Somewhere in a data centre in Navi Mumbai or Whitefield, a SharePoint 2016 system runs the document workflows of a listed Indian bank.

SharePoint is Microsoft software that lets companies store documents, share them and control who can access them on their own servers. But the software stopped receiving security patches on July 14.

Another product, Office Online Server, that lets employees open a loan file in a browser and edit it alongside a colleague without moving the file off the company's servers, will stop receiving patches on December 31, 2026.

Microsoft describes the changes as part of its effort to modernise productivity software and focus on cloud-based products.

For shareholders, the logic is simpler — the on-premises business wasn't generating recurring revenue, so it was closed.

The problem is that many Indian banks, insurers, brokerages and government-owned companies still have good reasons to keep sensitive documents on their own systems. They now have to decide what comes next.

And the risk isn’t theoretical either.

In July 2025, attackers broke into on-premises SharePoint servers around the world through a vulnerability that forced Microsoft to issue an emergency patch for the 2016 and 2019 versions, as well as the current version.

The next vulnerability in the 2016 or 2019 versions will not get that treatment.

For an Indian bank, insurer or public-sector company still running them, what was once an upgrade that could be scheduled at leisure is now an open security and audit issue.

Every route away from those servers costs money.

Microsoft’s Door Is Closing

Exchange Server 2016 and 2019, the mail and calendar software behind Outlook for companies that host their own email, left support in October last year.

SharePoint Server 2016 and 2019 followed on 14 July, the date Microsoft's own lifecycle list gives for both.

Office Online Server, the add-on that lets staff open, preview and jointly edit Word and Excel files in a browser without the file ever leaving the company's own SharePoint, retires on 31 December with no successor.

Two details give the game away.

First, Microsoft's stated fallback for customers who stay on the surviving Subscription Editions, the only on-premises versions still supported and sold as a rolling subscription rather than a one-off licence, is desktop software: Microsoft 365 Apps, the subscription version of Word and Excel, or Office LTSC 2024, the fixed-version perpetual one.

Consider what that means for a company that kept its documents on its own servers so they never left the building.

Until now, staff could open a file in a browser and edit it together while the file stayed put.

From January, the only supported way to edit that file will be to download it to a PC, open it in desktop Word or Excel, and upload it back. That is how it worked a decade ago.

Every edit puts a copy of the file on someone's laptop, only one person can work on it at a time, and the single copy of record an auditor expects is replaced by versions scattered across the building. These are the problems browser editing was bought to solve.

The browser editing the company bought in 2016 will still exist. But instead it being on-premises, it will live only in Microsoft's cloud.

Second, there is no Extended Security Updates programme for SharePoint 2016 or 2019. ESU is Microsoft's paid scheme for customers who need more time; when Windows Server and SQL Server versions were retired, it sold two or three more years of patches under it.

Microsoft has not put out a notice that names SharePoint and rules ESU out.

Its 2026 lifecycle list states that once a product reaches end of support, there are no more security updates and no free or paid support.

Where Microsoft does intend to sell more time, it says so publicly. It sold Exchange 2016 and 2019 customers six months of paid security updates when those products retired last October, then extended the programme to this October.

For SharePoint 2016 and 2019, it has chosen not to offer one. That absence is a commercial statement in itself.

Microsoft would rather a customer moved off the platform than paid to stay on it a little longer, and there is no price at which an on-premises customer can buy more time.

Who Gets The Migration Business?

A perpetual software licence is bought once. A Microsoft 365 subscription generates revenue every month, with additional products such as Copilot available on top.

Retiring the older products removes an alternative.

For Microsoft, every customer that moves from an old licence to a subscription becomes a recurring source of revenue.

Retiring the on-premises products does not merely nudge customers towards that model. It removes the alternative.

Every reluctant migrant is a new annuity, and the refusal to sell extended support ensures the migration cannot be postponed past the current financial year.

Indian IT services companies have an opportunity here too.

TCS, Infosys, Wipro, HCLTech and LTIMindtree all run large Microsoft practices, and the firms are not shy about their size.

