Lifecycle FAQ - Extended Security Updates

The Extended Security Update (ESU) program is a last resort option for customers who need to run certain legacy Microsoft products past the end of support. They are not intended as a long-term solution, but rather as a temporary bridge to stay secure while one migrates to a newer, supported platform. It includes Critical* and/or Important* security updates up to three years after the product's End of Extended Support date.

Extended Security Updates will be distributed if and when available. ESUs do not include new features, customer-requested non-security updates, or design change requests.

The ESU program does not extend the product lifecycle or extend technical support for the product beyond its lifecycle.

* As defined by the Microsoft Security Response Center (MSRC).

* Extended Security Updates for select Embedded products are available via OEMs. All others are available via volume licensing.
** One additional year of ESU is available for Windows Server and SQL Server 2008 and 2008 R2 only on Azure.

Customers who have Extended Security Updates and have an active support plan can receive support for problems specific to the actual ESUs:

• Deployment, Installation, and Activation of ESU keys, licenses and updates
• Servicing requests for bugs/regressions introduced as a result of ESU

General technical support and troubleshooting assistance is not available for products that have reached the end of lifecycle (the end of extended support date shown in the table above). The purchase or usage of ESUs does not change the associated products support lifecycle.

On Azure: Extended Security Updates are free for VMs in Azure. These include destinations such as Azure Virtual Machines (VMs), Dedicated Host, Azure VMware Solution, Nutanix Cloud Clusters on Azure, and the Azure Stack portfolio. Eligible customers can use the Azure Hybrid Benefit (available to customers with active Software Assurance or Server Subscriptions) to obtain discounts on the license of Azure Virtual Machines (IaaS) or Azure SQL Database Managed Instance (PaaS).

On-premises/hybrid environments: Extended Security Updates are available through specific volume licensing programs or through Azure Arc-enabled servers for Windows Server and SQL Server. Contact your Microsoft partner or account team to learn more. ESUs for select Embedded products are available via your embedded device manufacturer. For ESUs available through the Dynamics 365 Cloud Migration offer, customers can purchase via the Cloud Service Provider (CSP) licensing program.

Regardless of where the customer wants to deploy ESUs, coverage will be available for up to three years following the end of support date for a particular product.

No, Unified Support does not include ESUs.

On Azure: Applicable virtual machines (VMs) hosted in Azure are automatically enabled for ESUs if the VM is configured to receive updates, and these updates are provided free of charge.

On-premises/hybrid: Customers can install ESUs by accessing their multiple activation keys through the M365 Admin Center portal or directly installing ESUs through Azure Arc-enabled servers. Learn more about the installation details here for Windows Server and here for SQL Server installation.

Customers have two options for licensing ESU (ESU):

1. Via Azure Arc-enabled servers: With Extended Security Updates enabled by Azure Arc.
2. Commercial Licensing: Acquire Extended Security Updates licenses (SKUs) through a Microsoft Commercial Licensing program.

For maximum flexibility and convenience, we recommend using Azure Arc-enabled servers.

You can acquire ESU licenses either directly from Microsoft or from your partner such as an EA Reseller or CSP partner (eligible to sell ESUs as of Oct. 1, 2023 for both types of ESUs mentioned above).

Eligibility Criteria

To qualify for ESU on-premises or in hosted environments, your server or operating system must meet one of the following prerequisites:

1. Be covered by an active Software Assurance (SA) plan acquired through any program, such as Enterprise Agreement (EA), Enterprise Agreement Subscription (EAS), Server & Cloud Enrollment (SCE), or Enrollment for Education Solutions (EES).
2. Have active subscription licenses acquired through any program, including Cloud Solution Provider (CSP).
3. Have been acquired as 'License-Included' services through a Service Provider License Agreement (SPLA) partner.

Deployment scenarios

You can apply ESU enabled by Azure Arc and ESU licenses (SKUs) to any properly licensed server or operating system, whether it's deployed on-premises or on non-Azure clouds (including hosters). If you're running your OS in another cloud, make sure to adhere to the respective outsourcing or License Mobility policies for the underlying software.

