+|User profiles, Search, Apps, BCS, Secure store, Records management, InfoPath, Configure hybrid (Hybrid Configuration Wizard). | [More features](https://admin.microsoft.com/sharepoint?page=classicFeatures&modern=true) | |

+> [!NOTE]

+> This integration isn't supported in Office 365 operated by 21Vianet.

+2. Ensure that Windows instances are joined to a Microsoft Active Directory domain, Windows 10 Pro, or Enterprise instances that are enrolled for device management.

+3. Enable the [ConfigureViewInFileExplorer](/deployedge/microsoft-edge-policies#configureviewinfileexplorer) policy for Microsoft Edge that allows URLs with the viewinfileexplorer: scheme to open WebDAV URLs in Windows File Explorer.

+Use the options below to enable View in File Explorer using group policy or Intune:

+ Title: "Private key management for SSL certificates"

+audience: ITPro

+f1.keywords:

+- NOCSH

+ms.localizationpriority: medium

+ms.assetid: 88317397-e0cb-47c7-9093-7872bc685213

+description: "Learn how SSL certificate implements private key management."

+# Private key management for SSL certificates

+To better support least privileges scenarios and minimize the permissions given to certificate private keys, SharePoint Server Subscription Edition Version 23H1 applies more granular and sophisticated permission management for these private keys. The permissions will be based on the certificate assignments and will be dynamically updated when the certificate assignments change.

+For example, if a certificate is assigned to perform client certificate authentication to an Simple Mail Transfer Protocol (SMTP) server, SharePoint will ensure the process thatΓÇÖs connecting to the SMTP server has the necessary permissions to use the private key of that certificate. If a certificate is no longer assigned to perform client certificate authentication to an SMTP server, SharePoint will remove permissions for that process so it no longer has access to the private key of that certificate.

+The following APIs has been added

+*Microsoft.SharePoint.Administration.CertificateManagement.SPServerCertificate* class to allow third-party integration with this functionality.

+- [Private key management for SSL certificates](private-key-management-for-ssl-certificates.md)

+This article contains the information and procedures required to configure Workflow Manager in SharePoint Server.

+> [!NOTE]

+>There are two separate workflow engine products that power the SharePoint 2013 Workflow platform: Microsoft Workflow Manager and SharePoint Workflow Manager. Microsoft Workflow Manager is no longer available to be installed, whereas SharePoint Workflow Manager has been released to replace it. Hence, the instructions outlined in this document explain how to install SharePoint Workflow Manager.

+> You can watch a video series that walks through the process of installing and configuring the SharePoint 2013 Workflow platform. To view the videos, see [Video series: Install and configure Workflow in SharePoint Server 2013](video-series-install-and-configure-workflow-in-sharepoint-server-2013.md).

+|**SharePoint 2013 Workflow** <br/> |Windows Workflow Foundation 4 <br/> |Requires SharePoint Workflow Manager or Microsoft Workflow Manager, and SharePoint Server. <br/> |

+|**SharePoint 2013 Workflow - Project Server** <br/> |Windows Workflow Foundation 4 <br/> |Requires SharePoint Workflow Manager or Microsoft Workflow Manager, and Project server. <br/> |

+## New installation of SharePoint Workflow Manager

+SharePoint Workflow Manager may be installed on the same servers as SharePoint or on separate, dedicated servers.

+### Prerequisites

+SharePoint Workflow Manager requires Azure Service Fabric, which must be installed before you run SharePoint Workflow Manager setup. If the Azure Service Fabric Runtime is not already installed, follow these steps below to install it:

+1. The minimum version of Azure Service Fabric Runtime supported by SharePoint Workflow Manager is 9.0.1048.9590, and you can download it from [Azure Service Fabric Runtime](https://download.microsoft.com/download/8/3/6/836E3E99-A300-4714-8278-96BC3E8B5528/9.0.1048.9590/Microsoft.Azure.ServiceFabric.WindowsServer.9.0.1048.9590.zip). Or you can find and download any higher version of its Windows Installer from [here](/azure/service-fabric/service-fabric-get-started#install-the-sdk-and-tools).

+2. Open a PowerShell console as an elevated administrator and run the following command:

+ `.\ MicrosoftServiceFabric.9.0.1048.9590.exe /accepteula`

+3. To verify the Azure Service Fabric is installed, you should be able to find it in the Programs and Features of the Control Panel.

+> [!NOTE]

+>SharePoint Workflow Manager supports the version 9.0 CU2 (9.0.1048.9590) of Azure Service Fabric and [higher versions](/azure/service-fabric/service-fabric-versions). You can install higher versions than that. If you want to directly upgrade your Azure Service Fabric without uninstallation, note that there are [upgrade dependencies](/azure/service-fabric/service-fabric-versions). If **Windows Fabric** is already installed on your machine, you must uninstall it before installing Azure Service Fabric.

+### Install SharePoint Workflow Manager

+SharePoint Workflow Manager and SharePoint Workflow Manager Client can be downloaded from [here](https://www.microsoft.com/download/details.aspx?id=104867).

+Install both SharePoint Workflow Manager and SharePoint Workflow Manager Client on all servers in the Workflow Manager farm.

+Install SharePoint Workflow Manager Client on all servers in the SharePoint Server farm.

+### Install and configure SharePoint Server

+Install and configure SharePoint Server. To do so, see [Install and deploy SharePoint Server Subscription Edition](../install/install.md).

+> The SharePoint 2010 Workflow platform installs automatically when you install SharePoint Server. The SharePoint 2013 Workflow platform requires either Microsoft Workflow Manager or SharePoint Workflow Manager and must be installed separately and then configured to work with your SharePoint Server farm. To function correctly SharePoint 2013 Workflows require that the App Management Service and Site Subscription Service are provisioned. It is not required to set up a wildcard certificate and DNS registration but both instances need to be running.

+### Configure SharePoint Workflow Manager to work with the SharePoint Server farm

+Consider the following two key factors before configuring SharePoint Workflow Manager to work with SharePoint Server.

+- Is SharePoint Workflow Manager installed on a server that is part of the SharePoint farm?

+- Will communication between SharePoint Workflow Manager and SharePoint Server use **HTTP** or **HTTPS** ?

+These factors translate into four scenarios. Each scenario configures a SharePoint Server farm to communicate and function with the SharePoint Workflow Manager farm. Follow the scenario that matches your circumstance.

+|Scenario Number and Description|Scenario Number and Description|

+|1: SharePoint Workflow Manager is installed on a server that is part of the SharePoint Server farm. Communication takes place by using HTTP. <br/> |2: SharePoint Workflow Manager is installed on a server that is part of the SharePoint Server farm. Communication takes place by using HTTPS. <br/> |

+|3: SharePoint Workflow Manager is installed on a server that is NOT part of the SharePoint Server farm. Communication takes place by using HTTP. <br/> |4: SharePoint Workflow Manager is installed on a server that is NOT part of the SharePoint Server farm. Communication takes place by using HTTPS. <br/> |

+**To configure SharePoint Workflow Manager on a server that is part of the SharePoint Server farm and on which communication takes place by using HTTP**

+1. Sign-in to the computer in the SharePoint Server farm where SharePoint Workflow Manager was installed.

+4. Sign-in to each server in the SharePoint Server farm.

+ > When you install Workflow Manager on a server it automatically installs the Workflow Manager Client on that server. You will still need to install the Workflow Manager Client on any additional servers. For example, if you have a farm that contains five servers and you install SharePoint Workflow Manager on one of those servers you will still need to install the Workflow Manager Client on the four additional servers.

+5. Install the SharePoint Workflow Manager Client on each server in the SharePoint farm.

+

+**To configure SharePoint Workflow Manager on a server that is part of the SharePoint Server farm and on which communication takes place by using HTTPS**

+1. Determine if you need to install SharePoint Workflow Manager certificates in SharePoint.

+ Under some circumstances, you have to obtain and install SharePoint Workflow Manager certificates. If your installation requires that you obtain and install these certificates, you must complete that step before continuing. To learn whether you need to install certificates, and for instructions, see [Install Workflow Manager certificates in SharePoint Server](install-workflow-manager-certificates-in-sharepoint-server.md).

+2. Sign-in to the computer in the SharePoint Server farm where SharePoint Workflow Manager was installed.

+5. Sign-in to each server in the SharePoint Server farm.

+ > When you install SharePoint Workflow Manager on a server it automatically installs the Workflow Manager Client on that server. You will still have to install the SharePoint Workflow Manager Client on any additional servers. For example, if you have a farm that contains five servers and you install Workflow Manager on one of those servers you will still need to install the Workflow Manager Client on the four additional servers.

+6. Install the SharePoint Workflow Manager Client on each server in the SharePoint farm.

+**To configure SharePoint Workflow Manager on a server that is NOT part of the SharePoint Server farm and on which communication takes place by using HTTP**

+1. Sign-in to each server in the SharePoint Server farm.

