Lifecycle FAQ - Extended Security Updates

The Extended Security Update (ESU) program is a last resort option for customers who need to run certain legacy Microsoft products past the end of support. It includes Critical* and/or Important* security updates for a maximum of three years after the product's End of Extended Support date.

Extended Security Updates will be distributed if and when available. ESUs do not include new features, customer-requested non-security updates, or design change requests.

All Windows 7 and Windows Server 2008/R2 customers received an update on January 14, 2020 as the operating systems were in support until then. Updates for these operating systems after January 14, 2020 are provided for ESU customers only.

To learn more about year 2 of the ESU program for Windows 7 and Windows Server 2008, go here, and see our Windows 7 ESU FAQs.

* As defined by the Microsoft Security Response Center (MSRC).

* Extended Security Updates for select Embedded products are available via OEMs. All others are available via volume licensing.
** One additional year of ESU is available for Windows Server and SQL Server 2008 and 2008 R2 only on Azure.

For technical support, customers must purchase Extended Security Updates and have an active support plan in place to get technical support on a product that has moved beyond the Extended Support date. Please call 1-800-Microsoft to receive support.

For security updates only, customers can receive Extended Security Updates on the following products for free:

• SQL and Windows Server 2008/R2: Customers who move workloads to Azure Virtual Machines (IaaS) "as-is" will have free access to Extended Security Updates for both SQL Server and Windows Server 2008 and 2008 R2 for three years after the End of Support.

• Windows 7: Microsoft Windows Virtual Desktop provides a Windows 7 device with free Extended Security Updates through January 2023.

• Dynamics AX 2009 and AX 2012/R2: Dynamics customers who purchase Dynamics 365 Finance, Dynamics 365 Supply Chain, or Dynamics 365 Commerce with the intent to start their migration to the cloud will receive Extended Security Updates (ESU) at no charge until January 12, 2023. Contact your implementation partner or sales representative for more details.

Extended Security Updates are available through specific volume licensing programs. Contact your Microsoft partner or account team to learn more. ESUs for select Embedded products are available via your embedded device manufacturer. For ESUs available through the Dynamics 365 Cloud Migration offer, customers can purchase via the Cloud Service Provider (CSP) licensing program.

Coverage will be available in three consecutive 12-month increments following End of Support. Customers cannot buy partial periods (e.g., only 6 months). Extended Security Updates are transacted per year (12-month period), commencing with the End of Support date.

Eligible customers can use the Azure Hybrid Benefit (available to customers with active Software Assurance or Server Subscriptions) to obtain discounts on the license of Azure Virtual Machines (IaaS) or Azure SQL Database Managed Instance (PaaS).

No, customers must purchase ESU support separate from Unified Support. Once ESU support is purchased, customers can get technical support for products covered by the program.

SQL Server 2008/R2: Once SQL Server instances have been registered with the SQL Server registry service, customers can download the Extended Security Update packages using the link found in the Azure portal, if and when they are made available. Go here to learn more.

Customers who have purchased Windows ESUs can use the latest version of Configuration Manager, Current Branch to deploy and install Windows security updates.

Configuration Manager 2012 R2 will not be supported on Windows 7 or Windows Server 2008/R2 operating systems during their respective ESU phases.

For more information, go here.

.NET Framework 3.5 SP1, .NET Framework 4.5.2, .NET Framework 4.6, and .NET Framework 4.6.2 are supported during the Windows Server 2008 ESU until April 26, 2022. .NET Framework 4.5.2, 4.6, and 4.6.1 reach end of support on April 26, 2022. After this date, Windows Server 2008 ESU will include .NET Framework 4.6.2 and .NET Framework 3.5 SP1 only.

.NET Framework 3.5. SP1, and .NET Framework 4.5.2 through .NET Framework 4.8 are supported during Windows Server 2008 R2 and Windows 7 ESU phases until April 26, 2022. .NET Framework 4.5.2, 4.6, and 4.6.1 reach end of support on April 26, 2022. After this date, Windows Server 2008 R2 ESU and Windows 7 ESU will include .NET Framework 4.6.2 thru .NET Framework 4.8 and .NET Framework 3.5 SP1 only.

