SQL Server Extended Security Updates FAQ

Please go here to search for your product's lifecycle.

What is the Extended Security Update (ESU) program?

The Extended Security Updates (ESU) program is a last resort paid option for customers who need to run certain legacy Microsoft products past the end of support. They are not intended as a long-term solution, but rather as a temporary bridge to stay secure while one migrates to a newer, supported platform. SQL Server ESU includes only Critical security updates. These updates are provided up to three years after the product's End of Extended Support date.

The ESU program does not extend the product's lifecycle and does not provide technical support beyond the original support timeline. Customers using ESUs will not receive standard support services such as troubleshooting, bug fixes, or technical guidance for issues unrelated to security updates.

Extended Security Updates will be distributed if and when available. ESUs do not include new features, customer-requested non-security updates, or design change requests.

* As defined by the Microsoft Security Response Center (MSRC).

What products are included?

ESU Availability and End Dates

Products	End of Extended Support/ESU Start Date	ESU End Date Year 1	ESU End Date Year 2	ESU End Date Year 3	Type of Security Update
SQL Server 2014	July 9, 2024	July 8, 2025	July 14, 2026	July 12, 2027	Critical
SQL Server 2016	July 14, 2026	July 13, 2027	July 18, 2028	July 17, 2029	Critical

* Extended Security Updates for select Embedded products are available via OEMs. All others are available via volume licensing.

What are the best options for customers to stay secure on the latest versions of SQL Server?

To learn more about planning for end of support or retirement, click here for Extended Security Updates for SQL Server. For information on the latest versions of SQL Server and benefits of upgrade, visit the SQL Server pages on Microsoft.com.

How can I purchase ESUs?

To purchase ESUs, you can subscribe to Extended Security Updates Plan for individual servers through Azure Portal regardless of the hosting infrastructure for your servers. If your servers are hosted outside of Azure, they must be connected to Azure Arc. This method provides a modern, flexible, and cost-effective way to receive updates.

How do I install ESU updates?

After you subscribe to ESU Plan through Azure or Azure Arc, by default the updates will be installed automatically. You can also disable automatic installations to install these updates manually or by using a 3rd party patch management solution.

For SQL Server Extended Security Updates outside Azure that aren't running Azure Arc, customers will need to register their SQL Server in disconnected mode in the Azure portal following the steps here: What Are Extended Security Updates? - SQL Server | Microsoft Learn. Alternately, customers can call customer support with the volume licensing purchase information to get the ESU patches.

Learn more about the installation details here for SQL Server installation.

ESU for SQL Server Eligibility Criteria

Prerequisites

To qualify for ESU on-premises or in hosted environments, your server or operating system must meet one of the following prerequisites:

1. SQL Server is running a version and edition (Enterprise or Standard edition) covered by an existing ESU Plan.
2. Be hosted on Azure or be covered by an active Software Assurance (SA) plan acquired through any program, such as Enterprise Agreement (EA), Enterprise Agreement Subscription (EAS), Server & Cloud Enrollment (SCE), or Enrollment for Education Solutions (EES).
3. Have active subscription licenses acquired through any program, including Cloud Solution Provider (CSP).

Note

If your server has been acquired as 'License-Included' services directly from a Service Provider License Agreement (SPLA) partner, contact your partner for purchasing options.

Licensing with ESUs enabled by Azure Arc

For SQL Server

1. You can subscribe to an ESU Plan using the following options: vCore-based subscription: Pay based on the number of virtual cores (vCores) utilized by the operating system where the eligible SQL Server instances are running. The billing rate is based on the SQL Server edition. If you're operating multiple VMs, each VM will be billed individually. There is a 4-core minimum per VM for vCore subscriptions. This option is only available for SQL Servers installed on a virtual machine.
2. pCore-based subscription: Pay based on the number of physical cores (pCores) utilized by the host operating system regardless of the number of VMs running on the host, or number of SQL Server instances and their editions installed on these VMs. The billing rate is based on the SQL Server Enterprise edition. There is a 16-core minimum per server each pCore license. One license can cover one or several hosts.

To learn more about subscribing to a SQL Server ESU Plan, see Extended Security Updates - SQL Server enabled by Azure Arc | Microsoft Learn.

Back-billing for sign-ups after the end of support dates

If a customer enrolls in ESUs after the end of support dates, they will be billed a one-time upfront charge for the months they missed after the end of support date, with billing coming in at the end of the month. For example, if a SQL Server 2016 customer enrolls in January 2027, they will receive a one-time back-bill for July, August, September, October, November, and December 2026 during their first month.

