Please go here to search for your product's lifecycle.
What is the Extended Security Update (ESU) program?
The Extended Security Update (ESU) program is a last resort option for customers who need to run certain legacy Microsoft products past the end of support. They are not intended as a long-term solution, but rather as a temporary bridge to stay secure while one migrates to a newer, supported platform. It includes Critical* and/or Important* security updates up to three years after the product's End of Extended Support date.
Extended Security Updates will be distributed if and when available. ESUs do not include new features, customer-requested non-security updates, or design change requests.
The ESU program does not extend the product lifecycle or extend complete technical support for the product beyond its lifecycle. For more information, please refer to Support questions for ESUs.
* As defined by the Microsoft Security Response Center (MSRC).
What products are included?
ESU Availability and End Dates
Products | End of Extended Support/ESU Start Date | ESU End Date Year 1 | ESU End Date Year 2 | ESU End Date Year 3 | Type of Security Update |
---|---|---|---|---|---|
Windows Embedded POSReady 7* | October 12, 2021 | October 11, 2022 | October 10, 2023 | October 8, 2024 | Critical, Important |
SQL Server 2012 | July 12, 2022 | July 11, 2023 | July 9, 2024 | July 8, 2025 | Critical |
Windows Server 2012/R2 | October 10, 2023 | October 8, 2024 | October 14, 2025 | October 13, 2026 | Critical, Important |
SQL Server 2014 | July 9, 2024 | July 8, 2025 | July 14, 2026 | July 12, 2027 | Critical |
* Extended Security Updates for select Embedded products are available via OEMs. All others are available via volume licensing.
** One additional year of ESU is available for Windows Server and SQL Server 2008 and 2008 R2 only on Azure.
What are the best options for customers to stay secure on the latest versions of Windows Server or SQL Server?
To learn more about planning for end of support or retirement, click here for Extended Security Updates for SQL Server and Windows Server. For information on the latest versions of Windows Server and SQL Server and benefits of upgrade, visit the Windows Server and SQL Server pages on Microsoft.com.
How can I purchase ESUs?
On Azure: Extended Security Updates are free for VMs in Azure. These include destinations such as Azure Virtual Machines (VMs), Dedicated Host, Azure VMware Solution, Nutanix Cloud Clusters on Azure, and the Azure Stack portfolio. Eligible customers can use the Azure Hybrid Benefit (available to customers with active Software Assurance or Server Subscriptions) to obtain discounts on the license of Azure Virtual Machines (IaaS) or Azure SQL Database Managed Instance (PaaS).
On-premises/hybrid environments: Extended Security Updates are available through specific volume licensing programs or through Azure Arc-enabled servers for Windows Server and SQL Server. Contact your Microsoft partner or account team to learn more. ESUs for select Embedded products are available via your embedded device manufacturer. For ESUs available through the Dynamics 365 Cloud Migration offer, customers can purchase via the Cloud Service Provider (CSP) licensing program.
Regardless of where the customer wants to deploy ESUs, coverage will be available for up to three years following the end of support date for a particular product.
How do I install ESU updates?
On Azure: Applicable virtual machines (VMs) hosted in Azure are automatically enabled for ESUs if the VM is configured to receive updates, and these updates are provided free of charge.
On-premises/hybrid: Customers can install ESUs by accessing their multiple activation keys through the M365 Admin Center portal or directly installing ESUs through Azure Arc-enabled servers. Learn more about the installation details here for Windows Server and here for SQL Server installation.
ESU for Windows Server and SQL Server
How to obtain an ESU license outside of Azure?
Customers have two options for licensing ESU (ESU):
- Via Azure Arc-enabled servers: With Extended Security Updates enabled by Azure Arc.
- Commercial Licensing: Acquire Extended Security Updates licenses (SKUs) through a Microsoft Commercial Licensing program.
For maximum flexibility and convenience, we recommend using Azure Arc-enabled servers.
You can acquire ESU licenses either directly from Microsoft or from your partner such as an EA Reseller or CSP partner (eligible to sell ESUs as of Oct. 1, 2023 for both types of ESUs mentioned above).