To learn more about the Extended Security Update Program, and End of Support and migration options for Window 7 and SQL and Windows Server 2008/R2, see the following articles:

• App Assure -- application compatibility and migration assistance
• SQL Server 2012 and Windows Server 2012/R2 ESU FAQs
• How to get ESU for Windows devices
• How to get year 2 ESU for Windows
• Windows 7 ESU FAQ
• How to get ESU for Windows Embedded 7 Standard
• IT Pro FAQ about the end of support for Windows 7
• Windows 7 and Office 365 ProPlus support
• SQL Server 2008/R2 and Windows Server 2008/R2 ESU FAQs
• SQL Server 2008/2008 R2 ESU resource site
• Extended Security Updates and Microsoft Endpoint Configuration Manager
• Dynamics 365 Cloud Migration Offer

1. Via Azure Arc: With Extended Security Updates enabled by Azure Arc.
2. Commercial Licensing: Acquire Extended Security Updates licenses (SKUs) through a Microsoft Commercial Licensing program.

For maximum flexibility and convenience, we recommend using Azure Arc.

You can acquire ESU licenses either directly from Microsoft or from your partner such as an EA Reseller or CSP partner (eligible to sell ESUs as of Oct. 1, 2023 for both types of ESUs mentioned above).

To qualify for ESU on-premises or in hosted environments, your server or operating system must meet one of the following prerequisites:

1. Be covered by an active Software Assurance (SA) plan acquired through any program, such as Enterprise Agreement (EA), Enterprise Agreement Subscription (EAS), Server & Cloud Enrollment (SCE), or Enrollment for Education Solutions (EES).
2. Have active subscription licenses acquired through any program, including Cloud Solution Provider (CSP).
3. Have been acquired as 'License-Included' services through a Service Provider License Agreement (SPLA) partner.

You can apply ESU enabled by Azure Arc and ESU licenses (SKUs) to any properly licensed server or operating system, whether it's deployed on-premises or on non-Azure clouds (including hosters). If you're running your OS in another cloud, make sure to adhere to the respective outsourcing or License Mobility policies for the underlying software.

Examples:

1. SPLA Scenario: If you've acquired your software from a SPLA partner, you can cover it with ESU licenses
2. BYOL Scenario: If you've brought your own licenses to a cloud hosting provider via your Outsourcing policy or License Mobility, you can cover your software with ESU licenses.
3. On-premises: If you're running your software on-prem, you can cover it with ESU licenses.

For Windows Server

When opting for ESU via Azure Arc for Windows Server, you have two licensing choices:

1. vCore Licensing: Pay based on the number of virtual cores (vCores) utilized by the operating system. This option uses the Standard edition rate. If you're operating multiple VMs, the cost will be calculated based on the total number of vCores across all VMs. There is an 8-core minimum per VM for vCore licensing. This option is only available when covering an OS running as a virtual machine.

2. pCore Licensing: Pay based on the number of physical cores (pCores) utilized by the host operating system. This option can use either edition. Note that with pCore licensing, up to 2 guest VMs running on a WS Standard host are covered (additional VMs require additional ESU licenses). With the WS Datacenter host, all VMs are covered without the need for additional licenses. There is a 16-core minimum per server for pCore licensing.This option is available for covering OS's running as a physical host, a virtual machine, or a mix of both.

For ESUs enabled by Azure Arc, you can select either licensing option, irrespective of how the underlying server or operating system is licensed. You can also mix between pCore and vCore licensing for your VMs. Make sure you follow the allowed virtualization entitlements for your underlying software.

For SQL Server

For SQL Server covered by ESUs enabled Azure Arc, the licensing is based on the number of virtual cores (vCores). If you have multiple VMs, you'll need to pay for all the vCores used across those VMs. There is a 4-core minimum per VM.

Special Note for SQL Server 2012: Before you can use Extended Security Updates enabled by Azure Arc for SQL Server 2012, you must first acquire the Year 1 Extended Security Updates SKU through Commercial Licensing. For more details on how to license through Commercial Licensing, please refer to the section titled “Licensing with Extended Security Updates licenses (SKUs) through Commercial Licensing.”

Back-billing for sign-ups after the end of support dates

For customers who enroll in ESUs enabled by Azure Arc after the end of support dates (July 11, 2023 for SQL Server 2012 Year 2 and October 10, 2023 for Windows Server 2012/R2), they will be billed a one-time upfront charge for the months they missed after the end of support date, with billing coming in at the end of the month. For example, if a customer enrolls in January 2024, they will receive a one-time back-bill for October, November, and December 2023 during their first month.