TCS says its dedicated Microsoft Business Unit has 50,000 certified associates. HCLTech claims 75,000 Microsoft-trained professionals.

Wipro cites more than 40,000 trained and 12,000 certified on the Microsoft cloud. LTIMindtree puts its Microsoft-certified headcount at 12,000, and Infosys's practice runs to several thousand consultants holding more than 8,000 certifications.

A forced migration off an unsupported platform is the most reliable deal in the business. The client cannot defer it, cannot negotiate the deadline, and cannot easily switch vendors midway.

A deadline set in Redmond is a pipeline in Bengaluru, and it arrives with an auditor's letter attached.

The irony is one the industry prefers not to name. These are the same firms that advise Indian banks, insurers and ministries on data sovereignty, that help draft the compliance frameworks, and that sit on the committees.

They will now bill those clients for moving the document estate to a foreign cloud, because that is the only supported destination left. The sovereignty consulting and the migration consulting are sold from the same building.

The relationship runs both ways. In December, Satya Nadella stood on a stage in Bengaluru to announce that TCS, Infosys, Wipro and Cognizant would, between them, deploy more than 200,000 Copilot licences inside their own organisations.

The firms selling the migration are among Microsoft's largest customers for the product at the end of it.

Why India Can’t Just Cloud

Most of the world can shrug and move. Indian regulated entities have spent a decade building rules that make that harder.

The RBI's 2018 directive requires payment system data to be stored in India. The Digital Personal Data Protection Act, 2023, lets the government restrict transfers to notified jurisdictions.

SEBI's 2023 cloud framework, which covers exchanges, depositories, brokers and fund houses, requires them to keep data in India and to plan how they would leave a provider. Government departments are steered towards MeitY-empanelled cloud services.

None of this forbids Microsoft 365, and Microsoft runs Indian data-centre regions to satisfy it. But moving a bank's or a PSU's document estate from a server it owns to a tenant it rents is a programme of months, not a patch cycle. A firm that sells such migrations puts a typical 2,000-seat move at 16 to 24 weeks – that deadline arrived in July.

Indian lenders rarely disclose which SharePoint versions they run, so how many missed the date is not public.

For the market entities SEBI regulates, the exit rules add a second problem. They assume a workable way back. SEBI asks each entity to name its exit triggers and possible migration options, and to keep its data portable.

The contract must let it move to another provider, and its data must stay usable even after it leaves the cloud altogether.

The framework does not require an entity to own its software. It assumes that running systems in-house remains a normal choice, and leaves those systems to SEBI's older rules.

From January, the in-house route for documents is a rented Subscription Edition licence plus desktop Word, with no browser editing on the premises. The exit plan can still be written, but it now leads back to files copied onto laptops.

The Alternative Suites

Collabora Online, ONLYOFFICE, Nextcloud and Zoho have all spent the recent months offering to plug their own editor into an existing SharePoint through WOPI, the standard interface that lets any compatible editor stand in for Office Online Server, so that files stay where they are and only the editing layer changes.

Zoho adds a domestic-champion argument the others cannot make.

The swap is a weekend's work. But it fixes one deadline, not both.

The SharePoint underneath is still unpatched, and an auditor will not accept a new editor as an answer to an unsupported document system.

The customer must still upgrade to Subscription Edition, move to SharePoint Online, the cloud-hosted version inside Microsoft 365, or leave SharePoint, and every one of those paths puts a vendor in charge of the next deadline.

There is a second catch. The alternative suites do not run VBA, the macro language behind most working Excel models. The vendors call this "heavily customised scripts may need review". A CFO who has inherited a twenty-year-old MIS workbook would call it a rewrite.

Microsoft converts licences it sold once into subscriptions it collects forever. Indian IT services bill for the move. The alternative-suite vendors collect from whoever decides to fight.

The customer is the one party in the chain who pays and does not get paid. For a regulated Indian entity, the payment comes with a compliance programme attached.

That is what the end of ownership looks like on a balance sheet.

The servers will keep running on 1 January 2027. The invoices are already in the post.