How does SQL Server licensing work under the IaaS model for end-of-life SQL Server versions, whether the SQL Server VM is deployed from the Azure Marketplace image or installed manually on a non-Marketplace VM?

Question

I would like clarification on how licensing, support, and Extended Security Updates are handled for end-of-life SQL Server versions running on Azure IaaS virtual machines.

Specifically, for SQL Server 2016 and SQL Server 2019 running on Azure VMs under different licensing models:

• Azure Hybrid Benefit (AHB) enabled
• Azure Pay-As-You-Go (PAYG) licensing (Standard or Enterprise editions)

Please clarify the following:

1. After SQL Server reaches its end-of-support date, are Extended Security Updates automatically included for SQL Server instances running on Azure VMs?
2. Is any additional license, subscription, or agreement required to receive ESUs, or are they included as part of the Azure offering?
3. Are there any differences in ESU eligibility, compliance requirements, or costs between:
   • SQL Server licensed through Azure Hybrid Benefit (customer-owned licenses), and
     • SQL Server licensed through Azure's native Pay-As-You-Go model?
     1. How are security updates delivered and managed in each licensing scenario?

Additionally, confirm whether ESU eligibility applies to both of the following deployment models?

• A SQL Server VM deployed from the Azure Marketplace with SQL Server pre-installed.
• A standard Azure VM where SQL Server is installed separately after VM deployment.

Do Extended Security Updates cover both scenarios, or are there any differences in eligibility, licensing requirements, support coverage, or compliance considerations?

My objective is to understand the cost, licensing, compliance, and update implications of continuing to run older SQL Server versions on Azure IaaS under different deployment and licensing configurations.

Answer 1

Hi @$@chin

For SQL Server running on Azure Virtual Machines, it is helpful to separate SQL Server licensing from Extended Security Updates (ESUs).

Azure Hybrid Benefit (AHB) and Pay-As-You-Go (PAYG) primarily determine how the SQL Server license is acquired and billed. With PAYG, the SQL Server license cost is included in the Azure VM pricing. With AHB, eligible existing SQL Server licenses are used to reduce licensing costs in Azure. ESU eligibility is separate from the licensing model itself.

Regarding SQL Server 2016, Microsoft extended support ends on July 14, 2026. After that date, customers who continue running SQL Server 2016 may require Extended Security Updates. Microsoft has announced updated ESU pricing and licensing guidance for offerings released on or after April 1, 2026. Therefore, customers should review the latest ESU documentation and licensing terms rather than assuming ESUs are automatically included at no additional cost.

For SQL Server 2019, ESUs are not currently relevant because SQL Server 2019 remains within its supported lifecycle. Extended support continues until January 8, 2030, and normal security updates continue to be provided during that period.

For deployment models, both Azure Marketplace SQL Server images and self-installed SQL Server instances on Azure VMs can participate in SQL Server on Azure VM management scenarios. Marketplace images are typically registered automatically with the SQL IaaS Agent Extension. For manually installed SQL Server instances, Microsoft recommends registering the VM with the SQL IaaS Agent Extension to enable license management, Azure Hybrid Benefit configuration, automated patching, backup integration, and other SQL VM management capabilities.

Extended Security Updates, when applicable, are security-only updates intended to help customers continue protecting out-of-support SQL Server workloads while they plan upgrades or migrations. ESUs do not include new features, design changes, or general product enhancements.

References

• SQL Server 2016 lifecycle
• SQL Server 2019 lifecycle
• What are Extended Security Updates for SQL Server?
• https://www.microsoft.com/en-us/licensing/news/services-pricing-consistency-update
• SQL Server IaaS Agent extension for Azure VMs
• FAQ for SQL Server on Azure VMs
• https://learn.microsoft.com/en-us/azure/azure-sql/virtual-machines/windows/sql-agent-extension-automatic-registration-all-vms?view=azuresql

Answer 2

Welcome to Microsoft Q&A

Hello $@chin, I hope you are doing well,

When a SQL Server version (such as SQL Server 2016, which reaches End of Support in July 2026) is hosted on an Azure Virtual Machine, Extended Security Updates are provided completely free of charge for up to three years. You do not need to purchase a separate ESU subscription, agreement, or Software Assurance specifically for the ESU coverage. The ESUs are included natively as a platform benefit of running the workload on Azure IaaS.

