Microsoft pulled the plug on SharePoint Server 2016 and 2019 support on 14 July 2026, and on-premises farms have now gone close to four months with zero security patches. That’s not some abstract risk, either. The ToolShell exploit chain hit on-premises SharePoint servers back in July 2025, landed on CISA’s Known Exploited Vulnerabilities catalog, and didn’t touch SharePoint Online at all.
IT teams still running an old farm already know they need to move, but the bigger problem is that most of them have no real idea what’s actually sitting in the environment they’re about to migrate. Until you’ve done a proper audit of the farm, your migration plan is basically a guess with a deadline stapled to it. Here’s what that discovery work looks like and where it tends to throw up problems that catch teams off guard.
What a Content Inventory Actually Reveals
You need to start by cataloguing every site collection, subsite, document library and list so that nothing gets accidentally left behind or dragged into the new environment when it shouldn’t be. Farms that have been running for five years or more will almost always have dozens of site collections that haven’t been touched in ages, alongside libraries packed with documents that were uploaded once and never opened again.
Once the inventory is done, the split between live content and dead weight becomes obvious fast. A huge portion of files won’t have been accessed in over a year, and migrating all of that just burns time and inflates storage costs for zero benefit. Cutting dead content out of scope through archiving or outright deletion can halve the size of the migration before you’ve even started on the technical planning.
Custom Code and the Tools That Died in July
This is where migration plans tend to fall apart. SharePoint Designer 2013 and InfoPath 2013 both hit end of support on that same 14 July date, which means any workflows or forms built with those tools are now running on completely unsupported software with no fix on the way. An audit will catalogue every custom solution in the farm, from Designer workflows and InfoPath forms through to server-side solutions deployed as WSP packages.
Inventorying content is something most internal teams can handle on their own, but deciding what should be rebuilt from scratch and what can simply be lifted across requires a different kind of expertise. This is usually the stage where organisations bring in SharePoint consultants to run a structured discovery across content, libraries, governance and security before committing to a target platform. Getting the rebuild-or-replace decisions wrong will derail your timeline much more than a slow data transfer will, and by the time you realise the mistake, you’ve already lost weeks.
Broken Permissions and Governance Gaps
Permissions in SharePoint farms have a habit of decaying quietly. A contractor needs access to one folder, so inheritance gets broken there. Then the same thing happens in a different library for a different reason. Give that a few years and you’ll end up with unique permissions scattered everywhere, with not a single document explaining why they exist. Mapping all of this out during an audit will almost certainly surprise the team, even if they’re convinced governance has been tight.
If you carry broken permissions into a new environment, you’ve just imported the mess along with the data. An audit gives you a window to tighten up access controls, merge overlapping security groups and set governance policies that won’t collapse the moment users start working in the new platform. Leave it until after migration and the cleanup gets significantly harder, because everything has already been copied across and people are actively using it.
Why the Clock Is Tighter Than You Think
An audit forces you to make hard decisions before you’ve locked in a migration path, and that changes the entire shape of the project. If you discover that a huge chunk of content is dead, that a handful of critical workflows need rebuilding, that permissions are broken across key libraries, and that two InfoPath forms are propping up an entire approval process, the project looks completely different from what you originally assumed. Skip the audit and you’ll be guessing at timelines and budgets right up until something breaks mid-migration.
There’s also a hard deadline that makes waiting even riskier. Office Online Server will retire on 31 December 2026, and when it does, on-premises farms will lose the ability to view and edit Word, Excel and PowerPoint files in the browser entirely. That leaves teams with less than two months to scope this work if they want to avoid starting January with an environment that’s both unpatched and partially broken.