Office 2016 and Office 2019 stopped receiving security updates on 14 October 2025, yet both still open email attachments and documents from the internet every day on thousands of desktops and session hosts. Office is one of the most attacked pieces of software on a Windows endpoint, and an unpatched copy turns every malicious document into a working exploit. This guide sets out Microsoft's official dates, including the earlier end of support for connecting to Microsoft 365 services, how to find every remaining installation and the accounts that depend on it, the choice between Microsoft 365 Apps and Office LTSC 2024, macro and attachment hardening for the transition, and how to test and roll back. It is for endpoint, messaging and vulnerability management teams. For operating system lifecycles and the general upgrade or extend decision, see the Operating System End of Life and Extended Support Guide.
This is an independent guide from NHI Mgmt Group, based on Microsoft's public documentation as of November 2026. It is not sponsored or reviewed by Microsoft. Product features change, so confirm settings against Microsoft's current documentation.
Key takeaways
- Support ended on 14 October 2025. Microsoft lists every Office 2016 and 2019 suite and app, including Outlook, Project and Visio, with that end of support date under the Fixed Policy.
- Microsoft 365 connectivity ended earlier. Microsoft states that connecting Office 2016 and 2019 to Microsoft 365 services has not been supported since 10 October 2023; it may still work, but Microsoft does not test it.
- Office LTSC 2021 has now ended too. Its end of support and Microsoft 365 connectivity date was 13 October 2026, so it is not a migration target; LTSC 2024 is supported for connecting until 9 October 2029.
- No paid extension is listed. Microsoft's end of support pages state there are no further security updates or paid assisted support options for these versions; the fix is replacement.
- Harden while you migrate. Perpetual Office versions do not get the Microsoft 365 Apps default block on internet macros, so set macro policy explicitly and cover the gap with attack surface reduction and mail filtering.
What is changing and why
Office 2016 and Office 2019 are perpetual, one-time purchase releases governed by Microsoft's Fixed Lifecycle Policy. Office 2016 had five years of mainstream support, ending in October 2020; Office 2019 had a shortened lifecycle, with mainstream support ending in October 2023, so both reached the end of extended support together. Microsoft's 2025 end of support page states that after end of support there are no new security updates, non-security updates, free or paid assisted support options, or online technical content updates.
The change matters for security rather than features. Document parsing, Outlook preview handling, OLE and ActiveX, and VBA are long-standing attack surfaces. Supported versions receive security updates for new issues through the Microsoft Security Update Guide; Office 2016 and 2019 no longer do, so moving to a supported version is how you keep receiving them.
Official timeline and current status
Dates below come from Microsoft's lifecycle and deployment documentation, checked on 8 November 2026.
| Product | Mainstream end | End of support (security updates) | Microsoft 365 services connectivity supported until | Status at 8 Nov 2026 |
|---|---|---|---|---|
| Office 2016 (Windows) | October 2020 | 14 October 2025 | 10 October 2023 | Unsupported |
| Office 2019 (Windows) | October 2023 | 14 October 2025 | 10 October 2023 | Unsupported |
| Office LTSC 2021 | Not applicable | 13 October 2026 | 13 October 2026 | Unsupported (ended last month) |
| Office LTSC 2024 | Not applicable | October 2029 | 9 October 2029 | Supported |
| Microsoft 365 Apps | Modern Lifecycle Policy: supported while kept on a supported update channel and build | Supported | Supported | |
The individual lifecycle product pages record the end as 15 October 2025 at 06:59:59 Pacific time, which is the close of 14 October in the United States. Office 2016 for Mac and Office 2019 for Mac ended earlier, on 13 October 2020 and 10 October 2023 respectively, according to Microsoft's connectivity page.
Operating system combinations
Microsoft's Office and Windows configuration matrix adds detail that affects planning:
- Office LTSC 2024 is supported on Windows 11, Windows Server 2022 and Windows Server 2025, but the matrix lists no support on Windows Server 2016 or 2019. Session hosts on those servers cannot simply take LTSC 2024.
- Microsoft 365 Apps on Windows 10 and on Windows Server 2016, 2019 and 2022 continues to receive security updates until 10 October 2028 to help migration, even though full support on those platforms has ended or ends earlier.
- Windows Server 2016 itself ends support on 12 January 2027. See the companion Windows Server 2016 End of Support guide.
