Download websites that use Microsoft SharePoint

The platform was designed for people who log in, not for people who arrive from a search result. Microsoft built it as an intranet and document management layer, the place where a company keeps its policies, its project sites and its shared libraries. Every public site we find running the platform therefore started life as an internal system that somebody decided to open up, or as a portal built by a team that already owned the licence and saw no reason to buy anything else for the public side.

As of October 2026 we detect Microsoft SharePoint on 2,344 sites. The number is modest next to the general purpose publishing tools it sits beside in CMS, and modest is exactly the point. Nobody adopts an enterprise collaboration suite in order to run a brochure site. Presence on the public web is a byproduct of an organisation that had already standardised on Microsoft internally and then pushed one surface outward.

Microsoft shipped the first release in 2001, the code is C#, and the licence is Proprietary, which places the product firmly on the paid side of a procurement process. For a researcher that fact matters more than any technical detail. A domain running Microsoft SharePoint is a domain attached to an organisation with an IT department, a signed agreement, an identity directory and a budget cycle. The technology is a firmographic signal wearing a technical costume, and it is a good one, because nobody installs it by accident.

Version data is where the public footprint stops being trivia. We have recorded 177 distinct versions across the sites we crawl, 16.0.0.27709 among the builds that recur. Build numbers on this platform are patch levels rather than marketing releases, so a site that reveals one is quietly telling the internet how recently its operator ran an update. Anyone doing vulnerability research, migration outreach or competitive displacement work reads that field before anything else, because a patch level separates a maintained deployment from a forgotten one far better than a domain name does.

Detection has honest limits. The hosted tenancy and the self managed server share markup, script paths and header conventions, so we can say a site is served by the platform without always being able to say whether the server sits in a company rack or in a Microsoft data centre. A reverse proxy or a content delivery network in front of the site can strip the fingerprints we rely on, and a deployment with a heavily customised front end may never expose them at all. Treat the count as a floor drawn from sites that leak, not as a census of installations.

A per domain lookup answers whether one organisation you already have in mind runs the platform. The export answers the question that cannot be asked one domain at a time: across the whole crawled population, which organisations run it, at which build, on which domains, and which of them appeared or disappeared since the previous file. The result is a list of accounts rather than a fact about a website.