+2. Install the SharePoint Workflow Manager Client on each server in the SharePoint farm.

+ Before you can run the workflow pairing cmdlet, you must install SharePoint Workflow Manager Client on each of the servers in the SharePoint farm.

+3. Open the SharePoint Management Shell as an administrator by right-clicking the **SharePoint Management Shell** command and choosing **Run as administrator**.

+> You must install the SharePoint Workflow Manager Client on each server in the SharePoint farm before you run the pairing cmdlet.

+**To configure SharePoint Workflow Manager on a server that is NOT part of the SharePoint Server farm and on which communication takes place by using HTTPS**

+1. Determine whether you need to install SharePoint Workflow Manager certificates in SharePoint Server.

+ Under some circumstances, you have to obtain and install SharePoint Workflow Manager certificates. If your installation requires that you obtain and install these certificates, you must complete that step before continuing. To learn whether you need to install certificates, and for instructions, see [Install Workflow Manager certificates in SharePoint Server](install-workflow-manager-certificates-in-sharepoint-server.md).

+2. Sign-in to each server in the SharePoint Server farm.

+3. Install the SharePoint Workflow Manager Client on each server in the SharePoint farm.

+ Before you can run the workflow pairing cmdlet, you must install SharePoint Workflow Manager Client on each of the servers in the SharePoint farm.

+> You must install the SharePoint Workflow Manager Client on each server in the SharePoint farm before you run the pairing cmdlet.

+## Upgrade existing Microsoft Workflow Manager

+In order to update Microsoft Workflow Manager to SharePoint Workflow Manager, SharePoint Workflow Manager cannot be placed on top of Microsoft Workflow Manager. Installing this build requires first uninstalling any prior versions of Workflow Manager (Client) and Service Bus.

+You can upgrade to SharePoint Workflow Manager from any version of Microsoft Workflow Manager.

+Follow the steps below to uninstall Microsoft Workflow Manager and install SharePoint Workflow

+1. Open Workflow Manager Configuration Wizard.

+2. Select **Leave Workflow Manager Farm**.

+3. Confirm the subsequent steps until the end.

+ > [!NOTE]

+ >Each database used by Workflow Manager and Service Bus will need to be specified when rejoining the farm with SharePoint Workflow Manager. For example, the SQL Server instance and database name for the Workflow Manager farm management database and the Service Bus farm management database.

+4. Uninstall Microsoft Workflow Manager, Workflow Manager Client, Service Bus for Windows Server, and Windows Fabric if they're installed. You can uninstall them from the Control Panel. If Windows Fabric is installed, ensure you install Azure Service Fabric after uninstalling Windows Fabric.

+5. If the folder *%ProgramFiles%\Workflow Manager\1.0* already exists, you must manually remove it for the next steps to succeed.

+6. Install SharePoint Workflow Manager and SharePoint Workflow Manager Client.

+7. If there is more than one server in your Workflow Manager farm, repeat the previous steps on all farm servers.

+8. Run the Workflow Manager Configuration Wizard and rejoin the previous farm with the databases you noted in the previous steps on all servers in your Workflow Manager farm.

+ > [!NOTE]

+ >There is no need to delete the existing Workflow Service Application Proxy, and there is no need to re-register SPWorkflowService.

+9. Rerun the Workflow Manager Configuration Wizard, select **Upgrade Workflow Manager Farm**, and confirm subsequent steps until the end.

+ > [!NOTE]

+ >You only need to run this step once on any server in the Workflow Manager farm.

+10. Install SharePoint Workflow Management Client on each server in the SharePoint Server farm after uninstalling any previous versions.

+Follow these steps to validate that you have successfully installed and configured the required components.

+**Figure: Use IIS Manager to view the ports used by SharePoint Workflow Manager**

+Sharepoint Workflow Manager communicates by using TCP/IP or Named Pipes. Ensure that the appropriate communication protocol is enabled on the SQL Server instance that hosts the SharePoint Workflow Manager databases.

+Yes, you can leverage the Hybrid Configuration Wizard on the <a href="https://go.microsoft.com/fwlink/?linkid=2185077" target="_blank">**More features** page of the SharePoint admin center</a> for hybrid configurations. This wizard automates certain configuration steps required to connect on-premises SharePoint Server environment with SharePoint in Microsoft 365. [Read more about the Hybrid Configuration Wizard](hybrid-configuration-wizard-in-the-sharepoint-online-admin-center.md#hybrid-configuration-wizard-in-the-sharepoint-admin-center)

+***Can I leverage the SharePoint Hybrid Configuration Wizard to perform a clean-up of my hybrid environment or deactivate hybrid features that were activated by the wizard?***

+The Hybrid Configuration Wizard automates certain configuration steps to configure hybrid between on-premises SharePoint Server with SharePoint in Microsoft 365. This is not designed to undo the changes once the wizard completes. The Hybrid Configuration Wizard creates a Server-to-Server (S2S)/OAuth trust between the SharePoint in Microsoft 365 and SharePoint on-premises farm. After this is configured, re-running the wizard does not clean up the trust. You can refer to the documentation at [Hybrid Configuration Wizard in the SharePoint admin center](hybrid-configuration-wizard-in-the-sharepoint-online-admin-center.md#hybrid-configuration-wizard-in-the-sharepoint-admin-center).

+> If the Hybrid Configuration Wizard is run a second time with an enabled feature unchecked, this will not cause the feature to be uninstalled. Any additional selections will be installed and previously installed features will remain.

+If you plan to configure Cloud hybrid search with HA topologies in SharePoint Server, you can configure it with the Hybrid Configuration Wizard. The Hybrid Configuration Wizard has automated certain configuration steps needed to connect your on-premises SharePoint Server environment with SharePoint in Microsoft 365 for Cloud hybrid search. [Learn more](./configure-cloud-hybrid-searchroadmap.md).

+Hybrid features/Cloud search service application can be implemented on the same SharePoint farm as mentioned above. When you try to establish a S2S trust via the Cloud SSA onboarding script or Hybrid Configuration Wizard, the authentication realm of the on-premises Farm is updated to match the Microsoft 365 organization context id. Within the script, we set it using [Set-SPAuthenticationRealm](/powershell/module/sharepoint-server/set-spauthenticationrealm). Once the authentication realm is changed, existing SharePoint Add-ins fail to authenticate; users will get an HTTP 401 when they are redirected to the add-ins. You can read more about the problem as well and fix in the article [Provider-hosted add-ins stop working and HTTP 401 error after you configure SharePoint farm hybrid features](/sharepoint/support/administration/provider-hosted-add-ins-stop-working-and-http-401-error-after-configure-farm-hybrid-features).

+> If you configure hybrid using the Hybrid Configuration Wizard from the <a href="https://go.microsoft.com/fwlink/?linkid=2185077" target="_blank">**More features** page of the SharePoint admin center</a>, then the wizard takes care of the fix.

+- If you'll use the [Hybrid Configuration Wizard in the SharePoint admin center](hybrid-configuration-wizard-in-the-sharepoint-online-admin-center.md#hybrid-configuration-wizard-in-the-sharepoint-admin-center) to help you configure, ensure that the application farm that hosts the SharePoint Server Central Administration website has [.NET 4.6.2 or higher](https://dotnet.microsoft.com/download/dotnet-framework/net462) installed.

+|**2. [Create a cloud Search service application in SharePoint Server](configure-cloud-hybrid-searchroadmap.md#BKMK_CreateCloudSSA)** <br/> |Run the Hybrid Configuration Wizard on the application farm that hosts the SharePoint Server Central Administration website. <br/> Alternatively, run the **CreateCloudSSA.ps1** PowerShell script. <br/> |

+|**3. [Connect your cloud Search service application to your Microsoft 365 organization](configure-cloud-hybrid-searchroadmap.md#BKMK_ConnectCloudSSAToO365)** <br/> |If you used the Hybrid Configuration Wizard to create a cloud Search service application, skip this step. The Hybrid Configuration Wizard automatically connected your environments. <br/> Otherwise, run the **Onboard-CloudHybridSearch.ps1** PowerShell script to onboard your cloud SSA and Microsoft 365 organization to cloud hybrid search. The script sets up the cloud SSA to interact with the Microsoft 365 organization and also sets up server-to-server authentication. <br/> |

+Use the Hybrid Configuration Wizard to connect your SharePoint Server and Microsoft 365 environments and create the cloud Search service application.

+3. Navigate to [https://go.microsoft.com/fwlink/?linkid=867176](https://go.microsoft.com/fwlink/?linkid=867176) to download, install, and start the Hybrid Configuration Wizard.

+4. Follow the prompts in the Hybrid Configuration Wizard and select the hybrid search feature.