Examples:

1. SPLA Scenario: If you've acquired your software from an SPLA partner, you can cover it with ESU licenses.
2. BYOL Scenario: If you've brought your own licenses to a cloud hosting provider via your Outsourcing policy or License Mobility, you can cover your software with ESU licenses.
3. On-premises: If you're running your software on-prem, you can cover it with ESU licenses.

When opting for ESU via Azure Arc-enabled servers for Windows Server 2012 and 2012 R2, you have two licensing choices:

1. vCore Licensing: Pay based on the number of virtual cores (vCores) utilized by the operating system. This option uses the Standard edition rate. If you're operating multiple VMs, the cost will be calculated based on the total number of vCores across all VMs. There is an 8-core minimum per VM for vCore licensing. This option is only available when covering an OS running as a virtual machine.
2. pCore Licensing: Pay based on the number of physical cores (pCores) utilized by the host operating system. This option can use either edition. Note that with pCore licensing, up to 2 guest VMs running on a WS Standard host are covered (additional VMs require additional ESU licenses). With the WS Datacenter host, all VMs are covered without the need for additional licenses. There is a 16-core minimum per server for pCore licensing. This option is available for covering OS's running as a physical host, a virtual machine, or a mix of both.

For ESUs enabled by Azure Arc, you can select either licensing option, irrespective of how the underlying server or operating system is licensed. You can also mix between pCore and vCore licensing for your VMs. Make sure you follow the allowed virtualization entitlements for your underlying software.

For customers who enroll in ESUs enabled by Azure Arc after the end of support dates (July 11, 2023 for SQL Server 2012 Year 2 and October 10, 2023 for Windows Server 2012/R2), they will be billed a one-time upfront charge for the months they missed after the end of support date, with billing coming in at the end of the month. For example, if a customer enrolls in January 2024, they will receive a one-time back-bill for October, November, and December 2023 during their first month.

This also applies if a customer intermittently deactivates ESUs. For example, if a customer enrolls in October 2023, unenrolls in November 2023 and re-enrolls in March 2024, the re-enrollment will trigger back-billing for December 2023, January 2024, and February 2024.

With ESU enabled by Azure Arc, you can link paid ESU coverage to your eligible Disaster Recovery Benefit servers without incurring additional cost. Make sure you follow the underlying Disaster Recovery Benefit policy for your software.

With ESU enabled by Azure Arc, you can cover development and test instances licensed with Microsoft Developer edition licenses or Visual Studio subscriptions for no additional cost.

Extended Security Updates licenses (SKUs) obtained through Commercial Licensing are valid for annual coverage periods, such as Year 1 ESU, Year 2 ESU, and Year 3 ESU. Each ESU license entitles the specific server or operating system to receive security updates for the duration defined by that SKU (not by calendar year). For a comprehensive list of coverage periods, please reference the table at the top of this page.

You may only acquire ESU Year 2 and Year 3 licenses if you've also acquired the ESU license(s) for the prior year(s). For example, before you acquire the ESU Year 2 license, you must also acquire ESU Year 1.

ESU licenses correspond to the number of underlying core licenses of your server or operating system. You can license Windows Server and SQL Server based on either physical cores (pCores) or virtual cores (vCores). With ESUs sold through Commercial Licensing, the licenses must align with how you've licensed the underlying Windows Server or SQL Server.

• Physical Core Basis: If you choose this option for your underlying software, you'll need an ESU license for each physical core on the server. All validly licensed guest VMs running on the host are covered without the need for additional licenses. (Note that Windows Server and SQL Server software editions have different allowed virtualization entitlements for the number of guests allowed.) Windows Server has an 8-core minimum per processor and 16-core minimum per server for pCore licensing. SQL Server has a 4-core per processor minimum.
• Virtual Core Basis: If you opt for this option for your underlying software, you'll require an ESU license for each virtual core assigned to the VM. Windows Server has an 8-core minimum per VM for vCore licensing. SQL Server has a 4-core per VM minimum.

In summary, when licensing with Commercial Licensing ESUs (SKUs), the number of ESU core licenses must align with how you've licensed the underlying Windows Server or SQL Server. Also, with the Commercial Licensing ESUs, you must ensure that the ESU edition matches the edition of your underlying software. For instance, if you have Windows Server Datacenter on your VM, you should acquire ESU Datacenter edition if you want to license at the vCore level.

