Recommended Free Tools
Who handles SharePoint security updates: Microsoft or your organization? It depends on the deployment. With SharePoint Online, Microsoft operates the service infrastructure, while your organization remains responsible for its data, identities, access controls, configuration, and sharing practices. With SharePoint Server, your organization runs the farm and must deploy updates across its servers and complete the farm’s update process.
How security responsibilities differ
The distinction is not that one model removes security work. SharePoint Online shifts operation of the underlying service to Microsoft; SharePoint Server leaves the farm’s operation and servicing with your organization. Microsoft’s shared-responsibility model is an operational guide, not a replacement for the applicable service terms.
| Responsibility | SharePoint Server | SharePoint Online |
|---|---|---|
| Service infrastructure | Your organization operates the SharePoint farm and surrounding environment, including work across the farm’s servers. Microsoft’s SharePoint Server update overview | Microsoft manages the SaaS operating system and physical infrastructure under its shared-responsibility model. Microsoft’s shared responsibility guidance |
| Platform updates | Your administrators deploy updates and complete the farm update process. Microsoft’s SharePoint Server update overview | Microsoft operates the service. The cited guidance does not establish a customer-facing update timetable, so do not infer a specific cadence from this comparison. |
| Customer security work | Secure the farm and its configuration, identities, and access, and keep the deployed build supported. Subscription Edition servicing FAQ | Protect organizational data and identities, configure access controls and permissions, and manage how users share content. Microsoft’s cloud guidance states, “You control your data.” SharePoint and OneDrive cloud data security; sharing and permissions guidance |
What your organization still manages in SharePoint Online
Microsoft’s operation of the underlying service does not transfer ownership of your data or customer-controlled security decisions. Your security work includes managing identities, deciding who can access sites and content, setting appropriate permissions, and governing user sharing. Misconfiguration or excessive access can undermine protection even when Microsoft operates the infrastructure.
Use Microsoft’s shared responsibility guidance as a way to understand operational boundaries, then consult the applicable service terms for contractual obligations. The sources do not support promising a particular SharePoint Online patch schedule.
Quick wins for a faster PC:
Clear out junk files and repair common Windows errorsFree Scan →Scan for outdated or missing drivers - takes under a minuteDriver Scan →#1 Best Overall
What patching SharePoint Server involves
Server patching is more than installing a file on one machine. Microsoft documents a process with a patch phase and a build-to-build upgrade phase. The patch phase applies updates to each SharePoint Server in the farm; the upgrade phase completes the farm’s transition to the updated build. Microsoft says the upgrade phase can be postponed, but delaying it for too long can increase the chance of behavioral issues.
- Plan for the farm: account for the servers in the SharePoint farm and the full update process described in Microsoft’s software updates overview.
- Apply the patch phase: deploy the updates to each SharePoint Server in the farm.
- Complete the build-to-build upgrade phase: do not treat patch installation alone as completion. Although this phase can be postponed, avoid prolonged delay because Microsoft warns that it can raise the chance of behavioral issues.
- Check the exact release’s support status: the servicing rules differ between Subscription Edition and older releases.
Subscription Edition: monthly updates and a one-year build window
SharePoint Server Subscription Edition is listed as in support under Microsoft’s Modern Lifecycle Policy, but that does not mean every installed build stays supported indefinitely. Under Microsoft’s servicing policy, each public update build released starting January 10, 2023, has a one-year support window. Customers must run a supported build to remain supported. Microsoft recommends installing Subscription Edition public updates as soon as they become available.
Subscription Edition receives monthly public updates while the product is in support. Updates are cumulative. Beginning with the March 2023 public update, Microsoft combined the monthly package rather than issuing the previous separate core and language-pack packages. The exact current update is time-sensitive: Microsoft’s update history lists KB 5002908, version 16.0.20326.20136, released September 8, 2026. Check the SharePoint updates history for the latest release and confirm the installed build remains within its support window.
SharePoint Server 2016 and 2019 are past end of support
Microsoft lists July 14, 2026, as the end-of-support date for SharePoint Server 2016 and SharePoint Server 2019. Microsoft’s lifecycle guidance says products at end of support no longer receive new security or non-security updates or assisted support. Organizations still running either release should treat that lifecycle status as a current security concern and verify their migration or support options. See Microsoft’s SharePoint Server lifecycle search for product-specific lifecycle information.
Do not apply Subscription Edition’s servicing rule to 2016 or 2019: the release in use determines the relevant lifecycle and update path. Subscription Edition’s product status is listed separately on Microsoft’s lifecycle page.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Choosing an operating model
Neither model is inherently safer for every organization. The useful question is whether your organization can consistently handle the security work left with it under the model you choose.
- Consider SharePoint Online if shifting operation of the underlying service infrastructure to Microsoft fits your needs, and you can still manage data protection, identities, permissions, configuration, and sharing.
- Consider SharePoint Server in light of the operational control you need and whether you have the staff and discipline to secure the farm, deploy updates across its servers, complete upgrades, and keep the exact release on a supported build.
- For an existing Server deployment, identify the precise release and build first. Subscription Edition requires ongoing servicing; 2016 and 2019 reached end of support on July 14, 2026.
The available Microsoft materials establish responsibility boundaries and servicing facts, not comparative breach rates or a universal security outcome. Your decision should turn on the work your organization can reliably perform, as well as the requirements of your environment.
Quick Recap
Best Value
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
Do these 3 things before closing this tab:
1Clear out junk files and repair common Windows errors2Fix the driver behind crashes, sound loss and screen glitches3Repair Windows errors before they cause bigger problems
