SharePoint
Web platform part of Microsoft 365
From Wikipedia, the free encyclopedia
SharePoint is a web-based collaborative platform primarily used for building corporate intranets, document and content management, and file sharing. Developed by Microsoft, it is primarily used as part of the hosted service Microsoft 365, but it can also be hosted by an IT department or service provider, using an on premises version called "SharePoint Server". Launched in 2001,[8] SharePoint was originally licensed under the Microsoft Office Server suite (alongside Microsoft Exchange), and a feature limited version was bundled with Windows Server. These were unified under the SharePoint brand in 2010. The feature limited version, SharePoint Foundation, was discontinued in 2013. SharePoint today is primarily distributed as part of Microsoft 365, with the SharePoint Server available on a Microsoft 365 billing subscription.
.svg)
| Microsoft SharePoint | |||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|
| |||||||||||
 | |||||||||||
| Developer | Microsoft Corporation | ||||||||||
| Initial release | 28 March 2001 | ||||||||||
| Stable release(s) [±] | |||||||||||
| |||||||||||
| Operating system | Server:[5][6] Client: | ||||||||||
| Platform | x86-64 | ||||||||||
| Available in | Arabic, Azerbaijani, Basque, Bosnian, Bulgarian, Catalan, Chinese, Croatian, Czech, Danish, Dari, Dutch, English, Estonian, Finnish, French, Galician, German, Greek, Hebrew, Hindi, Hungarian, Indonesian, Irish, Italian, Japanese, Kazakh, Korean, Latvian, Lithuanian, Macedonian, Malay, Norwegian, Polish, Portuguese, Romanian, Russian, Serbian, Slovak, Slovenian, Spanish, Swedish, Thai, Turkish, Ukrainian, Vietnamese and Welsh[7] | ||||||||||
| Type | Content management system | ||||||||||
| License | Proprietary software | ||||||||||
| Website | www | ||||||||||
SharePoint provides the storage layer for OneDrive, Microsoft Teams files, and Microsoft Loop components, and is the primary grounding source for Microsoft 365 Copilot.[9]
According to Microsoft, as of March 2026[update], more than one billion users interact with SharePoint each year, with around two billion files uploaded and two million sites created daily.[9]
Applications
The most common uses of SharePoint include:
Enterprise content and document management
SharePoint allows storage, retrieval, searching, archiving, tracking, management, and reporting on electronic documents and records. Many of the functions in this product are designed around various legal, information management, and process requirements in organizations. SharePoint also provides search and "graph" functionality.[10] SharePoint allows collaborative real-time editing[11] and encrypted/information-rights-managed[12] synchronization by providing the underlying technical infrastructure for Microsoft OneDrive.[13]
SharePoint is often used to replace or supplement an existing corporate file server, and is typically coupled with an enterprise content management policy.[14]
Intranet and social network
A SharePoint intranet or intranet portal is a way to centralize access to enterprise information and applications. It is a tool that helps an organization manage its internal communications, applications and information more easily. By providing the tools to capture and share explicit knowledge in an organisation, Microsoft claims organizational improvements in employee training, employee engagement, business process management, organizational communication, and crisis management.[15][16] These capabilities are usually centered around "Communication sites" (previously, "Publishing sites").[17]
Group collaboration
SharePoint contains team collaboration groupware capabilities, including: document / file management, project scheduling (integrated with Outlook and Project), and other information tracking.[18] This capability is centred around "team sites". Team sites are created whenever a Microsoft Teams team is created, but they are also created independently of these, and have been a feature of SharePoint since 2001.
Storage in Microsoft 365
SharePoint stores most content in a Microsoft 365 tenant. OneDrive is a per-user SharePoint site, Microsoft Teams channel files reside in a SharePoint site provisioned per team, and Microsoft Loop components are stored in OneDrive, SharePoint, or SharePoint Embedded containers.[19] Microsoft Graph exposes this content as a unified API.