Examples:

1. Physical Core Scenario: A customer with a 16-core server licensed with Windows Server Datacenter on a pCore basis will need to acquire 16 ESU Datacenter licenses. This covers the entire server regardless of the number of guest VMs running on it.
2. Virtual Core Scenario: A customer with three 8-core VMs licensed with Windows Server Standard on a vCore basis will need 24 ESU licenses of the Standard edition to cover all VMs. When adding an additional VM, additional ESU licenses must be acquired accordingly. For VMs larger than eight vCores, i.e exceeding the minimum, add up all the vCores to get the correct price.Knowing your underlying license status for a given server enables you to accurately determine the number of Extended Security Update licenses you'll need.

With ESU (SKUs) through Commercial Licensing, you can also cover your eligible Disaster Recovery Benefit servers without acquiring additional licenses. Make sure you follow the underlying Disaster Recovery Benefit policy for your software.

With ESU (SKUs) through Commercial Licensing, you can cover development and test instances licensed with Microsoft Developer edition licenses or Visual Studio subscriptions for no additional cost.

Customers who migrate workloads to Azure will have access to ESUs for SQL Server 2012, and Windows Server 2012 and 2012 R2 for three years after the End of Support dates for no additional charge above the cost of running the virtual machine. This currently includes Azure destinations such as Azure virtual machines (VMs), Dedicated Host, Azure VMware Solution, Nutanix Cloud Clusters on Azure, and Azure Stack portfolio.

For ESUs in Azure, Software Assurance is not required for free ESUs, but Software Assurance is required for Azure Hybrid Benefit.

Year 1: 100% of full license price annually*

Year 2: 100% of full license price annually

Year 3: 100% of full license price annually

* SQL Server 2012 Year 1 ESUs were 75% of the full license price

Full License price is the equivalent to a License-only purchase and not the License portion of an L+SA contract.

• SQL Server 2012 Extended Support ended on July 12, 2022.
• Windows Server 2012 and 2012 R2 Extended Support will end on October 10, 2023.

Learn more about lifecycle support deadlines.

No, organizations must purchase prior months/years of ESUs when onboarding late.

Free ESUs will be available for customers on Azure, which includes workloads running on Azure Virtual Machines, Azure Dedicated Host, Azure VMWare Solutions, Nutanix Cloud Clusters on Azure, and Azure Stack Hub/Edge/HCI.

No, there are no changes to the type of updates in 2012 ESUs. Windows Server will distribute "Critical" and "Important" patches and SQL Server will distribute "Critical" updates.

For more information on what is considered "critical" or "important," please visit the Security Update Severity Rating System webpage.

ESUs do not include new features, customer-requested non-security hotfixes, or design change requests. However, Microsoft may include non-security fixes as deemed necessary.

No, there are no changes to technical support options for ESUs customers in 2012 but a clarification for awareness that technical support for ESUs is limited to the security updates in scope.

The Enterprise and Standard editions of SQL Server for versions 2012 and the Standard, Datacenter, and Embedded editions of Windows Server for versions 2008/2008 R2 and 2012/2012 R2 are eligible for ESUs. The 2008 R2 version of Windows Server and SQL Server was the final version supporting X86 (32 bit) processors, and all subsequent versions are x64 only.

For SQL Server 2012: ESUs include provision of Security Updates rated "critical" for a maximum of three years after end of support.

For Windows Server 2012/2012 R2: ESUs include provision of Security Updates and "Security Update Severity Rating System" rated "critical" and "important," for a maximum of three years after end of support.

ESUs will be distributed if and when available. ESUs do not include new features, customer-requested non-security hotfixes, or design change requests. However, Microsoft may include non-security fixes as deemed necessary.

For more information on what is considered "critical" or "important," please visit the MSRC site.

For end of support events in the past, SQL Server provided only Critical Security Updates, which meets the compliance criteria of our enterprise customers. SQL Server does not ship a general monthly security update. Microsoft only provides on-demand SQL Server security updates (GDRs) for MSRC "Security Update Guide" here SQL Server is identified as an affected product.