+The Hybrid Configuration Wizard lets you choose between a cloud SSA with the default search architecture on the application server that hosts the SharePoint Server Central Administration website, or a cloud SSA with a search architecture on **two** application servers (supports [high availability](../search/plan-enterprise-search-architecture.md#BKMK_HiAvail)).

+The Hybrid Configuration Wizard saves you time because it also connects the cloud SSA to your Microsoft 365 organization (step 3).

+On the application server that hosts the SharePoint Server Central Administration website, follow these steps:

+> If you used the Hybrid Configuration Wizard to create a cloud Search service application, then you can skip this step.

+On the application server that hosts the SharePoint Server Central Administration website, follow these steps:

+4. On the SharePoint in Microsoft 365 Hybrid Configuration Wizard page, select **click here**.

+6. On the **SharePoint Hybrid Configuration Wizard** page, select **Next**.

+Hybrid SharePoint taxonomy allows you to have a shared taxonomy between SharePoint Server and SharePoint in Microsoft 365. Hybrid content types allow you to have a shared set of content types between SharePoint Server and SharePoint in Microsoft 365.

+- Hybrid content types require the June 2017 public update or later.

+If you have an existing taxonomy in SharePoint Server, the best practice is to copy any term groups you want to be part of the shared taxonomy to SharePoint in Microsoft 365 before you configure hybrid SharePoint taxonomy. You can migrate more taxonomy groups from SharePoint Server to SharePoint in Microsoft 365 to add to the shared taxonomy later, but if you do, you may need to run the Hybrid Configuration Wizard again to include them in the shared taxonomy.

+The migration process copies taxonomy groups from SharePoint Server to SharePoint in Microsoft 365 by using the [Copy-SPTaxonomyGroups](/powershell/module/sharepoint-server/Copy-SPTaxonomyGroups?view=sharepoint-ps&preserve-view=true) PowerShell cmdlet.

+While the copy process preserves most user information associated with term sets - such as owner and stakeholders - note, that the copy process doesn't work with Active Directory groups. If you use Active Directory groups in your term sets, there are two options for copying your taxonomy groups:

+- You can replace the Active Directory groups with individual users within your taxonomy groups. The individual users are copied when you copy your taxonomy groups.

+- You can copy your taxonomy groups with the Active Directory groups in place. You'll see a PowerShell warning and the Active Directory group assignments are lost if you proceed. You can then assign a Microsoft 365 group in place of the Active Directory group after you've copied the taxonomy groups.

+You can also run Copy-SPTaxonomyGroups and you'll be prompted for the needed parameters.

+The content types are copied into https://contoso.sharepoint.com/sites/contentTypeHub. If this site doesn't exist, it's created for you, and the Site Collection Feature Content Type Syndication Hub is enabled. The site URL is hard coded and can't be changed.

+Configuration of hybrid SharePoint taxonomy is done using the Hybrid Configuration Wizard in the SharePoint admin center. The Hybrid Configuration Wizard has many prerequisites. Be sure to read [Hybrid Configuration Wizard in the SharePoint admin center](hybrid-configuration-wizard-in-the-sharepoint-online-admin-center.md#hybrid-configuration-wizard-in-the-sharepoint-admin-center) before you follow the procedures in this section.

+ **Configure hybrid SharePoint taxonomy using the Hybrid Configuration Wizard**

+The next step is to configure hybrid SharePoint taxonomy by running the Hybrid Configuration Wizard in the SharePoint admin center.

+1. Sign in a server in your SharePoint Server farm as the farm administrator.

+The [Stop-SPTaxonomyReplication](/powershell/module/sharepoint-server/Stop-SPTaxonomyReplication?view=sharepoint-ps&preserve-view=true) cmdlet stops taxonomy replication. For example:

+The [Stop-SPContentTypeReplication](/powershell/module/sharepoint-server/?view=sharepoint-ps&preserve-view=true) cmdlet stops content type replication:

+If you wish to reenable taxonomy replication again, you must run the Hybrid Configuration Wizard again.

+If you simply want to reconfigure which taxonomy groups you're replicating, there's no need to stop replication. You can just run the Hybrid Configuration Wizard again and specify the new taxonomy groups that you want to replicate.

+|3. [Run Hybrid Configuration Wizard](run-hybrid-picker.md) <br/> |Configure hybrid sites features by running the Hybrid Configuration Wizard in Microsoft 365. <br/> |

+> We recommend using the [SharePoint Hybrid Configuration Wizard](hybrid-configuration-wizard-in-the-sharepoint-online-admin-center.md#hybrid-configuration-wizard-in-the-sharepoint-admin-center) to establish the Server-to-Server authentication between SharePoint Server and SharePoint in Microsoft 365. If you are unable to use the Hybrid Configuration Wizard for any reason, follow the steps in this article to enable server-to-server authentication.

+|[Hybrid Configuration Wizard in the SharePoint admin center](hybrid-configuration-wizard-in-the-sharepoint-online-admin-center.md#hybrid-configuration-wizard-in-the-sharepoint-admin-center) <br/> |Learn about the Hybrid Configuration Wizard and which hybrid scenarios it enables. <br/> |

+The default STS certificate in the SharePoint farm is used by the Hybrid Configuration Wizard to establish the token signing trust when configuring hybrid workloads. Using the inbuilt STS certificate is the recommended approach when configuring hybrid workloads. If however, you intend to use a publicly signed certificate instead of the inbuilt STS one then you must replace the inbuilt certificate with your own following the provided guidance.

+ Title: Hybrid Configuration Wizard in the SharePoint admin center

+audience: ITPro

+f1.keywords:

+- CSH

+ms.localizationpriority: medium

+- Ent_O365_Hybrid

+- IT_Sharepoint_Server

+- IT_SharePoint_Hybrid_Top

+- Strat_SP_gtc

+- M365-collaboration

+- SPO_Content

+ms.assetid: dcac4cbf-7840-470a-9712-3b968c4f06d0

+description: Learn how to use the Hybrid Configuration Wizard in the SharePoint admin center.

+# Hybrid Configuration Wizard in the SharePoint admin center

+## What is the Hybrid Configuration Wizard?

+Hybrid Configuration Wizard is a wizard that can be downloaded to your SharePoint Server from Microsoft 365. The wizard helps automate certain configuration steps needed to connect your on-premises SharePoint Server environment with SharePoint in Microsoft 365. The Hybrid Configuration Wizard is your assistant, designed to do some of the work for you.

+Use the Hybrid Configuration Wizard to redirect OneDrive to Microsoft 365, leverage hybrid site features or app launcher, and add some extra integration between on-premises SharePoint Server and an extranet site made in Microsoft 365. Hybrid Configuration Wizard also creates a Server-to-Server (S2S)/OAuth connection for your [SharePoint Hybrid features](sharepoint-hybrid-sites-and-search.md).

+## Using the Hybrid Configuration Wizard

+First, you need to ensure you meet the prerequisites in your SharePoint Server on-premises farm, then you can run the Hybrid Configuration Wizard.

+ **Prerequisites to run the Hybrid Configuration Wizard**

+The Hybrid Configuration Wizard requires the [.NET Framework 4.6.2](https://dotnet.microsoft.com/download/dotnet-framework/net462) in order to run.

+To run the Hybrid Configuration Wizard, you must be:

+- A member of the Farm Administrators group.

+- A service application administrator (Full Control) for the User Profile Service.

+- A Microsoft 365 Global Admin, either with or without multi-factor authentication (MFA) enabled for the account.

+- Signed in to Microsoft 365 and SharePoint Server from a server in your SharePoint Server farm.

+- Able to launch the Hybrid Configuration Wizard as a Farm Admin with elevated permissions.

+> [!IMPORTANT]

+> The Hybrid Configuration Wizard must be launched from an on-premises server with SharePoint Server 2013, SharePoint Server 2016, SharePoint Server 2019, or SharePoint Server Subscription Edition installed. Launch it in the environment you want to use for your SharePoint hybrid.

+## SharePoint Hybrid features offered in the Hybrid Configuration Wizard

+Use the Hybrid Configuration Wizard to configure, or assist with the configuration of, hybrids that connect Microsoft 365 and your on-premises SharePoint environment.

+The Hybrid Configuration Wizard helps with or completes the setup of these hybrid features:

+- **[Hybrid OneDrive](plan-hybrid-onedrive-for-business.md)** - Choosing this option will redirect on-premises My Sites/OneDrive sites to SharePoint in Microsoft 365 and OneDrive. After the wizard completes, any click of the OneDrive link from on-premises redirects to OneDrive in the cloud. Once your redirection is complete, the users can begin to migrate any files to their online OneDrive. This option also sets up hybrid user profiles. When users click to view a profile, they'll be redirected to the profile in Microsoft 365.

+- **[Hybrid Sites Features](sharepoint-hybrid-sites-and-search.md)** - Choosing this option sets up hybrid sites features, a suite of site integration features, and OneDrive redirection. Selecting this option configures hybrid OneDrive and hybrid user profiles, hybrid site following, and the hybrid app launcher.