SharePoint Embedded, generally available since May 2024, exposes the same storage platform as a headless service for third-party applications, which hold data in tenant-bound containers accessed through Microsoft Graph.[20]
Search and AI
Microsoft Search is the tenant-wide search runtime over SharePoint and other Microsoft 365 content, and Microsoft 365 Copilot grounds responses in the same content through a permissions-trimmed semantic index.[21] Both honour SharePoint permissions at site, list, item, and file level. SharePoint agents, generally available since November 2024, are scoped retrieval agents stored as .agent files; each site has a default agent and users with edit rights can create custom ones, all inheriting the underlying SharePoint permissions and sensitivity labels.[22]
Custom web applications
SharePoint sites can host custom web applications built on the SharePoint Framework (SPFx), typically as React components written in TypeScript. The component renders in the SharePoint page and consumes Microsoft Graph for tenant data. Server-side logic is hosted separately, typically as an Azure Function consuming other Azure Services, with user authentication passed through a token issued by Microsoft Entra ID. SharePoint sites and lists are commonly used as low-code data stores for these applications, with Power Apps and Power Automate providing forms and process orchestration.[23]
On SharePoint Server, customisation historically used the on-premises Add-in model and full-trust farm solutions for similar scenarios; these are covered under developing on SharePoint Server.
Configuration, integration, and customization
Web-based configuration
SharePoint is primarily configured through a web browser. Capabilities for the management of a SharePoint site are "security trimmed", meaning that editing capabilities simply appear in place when permissions are granted. A "Site Collection Administrator" has the highest level of permission to manage individual SharePoint sites.
Admin Center
An administration center for configuring organisation-wide settings is usually available to SharePoint Administrators, who are responsible for managing the underlying infrastructure.
In the cloud, this is called the "SharePoint Admin Center". Features include:
- Tenant-wide policy controls around sharing/permissions, access control, apps, APIs, and security controls.
- Tenant-wide configuration of content services: search, managed metadata, content types, and other governance.
- Tenant-wide health and security reports, service health checks, migration features, and hybrid configuration.[24]
In SharePoint Server, this is called the "central administration site", and it contains significantly more features are available for the administration and health of the SharePoint server farm. Because they are not operated as a shared resource, features like the search crawler are more controllable and configurable.
Command line tools
Microsoft SharePoint's Server and SharePoint Online have multiple command line or PowerShell utilities available to ease administration.
- Microsoft also provides an official PowerShell module for cloud, as well as for SharePoint Server. These are supported only on Windows.
- The open source PnP PowerShell is managed by Microsoft, and is widely used in cloud hosted environments. It is available on PowerShell for Windows, Mac and Linux.
- A broader, cross-platform Microsoft 365 CLI (also open source) is also available.
Integrating with SharePoint
- The Microsoft Power Platform provides significant extensibility for SharePoint Online, especially Power Automate.
- Microsoft Graph provides an API endpoint for Microsoft 365 that is frequently used for SharePoint Online.
- SharePoint provides various APIs, including REST, ODATA, and object models.[25]
Developing on SharePoint Online
The SharePoint Framework (SPFx) is the supported model for client-side customisation in SharePoint Online and the only option that fully integrates with the modern user experience.[23] It uses TypeScript on Node.js with React as the default UI framework, and has been generally available since February 2017. New major versions ship roughly annually, aligned with the current Node.js LTS; SPFx 1.22 is the stable release as of April 2026 and runs on Node 22.[26]
For server-side custom development, the supported pattern is to host the code in Azure, secured with Entra ID through App Service Authentication ("Easy Auth"), which passes authentication through to the service.[27]
Sandboxed solutions and the Provider-hosted Add-in model are retired in SharePoint Online.
Developing on SharePoint Server
SharePoint Server supports SPFx, but lags the cloud by several versions; running on older Node.js and React releases.[28] As of 2026, Subscription Edition supports up to SPFx 1.5, released in 2018.[26]
Several deprecated earlier extensibility models remain installable on SharePoint Server:
- Add-in model (2013): SharePoint-hosted and provider-hosted apps served through a SharePoint proxy. Retired in the cloud on 2 April 2026.[29][30]
- Sandboxed solutions (2010): user-deployable, security-restricted code packages with resource quotas. Code execution disabled in SharePoint Online in 2014; declarative-only packages still installable on Server.[31]
- Farm solutions (2010): fully trusted assemblies installed at the farm level.
- Service applications (2010): services exposed through SharePoint's SOA bus at the farm level.