If a customer intermittently deactivates ESUs they will be back-billed for the days when the subscription was deactivated. For example, if a customer subscribes in January 2027, unsubscribes in February 2027 and re-subscribes in March 2027, it will trigger a back-billing charge for days in February and March when the subscription was deactivated. All charges will be included you your Azure monthly billing statement. If the Agent disconnects or is inactive for more than 30 days, it may cancel the ESU subscription and when the resource become online or re-connects that can cause bill back from the beginning of the current year. To learn more about scenarios that can cause back billing see Extended Security Updates - SQL Server enabled by Azure Arc | Microsoft Learn.

Disaster Recovery Benefit servers

You subscribe your eligible servers to an ESU Plan and it also receives Disaster Recovery Benefit, it will not incur additional cost. To qualify, all SQL Server instances on this server must meet the passivity criteria. To learn more, see Extended Security Updates - SQL Server enabled by Azure Arc | Microsoft Learn.

Development Environments

You can subscribe your non-production server to an ESU Plan for no extra cost. To learn more about how to manage ESU subscriptions in non-production environments, see Extended Security Updates - SQL Server enabled by Azure Arc | Microsoft Learn.

General Questions for SQL Server ESUs

What do ESUs include?

SQL Server ESU Plan includes provision of Security Updates rated "critical" in the "Security Update Severity Rating System" for a maximum of three years after end of support.

ESUs will be distributed if and when available. ESUs do not include new features, customer-requested non-security hotfixes, or design change requests. However, Microsoft may include non-security fixes as deemed necessary.

For more information on what is considered "critical" or "important," please visit the MSRC site.

Why do ESUs for SQL Server only offer "critical" updates?

For end of support events in the past, SQL Server provided only Critical Security Updates, which meets the compliance criteria of our enterprise customers. SQL Server does not ship a general monthly security update. Microsoft only provides on-demand SQL Server security updates (GDRs) for MSRC "Security Update Guide" here SQL Server is identified as an affected product.

If there are situations where new SQL Server important updates will not be provided and it is deemed critical by the customer but not by MSRC, we will work with the customer on a case-to-case basis to suggest appropriate mitigation if available.

How can customers and partners use ESUs purchased through the CSP program?

Cloud Solution Provider (CSP) partners will be able to offer ESU Plan to customers with eligible servers connected to Azure Arc. Customers will then have the right to use the ESU Plan for deployments on-prem or within outsourced environments running on authorized hosts.

Are customers required to cover all on-premises servers with active Software Assurance to get ESUs on-premises?

No, customers can choose to purchase Software Assurance only for the specific servers they need to subscribe to ESU Plan.

Can customers buy ESUs for SQL Server Express, Developer or Web edition?

No. Customers cannot subscribe to an ESU Plan for SQL Server Express, Developer or Web edition. However, the ESU Plans applies to the entire virtual or physical machine. If you have SQL Server Express or Developer edition installed on the same machine with a Standard or Enterprise edition of the same SQL Server version, the installed updates will apply to all installed instances.

Do I need Software Assurance on my CALs to access servers covered by ESUs?

Yes, to subscribe servers covered by a CAL to an ESU Plan, the customers must have active Software Assurance (or equivalent Subscription Licenses) for CALs and External Connector Licenses.

What are the options for SQL Server customers without Software Assurance?

Customers who need to stay on-premises can purchase ESUs when they have an active Server Subscription via EAS, EES, CSP, or Licenses through an EA or SCE in addition to Software Assurance through those programs. Alternatively, customers can use Software Assurance through Open, Select, or MPSA agreements in addition to product licenses through an EA, EAS, SCE, EES, or Subscription through CSP. Licenses and Software Assurance do not need to be on the same agreement.

For customers who do not have Software Assurance, an alternative to get access to ESUs is to migrate to Azure. Extended Security Updates are available for purchase for SQL Server in Azure, for versions with active ESU programs. For variable workloads, we recommend that customers migrate on Azure via Pay-As-You-Go, which allows for scaling up or down at any time. For predictable workloads, we recommend that customers migrate to Azure via Server Subscription and Reserved Instances.

Can customers cover non-production servers licensed under Visual Studio (MSDN) subscriptions with ESUs for on-premises environments?

Customers who subscribed to an ESU Plan for production servers may manually install those security updates to servers licensed under Visual Studio (MSDN) subscriptions at no additional cost. There is no limit to the number of MSDN servers a customer can cover. If they purchase ESUs for a production server, those updates can be applied to any number of MSDN servers.