This also applies if a customer intermittently deactivates ESUs. For example, if a customer enrolls in October 2023, unenrolls in November 2023 and re-enrolls in March 2024, the re-enrollment will trigger back-billing for December 2023, January 2024, and February 2024.

Disaster Recovery Benefit servers

With ESU enabled by Azure Arc, you can link paid ESU coverage to your eligible Disaster Recovery Benefit servers without incurring additional cost. Make sure you follow the underlying Disaster Recovery Benefit policy for your software.

Development Environments

With ESU enabled by Azure arc, you can cover development and test instances licensed with Microsoft Developer edition licenses or Visual Studio subscriptions for no additional cost.

Overview

Extended Security Update (ESU) licenses (SKUs) obtained through Commercial Licensing are valid for annual coverage periods, such as Year 1 ESU, Year 2 ESU, and Year 3 ESU. Each ESU license entitles the specific server or operating system to receive security updates for the duration defined by that SKU (not by calendar year). For a comprehensive list of coverage periods, please see ESU Availability and End Dates.

Prerequisites

You may only acquire ESU Year 2 and Year 3 licenses if you've also acquired the ESU license(s) for the prior year(s). For example, before you acquire the ESU Year 2 license, you must also acquire ESU Year 1.

Determining the Number of Required ESU Licenses

ESU licenses correspond to the number of underlying core licenses of your server or operating system. You can license Windows Server and SQL Server based on either physical cores (pCores) or virtual cores (vCores). With ESUs sold through Commercial Licensing, the licenses must align with how you've licensed the underlying Windows Server or SQL Server.

• Physical Core Basis: If you choose this option for your underlying software, you'll need an ESU license for each physical core on the server. All validly licensed guest VMs running on the host are covered without the need for additional licenses. (Note that Windows Server and SQL Server software editions have different allowed virtualization entitlements for the number of guests allowed). Windows Server has an 8-core minimum per processor and 16-core minimum per server for pCore licensing. SQL Server has a 4-core per processor minimum.

• Virtual Core Basis: If you opt for this option for your underlying software, you'll require an ESU license for each virtual core assigned to the VM. Windows Server has an 8-core minimum per VM for vCore licensing. SQL Server has a 4-core per VM minimum.

In summary, when licensing with Commercial Licensing ESUs (SKUs), the number of ESU core licenses must align with how you've licensed the underlying Windows Server or SQL Server. Also, with the Commercial Licensing ESUs, you must ensure that the ESU edition matches the edition of your underlying software. For instance, if you have Windows Server Datacenter on your VM, you should acquire ESU Datacenter edition if you want to license at the vCore level. Note: The majority of WS 2012 licenses were sold on a per Processor or per Core basis (not on a per VM basis). For purposes of ESU core calculation, assume each 2 Processor license (the minimum per server) is equivalent to 16 pCores.

Examples:

1. Physical Core Scenario: A customer with a 16-core server licensed with Windows Server Datacenter on a pCore basis will need to acquire 16 ESU Datacenter licenses. This covers the entire server regardless of the number of guest VMs running on it.

2. Virtual Core Scenario: A customer with three 8-core VMs licensed with Windows Server Standard on a vCore basis will need 24 ESU licenses of the Standard edition to cover all VMs. When adding an additional VM, additional ESU licenses must be acquired accordingly. For VMs larger than eight vCores, i.e exceeding the minimum, add up all the vCores to get the correct price.Knowing your underlying license status for a given server enables you to accurately determine the number of Extended Security Update licenses you'll need.

Disaster Recovery Benefit servers

With ESU enabled by Azure Arc, you can link paid ESU coverage to your eligible Disaster Recovery Benefit servers without incurring additional cost. Make sure you follow the underlying Disaster Recovery Benefit policy for your software.

Development Environments

With ESU enabled by Azure arc, you can cover development and test instances licensed with Microsoft Developer edition licenses or Visual Studio subscriptions for no additional cost.