Eligibility Criteria
To qualify for ESU on-premises or in hosted environments, your server or operating system must meet one of the following prerequisites:
- Be covered by an active Software Assurance (SA) plan acquired through any program, such as Enterprise Agreement (EA), Enterprise Agreement Subscription (EAS), Server & Cloud Enrollment (SCE), or Enrollment for Education Solutions (EES).
- Have active subscription licenses acquired through any program, including Cloud Solution Provider (CSP).
- Have been acquired as 'License-Included' services through a Service Provider License Agreement (SPLA) partner.
Note
"License-Included" means that you have obtained Windows Server or SQL Server licenses directly from a SPLA partner, rather than using your own licenses.
Deployment scenarios
You can apply ESU enabled by Azure Arc and ESU licenses (SKUs) to any properly licensed server or operating system, whether it's deployed on-premises or on non-Azure clouds (including hosters). If you're running your OS in another cloud, make sure to adhere to the respective outsourcing or License Mobility policies for the underlying software.
Examples:
- SPLA Scenario: If you've acquired your software from an SPLA partner, you can cover it with ESU licenses.
- BYOL Scenario: If you've brought your own licenses to a cloud hosting provider via your Outsourcing policy or License Mobility, you can cover your software with ESU licenses.
- On-premises: If you're running your software on-prem, you can cover it with ESU licenses.
Licensing with ESUs enabled by Azure Arc
For Windows Server 2012 and 2012 R2
When opting for ESU via Azure Arc-enabled servers for Windows Server 2012 and 2012 R2, you have two licensing choices:
- vCore Licensing: Pay based on the number of virtual cores (vCores) utilized by the operating system. This option uses the Standard edition rate. If you're operating multiple VMs, the cost will be calculated based on the total number of vCores across all VMs. There is an 8-core minimum per VM for vCore licensing. This option is only available when covering an OS running as a virtual machine.
- pCore Licensing: Pay based on the number of physical cores (pCores) utilized by the host operating system. This option can use either edition. Note that with pCore licensing, up to 2 guest VMs running on a WS Standard host are covered (additional VMs require additional ESU licenses). With the WS Datacenter host, all VMs are covered without the need for additional licenses. There is a 16-core minimum per server for pCore licensing. This option is available for covering OS's running as a physical host, a virtual machine, or a mix of both.
For ESUs enabled by Azure Arc, you can select either licensing option, irrespective of how the underlying server or operating system is licensed. You can also mix between pCore and vCore licensing for your VMs. Make sure you follow the allowed virtualization entitlements for your underlying software.
For SQL Server
For SQL Server covered by ESUs enabled Azure Arc, the licensing is based on the number of virtual cores (vCores). If you have multiple VMs, you'll need to pay for all the vCores used across those VMs. There is a 4-core minimum per VM.
Special Note for SQL Server 2012: Before you can use Extended Security Updates enabled by Azure Arc for SQL Server 2012, you must first acquire the Year 1 Extended Security Updates SKU through Commercial Licensing. For more details on how to license through Commercial Licensing, please refer to the section titled "Licensing with Extended Security Updates licenses (SKUs) through Commercial Licensing".
Back-billing for sign-ups after the end of support dates
For customers who enroll in ESUs enabled by Azure Arc after the end of support dates (July 11, 2023 for SQL Server 2012 Year 2 and October 10, 2023 for Windows Server 2012/R2), they will be billed a one-time upfront charge for the months they missed after the end of support date, with billing coming in at the end of the month. For example, if a customer enrolls in January 2024, they will receive a one-time back-bill for October, November, and December 2023 during their first month.
This also applies if a customer intermittently deactivates ESUs. For example, if a customer enrolls in October 2023, unenrolls in November 2023 and re-enrolls in March 2024, the re-enrollment will trigger back-billing for December 2023, January 2024, and February 2024.
Disaster Recovery Benefit servers
With ESU enabled by Azure Arc, you can link paid ESU coverage to your eligible Disaster Recovery Benefit servers without incurring additional cost. Make sure you follow the underlying Disaster Recovery Benefit policy for your software.
Development Environments
With ESU enabled by Azure Arc, you can cover development and test instances licensed with Microsoft Developer edition licenses or Visual Studio subscriptions for no additional cost.