• https://learn.microsoft.com/en-us/sql/sql-server/end-of-support/extended-security-updates-frequently-asked-questions?view=sql-server-ver17
• https://learn.microsoft.com/en-us/azure/azure-sql/virtual-machines/windows/sql-server-extend-end-of-support?view=azuresql

Azure Hybrid Benefit (AHB) vs. Pay-As-You-Go (PAYG)

There is absolutely no difference in ESU eligibility or ESU cost between these two models. Both receive free ESUs. The only difference is how the base SQL Server license is billed:

• PAYG: You pay for the SQL Server license by the second as part of your Azure compute bill.
• AHB: You apply your existing on-premises SQL Server licenses (which must have active Software Assurance) .

Delivery and Management

ESUs are published directly to the Microsoft Windows Update channels. Because the underlying infrastructure is Azure, Microsoft Update automatically detects the Azure fabric and presents the ESUs for download. To manage this effectively, it is highly recommended to use the SQL IaaS Agent Extension to configure Automated Patching and maintenance windows.

Marketplace Images vs. Custom/Self-Installed VMs

ESU eligibility applies equally to both deployment models. However, there is a strict compliance and manageability difference:

• Marketplace Images: Come with the SQL IaaS Agent Extension pre-installed and natively integrated into Azure Resource Manager.
• Self-Installed (Custom) VMs: You are fully eligible for free ESUs. However, to remain compliant with Azure licensing policies and to utilize AHB, you must manually register the VM with the SQL IaaS Agent Extension. While ESUs will still patch via Windows Update natively, registering the extension ensures your licensing metadata is correct and unlocks automated patching capabilities.
• https://learn.microsoft.com/en-us/azure/azure-sql/virtual-machines/windows/sql-server-iaas-agent-extension-automate-management?view=azuresql&tabs=azure-portal

😊 If my answer helped you resolve your issue, please consider marking it as the correct answer. This helps others in the community find solutions more easily. Thanks!

Answer 3

For SQL Server on Azure Virtual Machines, licensing and Extended Security Updates (ESUs) behave differently from on-premises, but they are consistent across deployment types (Marketplace image vs. self-installed) and license models (Azure Hybrid Benefit vs. pay-as-you-go) in the following ways.

1. Are ESUs automatically included on Azure VMs after end of support?
   Yes. For supported out-of-support versions (for example, SQL Server 2014 as shown in the context), SQL Server on Azure VMs automatically receives Extended Security Updates for up to three years after the end of the SQL Server lifecycle support. This ESU benefit is part of the SQL Server on Azure VM offering:

• “Extended security updates – Automatically receive security updates for your SQL Server on Azure VMs, up to three years after extended SQL Server lifecycle support ends.”

This behavior applies to SQL Server on Azure VMs as a platform feature, not tied to a specific licensing model.

2. Is any additional license, subscription, or agreement required to receive ESUs on Azure VMs?
   For SQL Server on Azure VMs, ESUs for eligible out-of-support versions are included as part of the Azure service and are not purchased separately when running in Azure IaaS:

• For SQL Server 2014 specifically, Azure services “have access to ESUs … for up to three years after the end of support, at no extra charge beyond the cost of running the Azure service.”
• ESUs are “applied automatically to the VM whether or not your SQL Server VM is registered with the SQL IaaS Agent extension.”

On-premises or hosted environments require separate ESU purchase and Software Assurance, but that requirement does not apply when using the Azure-native ESU benefit for SQL Server on Azure VMs.

3. Differences between Azure Hybrid Benefit vs. Pay-As-You-Go for ESUs

From the context, ESU eligibility and delivery on Azure VMs are independent of whether SQL Server is licensed via Azure Hybrid Benefit (AHB) or pay-as-you-go (PAYG):

• ESUs are listed as a feature of SQL Server on Azure VMs as a service, not as a feature of a particular license type.
• The SQL IaaS Agent extension FAQ explicitly states: “Extended Security Updates (ESU) are applied automatically to the VM whether or not your SQL Server VM is registered with the SQL IaaS Agent extension.”
• Azure Hybrid Benefit is a cost and compliance mechanism that lets customer-owned licenses be applied to Azure VMs to reduce SQL licensing cost; it does not change ESU entitlement for SQL Server on Azure VMs.