If there are situations where new SQL Server important updates will not be provided and it is deemed critical by the customer but not by MSRC, we will work with the customer on a case-to-case basis to suggest appropriate mitigation.

• ESUs enabled by Azure Arc: September 1, 2023.
• License (non-Azure Arc) ESUs: October 1, 2023.

Cloud Solution Provider (CSP) partners will be able to offer ESUs for end of support versions of Windows Server and SQL Server.  Customers will then have the right to use licenses covered by ESUs on deployments on-prem or within outsourced environments running on authorized hosts. Customers may also apply ESU licenses to "license-included" workloads acquired from SPLA partners or CSP-Hosts.

No, customers can choose to cover as many 2012/2012 R2 on-premises servers, with Software Assurance, as they need for ESUs.

No. Customers cannot buy ESUs for SQL Server Express or Developer edition. However, they can move their workloads to Azure and get the ESUs for no additional charges above the cost of using the Azure subscription. Also, customers who have ESUs for SQL Server production workloads are permitted to apply updates to their servers running SQL Server Developer edition solely for development and test purposes.

Yes, customers must have active Software Assurance (or equivalent Subscription Licenses) for CALs and External Connector Licenses permitting access to Servers with active ESU coverage. However, ESU coverage is neither required nor available for CALs or External Connector Licenses.

Yes, customers need to run SQL Server 2012 with the latest Service Pack to apply ESUs. Microsoft will only produce updates which can be applied on the latest Service Pack.

For customers who do not have Software Assurance, the alternative option to get access to ESUs is to migrate to Azure. For variable workloads, we recommend that customers migrate on Azure via Pay-As-You-Go, which allows for scaling up or down at any time. For predictable workloads, we recommend that customers migrate to Azure via Server Subscription and Reserved Instances.

Customers who need to stay on-premises can purchase ESUs when they have an active Server Subscription via EAS, EES, CSP, or Licenses through an EA or SCE in addition to Software Assurance through those programs. Alternatively, customers can use Software Assurance through Open, Select, or MPSA agreements in addition to product licenses through an EA, EAS, SCE, EES, or Subscription through CSP. Licenses and Software Assurance do not need to be on the same agreement.

There is no deadline for migration of the Windows Server 2012/R2 or SQL Server 2012 workloads to Azure. However, we recommend customers complete migration before the end of support date so that they do not miss any ESUs. If customers miss a year of ESUs coverage, they may buy coverage for previous years at the same time they buy coverage for a current period.

To find more information about end of support dates, refer to: Search Product and Services Lifecycle Information -- Microsoft Lifecycle | Microsoft Docs.

Customers who purchase ESUs for production servers may also apply those security updates to servers licensed under Visual Studio (MSDN) subscriptions at no additional cost. There is no limit to the number of MSDN servers a customer can cover. If they purchase ESUs for a production server, those updates can be applied to any number of MSDN servers.

Premium Assurance is no longer available, but we will honor the terms of Premium Assurance for customers who already purchased it.

Software Assurance is required as a pre-requisite to ESUs. If you have Software Assurance or an equivalent subscription (even if it is on a different enrollment/program type) then you can buy ESUs for Software Assurance covered servers on your Microsoft Enterprise Agreement (EA), Enterprise Agreement Subscription (EAS), or Server and Cloud Enrollment (SCE).

ESU coverage is not required to be co-terminus with Software Assurance coverage, but customers must have at least one month of qualifying Software Assurance coverage remaining at the time a given year of ESUs coverage is purchased.

ESUs can be purchased by customers with active Software Assurance under the following programs - Enterprise Agreement (EA), Enterprise Subscription Agreement (EAS), Server & Cloud Enrollment (SCE), Enrollment for Education Solutions (EES), or Subscription through programs such as Cloud Solution Provider (CSP).

Apps running on pre-installed Windows Servers are recommended to be migrated to supported OS versions or Windows Server on Azure.

Technical Support for ESUs is limited to the security updates received as part of the ESUs which includes deployment and Installation of ESU keys and/or ESU updates and support for any regressions resulting from the ESU updates.