Licensing with Extended Security Updates licenses (SKUs) through Commercial Licensing
Overview
Extended Security Updates licenses (SKUs) obtained through Commercial Licensing are valid for annual coverage periods, such as Year 1 ESU, Year 2 ESU, and Year 3 ESU. Each ESU license entitles the specific server or operating system to receive security updates for the duration defined by that SKU (not by calendar year). For a comprehensive list of coverage periods, please reference the table at the top of this page.
Prerequisites
You may only acquire ESU Year 2 and Year 3 licenses if you've also acquired the ESU license(s) for the prior year(s). For example, before you acquire the ESU Year 2 license, you must also acquire ESU Year 1.
Determining the Number of Required ESU Licenses
ESU licenses correspond to the number of underlying core licenses of your server or operating system. You can license Windows Server and SQL Server based on either physical cores (pCores) or virtual cores (vCores). With ESUs sold through Commercial Licensing, the licenses must align with how you've licensed the underlying Windows Server or SQL Server.
- Physical Core Basis: If you choose this option for your underlying software, you'll need an ESU license for each physical core on the server. All validly licensed guest VMs running on the host are covered without the need for additional licenses. (Note that Windows Server and SQL Server software editions have different allowed virtualization entitlements for the number of guests allowed.) Windows Server has an 8-core minimum per processor and 16-core minimum per server for pCore licensing. SQL Server has a 4-core per processor minimum.
- Virtual Core Basis: If you opt for this option for your underlying software, you'll require an ESU license for each virtual core assigned to the VM. Windows Server has an 8-core minimum per VM for vCore licensing. SQL Server has a 4-core per VM minimum.
In summary, when licensing with Commercial Licensing ESUs (SKUs), the number of ESU core licenses must align with how you've licensed the underlying Windows Server or SQL Server. Also, with the Commercial Licensing ESUs, you must ensure that the ESU edition matches the edition of your underlying software. For instance, if you have Windows Server Datacenter on your VM, you should acquire ESU Datacenter edition if you want to license at the vCore level.
Note
The majority of WS 2012 licenses were sold on a per Processor or per Core basis (not on a per VM basis). For purposes of ESU core calculation, assume each 2 Processor license (the minimum per server) is equivalent to 16 pCores.
Examples:
- Physical Core Scenario: A customer with a 16-core server licensed with Windows Server Datacenter on a pCore basis will need to acquire 16 ESU Datacenter licenses. This covers the entire server regardless of the number of guest VMs running on it.
- Virtual Core Scenario: A customer with three 8-core VMs licensed with Windows Server Standard on a vCore basis will need 24 ESU licenses of the Standard edition to cover all VMs. When adding an additional VM, additional ESU licenses must be acquired accordingly. For VMs larger than eight vCores, i.e exceeding the minimum, add up all the vCores to get the correct price.Knowing your underlying license status for a given server enables you to accurately determine the number of Extended Security Update licenses you'll need.
Disaster Recovery Benefit servers
With ESU (SKUs) through Commercial Licensing, you can also cover your eligible Disaster Recovery Benefit servers without acquiring additional licenses. Make sure you follow the underlying Disaster Recovery Benefit policy for your software.
Development Environments
With ESU (SKUs) through Commercial Licensing, you can cover development and test instances licensed with Microsoft Developer edition licenses or Visual Studio subscriptions for no additional cost.
Pricing
On Azure
Customers who migrate workloads to Azure will have access to ESUs for SQL Server 2012, and Windows Server 2012 and 2012 R2 for three years after the End of Support dates for no additional charge above the cost of running the virtual machine. This currently includes Azure destinations such as Azure virtual machines (VMs), Dedicated Host, Azure VMware Solution, Nutanix Cloud Clusters on Azure, and Azure Stack portfolio.
For ESUs in Azure, Software Assurance is not required for free ESUs, but Software Assurance is required for Azure Hybrid Benefit.
On-premises and in hosted environments
Year 1: 100% of full license price annually*
Year 2: 100% of full license price annually
Year 3: 100% of full license price annually
* SQL Server 2012 Year 1 ESUs were 75% of the full license price
Full License price is the equivalent to a License-only purchase and not the License portion of an L+SA contract.