Who and what is affected
| Where old Office lives | Why it is often missed | Specific risk |
|---|---|---|
| Desktops bought with perpetual licences | Licences were "owned", so no renewal prompt ever came | Daily email and web document handling |
| Remote Desktop and Citrix session hosts | Installed once in a golden image years ago | One exploit reaches many users' sessions |
| Standalone Visio and Project | Installed alongside Microsoft 365 Apps for a few users | Unpatched binaries next to a supported suite |
| Access runtime and databases | Business units depend on an .accdb front end | Database engine and VBA flaws; blocks the upgrade |
| Shop floor, lab and kiosk devices | Offline, owned by operations, not IT | Often run as shared accounts with local admin |
| Outlook 2016 or 2019 against Exchange Online | It still connects, so nobody notices | Unsupported, untested client against a cloud service |
Finding affected systems and identities
- Configuration Manager or Intune: Microsoft points to the Configuration Manager Office 365 Client Management dashboard to find devices with older Office. In Intune, use the discovered apps report and filter on Office product names and version 16.0 builds that are not Click-to-Run Microsoft 365 Apps.
- Installed product inventory: Office 2016 and 2019 share the 16.0 internal version number with Microsoft 365 Apps, so version alone is not enough. Separate them by product name and installation type: Office 2016 volume licence is MSI-based, while Office 2019 and Microsoft 365 Apps are Click-to-Run with different product IDs.
- Vulnerability scanners: most scanners flag unsupported Office as a finding; reconcile that list against the endpoint inventory.
- Sign-in logs: Entra ID sign-in logs record client application and user agent details for Outlook and Office clients; use them to find users still connecting old clients to Exchange Online and SharePoint.
- Licensing records: volume licence keys and KMS or Active Directory based activation counts show how many perpetual copies were deployed.
Identities: record which shared, kiosk and service accounts run Office, especially automation that drives Excel or Word through COM on a server, and any account with a mailbox opened by an unattended Outlook profile. These non-human uses break during migration and are frequently over-privileged. Where Office automation runs on servers, move it to supported APIs rather than reinstalling desktop Office under a service account.
Migration options
| Target | Fits when | Trade-offs |
|---|---|---|
| Microsoft 365 Apps (Current or Monthly Enterprise Channel) | Most users with Microsoft 365 or Office 365 licences | Monthly feature changes; gets security features such as the default internet macro block; needs channel management |
| Microsoft 365 Apps (Semi-Annual Enterprise Channel) | Line of business add-ins need longer testing | Fewer feature changes, slower arrival of new security features |
| Office LTSC 2024 | Regulated or certified devices that cannot take feature updates, process control and offline systems | Volume licence, one device per licence; fixed feature set; supported to October 2029 only; not on Server 2016 or 2019 |
| Office on the web | Frontline and light users | No VBA or COM add-ins; removes the local client attack surface |
| Remove Office | Kiosks and servers that do not need it | Smallest attack surface; automation must move to APIs |
Microsoft's upgrade guidance recommends Microsoft 365 Apps or Office LTSC 2024 and no longer presents LTSC 2021 as a target. It names the Microsoft 365 Apps Upgrade Readiness Toolkit for compatibility checks, the Office Deployment Tool for packaging, and App Assure for compatibility help. MSI-based installs must be removed before Microsoft 365 Apps is installed: the Office Deployment Tool's RemoveMSI element in the configuration XML does this during deployment, and the Microsoft Support and Recovery Assistant can scrub leftover installations.
Hardening during the transition
- Macros: Microsoft documents that the default block on macros in files from the internet applies to Microsoft 365 Apps update channels and does not change perpetual versions such as Office 2019. On remaining old installs, enforce "VBA Macro Notification Settings" set to "Disable all except digitally signed macros" (the security baseline value) through Group Policy, under each application's Trust Center node. See the Office Macro Blocking Guide.
- Attack surface reduction: on Microsoft Defender endpoints, enable the Office-related ASR rules in audit and then block mode, notably blocking Office applications from creating child processes and from injecting code into other processes.
- Mail and web filtering: detonate attachments, strip or quarantine macro-enabled formats from external senders and keep Mark of the Web intact through archive extraction.
- Least privilege: remove local admin from users on old Office devices so a document exploit runs with user rights only.
- Isolation: for devices that must keep old Office, block internet email and browsing on them, or restrict them to an internal document set.
Testing and rollback
- Inventory add-ins and macros: run the Readiness Toolkit or equivalent against a sample of user documents, COM add-ins and VSTO add-ins, and record owners.