Pricing

On Azure: Customers who migrate workloads to Azure will have access to ESUs for SQL Server 2012, and Windows Server 2012 and 2012 R2 for three years after the End of Support dates for no additional charge above the cost of running the virtual machine. This currently includes Azure destinations such as Azure virtual machines (VMs), Dedicated Host, Azure VMware Solution, Nutanix Cloud Clusters on Azure, and Azure Stack portfolio.

For ESUs in Azure, Software Assurance is not required for free ESUs, but Software Assurance is required for Azure Hybrid Benefit.

On-premises and in hosted environments: Eligible customers will be able to purchase ESUs. Both ESUs enabled by Azure Arc and ESU licenses (SKUs) are priced as below:

Year 1: 100% of full license price annually*

Year 2: 100% of full license price annually

Year 3: 100% of full license price annually

* SQL Server 2012 Year 1 ESUs were 75% of the full license price

Full License price is the equivalent to a License-only purchase and not the License portion of an L+SA contract.

• SQL Server 2012 Extended Support ended on July 12, 2022.
• Windows Server 2012 and 2012 R2 Extended Support will end on October 10, 2023.

Learn more about lifecycle support deadlines.

No, organizations must purchase prior months/years of ESUs when onboarding late.

Free ESUs will be available for customers on Azure, which includes workloads running on Azure Virtual Machines, Azure Dedicated Host, Azure VMWare Solutions, Nutanix Cloud Clusters on Azure, and Azure Stack Hub/Edge/HCI.

No, there are no changes to the type of updates in 2012 ESUs. Windows Server will distribute “Critical” and “Important” patches and SQL Server will distribute “Critical” updates.

For more information on what is considered "critical" or "important," please visit the Security Update Severity Rating System webpage.

ESUs do not include new features, customer-requested non-security hotfixes, or design change requests. However, Microsoft may include non-security fixes as deemed necessary.

No, there are no changes to technical support options for ESUs customers in 2012. Customers can still use an active support contract such as Software Assurance or Premier/Unified Support on the relevant on-premises and hosted Windows Server 2012/2012 R2 and SQL Server 2012 product(s) to get technical support if they choose to stay on-premises or in hosted environments. Alternatively, if hosting on Azure, customers can use an Azure Support plan to get technical support.

The Enterprise and Standard editions of SQL Server for versions 2012 and the Standard, Datacenter, and Embedded editions of Windows Server for versions 2008/2008 R2 and 2012/2012 R2 are eligible for ESUs. The 2008 R2 version of Windows Server and SQL Server was the final version supporting X86 (32 bit) processors, and all subsequent versions are x64 only.

For SQL Server 2012: ESUs include provision of Security Updates rated "critical" for a maximum of three years after end of support.

For Windows Server 2008/2008 R2 and 2012/2012 R2: ESUs include provision of Security Updates and "Security Update Severity Rating System" rated "critical" and "important," for a maximum of three years after end of support.

ESUs will be distributed if and when available. ESUs do not include technical support, but you may use other Microsoft support plans to get assistance on your Server 2008/2008 R2 and 2012/2012 R2 questions on workloads covered by ESUs.

ESUs do not include new features, customer-requested non-security hotfixes, or design change requests. However, Microsoft may include non-security fixes as deemed necessary.

For more information on what is considered "critical" or "important," please visit the MSRC site.

For end of support events in the past, SQL Server provided only Critical Security Updates, which meets the compliance criteria of our enterprise customers. SQL Server does not ship a general monthly security update. Microsoft only provides on-demand SQL Server security updates (GDRs) for MSRC "Security Update Guide" here SQL Server is identified as an affected product.

If there are situations where new SQL Server important updates will not be provided and it is deemed critical by the customer but not by MSRC, we will work with the customer on a case-to-case basis to suggest appropriate mitigation.

ESUs enabled by Azure Arc: September 1, 2023.

License (non-Azure Arc) ESUs: October 1, 2023.

Cloud Solution Provider (CSP) partners will be able to offer ESUs for end of support versions of Windows Server and SQL Server.

Customers will then have the right to use licenses covered by ESUs on deployments on-prem or within outsourced environments running on authorized hosts. Customers may also apply ESU licenses to "license-included" workloads acquired from SPLA partners or CSP-Hosts.

No, customers can choose to cover as many 2012/2012 R2 on-premises servers, with Software Assurance, as they need for ESUs.