General Questions for Windows Server 2012/R2 and SQL Server 2012 ESUs
When will SQL Server 2012 and Windows Server 2012/2012 R2 reach end of support?
- SQL Server 2012 Extended Support ended on July 12, 2022.
- Windows Server 2012 and 2012 R2 Extended Support ended on October 10, 2023.
Learn more about lifecycle support deadlines.
Can I onboard later and buy just Year 2 of 2012 ESUs?
No, organizations must purchase prior months/years of ESUs when onboarding late.
Where can I get free ESUs on Azure?
Free ESUs will be available for customers on Azure, which includes workloads running on Azure Virtual Machines, Azure Dedicated Host, Azure VMWare Solutions, Nutanix Cloud Clusters on Azure, and Azure Stack Hub/Edge/HCI.
Are there any changes to the type of updates in 2012 ESUs compared to 2008 ESUs?
No, there are no changes to the type of updates in 2012 ESUs. Windows Server will distribute "Critical" and "Important" patches and SQL Server will distribute "Critical" updates.
For more information on what is considered "critical" or "important," please visit the Security Update Severity Rating System webpage.
ESUs do not include new features, customer-requested non-security hotfixes, or design change requests. However, Microsoft may include non-security fixes as deemed necessary.
What editions of SQL Server 2012 and Windows Server 2012/2012 R2 are eligible for ESUs?
The Enterprise and Standard editions of SQL Server for versions 2012 and the Standard, Datacenter, and Embedded editions of Windows Server for versions 2012/2012 R2 are eligible for ESUs.
What do ESUs include?
For SQL Server 2012: ESUs include provision of Security Updates rated "critical" for a maximum of three years after end of support.
For Windows Server 2012/2012 R2: ESUs include provision of Security Updates and "Security Update Severity Rating System" rated "critical" and "important," for a maximum of three years after end of support.
ESUs will be distributed if and when available. ESUs do not include new features, customer-requested non-security hotfixes, or design change requests. However, Microsoft may include non-security fixes as deemed necessary.
For more information on what is considered "critical" or "important," please visit the MSRC site.
Why do ESUs for SQL Server 2012 only offer "critical" updates?
For end of support events in the past, SQL Server provided only Critical Security Updates, which meets the compliance criteria of our enterprise customers. SQL Server does not ship a general monthly security update. Microsoft only provides on-demand SQL Server security updates (GDRs) for MSRC "Security Update Guide" here SQL Server is identified as an affected product.
If there are situations where new SQL Server important updates will not be provided and it is deemed critical by the customer but not by MSRC, we will work with the customer on a case-to-case basis to suggest appropriate mitigation.
When will ESUs be available for purchase in the CSP program?
- ESUs enabled by Azure Arc: September 1, 2023.
- License (non-Azure Arc) ESUs: October 1, 2023.
How can customers and partners use ESUs purchased through the CSP program?
Cloud Solution Provider (CSP) partners will be able to offer ESUs for end of support versions of Windows Server and SQL Server. Customers will then have the right to use licenses covered by ESUs on deployments on-prem or within outsourced environments running on authorized hosts. Customers may also apply ESU licenses to "license-included" workloads acquired from SPLA partners or CSP-Hosts.
Are customers required to cover all on-premises servers with active Software Assurance to get ESUs on-premises?
No, customers can choose to cover as many 2012/2012 R2 on-premises servers, with Software Assurance, as they need for ESUs.
Can customers buy ESUs for SQL Server Express or Developer edition?
No. Customers cannot buy ESUs for SQL Server Express or Developer edition. However, they can move their workloads to Azure and get the ESUs for no additional charges above the cost of using the Azure subscription. Also, customers who have ESUs for SQL Server production workloads are permitted to apply updates to their servers running SQL Server Developer edition solely for development and test purposes.
Do I need Software Assurance on my CALs to access servers covered by ESUs?
Yes, customers must have active Software Assurance (or equivalent Subscription Licenses) for CALs and External Connector Licenses permitting access to Servers with active ESU coverage. However, ESU coverage is neither required nor available for CALs or External Connector Licenses.