+- **[Hybrid App Launcher](the-extensible-hybrid-app-launcher.md)** - This hybrid feature further integrates Microsoft 365 with your on-premises SharePoint Server farm by placing tiles like Office 365 Delve and Video (and custom Microsoft 365 tiles you may have) on the on-premises SharePoint Server App Launcher. This option also sets up hybrid OneDrive with user profile redirection, and sites features.

+- **[Business-to-business (B2B) extranet sites](../../SharePointOnline/create-b2b-extranet.md)** - Choosing this option installs extra features you can integrate with an extranet site you create in Microsoft 365. With Microsoft 365 extranet, partners can connect directly to a members-only site in Microsoft 365 without access to the corporate on-premises environment or any other Microsoft 365 site. Choosing this option sets up OneDrive and user profile redirection, sites features, and hybrid app launcher.

+- **[Hybrid Taxonomy](plan-hybrid-sharepoint-taxonomy-and-hybrid-content-types.md)** - This feature allows a centralized taxonomy that's readable and writable in the Microsoft 365 Cloud, to be used as a read-only copy within the premises. This feature includes Hybrid Content type (June 2017 PU required) which replicates the published content types in Microsoft 365 to on-premises. Choosing this option sets up OneDrive and user profile redirection, sites features, and hybrid app launcher.

+- **[Hybrid self-service site creation](hybrid-self-service-site-creation.md)** - This feature redirects the default self-service site creation page in SharePoint Server 2013, SharePoint Server 2016, or SharePoint Server 2019 (/_layouts/15/scsignup.aspx) to the SharePoint in Microsoft 365 Group Creation page. This setting can be configured independently for each web application in your farm. It helps your users create their sites in SharePoint in Microsoft 365 instead of SharePoint Server.

+- **[Cloud hybrid search](./learn-about-cloud-hybrid-search-for-sharepoint.md)** - Choosing this option creates a cloud Search service application in SharePoint Server and connects it to your Microsoft 365 organization. Implementing this option means you've performed one of the steps needed to set up cloud hybrid search; you must do the rest of the steps yourself (see the [roadmap](configure-cloud-hybrid-searchroadmap.md)). This option doesn't include setting up of other hybrid features.

+> [!TIP]

+> If the Hybrid Configuration Wizard is run a second time with an enabled feature unchecked, this setting won't cause the feature to be uninstalled. Any additional selections will be installed and previously installed features will remain.

+For all options, the Hybrid Configuration Wizard configures a server-to-server trust between your SharePoint Server farm and Microsoft 365.

+The Hybrid Configuration Wizard doesn't uninstall features. If you run the Hybrid Configuration Wizard and deselect a feature that you previously installed, it remains installed.

+To get started configuring hybrid features for your environment, choose from:

+- [Configure hybrid OneDrive - roadmap](configure-hybrid-onedrive-for-businessroadmap.md)

+- [Configure hybrid sites features - roadmap](configure-hybrid-sites-featuresroadmap.md)

+- [Configure cloud hybrid search - roadmap](configure-cloud-hybrid-searchroadmap.md)

+- [Configure hybrid SharePoint taxonomy and hybrid content types](configure-hybrid-sharepoint-taxonomy-and-hybrid-content-types.md)

+## Hybrid Configuration Wizard Prerequisite Checking

+While running the Hybrid Configuration Wizard, the basic SharePoint farm settings are checked which would otherwise block the setup of essential hybrid building-blocks (such as OAuth/S2S Trust). The importance of settings' check is why you should launch the Hybrid Configuration Wizard from a server that will be part of your SharePoint hybrid. Some of the settings that are detected and checked while the configuration is run, include whether the:

+- SharePoint Server farm exists

+- Account is a farm administrator

+- SharePoint farm is a version that can function in a hybrid configuration

+- AppMangementServiceInstance is online

+- AppMangementServiceApplication is online

+- AppMangementServiceApplicationProxy is online

+- UserProfileApplicationProxy is online

+- The SPO365LinkSettings cmdlet (used to set MySiteHostURL) is accessible on the server

+The results of this testing can be viewed as a report if any prerequisite isn't met. If all prerequisites are met, you'll see green check-marks beside all the prerequisites and can continue your hybrid configuration.

+## Authentication realm update

+As part of hybrid configuration, the Hybrid Configuration Wizard updates the on-premises farm's authentication realm to match the Microsoft 365 organization context ID. After the authentication realm is changed, existing SharePoint in Microsoft 365 add-ins fail to authenticate. The Hybrid Configuration Wizard attempts to fix this issue automatically. If the Hybrid Configuration Wizard isn't able to fix this issue or if you choose to fix it manually, follow the steps in [Fix the HTTP 401 error with provider-hosted add-ins and issues with workflow and cross farm trust scenarios in SharePoint in Microsoft 365](https://support.microsoft.com/help/4010011).

+## See also

+#### Other Resources

+[You receive the error "Value cannot be null. Parameter name: My site URL or team site URL from Discovery Service is null or empty" when you use the SharePoint Hybrid Configuration Wizard](https://support.microsoft.com/kb/3204761)

+## Configure hybrid self-service site creation using the Hybrid Configuration Wizard

+Configuring hybrid self-service site creation is done by using the Hybrid Configuration Wizard in the SharePoint admin center.

+> If you've previously configured other hybrid features with the Hybrid Configuration Wizard, you can go directly to the SharePoint Central Administration website to manage hybrid self-service site creation. In this case, the hybrid connection has been made and there's no need to run the Hybrid Configuration Wizard again.

+When the Hybrid Configuration Wizard completes, hybrid self-service site creation will be enabled for the web application that you selected.

+description: "SharePoint hybrid taxonomy enables you to have a single taxonomy that spans SharePoint Server and SharePoint in Microsoft 365. This single taxonomy gives you a single, consistent taxonomy no matter where your sites are located."

+SharePoint hybrid taxonomy enables you to have a single taxonomy that spans SharePoint Server and SharePoint in Microsoft 365. This single taxonomy gives you a single, consistent taxonomy no matter where your sites are located.

+- Hybrid content types require the June 2017 public update or later.

+Configuration of both features uses the Hybrid Configuration Wizard in the <a href="https://go.microsoft.com/fwlink/?linkid=2185219" target="_blank">SharePoint admin center</a>, which also has many prerequisites. Be sure to read [Hybrid picker in the SharePoint admin center](hybrid-configuration-wizard-in-the-sharepoint-online-admin-center.md#hybrid-configuration-wizard-in-the-sharepoint-admin-center) as you plan your hybrid SharePoint taxonomy rollout.

+As with all hybrid scenarios, hybrid SharePoint taxonomy and hybrid content types both rely on your [user accounts being synchronized between SharePoint Server and SharePoint in Microsoft 365](/office365/enterprise/office-365-integration), though users whose accounts aren't synchronized can still use the replicated and local term sets on-premises.

+You choose the groups that you want to share across SharePoint Server and SharePoint in Microsoft 365. System and special groups (the System, Search, SearchDirectories, and People groups) can't be replicated, but any other groups that you create can be. (Be sure you're not reusing terms between groups that you replicate and groups that you don't replicate.)

+If you already have a taxonomy in SharePoint Server, you can copy it to SharePoint in Microsoft 365 by using PowerShell. This taxonomy - once copied into SharePoint in Microsoft 365 - allows you to create your master taxonomy from your existing SharePoint Server and SharePoint in Microsoft 365 taxonomies, while maintaining the IDs of the terms, term sets, and term groups in those taxonomies.

+We recommend that you copy your taxonomy to SharePoint in Microsoft 365 before you set up hybrid SharePoint taxonomy. You can do so at a later time, but you'll have to rerun the Hybrid Configuration Wizard in order to turn on replication for those groups.

+You can continue to work with local term sets in both locations. They remain local and aren't affected by hybrid SharePoint taxonomy. These local site-specific terms can't be replicated.

+If you already have content types in SharePoint Server, you can copy them to SharePoint in Microsoft 365 by using PowerShell. These content types - once copied into SharePoint in Microsoft 365 - allows you to create your master content types list from your existing SharePoint Server and SharePoint in Microsoft 365 content types. You control which content types are shared across SharePoint in Microsoft 365 and SharePoint Server.

+To get started configuring hybrid SharePoint taxonomy and hybrid content types, be sure you've reviewed the [prerequisites for the Hybrid Configuration Wizard](hybrid-configuration-wizard-in-the-sharepoint-online-admin-center.md#hybrid-configuration-wizard-in-the-sharepoint-admin-center), and then read [Configure hybrid SharePoint taxonomy and hybrid content types](configure-hybrid-sharepoint-taxonomy-and-hybrid-content-types.md).