To learn more about how to manage ESU subscriptions in non-production environments, see Extended Security Updates - SQL Server enabled by Azure Arc | Microsoft Learn.

Does this offer replace Premium Assurance?

Premium Assurance is no longer available, but we will honor the terms of Premium Assurance for customers who have already purchased it.

If existing licenses were bought with Software Assurance on Select or through a Microsoft Products and Services Agreement, can ESUs still be purchased under a different but eligible agreement?

Software Assurance is required as a pre-requisite to subscribe to an ESU Plan. If you have Software Assurance or an equivalent subscription (even if it is on a different enrollment/program type) then you can subscribe to ESU Plan for Software Assurance covered servers on your Microsoft Enterprise Agreement (EA), Enterprise Agreement Subscription (EAS), or Server and Cloud Enrollment (SCE).

What happens if Software Assurance is not renewed on time, or at all?

ESU coverage is not required to be co-terminus with Software Assurance coverage, but customers must have at least one month of qualifying Software Assurance coverage remaining at the time a given year of ESUs coverage is purchased.

Support questions for ESUs

Can I get support after the Extended Support date, without purchasing Extended Security Updates?

Extended Security Updates licenses (ESUs) do not include support unless the customer is covered by one of the following support plans: Pay Per Incident, Unified, Azure Support and Premier Support for Partners. This applies to SQL Server ESUs running in Azure, connected to Azure Arc, or in disconnected mode. Support for Products with ESU coverage is limited to the following issues:

• Deployment, installation, and activation of licenses and updates
• Bugs/regressions introduced with the installation of a security update

Support for Products with ESU coverage does not include general technical support and troubleshooting assistance for the underlying products except as specified above. Issue resolution is not guaranteed.

Is technical support included when you purchase ESUs?

No, technical support isn't included in the ESU program. Microsoft will provide support for customers that encounter issues pertaining to ESU as defined here.

Can customers get technical support for SQL Server after the End of Support dates, without purchasing ESUs?

No. If a customer has an eligible SQL Server without ESUs, they cannot log a support ticket, even if they have a support plan.

What are the support expectations when requesting support for a product utilizing ESUs?

When customers have purchased ESUs and have an existing paid support plan:

Scenario: Customer can open a support ticket regarding installation, licensing, or activation.

Response: Yes

Scenario: Customer can open a support ticket regarding problems introduced as a result of installation of an ESU.

Response: Yes, if it is determined that the issue is caused by the ESU, the Support Team will file a bug on the customer's behalf.

This program covers only the named product and the components that shipped with it. Unless explicitly stated the scope of this program does not extend to any other products or tools that the customer may be running on or with the covered product.

Does Unified Support include ESUs?

No, customers must purchase ESUs separately. Customers with Unified Support and ESUs can request technical support for issues per the scope noted above.

How are customers verified for limited technical support for ESU and can they submit support incidents online?

All customers must call Microsoft support with their Agreement number to be verified as having acquired ESU. A support incident will be created for ESU customers. Services Hub does not list any products that have reached end of support in the dropdown menu.

How do Tech Routers know which customers have purchased ESUs?

As we continue to work to fully automate the validation process, the tech routers will validate whether a customer purchased ESUs. Once the customer is validated, a case will be created and routed to the appropriate queue for ESU technical support. Customers should provide their Enterprise Agreement number or full customer name for validation.

This does not apply to SQL Server on Azure VM or ESUs subscriptions in Azure Arc.

What is the support expectation if a customer encounters an issue that requires a new feature?

If an investigation determines that resolution requires product enhancement available in a recent release, then a request will be made to the customer to upgrade to a more recent release where the capability is already available. No new product enhancements will be made after any product reaches end of support or retirement.

Is offline servicing available for operating system images covered by ESUs?

No. ESUs require online servicing (booted into the image taking the updates. See online servicing for more details).

ESUs are not supported in offline servicing mode. Applying ESUs in offline servicing mode will generate an error and updates will fail.

How will ESUs be distributed?

There are two options to get ESUs:

1. For servers subscribed to ESU Plan there are no keys needed; the Azure subscription performs all the authentication and replaces the need for acquisition, deployment, and management of patches. Additionally, an inventory view will show the Extended Security Update coverage of all SQL Server machines on Azure Portal. Learn more here.
2. Customers can also register disconnected servers in Azure Arc or call support to get the packages if they prefer to stay disconnected (non-Arc): What Are Extended Security Updates? - SQL Server | Microsoft Learn.