No. If a customer has SQL Server 2012 or Windows Server 2012/2012 R2 without ESUs, they cannot log a support ticket, even if they have a support plan.

When customers have purchased ESUs and have an existing support plan:

Scenario: Customer can open a support ticket regarding installation of ESU keys / licensing / activation.
Response: Yes

Scenario: Customer can open a support ticket regarding installation of ESU update
Response: Yes

Scenario: Customer can open a support ticket regarding problems introduced as a result of installation of an ESU
Response: Yes, If it is determined that the issue is caused by the ESU, the Support Team will file a bug on the customer's behalf.

Scenario: Support Team will provide support for general product functionality or troubleshooting not related to the ESU itself.
Response: No

This program covers only the named product and the components that shipped with it. Unless explicitly stated the scope of this program does not extend to any other products or tools that the customer may be running on or with the covered product.

No. The ESU program does not extend technical support for a product.

No, customers must purchase ESUs separately. The cost of ESUs is not included in the price calculation of the Unified Support agreement. However, customers with Unified Support and ESUs can request technical support for issues directly related to the ESU itself (such as licensing, activation, and installation of the ESU).

All customers must call Microsoft support with their Agreement number to be verified as having acquired ESU. A support incident will be created for ESU customers. Services Hub does not list any products that have reached end of support in the dropdown menu.

As we continue to work to fully automate the validation process, the tech routers will validate whether a customer purchased ESUs. Once the customer is validated, a case will be created and routed to the appropriate queue for ESU technical support. Customers should provide their Enterprise Agreement number or full customer name for validation.

If an investigation determines that resolution requires product enhancement available in a recent release, then a request will be made to the customer to upgrade to a more recent release where the capability is already available. No new product enhancements will be made for SQL 2012 or Windows Server 2012/2012 R2.

No. The Extended Security Update (ESU) for Windows 7, Windows Server 2008/R2 and 2012/R2 will require online servicing (booted into the image taking the updates. See online servicing for more details).

ESUs are not supported in offline servicing mode. Applying ESUs in offline servicing mode will generate an error and updates will fail.

In Azure, ESUs are automatically applied.

In on-premises and hosted environments, there are two options to get ESUs:

1. ESUs enabled by Azure Arc-enabled servers, where you can enroll your machines in Windows Server 2012/R2 or SQL Server 2012 ESUs via the Azure portal, connect through Azure Arc-enabled servers, and pay for them as an Azure billed service. You pay a monthly fee for these ESUs. There are no keys needed; the new Azure subscription performs all the authentication and replaces the need for acquisition, deployment, and management of keys. Additionally, an inventory view will show the Extended Security Update coverage of all Windows and SQL Server machines enabled by Azure Arc. Learn more here.

2. Get ESUs through Windows Update, Windows Server Update Service, and Catalog. The Wsusscn2.cab will also include ESUs and be available during the Extended Security Update period. The latest Wsusscn2.cab file is available for download at the following location: Download Wsusscn2.cab.

This currently includes Azure destinations such as Azure virtual machines (VMs), Dedicated Host, Azure VMware Solution, Nutanix Cloud Clusters on Azure, and Azure Stack HCI.

Yes, customers with active Software Assurance or equivalent Server Subscriptions can leverage Azure Hybrid Benefit:

SQL Server: Customers can leverage existing on-premises license investments for discounted prices on SQL Server running on Azure SQL Managed Instance, Azure Virtual Machines, and Azure SQL Managed Instance enabled by Azure Arc in hybrid environments.

Windows Server: Customers can leverage existing on-premises license investments to save on Azure Virtual Machines.

Customers choosing to move to Azure IaaS can combine Azure Hybrid Benefit savings for SQL Server and Windows Server for increased cost savings.

Yes, ESUs will be available on Azure Virtual Machines on Azure Government regions.

The ESUs offer does not include technical support beyond the security updates in scope. For customers who purchased Windows Server 2012/2012 R2 or SQL Server 2012 via SPLA, they should contact the SPLA provider, and that provider can use a Partner Support Agreement. Customers cannot contact Microsoft directly if they purchase through SPLA.