Do SQL Server 2012 customers need to be running the most current Service Pack to benefit from ESUs?
Yes, customers need to run SQL Server 2012 with the latest Service Pack to apply ESUs. Microsoft will only produce updates which can be applied on the latest Service Pack.
What are the options for SQL Server 2012 as well as Windows Server 2012/2012 R2 customers without Software Assurance?
For customers who do not have Software Assurance, the alternative option to get access to ESUs is to migrate to Azure. For variable workloads, we recommend that customers migrate on Azure via Pay-As-You-Go, which allows for scaling up or down at any time. For predictable workloads, we recommend that customers migrate to Azure via Server Subscription and Reserved Instances.
Customers who need to stay on-premises can purchase ESUs when they have an active Server Subscription via EAS, EES, CSP, or Licenses through an EA or SCE in addition to Software Assurance through those programs. Alternatively, customers can use Software Assurance through Open, Select, or MPSA agreements in addition to product licenses through an EA, EAS, SCE, EES, or Subscription through CSP. Licenses and Software Assurance do not need to be on the same agreement.
Is there a deadline for when servers need to be migrated to Azure, or can customers wait until the end of support dates?
There is no deadline for migration of the Windows Server 2012/R2 or SQL Server 2012 workloads to Azure. However, we recommend customers complete migration before the end of support date so that they do not miss any ESUs. If customers miss a year of ESUs coverage, they may buy coverage for previous years at the same time they buy coverage for a current period.
To find more information about end of support dates, refer to: Search Product and Services Lifecycle Information -- Microsoft Lifecycle | Microsoft Docs.
Can customers cover non-production servers licensed under Visual Studio (MSDN) subscriptions with ESUs for on-premises environments?
Customers who purchase ESUs for production servers may also apply those security updates to servers licensed under Visual Studio (MSDN) subscriptions at no additional cost. There is no limit to the number of MSDN servers a customer can cover. If they purchase ESUs for a production server, those updates can be applied to any number of MSDN servers.
Does this offer replace Premium Assurance?
Premium Assurance is no longer available, but we will honor the terms of Premium Assurance for customers who already purchased it.
If existing licenses were bought with Software Assurance on Select or through a Microsoft Products and Services Agreement, can ESUs still be purchased under a different but eligible agreement?
Software Assurance is required as a pre-requisite to ESUs. If you have Software Assurance or an equivalent subscription (even if it is on a different enrollment/program type) then you can buy ESUs for Software Assurance covered servers on your Microsoft Enterprise Agreement (EA), Enterprise Agreement Subscription (EAS), or Server and Cloud Enrollment (SCE).
What happens if Software Assurance is not renewed on time, or at all?
ESU coverage is not required to be co-terminus with Software Assurance coverage, but customers must have at least one month of qualifying Software Assurance coverage remaining at the time a given year of ESUs coverage is purchased.
What happens if a customer has a Windows Server OEM license and wants to add ESUs?
ESUs can be purchased by customers with active Software Assurance under the following programs - Enterprise Agreement (EA), Enterprise Subscription Agreement (EAS), Server & Cloud Enrollment (SCE), Enrollment for Education Solutions (EES), or Subscription through programs such as Cloud Solution Provider (CSP).
Apps running on pre-installed Windows Servers are recommended to be migrated to supported OS versions or Windows Server on Azure.
Support questions for ESUs
Can I get support after the Extended Support date, without purchasing Extended Security Updates?
Extended Security Updates licenses (ESUs) do not include support unless the customer is covered by one of the following support plans: Pay Per Incident, Unified, and Premier Support for Partners. Support for Products with ESU coverage is limited to the following issues:
- Deployment, installation, and activation of ESU keys, licenses and updates
- Bugs/regressions introduced with the installation of a security update
- Troubleshooting services and assistance to resolve known and documented issues related to the underlying operating systems
Support for Products with ESU coverage does not include general technical support and troubleshooting assistance for the underlying products except as specified above. Issue resolution is not guaranteed.
Is technical support included when you purchase ESUs?
No, technical support is not included. Customers must purchase a paid support plan (Pay Per Incident, Unified, and Premier Support for Partners) to leverage technical support.