SharePoint Designer
SharePoint Designer is a desktop application for editing SharePoint sites, pages, and workflows. It is deprecated; Designer 2013 was the final release and remains the primary editor for legacy SharePoint 2013 workflows, which retire in SharePoint Online on 2 April 2026 but continue to function on SharePoint Server.[32] Power Automate and Power Apps are the supported replacements for new development.
Security, administration and compliance
Cloud edition
Microsoft 365 provides legal compliance features through their Microsoft Purview product, Microsoft Intune Endpoint Management, and the SharePoint admin center, where retention policies and sharing policies can be administered by the SharePoint Administrator.[33]
Some legacy features such as in-place retention can be configured without the additional cost of Purview.[34]
SharePoint Server
SharePoint's architecture enables a 'least-privileges' execution permission model.[35]
SharePoint Central Administration (the CA) provides a complete centralized management interface for web and service applications in the SharePoint farm, including Active Directory account management for web and service applications. In the event of the failure of the CA, Windows PowerShell is typically used on the CA server to reconfigure the farm.
Security and patching issues
Microsoft SharePoint Server has a manual patching arrangement that is widely regarded as convoluted and complex.[36] Over the years, it has been subject to numerous critical security vulnerabilities, which are frequently exploited in the wild.[37] As a consequence, it's no longer considered best practice to host SharePoint Server with public facing internet access.
ToolShell (2025)
A zero-day exploit chain dubbed "ToolShell", combining CVE-2025-49704, CVE-2025-49706, CVE-2025-53770 and CVE-2025-53771, began targeting government agencies, universities, and businesses in the United States, China, and Europe using on-premises SharePoint servers on 18 July 2025.[38][39] The attackers chained the four CVEs to take control of SharePoint servers and extract ASP.NET machine keys, enabling persistent access including back doors for follow-on attacks.[40][41]
Microsoft issued initial updates for SharePoint Server Subscription Edition and SharePoint Server 2019 on 20 July 2025;[40][42] the first patch was found to be incomplete and Microsoft re-released fixes within the same week.[43] A CISA alert was issued on 20 July 2025.[44][45]
Microsoft attributed the exploitation to Chinese state-sponsored advanced persistent threat groups it tracks as Linen Typhoon, Violet Typhoon and Storm-2603, with reported targets including the National Nuclear Security Administration.[46][47]
SharePoint Server Architecture
Farms
A SharePoint farm is a logical grouping of SharePoint servers that share common resources.[48] A farm typically operates stand-alone, but can also subscribe to functions from another farm, or provide functions to another farm. Each farm has its own central configuration database, which is managed through either a PowerShell interface, or a Central Administration website (which relies partly on PowerShell's infrastructure). Each server in the farm is able to directly interface with the central configuration database. Servers use this to configure services (e.g. IIS, windows features, database connections) to match the requirements of the farm, and to report server health issues, resource allocation issues, etc.
Web applications
Web applications (WAs) are top-level containers for content in a SharePoint farm. A web application is associated primarily with IIS configuration. A web application consists of a set of access mappings or URLs defined in the SharePoint central management console, which are replicated by SharePoint across every IIS Instance (e.g. Web Application Servers) configured in the farm.
Service applications
Service applications provide granular pieces of SharePoint functionality to other web and service applications in the farm. Examples of service applications include the User Profile Sync service, and the Search Indexing service. A service application can be turned off, exist on one server, or be load-balanced across many servers in a farm. Service Applications are designed to have independent functionality and independent security scopes.[49]
Site collections
A site collection is a hierarchical group of 'SharePoint Sites'. Each web application must have at least one site collection. Site collections share common properties (detailed here), common subscriptions to service applications, and can be configured with unique host names.[50] A site collection may have a distinct content databases, or may share a content database with other site collections in the same web application.[49]
History
Origins
SharePoint evolved from projects codenamed "Office Server" and "Tahoe" during the Office XP development cycle.
"Office Server" evolved out of the FrontPage and Office Server Extensions and "Team Pages". It targeted simple, bottom-up collaboration.
"Tahoe", built on shared technology with Exchange and the "Digital Dashboard", targeted top-down portals, search and document management. The searching and indexing capabilities of SharePoint came from the "Tahoe" feature set. The search and indexing features were a combination of the index and crawling features from the Microsoft Site Server family of products and from the query language of Microsoft Index Server.[51]