Who is responsible for SharePoint security updates: Microsoft or your organization? It depends on the deployment. With SharePoint Online, Microsoft operates the service infrastructure, while your organization remains responsible for its data, identities, permissions, sharing, and customer-controlled configuration. With SharePoint Server, your organization operates the farm and installs updates across its servers, then completes the farm’s upgrade process.
That distinction is operational, not a universal security ranking. The right choice depends in part on whether your organization can consistently manage the security work that remains its responsibility.
What changes between SharePoint Server and SharePoint Online?
| Responsibility | SharePoint Server | SharePoint Online |
|---|---|---|
| Service infrastructure | Your organization operates the SharePoint farm and its surrounding environment. | Microsoft operates the SaaS service infrastructure, including the operating system and physical layers, under its shared-responsibility model. |
| Service updates | Your organization deploys updates across the farm servers and completes the farm update process. | Microsoft operates the service. The cited guidance does not establish a specific customer-facing update schedule. |
| Customer security work | Secure the farm and its configuration, manage identities and access, and keep the exact SharePoint release on a supported build. | Protect your data and identities; configure access controls and permissions; and manage user sharing and customer-controlled settings. |
Microsoft’s cloud guidance summarizes the customer’s continuing role with the statement, “You control your data.” See How SharePoint and OneDrive safeguard your data in the cloud and Microsoft’s shared-responsibility guidance. The responsibility model is an operational guide; applicable service terms govern the service.
What does SharePoint Online security still require from your organization?
Moving to SharePoint Online shifts operation of the underlying service infrastructure to Microsoft; it does not transfer ownership of your data or customer-managed decisions about who can access it. Your organization still needs to govern identities, permissions, configuration, and sharing practices.
#1 Best Overall
- Data: Decide what information belongs in SharePoint and protect it through your organization’s policies and controls.
- Identity and access: Manage identities and determine which users can access the service and its content.
- Permissions and sharing: Set appropriate site and content permissions and manage how users share information. Microsoft documents these considerations in Sharing and permissions in the SharePoint modern experience.
- Configuration: Review customer-controlled settings rather than treating Microsoft’s operation of the infrastructure as a substitute for your security administration.
The sources establish these responsibility areas but do not specify a universal SharePoint Online patch timetable. Do not infer one from the fact that Microsoft operates the service.
How does SharePoint Server patching work?
For SharePoint Server, applying an update is not simply a matter of installing a file on one machine. Microsoft’s software updates overview describes two phases:
Rank #2
- Patch phase: Apply the update to each SharePoint Server in the farm.
- Build-to-build upgrade phase: Complete the farm upgrade process after patching. Microsoft says this phase can be postponed, but delaying it for too long can increase the chance of behavioral issues.
Your organization owns deployment and completion of this process. Plan for the farm as a whole, and verify the instructions for the exact SharePoint release in use.
What are the current SharePoint Server servicing and support facts?
Support status depends on the release and, for Subscription Edition, the specific build. Microsoft’s servicing pages are the authority to check before scheduling an update.
Recommended Free Tools
Subscription Edition
- SharePoint Server Subscription Edition is listed as in support under Microsoft’s Modern Lifecycle Policy, but individual builds follow a separate servicing policy.
- For each public update build beginning January 10, 2023, the support window is one year from that build’s release. Microsoft says customers must run a supported build to remain supported. See the Subscription Edition servicing FAQ.
- Microsoft recommends installing Subscription Edition public updates as soon as they become available. Updates are cumulative. Beginning with the March 2023 public update, Microsoft combined the monthly update into one package instead of separate core and language-pack packages.
- In the update history available on October 4, 2026, Microsoft lists KB 5002908, version 16.0.20326.20136, released September 8, 2026, as the Subscription Edition update. Check Microsoft’s live SharePoint updates page for the latest entry before acting; the listed build can change.
SharePoint Server 2016 and 2019
Microsoft lists July 14, 2026, as the end-of-support date for SharePoint Server 2016 and SharePoint Server 2019. Microsoft’s SharePoint Server lifecycle search identifies lifecycle status; Microsoft says products at end of support no longer receive new security or non-security updates or assisted support. If either release remains in use, treat its lifecycle status as a current security concern and verify migration or support options with Microsoft.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.How should an organization choose between the models?
Neither deployment model is inherently safer for every organization. The useful question is whether your team can reliably perform the responsibilities associated with the model, and whether the exact server release remains supported.
Quick Recap
Rank #4
- Assess operational capacity: For SharePoint Server, account for farm operations, update deployment, and the upgrade phase. For SharePoint Online, account for identity, data, permissions, sharing, and configuration management.
- Check the actual release: Do not treat Subscription Edition’s servicing policy as applying to Server 2016 or 2019. Confirm the exact edition and build against Microsoft’s lifecycle and update pages.
- Make patching routine: Subscription Edition’s one-year per-build support window makes regular servicing necessary, not just an occasional major-version project.
- Use a qualified assessment when needed: Organizations that need hands-on help can explore Microsoft’s Offline Assessment for SharePoint resource and verify the scope and qualifications of any service provider.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