Can customers get technical support for SQL Server 2012 or Windows Server 2012/2012 R2 after the End of Support dates, without purchasing ESUs?
No. If a customer has SQL Server 2012 or Windows Server 2012/2012 R2 without ESUs, they cannot log a support ticket, even if they have a support plan.
What are the support expectations when requesting support for a product utilizing ESUs?
When customers have purchased ESUs and have an existing paid support plan:
Scenario: Customer can open a support ticket regarding installation of ESU keys / licensing / activation.
Response: Yes
Scenario: Customer can open a support ticket regarding general product issues.
Response: Yes
Scenario: Customer can open a support ticket regarding problems introduced as a result of installation of an ESU.
Response: Yes, if it is determined that the issue is caused by the ESU, the Support Team will file a bug on the customer's behalf.
A partial list of items that are deemed out of scope for this support include:
- Root Cause Analysis
- Development Change Requests
- File product bugs
- Build out lab deployments to attempt to reproduce a customer reported problem or for usage as a proof of concept
- Escalation to product development team resources
- Configuration and setup assistance related to new installations or deployments
- Performance optimizations and tuning
This program covers only the named product and the components that shipped with it. Unless explicitly stated the scope of this program does not extend to any other products or tools that the customer may be running on or with the covered product.
Does Unified Support include ESUs?
No, customers must purchase ESUs separately. Customers with Unified Support and ESUs can request technical support for issues per the scope noted above.
How are customers verified for limited technical support for ESU and can they submit support incidents online?
All customers must call Microsoft support with their Agreement number to be verified as having acquired ESU. A support incident will be created for ESU customers. Services Hub does not list any products that have reached end of support in the dropdown menu.
How do Tech Routers know who have purchased ESUs?
As we continue to work to fully automate the validation process, the tech routers will validate whether a customer purchased ESUs. Once the customer is validated, a case will be created and routed to the appropriate queue for ESU technical support. Customers should provide their Enterprise Agreement number or full customer name for validation.
What is the support expectation if a customer encounters an issue that requires a new feature?
If an investigation determines that resolution requires product enhancement available in a recent release, then a request will be made to the customer to upgrade to a more recent release where the capability is already available. No new product enhancements will be made after any product reaches end of support or retirement.
Is offline servicing available for operating system images covered by ESUs?
No. The Extended Security Update (ESU) for Windows Server 2012/R2 will require online servicing (booted into the image taking the updates. See online servicing for more details).
ESUs are not supported in offline servicing mode. Applying ESUs in offline servicing mode will generate an error and updates will fail.
How will ESUs be distributed?
In Azure, ESUs are automatically applied.
In on-premises and hosted environments, there are two options to get ESUs:
ESUs enabled by Azure Arc-enabled servers, where you can enroll your machines in Windows Server 2012/R2 or SQL Server 2012 ESUs via the Azure portal, connect through Azure Arc-enabled servers, and pay for them as an Azure billed service. You pay a monthly fee for these ESUs. There are no keys needed; the new Azure subscription performs all the authentication and replaces the need for acquisition, deployment, and management of keys. Additionally, an inventory view will show the Extended Security Update coverage of all Windows and SQL Server machines enabled by Azure Arc. Learn more here.
Get ESUs through Windows Update, Windows Server Update Service, and Catalog. The Wsusscn2.cab will also include ESUs and be available during the Extended Security Update period. The latest Wsusscn2.cab file is available for download at the following location: Download Wsusscn2.cab.
ESUs on Azure
What Azure destinations are eligible for free ESUs?
This currently includes Azure destinations such as Azure virtual machines (VMs), Dedicated Host, Azure VMware Solution, Nutanix Cloud Clusters on Azure, and Azure Stack HCI.
Can customers leverage Azure Hybrid Benefit for SQL Server 2012 as well as Windows Server 2012/2012 R2 versions?
Yes, customers with active Software Assurance or equivalent Server Subscriptions can leverage Azure Hybrid Benefit:
SQL Server: Customers can leverage existing on-premises license investments for discounted prices on SQL Server running on Azure SQL Managed Instance, Azure Virtual Machines, and Azure SQL Managed Instance enabled by Azure Arc in hybrid environments.
