQL Server versions, and installed cumulative updates.
• Inventory all site collections. Identify business-critical sites, archive sites, orphaned sites, and external-facing sites. Document business owners for each.
• Map dependencies. List custom solutions (WSPs, SAND solutions, timer jobs, web parts), integrations (e.g., Power BI, Office Online Server, third-party apps), and authentication providers.
• Identify unsupported features. Check for features that depend on Office Web Apps Server or other sunsetted components. Note these as high-risk.

Deliverable: A completed asset inventory with business owner, data classification, and dependency matrix.

Weeks 3–4: Risk Assessment & Isolation

• Perform a security review. Scan for known CVE exposure on your current build. If patch levels are behind, apply the latest Cumulative Update (16.0.5556.1005 or later if available before July 14).
• Segment the farm. Place SharePoint 2016 servers on a restricted network segment with minimal internet exposure. Close all administrative ports to non-admin networks.
• Disable external access if possible. If external users must connect, restrict to a read-only or limited set of site collections and enforce modern authentication (if supported).
• Harden the OS and SQL layer. Apply latest OS patches (Windows Server 2016/2019/2022 — whichever you run), harden SQL Server, and limit administrative access.

Deliverable: Security remediation log, network architecture diagram with segmentation notes, and access control list updates.

Weeks 5–6: Documentation & Audit Preparation

• Create a risk register. Document each identified risk (e.g., no patches after July 14, unpatched CVEs, custom code with no support). Include impact and likelihood ratings.
• Prepare an EOL disclosure statement. Write a clear narrative describing the EOL status, your mitigation steps, and the planned remediation timeline (migration to a supported platform). Share this with internal audit, risk management, and cyber insurance carrier.
• Document runbooks. Ensure the team has documented procedures for restarting services, restoring from backup, and reverting configuration changes — all of which must be performed without Microsoft support.
• Back up and test recovery. Perform a full farm backup (config, content, service applications). Test a restore in a non-production environment. This is your safety net.

Deliverable: Risk register, EOL disclosure document, updated runbooks, and verified restoration test report.

Weeks 7–8: Secure Extended Support Contract

• Choose a third-party support provider. With no vendor support available, you need a maintenance partner that can provide:
  • Security patches and hotfixes for uncovered vulnerabilities
  • Break-fix support with defined SLAs
  • Compliance documentation for auditors
• Initiate onboarding. Sign a contract that takes effect on July 14, 2026 (or earlier). Provide your AV inventory and current build information. Expect an initial security assessment as part of onboarding.
• Align internal SLAs. Update your incident management process to reflect that Tier-3 vendor support is now provided by your third-party partner, not Microsoft.

Deliverable: Executed support contract with effective date aligning to EOL, updated incident response process.

The End-State: Running SharePoint 2016 Safely After EOL

After July 14, 2026, your SharePoint 2016 environment can continue running — but it will require deliberate management:

• No new features or functional upgrades. The platform is frozen.
• Security posture depends on isolation + third-party patches. You must maintain network segmentation, apply third-party hotfixes promptly, and monitor for new vulnerabilities.
• Backup and disaster recovery become your own responsibility. Without vendor recovery assistance, test backups quarterly.
• Auditors and insurers expect a documented plan. Your EOL disclosure, risk register, and third-party support contract are your defense.

Next Step: Protect Your Operations Before Day One

The next three months are your window to turn an uncomfortable situation into a controlled one. Inventory, isolate, document, and secure support coverage — in that order. A third-party support partner can keep your SharePoint 2016 farm running, patched, and compliant while you plan a longer-term migration.

Contact us to discuss extending support coverage for your SharePoint 2016 environment before the July 14 deadline.

For more vendor lifecycle information, visit our Microsoft software support page.