+The final step to removing hybrid is to delete the **Azure Access Control Service Application Proxy** and **SharePoint Application Principal Management Service Application Proxy** created by the Hybrid Configuration Wizard.

+ Title: "Run Hybrid Configuration Wizard"

+description: "Learn to run Hybrid Configuration Wizard in Microsoft 365 for enterprises."

+# Run Hybrid Configuration Wizard

+Hybrid Configuration Wizard is located in Microsoft 365 for enterprises, and you can use it to help you configure certain hybrid scenarios between Microsoft 365 and SharePoint Server.

+> If you're using a pop-up blocker with your browser, be sure to turn it off before running the Hybrid Configuration Wizard.

+ **To run Hybrid Configuration Wizard**

+4. To configure your hybrid features, follow the prompts in Hybrid Configuration Wizard.

+ > [!NOTE]

+ > SharePoint Server Subscription Edition will require the Visual C++ 2015-2022 Redistributable (x64) as a software prerequisite starting with SharePoint Server Subscription Edition Version 23H1. This new software prerequisite replaces the Visual C++ Redistributable Package for Visual Studio 2015-2019. This new software prerequisite will not be installed by the prerequisiteinstaller.exe tool, but will be installed by the SharePoint Server Subscription Edition Version 23H1 feature update if it isn't already installed. To download and install it separately, see [Visual C++ 2015-2022 Redistributable (x64)](https://go.microsoft.com/fwlink/?LinkId=2224881).

+- SharePoint Server 2019 build 16.0.10396.20000 or higher (KB 5002358: March 14, 2023 security update for SharePoint Server 2019)

+| Hybrid Auditing ODL Error Log Upload Job | Upload event IDs and timestamps from ODL error logs to Microsoft to monitor the health and stability of the SharePoint Hybrid Auditing Feature. This job only uploads data if you have turned on the SharePoint Hybrid Auditing feature in the Hybrid Configuration Wizard ΓÇô if Hybrid Auditing is not configured this timer job will do nothing. | Disabled |

+ Title: "Deploy software updates for SharePoint Server 2016, 2019, and Subscription Edition"

+# Deploy software updates for SharePoint Server 2016, 2019, and Subscription Edition

+Microsoft periodically releases software updates for SharePoint Server 2016, 2019 and Subscription Edition. The following articles provide information about the software update process for SharePoint Server 2016, 2019 and Subscription Edition.

+> [!IMPORTANT]

+> Microsoft is changing how software updates for SharePoint Server Subscription Edition are packaged beginning with the March 2023 public update, which introduces SharePoint Server Subscription Edition Version 23H1. In this software update, Microsoft will no longer release separate core and language pack software updates each month. Instead, Microsoft will release a single software update each month that will contain all of the changes that previously would have been included in those two separate updates. Going forward, customers will only need to install this single software update each month to be fully up to date with the latest security fixes, bug fixes, and new feature experiences.

+> [!NOTE]

+> Microsoft will continue to release separate core and language pack software updates for SharePoint Server 2016 and SharePoint Server 2019. Customers will need to continue installing the latest version of the core and language pack software updates each month to ensure theyΓÇÖre fully up to date with the latest security fixes, bug fixes, and new feature experiences.

+## Articles about software updates for SharePoint Server 2016, 2019, and Subscription Edition

+|[Software updates overview for SharePoint Server 2016, 2019 and Subscription Edition](software-updates-overview.md) <br/> |Provides an overview of the software update process for SharePoint Server 2016, 2019, and Subscription Edition. <br/> |

+|[Install a software update for SharePoint Server 2016, 2019 and Subscription Edition](install-a-software-update.md) <br/> |Learn how to install a software update on servers in a SharePoint farm. <br/> |

+|[SharePoint Server zero downtime patching steps](sharepoint-server-2016-zero-downtime-patching-steps.md) <br/> |Learn the steps to patch a software update on servers in a SharePoint farm. <br/> |

+|[Video: How to enable Remote Windows PowerShell to use with SharePoint Server](video-how-to-enable-remote-windows-powershell-to-use-with-sharepoint-server.md) <br/> |Learn how to enable remote PowerShell to use with servers in a SharePoint farm. <br/> |

+- [Account permissions and security settings in SharePoint Servers](../install/account-permissions-and-security-settings-in-sharepoint-server-2016.md)

+- [Software updates overview for SharePoint Server 2016, 2019, and Subscription Edition](./software-updates-overview.md)

+- [Prepare to deploy software updates for SharePoint Server 2016, 2019, and Subscription Edition](./deploy-updates-for-sharepoint-server-2016.md)

+>While the steps in this article refer to SharePoint Server 2016, they are applicable to SharePoint Foundation 2013, SharePoint Server 2013, SharePoint Server 2019, and SharePoint Server Subscription Edition unless otherwise noted.

+Don't start the update if any of the preceding conditions aren't satisfied. Resolve all issues before you continue.

+SharePoint Server 2016, 2019, and Subscription Edition can handle certain upgrade failures after the patching phase finishes. However, if the build-to-build upgrade fails, you might have to restore from a backup. Therefore, make sure that you perform a full backup before you start the update process. After the restore is complete, you can resume the update. Completed tasks don't run again. For more information, see the following resources:

+Before you start to deploy a software update, verify that the update strategy that you plan to use is optimal for your SharePoint Server 2016, 2019, or Subscription Edition environment. There are several factors, such as downtime reduction, cost, and complexity that determine the strategy to use to deploy a software update.

+For more information about how the database-attach process works, see the diagrams in [Overview of the upgrade process from SharePoint 2013 to SharePoint Server 2016](./overview-of-the-upgrade-process.md), [Overview of the upgrade process to SharePoint Server 2019](overview-of-the-upgrade-process-2019.md), and [Overview of the upgrade process to SharePoint Server Subscription Edition](overview-of-the-upgrade-process-subscription-edition.md).

+Monitor the process that deploys updates to verify that the update is proceeding as planned. There might be issues that block the update or that result in an updated farm that has elements that don't work as expected. Pay extra attention to database synchronization and customizations.

+When you're ready to continue, perform only one of the following procedures in this article to install the update:

+In this scenario you disable incoming requests to the front-end web servers, thus effectively shutting down the entire farm. Then you install the update on all the farm servers. This strategy combines the update and the build-to-build upgrade phase that is described in the [Software updates overview for SharePoint Server 2016](/sharepoint/upgrade-and-update/software-updates-overview#software-update-process) section of [Overview of the upgrade process from SharePoint 2013 to SharePoint Server 2016](./overview-of-the-upgrade-process.md).

+1. Notify users that the farm won't be available while you're installing the update.

+4. Run the update executable file to install the update on all other application servers that host Search components (APP-2). To do this, perform the procedure [Host Search components](#HostSearch) which appears later in this article, and then return to the next step in this procedure. Don't run the SharePoint Products Configuration Wizard on these servers at this time.

+10. Run the SharePoint Products Configuration Wizard on the Central Administration server (APP-1). This upgrades the configuration database and upgrade each content database.

+ For information about how to run the wizard, see [Install SharePoint Server across multiple servers](/SharePoint/install/install-sharepoint-server-2016-across-multiple-servers) for SharePoint Server 2016, 2019, or Subscription Edition. See [Install SharePoint 2013 across multiple servers for a three-tier farm](../install/multiple-servers-for-a-three-tier-farm.md) for SharePoint 2013.

+ > [!NOTE]

+ > Run the configuration wizard to ensure that if an update fails for a specific server, the error is not propagated to the other web servers. For example, a failed update for one server could make the update fail for one or more site collections.

+16. Notify users that the farm is available. You're finished installing the update and using this article.

+This scenario takes advantage of the backward compatibility of SharePoint and the deferred upgrade feature to reduce the farm downtime that is required to deploy a software update. However, downtime isn't eliminated. The sites and services won't be available while the database content is being upgraded.

+For more information, see the following:

+- [Software updates overview for SharePoint Server 2016, 2019, and Subscription Edition](./software-updates-overview.md)

+- [Overview of the upgrade process from SharePoint 2013 to SharePoint Server 2016](./verify-upgrade-for-databases.md)

+- [Verify database upgrades in SharePoint Server 2019](./verify-upgrade-for-databases-2019.md)

+- [Verify database upgrades in SharePoint Server Subscription Edition](./verify-upgrade-for-databases-subscription-edition.md)

+2. On each web server that is out of the load-balancing rotation (WEB-1 and WEB-2), run the executable file to install the update. Don't run the SharePoint Products Configuration Wizard on these servers. Verify that these web servers were updated successfully by reviewing the upgrade log files.

+5. On each web server that is out of the load-balancing rotation, run the executable file to install the update. Don't run the SharePoint Products Configuration Wizard on these servers at this time. Verify that both of the web servers were updated successfully by reviewing the upgrade log files.