Windows Server: Customers can leverage existing on-premises license investments to save on Azure Virtual Machines.
Customers choosing to move to Azure IaaS can combine Azure Hybrid Benefit savings for SQL Server and Windows Server for increased cost savings.
Can customers get free ESUs on Azure Government regions?
Yes, ESUs will be available on Azure Virtual Machines on Azure Government regions.
How do I get technical support for ESUs for my 2012/2012 R2 server workloads if I am running them on a hosted environment?
The ESUs offer does not include technical support beyond the security updates in scope. For customers who purchased Windows Server 2012/2012 R2 or SQL Server 2012 via SPLA, they should contact the SPLA provider, and that provider can use a Partner Support Agreement. Customers cannot contact Microsoft directly if they purchase through SPLA.
ESUs in on-premises and other cloud/hosting environments
Will the Azure Arc-enabled servers solution work with third party update tools (ex. SolarWinds or Qualys)?
Yes, you have the flexibility to use a first- or third-party solution for the delivery of ESUs. Some common patching solutions include Update Management Center on Azure, Systems Center Configuration Manager, Qualys, SolarWinds, and Tanium.
How should I deploy ESUs if I need to operate completely offline and can't be connected to Azure?
Azure Arc-enabled servers can handle intermittent loss of connectivity but expects connectivity at least once in a thirty-day window. Azure Arc-enabled servers support public endpoint, proxy server, and private link as connectivity options. If you require ESU's in a disconnected scenario, you should apply ESU keys manually. Learn more about this here.
How do I sign up for ESUs for SQL Server 2012 enabled by Azure Arc?
To activate ESUs for SQL Server 2012 enabled by Azure Arc subscription, follow these steps:
- Make sure that you have purchased the Year 1 ESU.
- Onboard the instances that you wish to cover to Azure Arc using one of the deployment options and set the license to Software Assurance.
- Activate ESUs using the SQL Server Configuration blade on each connected machine.
How will SQL Server ESUs enabled by Azure Arc show up on my bill?
While you can sign up for SQL Server ESUs enabled by Azure Arc any time after June 26, 2023, the billing will automatically start after September 1, 2023. We encourage you to sign up as soon as possible since the protection starts from the moment the ESUs subscription is activated.
Your monthly bill will show the aggregate cost of Extended Security Update subscriptions based on the editions, total number of server cores you subscribed to ESU, and the number of days in the month.
How do I cancel my ESUs subscription if I migrate to Azure in the middle of my subscription?
Your ESUs charges will stop immediately in the following cases:
- You manually cancelled your subscription for any reason.
- You migrated your SQL server to Azure; no manual cancellation is needed.
- You upgraded your SQL server to a newer version; no manual cancellation is needed.
If you cancel your ESUs or unsubscribe without migrating to Azure or upgrading to a newer version, the billing will stop billing immediately, but you will lose access to the future patches.
Product and implementation questions for ESUs
How can I do offline activation?
Windows Server 2012/R2: Once the ESUs pre-requisite updates are installed, please refer to this blog for offline activation.
How can I get ESUs on Nested VMs?
To get the ESUs on Nested VMs you need to install and activate the ESUs key on the top-level guest VM (aka Nested VM), even if you are running on Azure. For detailed instructions on how to purchase and activate ESUs (for both Windows Server 2008/ 2008 R2, 2012/2012 R2 and Windows 7), please see this blog post on Tech Community.
Are there recommended tools to inventory my 2012 environment?
Customers may use their preferred tools for software and hardware inventory. Find links to inventory tools from Microsoft and our partners on the Azure migration center site.
What are the options for migrating VMware-based workloads from on-premises to Azure?
Customers can migrate workloads from a VMware-based virtual machine on-premises to Azure Virtual Machines using Azure Site Recovery or use many partner tools. Another option is the new VMware on Azure solution, for a dedicated hosting experience.
If a SQL Server 2012 customer wants to bring their own license (BYOL), are they required to have Software Assurance coverage?
Yes, customers need to have Software Assurance to take advantage of the BYOL program for SQL Server on Azure Virtual Machines as part of the License Mobility program. For customers without Software Assurance, we recommend customers move to Azure SQL Managed Instance for their 2008 environments. Customers can also migrate to pay-as-you-go Azure Virtual Machines. Software Assurance customers who license SQL by core also have the option of migrating to Azure using the Azure Hybrid Benefit.