No. Customers cannot buy ESUs for SQL Server Express or Developer edition. However, they can move their workloads to Azure and get the ESUs for no additional charges above the cost of using the Azure subscription. Also, customers who have ESUs for SQL Server production workloads are permitted to apply updates to their servers running SQL Server Developer edition solely for development and test purposes.

Yes, customers must have active Software Assurance (or equivalent Subscription Licenses) for CALs and External Connector Licenses permitting access to Servers with active ESU coverage. However, ESU coverage is neither required nor available for CALs or External Connector Licenses.

Yes, customers need to run SQL Server 2012 as well as Windows Server 2012/2012 R2 with the latest Service Pack to apply ESUs. Microsoft will only produce updates which can be applied on the latest Service Pack.

For customers who do not have Software Assurance, the alternative option to get access to ESUs is to migrate to Azure. For variable workloads, we recommend that customers migrate on Azure via Pay-As-You-Go, which allows for scaling up or down at any time. For predictable workloads, we recommend that customers migrate to Azure via Server Subscription and Reserved Instances.

Customers who need to stay on-premises can purchase ESUs when they have an active Server Subscription via EAS, EES, CSP, or Licenses through an EA or SCE in addition to Software Assurance through those programs. Alternatively, customers can use Software Assurance through Open, Select, or MPSA agreements in addition to product licenses through an EA, EAS, SCE, EES, or Subscription through CSP. Licenses and Software Assurance do not need to be on the same agreement.

There is no deadline for migration of the Windows Server 2012/R2 or SQL Server 2012 workloads to Azure. However, we recommend customers complete migration before the end of support date so that they do not miss any ESUs. If customers miss a year of ESUs coverage, they may buy coverage for previous years at the same time they buy coverage for a current period.

To find more information about end of support dates, refer to: Search Product and Services Lifecycle Information -- Microsoft Lifecycle | Microsoft Docs.

Customers who purchase ESUs for production servers may also apply those security updates to servers licensed under Visual Studio (MSDN) subscriptions at no additional cost. There is no limit to the number of MSDN servers a customer can cover. If they purchase ESUs for a production server, those updates can be applied to any number of MSDN servers.

Yes. Premium Assurance is no longer available, but we will honor the terms of Premium Assurance for customers who already purchased it.

Please visit the Windows 7 EOS FAQ for more information about these products.

Software Assurance is required as a pre-requisite to ESUs. If you have Software Assurance or an equivalent subscription (even if it is on a different enrollment/program type) then you can buy ESUs for Software Assurance covered servers on your Microsoft Enterprise Agreement (EA), Enterprise Agreement Subscription (EAS), or Server and Cloud Enrollment (SCE).

ESU coverage is not required to be co-terminus with Software Assurance coverage, but customers must have at least one month of qualifying Software Assurance coverage remaining at the time a given year of ESUs coverage is purchased.

ESUs can be purchased by customers with active Software Assurance under the following programs - Enterprise Agreement (EA), Enterprise Subscription Agreement (EAS), Server & Cloud Enrollment (SCE), Enrollment for Education Solutions (EES), or Subscription through programs such as Cloud Solution Provider (CSP).

Apps running on pre-installed Windows Servers are recommended to be migrated to supported OS versions or Windows Server on Azure.

No, but customers can use an active support contract such as Software Assurance or Premier/Unified Support on the relevant on-premises product(s) to get technical support if they choose to stay on-premises. Alternatively, if hosting on Azure, customers can use an Azure Supportplan to get technical support.

No. If a customer has SQL Server 2012 or Windows Server 2012/2012 R2 and chooses to remain on-premises during a migration without ESUs, they cannot log a support ticket, even if they have a support plan. If they migrate to Azure, however, they can get support using their Azure Support Plan.

When customers have purchased ESUs and have an existing support plan:

Scenario: Customer can open a support ticket
Response: Yes

Scenario: Support Team will work to troubleshoot customer issue
Response: Yes

Scenario: Support Team will do a root cause analysis
Response: No

Scenario: Support Team will file a bug or a Design Change Request (DCR)
Response: No*

* If the issue is related to a security update, the Support Team will file a bug on the customer's behalf to solve the issue.

This program covers only the named product and the components that shipped with it. Unless explicitly stated the scope of this program does not extend to any other products or tools that the customer may be running on or with the covered product.