+7. Install the update on all application servers that host Search components (APP-1 and APP-2). To do this, perform the procedure [Install a software update for SharePoint Server 2016](#install-a-software-update-on-servers-that-host-search-components) which appears later in this article, and then return to the next step in this procedure. Don't run the SharePoint Products Configuration Wizard at this time.

+8. If your farm has additional application servers that don't host Search components, run the update executable file to install the update on these servers. Don't run the SharePoint Products Configuration Wizard on these servers at this time.

+At this point in the process, the databases and other components such as settings, features, and site-level data must still be upgraded because the SharePoint Products Configuration Wizard wasn't run on any of the farm servers. However, the farm should be capable of running in backward compatibility mode.

+The following illustration shows the steps that upgrade the farm servers to finish the patching process. During this process, the sites that are being upgraded won't be available to users.

+ If the software update contains updates to services that must be applied, you can upgrade the service, and then resume operating the farm (step 8 in the following procedure) until it's possible to take a longer farm outage to complete the content and farm upgrade.

+ You can also upgrade individual content databases in parallel for a very small number of content databases at the same time. However, don't attempt to upgrade too many content databases in parallel because it slows down the overall upgrade process and extends the outage time. We recommend that you don't upgrade more than two content databases on the same SQL Server volume at a time. Start the upgrade for each content database that will occur in parallel several minutes apart to prevent lock contention as the upgrade process starts. In addition, limit the number of content databases that you upgrade on a single web server or application server. Each additional upgrade process consumes a relatively large number of resources. The typical number of content databases that you can upgrade per web server or application server is four databases. However, be sure not to exceed the number of databases that are being upgraded per SQL Server volume, no matter which web server or application server originates the upgrade.

+ Some updates might also require you to run additional PowerShell cmdlets to upgrade specific service applications. Notes for a software update might indicate that you have to upgrade a specific service so that it will continue to operate after patching. This applies to a service that can't operate in backward compatibility mode, for example.

+ This is an optional step, but it helps ensure that all content databases are upgraded first. It has the advantage of enabling some parallelism to reduce the outage time. If it isn't performed, all remaining non-upgraded content databases will be upgraded serially when you run the SharePoint Products Configuration Wizard to upgrade the farm servers.

+7. Verify update completion and success.

+

+ For more information, see [Verify database upgrades in SharePoint 2013](./verify-upgrade.md), [Verify database upgrades in SharePoint Server 2016](/sharepoint/upgrade-and-update/verify-upgrade-for-databases), [Verify database upgrades in SharePoint Server 2019](/sharepoint/upgrade-and-update/verify-upgrade-for-databases-2019), and [Verify database upgrades in SharePoint Server Subscription Edition](/sharepoint/upgrade-and-update/verify-upgrade-for-databases-subscription-edition) .

+ You're finished installing the update and using this article.

+The following illustration shows the sequence of steps to follow to install the update on a new farm by using the database attach method.

+For more information, see [Upgrade content databases from SharePoint 2013 to SharePoint Server 2016](./upgrade-content-databases.md), [Upgrade databases from SharePoint 2016 to SharePoint Server 2019](/sharepoint/upgrade-and-update/upgrade-databases-2019), and [Upgrade databases from SharePoint Server 2019 and SharePoint Server 2016 to SharePoint Server Subscription Edition](/sharepoint/upgrade-and-update/upgrade-databases-subscription-edition).

+1. Create a new farm where you'll install the software update. This farm doesn't require front-end web servers.

+

+ For more info, see [Create the SharePoint 2016 farm for a database attach upgrade](./create-the-sharepoint-server-2016-farm-for-a-database-attach-upgrade.md), [Create the SharePoint Server 2019 farm for a database attach upgrade](/sharepoint/upgrade-and-update/create-the-sharepoint-server-2019-farm-for-a-database-attach-upgrade), and [Create the SharePoint Server Subscription Edition farm for a database attach upgrade](/sharepoint/upgrade-and-update/create-the-sharepoint-server-subscription-edition-farm-for-a-database-attach-upgrade).

+ > [!NOTE]

+ > Steps 4 through 13 do not apply to SharePoint Foundation 2013, SharePoint Server 2016, SharePoint Server 2019, and SharePoint Server Subscription Edition.

+4. If you're patching the User Profile Service service application database, you must export the User Profile Synchronization Service encryption key from the old database, and then import the key to the new database. This key is also known as the Microsoft Identity Integration Server (MIIS) key, the Synchronization Service encryption key, and the Forefront Identity Manager 2010 (FIM 2010) key. If you don't export and then import the key correctly, the Synchronization Service won't start. To export the encryption key, complete these steps:

+ 1. Use farm administrator credentials to sign in to the computer that contains the old User Profile Service service application database.

+ 1. Use farm administrator credentials to sign in to the computer that contains the new User Profile Service service application database.

+ 2. Attempt to start the User Profile Synchronization service. Because you haven't yet imported the encryption key, the service won't start. Confirm that the service didn't start by using the ULS log or by making sure that the status of the service is **Stopped**.

+ You're finished installing the update and using this article.

+Perform the procedures in this section only when they're pointed to from other procedures in this article. This includes the following procedures that are in this section:

+5. On each server in availability group 2, stop the Search-related Windows services in the same order that was prescribed for stopping them for availability group 1. Again, it's important to verify that each service is stopped before you stop the next service.

+1. Start a SharePoint Management Shell on any server in the farm.

+ - The set must contain a Search administration component that isn't the primary component that was identified in step 2 in this procedure.

+> Do not use `Stop-SPDistributedCacheServiceInstance -Graceful` for SharePoint Server 2013, SharePoint Server 2016, and SharePoint Server 2019 as this will terminate Distributed Cache prior to the cache being transferred to another server in the farm. But `Stop-SPDistributedCacheServiceInstance -Graceful` can be used for SharePoint Server Subscription Edition.

+### Troubleshoot software updates on servers that host Search components

+- **Issue:** After an update, you may no longer have proper registry key or file system permissions.

+ Title: "Software updates overview for SharePoint Server 2016, 2019, and Subscription Edition"

+# Software updates overview for SharePoint Server 2016, 2019, and Subscription Edition

+Administrators update SharePoint Server 2016, 2019, or Subscription Edition to deploy or update assemblies that provide functionality and to upgrade databases. A successful update follows a methodical approach that minimizes interruptions in service. Review information in this article to learn about the process before you begin the update process.

+> This article applies to SharePoint Server 2016, 2019, and Subscription Edition.

+- [Account permissions and security settings in SharePoint Server 2016, 2019, and Subscription Edition](../install/account-permissions-and-security-settings-in-sharepoint-server-2016.md)

+Information in this article is for all IT professionals who maintain SharePoint Server 2016, 2019, or Subscription Edition. However, specific instructions to install a software update are intended for IT professionals who have to deploy software updates on a farm of servers that host SharePoint Server 2016, 2019, or Subscription Edition.

+- SharePoint Server Subscription Edition

+- SharePoint Server Subscription Edition Language Packs

+> The process that installs software updates in stand-alone environments of SharePoint Server 2016, 2019, or Subscription Edition is a simpler process than the process that installs software updates in a server farm and does not require all the steps that are required for a server farm.

+> [!NOTE]

+> From March 2023 PU, Microsoft will release a single ΓÇ£uberΓÇ¥ patch for SharePoint Server Subscription Edition that contains all of the fixes that previously would have been released in those separate 'sts-x-none' and 'wssloc' patches.

+To understand how to implement software updates in SharePoint Server 2016, 2019, and Subscription Edition, it is important to understand the terminology for the core components.

+|**upgrade** <br/> |Process by which you change an environment to use a newer version of software. You can upgrade to a minor release, such as an update or patch, or to a major release. An upgrade to a minor release is called a build-to-build upgrade. An upgrade to a major release is called a version-to-version upgrade. <br/> |In SharePoint Server 2016, for build-to-build upgrades, you can use either in-place or database-attach methods. For version-to-version upgrade, only database-attach is supported. For more information about version-to-version upgrade, see [Overview of the upgrade process to SharePoint Server 2016](overview-of-the-upgrade-process.md), [Overview of the upgrade process to SharePoint Server 2019](overview-of-the-upgrade-process-2019.md) and [Overview of the upgrade process to SharePoint Server Subscription Edition](overview-of-the-upgrade-process-subscription-edition.md). For an overview of the steps for in-place and database-attach upgrade for build-to-build upgrades, see [Install a software update for SharePoint Server 2016, 2019, and Subscription Edition](install-a-software-update.md) <br/> |

+SharePoint Server 2016, 2019, and Subscription Edition has features that facilitate the end-to-end software update experience. Some of these features are as follows:

+The process that deploys updates in a SharePoint Server 2016, 2019, and Subscription Edition environment is a two-phase process: patching and build-to-build upgrade.