Azure SQL Managed Instance is a service in Azure providing nearly 100% compatibility with SQL Server on-premises. Managed Instance provides built-in high availability/disaster recovery capabilities plus intelligent performance features and the ability to scale on the fly. Managed Instance also provides a version-less experience that takes away the need for manual security patching and upgrades. See the Azure pricing guidance page for more information on the BYOL program.
How do customers know if an application currently running on Windows Server 2012/R2 or SQL Server 2012 will run on Azure or on a newer version of Windows Server or SQL Server?
Windows Server instances running on Azure, including VMware and Nutanix solutions, as well as Azure connected devices Azure Stack Hub and Azure Stack HCI are eligible for free ESUs.
Apps running with or on SQL Server and Windows Server 2012 can generally be rehosted to Azure with no application code change. Customers that are ready to upgrade, either in Azure or on-premises, can review the Azure Marketplace Catalog, as well as consult with their software vendor to find the matrix of supported apps on all the Windows Server and SQL Server versions.
Note
Both Normal and Classic VMs with Windows Server are supported.
Customers should assess their application infrastructure before migrating any server applications. They can learn more about the recommended process in the Azure Migration Center where they will learn how to leverage services like Azure Migrate to complete a readiness assessment including a cost estimate to run the application infrastructure in Azure. For further questions, work with your Microsoft partner, Microsoft Services, or your Account team to evaluate application readiness.
Can customers download ESUs by synchronizing Windows Server Update Services with the Microsoft Update site, or is it necessary to import from the online catalog?
ESUs will continue to be available through all normal channels -- Windows Update, Windows Server Update Service, and Catalog. Importing from the online catalog into Windows Server Update Services (WSUS) is not required.
If Windows Server Update Services has approved ESUs for WS 2012 / 2012 R2 but has not activated the ESUs key, will Windows Update cause an error?
The updates will show as not applicable in Windows Server Update Service (WSUS). If you try to install the ESUs manually from the catalog, it will fail to install. Also, please note, ESUs activated devices and non-ESUs activated devices can exist in the same computer group for patch deployment.
Can I use 3rd-party application control solutions to protect my SQL Server environment, instead of installing SQL Server security updates after the End of Support date?
Third party application control solutions are not a replacement for product security fixes.
What versions of SQL Server and Windows Server can get ESUs in Azure Stack?
SQL Server 2012 ESUs will be supported on Azure Stack. Windows Server 2012, 2012 R2 will be supported on Azure Stack.
For customers with a SQL Server 2012 cluster using shared storage, what is the guidance for migrating to Azure?
Azure does not currently support shared storage clustering. For advice on how to configure a highly available SQL Server instance on Azure, refer to this guide on SQL Server High Availability.
Additional resources
How can I learn more?
To learn more about the Extended Security Update Program, and End of Support and migration options, see the following articles:
- App Assure -- application compatibility and migration assistance
- SQL Server 2012 and Windows Server 2012/R2 ESU FAQs
- How to get ESU for Windows devices
- How to get year 2 ESU for Windows
- Windows 7 ESU FAQ
- How to get ESU for Windows Embedded 7 Standard
- IT Pro FAQ about the end of support for Windows 7
- Windows 7 and Office 365 ProPlus support
- SQL Server 2008/R2 and Windows Server 2008/R2 ESU FAQs
- SQL Server 2008/2008 R2 ESU resource site
- Extended Security Updates and Microsoft Endpoint Configuration Manager
Documentation
How to get ESUs for Windows Server
How to get ESUs for SQL Server
Obtaining Extended Security Updates for eligible Windows devices - Microsoft Community Hub
Microsoft Lifecycle Policy | Microsoft Learn
All Azure Arc-enabled servers Learn documentation:
Deliver Extended Security Updates for Windows Server 2012 - Azure Arc | Microsoft Learn
Pricing -- Azure Arc | Microsoft Azure
Windows Server 2012/R2: Extended Security Updates | Windows IT Pro Blog (microsoft.com)