Microsoft is committed to helping customers upgrade or migrate to the cloud and will provide best effort support to troubleshoot an issue for SQL Server 2012 as well as Windows Server 2008/2008 R2 and 2012/2012 R2 covered under ESUs after the End of Support dates for those products.

No, customers must purchase ESUs separately. The cost of ESUs is not included in the price calculation of the Unified Support agreement. However, customers with Unified Support and ESUs can request technical support for the 2012 or 2012 R2 servers covered by ESUs. Onsite or proactive support will only be available to a customer if it is part of their Unified Support agreement.

Yes, organizations which have purchased ESUs can submit support incidents using any Microsoft Support offering, including Unified and Premier Support. Microsoft Partners are also able to submit tickets on behalf of their customers as long as the customer has purchased ESUs, though Partners will need a support agreement in place to do so.

All customers must call Microsoft Support in order to place a request for a technical support incident. Services Hub no longer shows end-of-life versions, such as SQL Server 2012, in the drop down.

As we continue to work to fully automate the validation process, the tech routers will validate whether a customer purchased ESUs. Once the customer is validated, a case will be created and routed to the appropriate queue for technical support. Customers should provide their Enterprise Agreement number or full customer name for validation.

If an investigation determines that resolution requires product enhancement available in a recent release, then a request will be made to the customer to upgrade to a more recent release where the capability is already available. No new product enhancements will be made for SQL 2012 or Windows Server 2008/2008 R2 or 2012/2012 R2.

No. The Extended Security Update (ESU) for Windows 7, Windows Server 2008/R2 and 2012/R2 will require online servicing (booted into the image taking the updates. See online servicing for more details).

ESUs are not supported in offline servicing mode. Applying ESUs in offline servicing mode will generate an error and updates will fail.

In Azure, ESUs are automatically applied.

In on-premises and hosted environments, there are two options to get ESUs:

1. ESUs enabled by Azure Arc, where you can enroll your machines in Windows Server 2012/R2 or SQL Server 2012 ESUs via the Azure portal, connect through Azure Arc, and pay for them as an Azure billed service. You pay a monthly fee for these ESUs. There are no keys needed; the new Azure subscription performs all the authentication and replaces the need for acquisition, deployment, and management of keys. Additionally, an inventory view will show the Extended Security Update coverage of all Windows and SQL Server machines enabled by Azure Arc. Learn more here.

2. Get ESUs through Windows Update, Windows Server Update Service, and Catalog. The Wsusscn2.cab will also include ESUs and be available during the Extended Security Update period. The latest Wsusscn2.cab file is available for download at the following location: Download Wsusscn2.cab.

This currently includes Azure destinations such as Azure virtual machines (VMs), Dedicated Host, Azure VMware Solution, Nutanix Cloud Clusters on Azure, and Azure Stack HCI.

Yes, customers with active Software Assurance or equivalent Server Subscriptions can leverage Azure Hybrid Benefit:

SQL Server: Customers can leverage existing on-premises license investments for discounted prices on SQL Server running on Azure SQL Managed Instance, Azure Virtual Machines, and Azure SQL Managed Instance enabled by Azure Arc in hybrid environments.

Windows Server: Customers can leverage existing on-premises license investments to save on Azure Virtual Machines.

Customers choosing to move to Azure IaaS can combine Azure Hybrid Benefit savings for SQL Server and Windows Server for increased cost savings.

Yes, ESUs will be available on Azure Virtual Machines on Azure Government regions.

The ESUs offer does not include technical support. Customers can use existing support agreements for questions. For customers who purchased Windows Server 2012/2012 R2 or SQL Server 2012 via SPLA, they should contact the SPLA provider, and that provider can use a Partner Support Agreement. Customers cannot contact Microsoft directly if they purchase through SPLA.

Yes, you have the flexibility to use a first- or third-party solution for the delivery of ESUs. Some common patching solutions include Update Management Center on Azure, Systems Center Configuration Manager, Qualys, SolarWinds, and Tanium.

Azure Arc-enabled servers can handle intermittent loss of connectivity but expects connectivity at least once in a thirty-day window. Azure Arc-enabled servers support public endpoint, proxy server, and private link as connectivity options. If you require ESU's in a disconnected scenario, you should apply ESU keys manually. Learn more about this here.