Yes, you have the flexibility to use a first- or third-party solution for the delivery of ESUs. Some common patching solutions include Update Management Center on Azure, Systems Center Configuration Manager, Qualys, SolarWinds, and Tanium.

Azure Arc-enabled servers can handle intermittent loss of connectivity but expects connectivity at least once in a thirty-day window. Azure Arc-enabled servers support public endpoint, proxy server, and private link as connectivity options. If you require ESU's in a disconnected scenario, you should apply ESU keys manually. Learn more about this here.

To activate ESUs for SQL Server 2012 enabled by Azure Arc subscription, follow these steps:

1. Make sure that you have purchased the Year 1 ESU.
2. Onboard the instances that you wish to cover to Azure Arc using one of the deployment options and set the license to Software Assurance.
3. Activate ESUs using the SQL Server Configuration blade on each connected machine.

While you can sign up for SQL Server ESUs enabled by Azure Arc any time after June 26, 2023, the billing will automatically start after September 1, 2023. We encourage you to sign up as soon as possible since the protection starts from the moment the ESUs subscription is activated.

Your monthly bill will show the aggregate cost of Extended Security Update subscriptions based on the editions, total number of server cores you subscribed to ESU, and the number of days in the month.

Your ESUs charges will stop immediately in the following cases:

1. You manually cancelled your subscription for any reason.
2. You migrated your SQL server to Azure; no manual cancellation is needed.
3. You upgraded your SQL server to a newer version; no manual cancellation is needed.

If you cancel your ESUs or unsubscribe without migrating to Azure or upgrading to a newer version, the billing will stop billing immediately, but you will lose access to the future patches.

Win7/Server 2008/R2 and 2012/R2: Once the ESUs pre-requisite updates are installed (See the blog) offline activation can be done using the following steps.

Windows Server 2008 SP2: The support will be in an upcoming release, but the same steps will apply.

1. Slmgr.vbs /ipk < ESUs MAK Key> to install the product key
2. Get the Installation ID for the ESUs Key using the corresponding ESUs Activation ID (Refer to the blog for ESUs Activation IDs for each program). For example:
   C:\Windows\system32>slmgr /dti 77db037b-95c3-48d7-a3ab-a9c6d41093e0
   Microsoft (R) Windows Script Host Version 5.8
   Copyright (C) Microsoft Corporation. All rights reserved.
   Installation ID: 003842447833058154105433619200708862559816407110910340
3. Once you have the Installation ID, call the Microsoft Licensing Activation Center for your region; they will walk you through the steps to get the Confirmation ID, note it down.
4. Use the Slmgr /atp <Confirmation ID> <ESU Activation ID> to activate the ESUs SKU using the Confirmation Id obtained in the above step.
   C:\Windows\system32>slmgr /atp
   77db037b-95c3-48d7-a3ab-a9c6d41093e0
   Microsoft (R) Windows Script Host Version 5.8
   Copyright (C) Microsoft Corporation. All rights reserved.
   Confirmation ID for product 77db037b-95c3-48d7-a3ab-a9c6d41093e0 deposited successfully.
   After this step, ESUs License is activated successfully (slmgr /dlv <Esu Activation Id> should show Licensed).

To get the ESUs on Nested VMs you need to install and activate the ESUs key on the top-level guest VM (aka Nested VM), even if you are running on Azure. For detailed instructions on how to purchase and activate ESUs (for both Windows Server 2008/ 2008 R2, 2012/2012 R2 and Windows 7), please see this blog post on Tech Community.

Customers may use their preferred tools for software and hardware inventory. Find links to inventory tools from Microsoft and our partners on the Azure migration center site.

Customers can migrate workloads from a VMware-based virtual machine on-premises to Azure Virtual Machines using Azure Site Recovery or use many partner tools. Another option is the new VMware on Azure solution, for a dedicated hosting experience.

Yes, customers need to have Software Assurance to take advantage of the BYOL program for SQL Server on Azure Virtual Machines as part of the License Mobility program. For customers without Software Assurance, we recommend customers move to Azure SQL Managed Instance for their 2008 environments. Customers can also migrate to pay-as-you-go Azure Virtual Machines. Software Assurance customers who license SQL by core also have the option of migrating to Azure using the Azure Hybrid Benefit.