Please go here to search for your product's lifecycle.

The Extended Security Updates (ESU) program is a last resort paid option for customers who need to run certain legacy Microsoft products past the end of support. They are not intended as a long-term solution, but rather as a temporary bridge to stay secure while one migrates to a newer, supported platform. SQL Server ESU includes only Critical security updates. These updates are provided up to three years after the product's End of Extended Support date.

The ESU program does not extend the product's lifecycle and does not provide technical support beyond the original support timeline. Customers using ESUs will not receive standard support services such as troubleshooting, bug fixes, or technical guidance for issues unrelated to security updates.

Extended Security Updates will be distributed if and when available. ESUs do not include new features, customer-requested non-security updates, or design change requests.

* As defined by the Microsoft Security Response Center (MSRC).

Products	End of Extended Support/ESU Start Date	ESU End Date Year 1	ESU End Date Year 2	ESU End Date Year 3	Type of Security Update
SQL Server 2014	July 9, 2024	July 8, 2025	July 14, 2026	July 12, 2027	Critical
SQL Server 2016	July 14, 2026	July 13, 2027	July 18, 2028	July 17, 2029	Critical

* Extended Security Updates for select Embedded products are available via OEMs. All others are available via volume licensing.

To learn more about planning for end of support or retirement, click here for Extended Security Updates for SQL Server. For information on the latest versions of SQL Server and benefits of upgrade, visit the SQL Server pages on Microsoft.com.

To purchase ESUs, you can subscribe to Extended Security Updates Plan for individual servers through Azure Portal regardless of the hosting infrastructure for your servers. If your servers are hosted outside of Azure, they must be connected to Azure Arc. This method provides a modern, flexible, and cost-effective way to receive updates.

After you subscribe to ESU Plan through Azure or Azure Arc, by default the updates will be installed automatically. You can also disable automatic installations to install these updates manually or by using a 3rd party patch management solution.

For SQL Server Extended Security Updates outside Azure that aren't running Azure Arc, customers will need to register their SQL Server in disconnected mode in the Azure portal following the steps here: What Are Extended Security Updates? - SQL Server | Microsoft Learn. Alternately, customers can call customer support with the volume licensing purchase information to get the ESU patches.

Learn more about the installation details here for SQL Server installation.

To qualify for ESU on-premises or in hosted environments, your server or operating system must meet one of the following prerequisites:

1. SQL Server is running a version and edition (Enterprise or Standard edition) covered by an existing ESU Plan.
2. Be hosted on Azure or be covered by an active Software Assurance (SA) plan acquired through any program, such as Enterprise Agreement (EA), Enterprise Agreement Subscription (EAS), Server & Cloud Enrollment (SCE), or Enrollment for Education Solutions (EES).
3. Have active subscription licenses acquired through any program, including Cloud Solution Provider (CSP).

Note

If your server has been acquired as 'License-Included' services directly from a Service Provider License Agreement (SPLA) partner, contact your partner for purchasing options.

1. You can subscribe to an ESU Plan using the following options: vCore-based subscription: Pay based on the number of virtual cores (vCores) utilized by the operating system where the eligible SQL Server instances are running. The billing rate is based on the SQL Server edition. If you're operating multiple VMs, each VM will be billed individually. There is a 4-core minimum per VM for vCore subscriptions. This option is only available for SQL Servers installed on a virtual machine.
2. pCore-based subscription: Pay based on the number of physical cores (pCores) utilized by the host operating system regardless of the number of VMs running on the host, or number of SQL Server instances and their editions installed on these VMs. The billing rate is based on the SQL Server Enterprise edition. There is a 16-core minimum per server each pCore license. One license can cover one or several hosts.

To learn more about subscribing to a SQL Server ESU Plan, see Extended Security Updates - SQL Server enabled by Azure Arc | Microsoft Learn.

If a customer enrolls in ESUs after the end of support dates, they will be billed a one-time upfront charge for the months they missed after the end of support date, with billing coming in at the end of the month. For example, if a SQL Server 2016 customer enrolls in January 2027, they will receive a one-time back-bill for July, August, September, October, November, and December 2026 during their first month.