Therefore, based on the provided information:

• ESU eligibility: Same for AHB and PAYG when running as SQL Server on Azure VMs for supported out-of-support versions.
• Compliance: AHB requires that customer-owned licenses with Software Assurance be correctly declared (for example, via the SQL IaaS Agent extension) to be compliant, but this is about licensing, not ESU entitlement.
• Cost: ESUs themselves are at no extra charge on Azure VMs for eligible versions; the cost difference between AHB and PAYG is in how SQL Server licenses are billed (customer-owned vs. license-included), not in ESU pricing.

4. How are security updates delivered and managed in each licensing scenario?

Delivery and management of ESUs on Azure VMs are the same regardless of AHB vs. PAYG:

• ESUs are “automatically receive[d]” as part of the SQL Server on Azure VM feature set.
• The SQL IaaS Agent extension is not required for ESUs; it is used for manageability (automated patching, backups, flexible licensing, tempdb configuration, etc.) and for declaring license type (AHB vs. PAYG).
• The extension itself has “minimal impact” and “no additional charges” and is primarily for management and licensing configuration, not for ESU entitlement.

So, in both AHB and PAYG scenarios, ESUs are delivered as part of the Azure VM’s normal update/patching process for SQL Server on Azure VMs, and the licensing model does not change how ESUs are technically applied.

5. Marketplace SQL Server image vs. self-installed SQL Server on a standard Azure VM

The ESU benefit applies to SQL Server on Azure VMs regardless of whether SQL Server was deployed from a Marketplace image or installed manually, as long as the VM is recognized and managed as a SQL Server on Azure VM:

• Marketplace images come with the SQL IaaS Agent extension preinstalled, and are explicitly part of the “SQL Server on Azure VMs” offering.
• For self-installed SQL Server on Azure VMs, the guidance is to “manually install the SQL IaaS Agent extension” and register the instance so it is treated as a SQL Server on Azure VM. This registration enables flexible licensing (including AHB) and manageability features.
• The FAQ clarifies that ESUs are applied automatically “whether or not your SQL Server VM is registered with the SQL IaaS Agent extension,” which implies that once the VM is running SQL Server on Azure infrastructure, ESUs are not gated on how SQL was installed.

From the context, there is no stated difference in ESU eligibility between:

• A VM deployed from an Azure Marketplace SQL Server image, and
• A standard Azure VM where SQL Server is installed later, provided it is treated as SQL Server on Azure VM.

The differences between these deployment models are:

• Licensing configuration:
  • Marketplace images are license-included by default (PAYG), with the option to switch to Azure Hybrid Benefit.
  • Self-installed SQL requires manual registration with the SQL IaaS Agent extension to declare license type and use AHB.
• Manageability and compliance:
  • Registration with the SQL IaaS Agent extension is recommended “to meet compliance requirements and to utilize optional features such as automated patching and automatic backups” and to “specify the license type” for each SQL Server VM.

ESU coverage itself, however, is described as a feature of SQL Server on Azure VMs and is not differentiated by deployment method in the provided material.

Summary for the requested scenarios:

• SQL Server 2016 / 2019 on Azure VMs with AHB:
  • SQL licensing cost is based on customer-owned licenses via Azure Hybrid Benefit.
  • ESUs for eligible out-of-support versions on Azure VMs are automatically provided for up to three years after end of support, with no extra ESU charge indicated in the Azure VM context.
  • Register with SQL IaaS Agent extension to declare AHB and use management features; ESUs do not depend on this registration.
• SQL Server 2016 / 2019 on Azure VMs with PAYG:
  • SQL licensing is included in the VM’s per-second price.
  • ESUs for eligible out-of-support versions on Azure VMs are automatically provided for up to three years after end of support, at no extra ESU charge beyond the Azure service cost.
  • SQL IaaS Agent extension is typically preinstalled on Marketplace images; ESUs are still automatic even if the extension is removed.
• Marketplace vs. self-installed VMs:
  • Both are eligible for the Azure ESU benefit when running SQL Server on Azure VMs.
  • Marketplace images simplify licensing and extension setup; self-installed VMs should be registered with the SQL IaaS Agent extension for proper license declaration and management, but ESUs are not gated on the extension.

---

References:

• What are Extended Security Updates for SQL Server?
• Extend support for SQL Server with Azure
• SQL Server Extended Security Updates enabled by Azure Arc
• Frequently asked questions for SQL Server on Azure VMs
• What is SQL Server on Azure Windows Virtual Machines?
• Provision SQL Server on Azure VM (Azure portal)