To activate ESUs for SQL Server 2012 enabled by Azure Arc subscription, follow these steps:

1. Make sure that you have purchased the Year 1 ESU.
2. Onboard the instances that you wish to cover to Azure Arc using one of the deployment options and set the license to Software Assurance.
3. Activate ESUs using the SQL Server Configuration blade on each connected machine.

While you can sign up for SQL Server ESUs enabled by Azure Arc any time after June 26, 2023, the billing will automatically start after September 1, 2023. We encourage you to sign up as soon as possible since the protection starts from the moment the ESUs subscription is activated.

Your monthly bill will show the aggregate cost of Extended Security Update subscriptions based on the editions, total number of server cores you subscribed to ESU, and the number of days in the month.

Your ESUs charges will stop immediately in the following cases:

1. You manually cancelled your subscription for any reason.
2. You migrated your SQL server to Azure; no manual cancellation is needed.
3. You upgraded your SQL server to a newer version; no manual cancellation is needed.
   If you cancel your ESUs or unsubscribe without migrating to Azure or upgrading to a newer version, the billing will stop billing immediately, but you will lose access to the future patches.

Win7/Server 2008 R2: Once the ESUs pre-requisite updates are installed (See the blog) phone activation can be done using the following steps.

Windows Server 2008 SP2: The support will be in an upcoming release, but the same steps will apply.

1. Slmgr.vbs /ipk <ESUs MAK Key> to install the product key

2. Get the Installation ID for the ESUs Key using the corresponding ESUs Activation ID (Refer to the blog for ESUs Activation IDs for each program). For example:

   C:\Windows\system32>slmgr /dti 77db037b-95c3-48d7-a3ab-a9c6d41093e0
   Microsoft (R) Windows Script Host Version 5.8
   Copyright (C) Microsoft Corporation. All rights reserved.
   Installation ID: 003842447833058154105433619200708862559816407110910340
   

3. Once you have the Installation ID, call the Microsoft Licensing Activation Center for your region; they will walk you through the steps to get the Confirmation ID, note it down.

4. Use the Slmgr /atp <Confirmation ID> <ESU Activation ID> to activate the ESUs SKU using the Confirmation Id obtained in the above step.

   C:\Windows\system32>slmgr /atp
   77db037b-95c3-48d7-a3ab-a9c6d41093e0
   Microsoft (R) Windows Script Host Version 5.8
   Copyright (C) Microsoft Corporation. All rights reserved.
   Confirmation ID for product 77db037b-95c3-48d7-a3ab-a9c6d41093e0 deposited successfully.
   

After this step, ESUs License is activated successfully (slmgr /dlv <Esu Activation Id> should show Licensed).

To get the ESUs on Nested VMs you need to install and activate the ESUs key on the top-level guest VM (aka Nested VM), even if you are running on Azure. For detailed instructions on how to purchase and activate ESUs (for both Windows Server 2008/ 2008 R2, 2012/2012 R2 and Windows 7), please see this blog post on Tech Community.

Customers may use their preferred tools for software and hardware inventory. Find links to inventory tools from Microsoft and our partners on the Azure migration center site.

Customers can migrate workloads from a VMware-based virtual machine on-premises to Azure Virtual Machines using Azure Site Recovery or use many partner tools. Another option is the new VMware on Azure solution, for a dedicated hosting experience.

Yes, customers need to have Software Assurance to take advantage of the BYOL program for SQL Server on Azure Virtual Machines as part of the License Mobility program. For customers without Software Assurance, we recommend customers move to Azure SQL Managed Instance for their 2008 environments. Customers can also migrate to pay-as-you-go Azure Virtual Machines. Software Assurance customers who license SQL by core also have the option of migrating to Azure using the Azure Hybrid Benefit.

Azure SQL Managed Instance is a service in Azure providing nearly 100% compatibility with SQL Server on-premises. Managed Instance provides built-in high availability/disaster recovery capabilities plus intelligent performance features and the ability to scale on the fly. Managed Instance also provides a version-less experience that takes away the need for manual security patching and upgrades. See the Azure pricing guidance page for more information on the BYOL program.