+The patch phase has two steps, the patch deployment step and the binaries deployment step. During the patch deployment step, new binary files are copied to the server running SharePoint Server 2016, 2019, or Subscription Edition. Services that use files that the patch has to replace are temporarily stopped. Stopping services reduces the requirement to restart the server to replace files that are being used. However, in some instances you have to restart the server.

+The second step in the patch phase is the binaries deployment step. In this step, the installer copies support dynamic link library (.dll) files to the appropriate directories on the server that is running SharePoint Server 2016, 2019, or Subscription Edition. This step ensures that all the web applications are running the correct version of the binary files and will function correctly after the update is installed. The update phase is complete after the binaries deployment step.

+> The information in this section is valid if you farm is not in a high availability (HA) environment. If you have an HA environment, follow the instructions at [SharePoint Server zero downtime patching steps](./sharepoint-server-2016-zero-downtime-patching-steps.md).

+The cycle that is used for upgrading SharePoint Server 2016, 2019, or Subscription Edition farms and servers also applies to deploying software updates, which are a subset of an upgrade phase. We recommend that you use the update cycle in the following illustration as a guide to deploy software updates.

+First, ensure that the system can be provisioned as a farm server. For more information, see [Hardware and software requirements for SharePoint Server 2016](../install/hardware-and-software-requirements.md), [Hardware and software requirements for SharePoint Server 2019](/sharepoint/install/hardware-and-software-requirements-2019), and [System requirements for SharePoint Server Subscription Edition](/sharepoint/install/system-requirements-for-sharepoint-subscription-edition).

+Ensure that any server that you plan to update is running the same version of the operating system as the other farm servers. This includes updates, service packs, and security hotfixes.

+For more information about the update strategy to use, see [Install a software update for SharePoint Server 2016, 2019, and Subscription Edition](install-a-software-update.md)

+Learn about the new features and updates introduced in the SharePoint Server Subscription Edition Version 22H2 feature update.

+|**Feature**|**Release ring**|**More information**|

+ Title: "New and improved features in SharePoint Server Subscription Edition Version 23H1"

+audience: ITPro

+f1.keywords:

+- NOCSH

+ms.localizationpriority: high

+- IT_Sharepoint_Server

+- IT_Sharepoint_Server_Top

+- Strat_SP_server

+description: "Learn about the new features and updates to existing features in SharePoint Server Subscription Edition Version 23H1."

+# New and improved features in SharePoint Server Subscription Edition Version 23H1

+Learn about the new features and updates introduced in the SharePoint Server Subscription Edition Version 23H1 feature update.

+## List of new features and updates to existing features

+The following table provides the list of new features and updates to existing features in SharePoint Server Subscription Edition.

+|**Feature**|**Release ring**|**More information**|

+|:--|:--|:--|

+|**Copy and move improvement in modern document library** <br/> |Standard release <br/> |For more information, see [Copy and move improvement in modern document library](/sharepoint/what-s-new/new-and-improved-features-in-sharepoint-server-subscription-edition-22h2-release#copy-and-move-improvement-in-modern-document-library).<br/> <br/>This was part of *Early release* in the Version 22H2 feature update.|

+|**Bulk editing in modern lists** <br/> |Standard release <br/> |For more information, see [Bulk editing in modern lists](/sharepoint/what-s-new/new-and-improved-features-in-sharepoint-server-subscription-edition-22h2-release#bulk-editing-in-modern-lists). <br/> <br/> This was part of *Early release* in the Version 22H2 feature update.|

+|**Column formatting enhancement** <br/> |Standard release <br/> |For more information, see [Column formatting enhancement](/sharepoint/what-s-new/new-and-improved-features-in-sharepoint-server-subscription-edition-22h2-release#column-formatting-enhancement). <br/> <br/> This was part of *Early release* in the Version 22H2 feature update.|

+|**Button web part** <br/> |Standard release <br/> |For more information, see [Button web part](/sharepoint/what-s-new/new-and-improved-features-in-sharepoint-server-subscription-edition-22h2-release#button-web-part). <br/> <br/> This was part of *Early release* in the Version 22H2 feature update.|

+|**Choose the default site language in the modern self-service site creation pane** <br/> |Standard release <br/> |For more information, see [Choose the default site language in the modern self-service site creation pane](/sharepoint/what-s-new/new-and-improved-features-in-sharepoint-server-subscription-edition-22h2-release#choose-the-default-site-language-in-the-modern-self-service-site-creation-pane). <br/> <br/> This was part of *Early release* in the Version 22H2 feature update.|

+|**New SharePoint RESTful ListData.svc implementation** <br/> |Standard release <br/> |For more information, see [New SharePoint RESTful ListData.svc implementation](/sharepoint/what-s-new/new-and-improved-features-in-sharepoint-server-subscription-edition-22h2-release#new-sharepoint-restful-listdatasvc-implementation). <br/> <br/> This was part of *Early release* in the Version 22H2 feature update.|

+|**Unified "uber" patches** <br/> |Standard release <br/> |For more information, see [Unified "uber" patches](#unified-uber-patches). <br/> |

+|**Support for SharePoint Framework (SPFx) version 1.5.1** <br/> |Standard release <br/> |For more information, see [Support for SharePoint Framework (SPFx) version 1.5.1](#sfsf). <br/> |

+|**New PowerShell cmdlets for variations feature** <br/> |Standard release <br/> |For more information, see [New PowerShell cmdlets for variations feature](#new-powershell-cmdlets-for-variations-feature). <br/> |

+|**SharePoint Server recompiled with Visual C++ 2022** <br/> |Standard release <br/> |For more information, see [SharePoint Server recompiled with Visual C++ 2022](#ssrwv). <br/> |

+|**Private key management in certificate management** <br/> |Early release <br/> |For more information, see [Private key management in certificate management](#private-key-management-in-certificate-management). <br/> |

+|**Support for wildcard host header bindings** <br/> |Early release <br/> |For more information, see [Support for wildcard host header bindings](#support-for-wildcard-host-header-bindings). <br/> |

+|**Expanded usage of modern sharing dialog** <br/> |Early release <br/> |For more information, see [Expanded usage of modern sharing dialog](#expanded-usage-of-modern-sharing-dialog). <br/> |

+|**Column totals in modern list views** <br/> |Early release <br/> |For more information, see [Column totals in modern list views](#column-totals-in-modern-list-views). <br/> |

+|**Enhanced Quick Chart web part** <br/> |Early release <br/> |For more information, see [Enhanced Quick Chart web part](#enhanced-quick-chart-web-part). <br/> |

+|**Improved file picker** <br/> |Early release <br/> |For more information, see [Improved file picker](#improved-file-picker). <br/> |

+## Detailed description of features

+This section provides detailed descriptions of the new and updated features in SharePoint Server Subscription Edition Version 23H1.

+> [!NOTE]

+> Features previously introduced in the SharePoint Server Subscription Edition Version 22H2 feature update will not be described here. See [New and improved features in SharePoint Server Subscription Edition Version 22H2](/sharepoint/what-s-new/new-and-improved-features-in-sharepoint-server-subscription-edition-22h2-release) for descriptions of those features.

+### Unified "uber" patches

+Up until now, Microsoft would release two separate public updates each month for SharePoint Server 2016, SharePoint Server 2019, and SharePoint Server Subscription Edition. The first public update was called the **STS** or **core** update and contained all of the language-independent file updates. The second public update was called the **WSSLOC** or **language pack** update and contained all of the language-dependent file updates. Both public updates were required to be installed to fully update a SharePoint farm, although a new language-dependent WSSLOC public update may not have been released every month.

+Some SharePoint customers were confused by the need to download and install two separate updates to fully update their SharePoint farm each month. They may mistakenly only download and install one of those updates, which could lead to unexpected behavior in their SharePoint farms due to mismatched updates.

+To simplify the process of updating your SharePoint Server farm, Microsoft will now only release a single update each month for SharePoint Server Subscription Edition, starting with the March 2023 public update. This single "uber" update combines all of the fixes that would have previously been released in separate STS and WSSLOC updates.

+The single uber updates are cumulative, so you only need to install the latest uber update to be fully up to date with all of the latest fixes for SharePoint Server Subscription Edition. It isnΓÇÖt necessary to install any of the previous STS or WSSLOC updates before installing the uber update. No additional STS or WSSLOC updates will be released after the February 2023 public updates.

+Customers should remember to run the SharePoint upgrade actions in their farm after installing a new update to complete the patching and upgrade process. For more information, see [Upgrade to SharePoint Server Subscription Edition](/sharepoint/upgrade-and-update/upgrade-to-sharepoint-server-subscription-edition).

+For more information, see [Software updates overview for SharePoint Server 2016, 2019, and Subscription Edition](/SharePoint/upgrade-and-update/software-updates-overview?branch=pr-en-us-4897), and [Install a software update for SharePoint Server](/SharePoint/upgrade-and-update/install-a-software-update?branch=pr-en-us-4897).