- Pilot ring: deploy to IT and a business volunteer group first, including at least one heavy Excel, Access and Outlook user, for two to four weeks.
- Broad rings: deploy by department, keeping finance and other add-in heavy teams for a later ring after their add-ins are confirmed.
- Session hosts: build a new golden image with the target Office version and run it in parallel with the old pool; switch users by group membership.
- Rollback: for Click-to-Run, keep a known-good build number to roll back to with the Office Deployment Tool; for session hosts, keep the old image available but closed to new logons, with a removal date.
- Exit criteria: zero Office 2016, 2019 and LTSC 2021 installations in inventory, and no old Outlook clients in sign-in logs for 30 days.
Risks of doing nothing
- Document exploits stay live: phishing attachments (ATT&CK T1566.001) and malicious files opened by users (T1204.002) target exactly this software, and no fix will arrive for new flaws.
- Outlook as an entry point: mail clients can be targeted without macros, and old clients will not receive fixes for future issues.
- Service problems: Microsoft warns that unsupported versions connecting to Microsoft 365 may lose functionality and hit performance or reliability issues because services are not tested against them.
- Audit findings: NIST SP 800-53 SA-22 and CIS Controls v8.1 Safeguard 2.2 both treat unsupported software as a gap needing removal or a documented exception.
- Newer security features: perpetual versions do not include protections added to Microsoft 365 Apps since release, including the default internet macro block.
Detection, metrics and framework mapping
Until removal is complete, alert on Office processes spawning script interpreters or command shells, on macro execution from documents carrying Mark of the Web, and on old Outlook user agents in sign-in logs. See the Macro Malware Guide for detection detail.
- Devices with Office 2016, 2019 or LTSC 2021, trending to zero, by business unit.
- Users connecting old Outlook clients to Exchange Online, from sign-in logs.
- Add-ins validated on the target version as a percentage of add-ins in use.
- ASR rule coverage in block mode on devices still running old Office.
- Exceptions with a named owner, compensating controls and an expiry date.
| Framework | Reference | Relevance |
|---|---|---|
| NIST SP 800-53 Rev 5 | SA-22, CM-8, CM-7, SI-2 | Unsupported components, inventory, least functionality, flaw remediation |
| NIST CSF 2.0 | ID.AM-02, ID.AM-08, PR.PS-02 | Software inventory and lifecycle, software replaced commensurate with risk |
| CIS Controls v8.1 | Safeguards 2.2, 7.4, 9.6, 9.7 | Supported software, application patch management, blocking unnecessary file types, email anti-malware |
| ISO/IEC 27001:2022 Annex A | A.8.8, A.8.19 | Technical vulnerabilities, installation of software on operational systems |
| MITRE ATT&CK v20 | T1566.001, T1204.002 | Attachment-borne initial access and user execution |
Practitioner checklist
- Build one inventory of Office 2016, 2019 and LTSC 2021 installs, including standalone Visio, Project and Access, from endpoint management, scanners and licence records.
- Pull Entra ID sign-in logs to find old Outlook and Office clients still connecting to Microsoft 365.
- Choose Microsoft 365 Apps by default and Office LTSC 2024 only for devices that cannot take feature updates.
- Check session hosts: LTSC 2024 is not listed for Windows Server 2016 or 2019, so plan the OS and Office together.
- Inventory add-ins and macros, assign owners and test them in a pilot ring before broad deployment.
- Remove MSI installs with the Office Deployment Tool's RemoveMSI option and verify no old binaries remain.
- On any old install that must stay temporarily, enforce macro notification policy, Office ASR rules and remove local admin.
- Replace server-side Office automation under service accounts with supported APIs.
- Record exceptions with compensating controls and an expiry date, and report the count monthly.
Standards and references
- Microsoft Learn: Products reaching end of support in 2025
- Microsoft Learn: Office versions and connectivity to Microsoft 365 services
- Microsoft Learn: Plan your upgrade from older versions of Office
- Microsoft Learn: Windows and Office configuration support matrix
- Microsoft Learn: Macros from the internet are blocked by default in Office
- NIST: SP 800-53 Rev. 5, Security and Privacy Controls
- CIS: Critical Security Controls v8.1
Related NHI Mgmt Group resources: Operating System End of Life and Extended Support Guide · Office Macro Blocking Guide · Malicious Office Add-ins Guide · Windows 10 End of Life · Technology End of Life Policy Template