Azure SQL Managed Instance is a service in Azure providing nearly 100% compatibility with SQL Server on-premises. Managed Instance provides built-in high availability/disaster recovery capabilities plus intelligent performance features and the ability to scale on the fly. Managed Instance also provides a version-less experience that takes away the need for manual security patching and upgrades. See the Azure pricing guidance page for more information on the BYOL program.

Windows Server instances running on Azure, including VMware and Nutanix solutions, as well as Azure connected devices Azure Stack Hub and Azure Stack HCI are eligible for free ESUs.

Apps running with or on SQL Server and Windows Server 2012 can generally be rehosted to Azure with no application code change. Customers that are ready to upgrade, either in Azure or on-premises, can review the Azure Marketplace Catalog, as well as consult with their software vendor to find the matrix of supported apps on all the Windows Server and SQL Server versions.

Customers should assess their application infrastructure before migrating any server applications. They can learn more about the recommended process in the Azure Migration Center where they will learn how to leverage services like Azure Migrate to complete a readiness assessment including a cost estimate to run the application infrastructure in Azure. For further questions, work with your Microsoft partner, Microsoft Services, or your Account team to evaluate application readiness.

ESUs will continue to be available through all normal channels -- Windows Update, Windows Server Update Service, and Catalog. Importing from the online catalog into Windows Server Update Services (WSUS) is not required.

The updates will show as not applicable in Windows Server Update Service (WSUS). If you try to install the ESUs manually from the catalog, it will fail to install. Also, please note, ESUs activated devices and non-ESUs activated devices can exist in the same computer group for patch deployment.

Third party application control solutions are not a replacement for product security fixes.

SQL Server 2012 ESUs will be supported on Azure Stack. Windows Server 2012, 2012 R2 will be supported on Azure Stack.

Azure does not currently support shared storage clustering. For advice on how to configure a highly available SQL Server instance on Azure, refer to this guide on SQL Server High Availability.

To learn more about the Extended Security Update Program, and End of Support and migration options, see the following articles:

• App Assure -- application compatibility and migration assistance
• SQL Server 2012 and Windows Server 2012/R2 ESU FAQs
• How to get ESU for Windows devices
• How to get year 2 ESU for Windows
• Windows 7 ESU FAQ
• How to get ESU for Windows Embedded 7 Standard
• IT Pro FAQ about the end of support for Windows 7
• Windows 7 and Office 365 ProPlus support
• SQL Server 2008/R2 and Windows Server 2008/R2 ESU FAQs
• SQL Server 2008/2008 R2 ESU resource site
• Extended Security Updates and Microsoft Endpoint Configuration Manager
• Dynamics 365 Cloud Migration Offer

How to get ESUs for Windows Server

How to get ESUs for SQL Server

Obtaining Extended Security Updates for eligible Windows devices - Microsoft Community Hub

Microsoft Lifecycle Policy | Microsoft Learn

All Azure Arc-enabled servers Learn documentation:

How to prepare to deliver Extended Security Updates for Windows Server 2012 through Azure Arc - Azure Arc | Microsoft Learn

License provisioning guidelines for Extended Security Updates for Windows Server 2012 - Azure Arc | Microsoft Learn

Billing service for Extended Security Updates for Windows Server 2012 through Azure Arc - Azure Arc | Microsoft Learn

Deliver Extended Security Updates for Windows Server 2012 - Azure Arc | Microsoft Learn

Programmatically deploy and manage Azure Arc Extended Security Updates licenses - Azure Arc | Microsoft Learn

How to troubleshoot delivery of Extended Security Updates for Windows Server 2012 through Azure Arc - Azure Arc | Microsoft Learn

Pricing -- Azure Arc | Microsoft Azure

KB5031043: Procedure to continue receiving security updates after extended support has ended on October 10, 2023 - Microsoft Support

Windows Server 2012/R2: Extended Security Updates | Windows IT Pro Blog (microsoft.com)

Azure Hybrid Benefit FAQ