+<a name="sfsf"> </a>

+### Support for SharePoint Framework (SPFx) version 1.5.1

+Previous versions of SharePoint Server Subscription Edition supported SharePoint Framework (SPFx) version 1.4.1. To expand the customization scenarios that SharePoint Server Subscription Edition supports, the 23H1 feature update adds support for SharePoint Framework (SPFx) version 1.5.1.

+This is one step on our long-term journey to improve and expand the capabilities of SharePoint Framework in SharePoint Server Subscription Edition.

+For more information about SharePoint Framework version 1.5.1, see [SharePoint Framework v1.5.1 release notes](/sharepoint/dev/spfx/release-1.5.1).

+### New PowerShell cmdlets for variations feature

+Previous versions of SharePoint Server included an `stsadm.exe -o variationsfixuptool` command to configure the variations feature of SharePoint. However, the `stsadm.exe` command line tool was removed in SharePoint Server Subscription Edition with no PowerShell cmdlets provided to replace this variations functionality.

+SharePoint Server Subscription Edition Version 23H1 introduces four new PowerShell cmdlets that replaces the functionality of the `stsadm.exe -o variationsfixuptool` command.

+Those cmdlets are:

+ - `Deploy-SPVariation -Identity <SPWebPipeBind> [-Recurse] [-Label <String>]`

+ - `Repair-SPVariation -Identity <SPWebPipeBind> [-Recurse] [-Label <String>]`

+ - `Test-SPVariation -Identity <SPWebPipeBind> [-Recurse] [-Label <String>]`

+ - `Get-SPVariationJob -Identity <SPWebPipeBind>`

+For more information, see [Cmdlet reference for SharePoint Server](/powershell/module/sharepoint-server/).

+<a name="ssrwv"> </a>

+### SharePoint Server recompiled with Visual C++ 2022

+Previous versions of SharePoint Server Subscription Edition were compiled with the Visual C++ 2019 compiler for unmanaged code. The SharePoint Prerequisite Installer that comes with the SharePoint Server Subscription Edition installed the Visual C++ Redistributable Package for Visual Studio 2015-2019 to support the binaries compiled with that compiler.

+To ensure SharePoint Server can take advantage of the latest capabilities and fixes in the Visual C++ libraries, Microsoft has recompiled SharePoint Server Subscription Edition Version 23H1 with the Visual C++ 2022 compiler. The Version 23H1 feature update will automatically install the Visual C++ Redistributable Package for Visual Studio 2015-2022 to support the binaries recompiled with this compiler.

+

+### Private key management in certificate management

+

+SharePoint Server Subscription Edition introduced a new certificate management feature that allows SharePoint farm administrators to directly manage the deployment and lifecycle of SSL/TLS certificates in their SharePoint Server farms. The certificate management feature would apply a standard set of permissions to the private keys of these certificates regardless of their use cases.

+To better support least privileges scenarios and minimize the permissions given to these private keys, SharePoint Server Subscription Edition Version 23H1 applies more granular and sophisticated permission management for these private keys. The permissions are based on the certificate assignments and will be dynamically updated when the certificate assignments change.

+For example, if a certificate is assigned to perform client certificate authentication to an SMTP server, SharePoint ensures the process thatΓÇÖs connecting to the SMTP server has the necessary permissions to use the private key of that certificate. If a certificate is no longer assigned to perform client certificate authentication to an SMTP server, SharePoint removes permissions for that process so it no longer has access to the private key of that certificate.

+APIs have been added to the *Microsoft.SharePoint.Administration.CertificateManagement.SPServerCertificate* class to allow third party integration with this functionality.

+

+### Support for wildcard host header bindings

+

+Previous versions of SharePoint Server Subscription Edition support host header bindings that would allow multiple SharePoint web applications to share the same TCP port. However, SharePoint Server only supported explicit host header bindings such as "sharepoint.example.com". Sometimes customers may want to support multiple host-named site collections across multiple web applications, all using the same TCP port.

+SharePoint Server Subscription Edition Version 23H1 adds support for specifying a wildcard host header binding for a web application. This allows you to specify different wildcard bindings across multiple web applications that can share the same TCP port such as `*.external.example.com` and `*.internal.example.com`. You can then provision host-named site collections in the first web application using the `*.external.example.com` DNS naming scheme (such as `site1.external.example.com`, `site2.external.example.com`, etc.) and other host-named site collections in the second web application using the `*.internal.example.com` DNS naming scheme (such as `site1.internal.example.com`, `site2.internal.example.com`, etc.).

+

+### Expanded usage of modern sharing dialog

+

+In previous releases of SharePoint Server Subscription Edition, using sharing functionality in lists, document libraries, pages, or site contents would trigger the classic sharing dialog, even when using the modern view in a modern Team site or Communication site.

+To provide a more intuitive sharing experience, these sharing entry points have been updated to use SharePointΓÇÖs modern sharing dialog. The modern sharing dialog is also a more accessible experience.

+### Column totals in modern list views

+

+SharePoint Server Subscription Edition Version 23H1 adds support for displaying column totals in modern list views just like in classic list views. This option can be enabled in the **save view** feature.

+

+### Enhanced Quick Chart web part

+

+Previous versions of SharePoint Server Subscription Edition allowed users to manually enter data in the Quick Chart modern web part to render charts on modern pages. However, users were unable to connect the Quick Chart web part to a list or library within the site to consume its data.

+SharePoint Server Subscription Edition Version 23H1 enhances the Quick Chart modern web part by adding a **Get data from a list or library on this site** option. Users can now configure the Quick Chart web part to consume data from a list or library within the site.

+For more information, see [Use the Quick Chart web part](https://support.microsoft.com/office/use-the-quick-chart-web-part-bcfee244-2408-400b-a9bd-4eca61aead51).

+

+### Improved file picker

+

+SharePoint Server Subscription Edition Version 23H1 improves the modern file picker used by the Quick Links and File Viewer web parts. The Quick Links web part file picker can now support more file types such as PDF, TXT, MP4, M4V, MP3, OGG, and WAV. The File Viewer web part file picker can now support PDF files.

+To ensure that users receive highly relevant help content, we are moving from away from our legacy on-premises SharePoint help engine, which is based on help collections being installed in the on-premises farm. The new SharePoint help system is now rendered in the cloud and will have updated, synchronized content with Microsoft 365. Custom help based on the legacy SharePoint help engine will remain supported, but deprecated, for the SharePoint Server 2019 release.

+As Microsoft continues to innovate in SharePoint, an increasing number of SharePoint multi-tenancy capabilities are taking dependencies on cloud technologies that aren't available in on-premises environments. The cost and complexity of providing an on-premises alternative has become prohibitive, so we will no longer support multi-tenancy in the SharePoint Server 2019 release. Existing SharePoint Server customers who depend on multi-tenancy are recommended to explore migrating to SharePoint in Microsoft 365. Other options include migrating to a non-multi-tenancy farm configuration or remaining with SharePoint Server 2016.

+Where:

+ - InfoPath Forms Services

+

+ - Microsoft Workflow Manager

+

+ - SharePoint 2010 workflows

+

+ - SharePoint Designer 2013

+### InfoPath Forms Services

+InfoPath Forms Services are deprecated but will remain supported for the SharePoint Server Subscription Edition release until July 14, 2026. After that date, InfoPath Forms Services will no longer be supported. Microsoft recommends exploring Power Apps as a potential alternative to InfoPath forms.

+### Microsoft Workflow Manager

+Microsoft has released SharePoint Workflow Manager as the new workflow engine to power the SharePoint 2013 Workflow platform for SharePoint Server and replace Microsoft Workflow Manager. We recommend that all customers using SharePoint 2013 workflows upgrade to SharePoint Workflow Manager as soon as theyΓÇÖre able to. Microsoft will focus all future investments and maintenance on SharePoint Workflow Manger rather than Microsoft Workflow Manager, including providing support beyond the year 2026. For more information, see [Install and configure workflow for SharePoint Server](/sharepoint/governance/install-and-configure-workflow-for-sharepoint-server).

+### SharePoint Designer 2013

+SharePoint Designer 2013 is deprecated but will remain supported with SharePoint Server Subscription Edition until July 14, 2026. After that date, SharePoint Designer 2013 will no longer be supported. Customers will be able to continue using Visual Studio to create and edit their SharePoint 2013 workflows after that date.

+Internet Explorer 11 is only supported in the SharePoint Central Administration site. Internet Explorer 11 isn't supported in Team sites, OneDrive personal sites, or any other types of SharePoint content sites. Microsoft recommends exploring Microsoft Edge as the replacement for Internet Explorer 11.

+Classic authentication mode has been removed and is no longer supported by Microsoft for content web applications in SharePoint Server Subscription Edition. Content web applications will now only support claims authentication mode. The Central Administration web application continues to use and support classic authentication mode.