Windows Server instances running on Azure, including VMware and Nutanix solutions, as well as Azure connected devices Azure Stack Hub and Azure Stack HCI are eligible for free ESUs.

Apps running with or on SQL Server and Windows Server 2012 can generally be rehosted to Azure with no application code change. Customers that are ready to upgrade, either in Azure or on-premises, can review the Azure Marketplace Catalog, as well as consult with their software vendor to find the matrix of supported apps on all the Windows Server and SQL Server versions.

Note: Both Normal and Classic VMs with Windows Server are supported

Customers should assess their application infrastructure before migrating any server applications. They can learn more about the recommended process in the Azure Migration Center where you will learn how to leverage services like Azure Migrate to complete a readiness assessment including a cost estimate to run the application infrastructure in Azure. For further questions, work with your Microsoft partner, Microsoft Services, or your Account team to evaluate application readiness.

Azure Site Recovery can migrate these VMs to Azure but will convert them to an Azure IaaS Gen-1 virtual machine. Gen-2 is not supported at this time.

For Windows Server 2008 and 2008 R2, the following System Center versions are supported:

Product: SCOM (System Center Operations Manager) Server
System Center 2012 and 2012 R2: Yes*
System Center 2016: No
System Center 2019: No

Product: SCOM (System Center Operations Manager) (Agent Monitoring only)
System Center 2012 and 2012 R2: Yes
System Center 2016: Yes
System Center 2019: No

Product: VMM (Virtual Machine Manager) Server
System Center 2012 and 2012 R2: No
System Center 2016: No
System Center 2019: No

Product: VMM (Virtual Machine Manager) Agent
System Center 2012 and 2012 R2: Yes*
System Center 2016: No
System Center 2019: No

Product: Orchestrator
System Center 2012 and 2012 R2: Yes
System Center 2016: No
System Center 2019: No

Product: Service Manager
System Center 2012 and 2012 R2: Yes
System Center 2016: No
System Center 2019: No

Product: DPM (Data Protection Manager) Server
System Center 2012 and 2012 R2: Yes
System Center 2016: No
System Center 2019: No

Product: DPM (Data Protection Manager) Agent
System Center 2012 and 2012 R2: Yes
System Center 2016: Yes
System Center 2019: No

Product: ConfigMgr (System Center Configuration Manager)
System Center 2012 and 2012 R2: No
System Center 2016/2019 LTSB: No
System Center Current Branch: Yes**

* Windows Server 2008 R2 only

** For clients covered by ESUs, the latest released version of ConfigMgr (current branch) can deploy and install any security updates released. Client management features not related to patch management or operating system deployment will no longer be tested on the operating systems covered under ESUs. While they may continue to function in some capacity for a period, there are no guarantees. Microsoft recommends upgrading or migrating to current operating systems to receive client management support.

The SQL Management Pack for SCOM (System Center Operations Manager) can be used to monitor SQL Server 2008, 2008 R2 and 2012 instances. Customers can also use DPM (Data Protection Manager) to back up SQL Server 2008, 2008 R2, and 2012 instances. The following System Center versions are supported for these purposes:

Component: SCOM (System Center Operations Manager)
System Center 2012 and 2012 R2: Yes
System Center 2016: Yes
System Center 2019: No

Component: DPM (Data Protection Manager)
System Center 2012 and 2012 R2: Yes
System Center 2016: Yes
System Center 2019: No

ESUs will continue to be available through all normal channels -- Windows Update, Windows Server Update Service, and Catalog. Importing from the online catalog into Windows Server Update Services (WSUS) is not required.

The updates will show as not applicable in Windows Server Update Service (WSUS). If you try to install the ESUs manually from the catalog, it will fail to install.

Also, please note, ESUs activated devices and non-ESUs activated devices can exist in the same computer group for patch deployment.

Third party application control solutions are not a replacement for product security fixes.

SQL Server 2012 ESUs will be supported on Azure Stack. Windows Server 2012, 2012 R2, 2008 SP3 and 2008 R2 SP2 will be supported on Azure Stack.

Azure does not currently support shared storage clustering. For advice on how to configure a highly available SQL Server instance on Azure, refer to this guide on SQL Server High Availability.

• How to get ESUs for Windows Server
• How to get ESUs for SQL Server

• Azure Hybrid Benefit FAQ
• Windows 7 end of support