If a customer intermittently deactivates ESUs they will be back-billed for the days when the subscription was deactivated. For example, if a customer subscribes in January 2027, unsubscribes in February 2027 and re-subscribes in March 2027, it will trigger a back-billing charge for days in February and March when the subscription was deactivated. All charges will be included you your Azure monthly billing statement. If the Agent disconnects or is inactive for more than 30 days, it may cancel the ESU subscription and when the resource become online or re-connects that can cause bill back from the beginning of the current year. To learn more about scenarios that can cause back billing see Extended Security Updates - SQL Server enabled by Azure Arc | Microsoft Learn.

You subscribe your eligible servers to an ESU Plan and it also receives Disaster Recovery Benefit, it will not incur additional cost. To qualify, all SQL Server instances on this server must meet the passivity criteria. To learn more, see Extended Security Updates - SQL Server enabled by Azure Arc | Microsoft Learn.

You can subscribe your non-production server to an ESU Plan for no extra cost. To learn more about how to manage ESU subscriptions in non-production environments, see Extended Security Updates - SQL Server enabled by Azure Arc | Microsoft Learn.

SQL Server ESU Plan includes provision of Security Updates rated "critical" in the "Security Update Severity Rating System" for a maximum of three years after end of support.

ESUs will be distributed if and when available. ESUs do not include new features, customer-requested non-security hotfixes, or design change requests. However, Microsoft may include non-security fixes as deemed necessary.

For more information on what is considered "critical" or "important," please visit the MSRC site.

For end of support events in the past, SQL Server provided only Critical Security Updates, which meets the compliance criteria of our enterprise customers. SQL Server does not ship a general monthly security update. Microsoft only provides on-demand SQL Server security updates (GDRs) for MSRC "Security Update Guide" here SQL Server is identified as an affected product.

If there are situations where new SQL Server important updates will not be provided and it is deemed critical by the customer but not by MSRC, we will work with the customer on a case-to-case basis to suggest appropriate mitigation if available.

Cloud Solution Provider (CSP) partners will be able to offer ESU Plan to customers with eligible servers connected to Azure Arc. Customers will then have the right to use the ESU Plan for deployments on-prem or within outsourced environments running on authorized hosts.

No, customers can choose to purchase Software Assurance only for the specific servers they need to subscribe to ESU Plan.

No. Customers cannot subscribe to an ESU Plan for SQL Server Express, Developer or Web edition. However, the ESU Plans applies to the entire virtual or physical machine. If you have SQL Server Express or Developer edition installed on the same machine with a Standard or Enterprise edition of the same SQL Server version, the installed updates will apply to all installed instances.

Yes, to subscribe servers covered by a CAL to an ESU Plan, the customers must have active Software Assurance (or equivalent Subscription Licenses) for CALs and External Connector Licenses.

Customers who need to stay on-premises can purchase ESUs when they have an active Server Subscription via EAS, EES, CSP, or Licenses through an EA or SCE in addition to Software Assurance through those programs. Alternatively, customers can use Software Assurance through Open, Select, or MPSA agreements in addition to product licenses through an EA, EAS, SCE, EES, or Subscription through CSP. Licenses and Software Assurance do not need to be on the same agreement.

For customers who do not have Software Assurance, an alternative to get access to ESUs is to migrate to Azure. Extended Security Updates are available for purchase for SQL Server in Azure, for versions with active ESU programs. For variable workloads, we recommend that customers migrate on Azure via Pay-As-You-Go, which allows for scaling up or down at any time. For predictable workloads, we recommend that customers migrate to Azure via Server Subscription and Reserved Instances.

Customers who subscribed to an ESU Plan for production servers may manually install those security updates to servers licensed under Visual Studio (MSDN) subscriptions at no additional cost. There is no limit to the number of MSDN servers a customer can cover. If they purchase ESUs for a production server, those updates can be applied to any number of MSDN servers.

To learn more about how to manage ESU subscriptions in non-production environments, see Extended Security Updates - SQL Server enabled by Azure Arc | Microsoft Learn.

Premium Assurance is no longer available, but we will honor the terms of Premium Assurance for customers who have already purchased it.

Software Assurance is required as a pre-requisite to subscribe to an ESU Plan. If you have Software Assurance or an equivalent subscription (even if it is on a different enrollment/program type) then you can subscribe to ESU Plan for Software Assurance covered servers on your Microsoft Enterprise Agreement (EA), Enterprise Agreement Subscription (EAS), or Server and Cloud Enrollment (SCE).

ESU coverage is not required to be co-terminus with Software Assurance coverage, but customers must have at least one month of qualifying Software Assurance coverage remaining at the time a given year of ESUs coverage is purchased.

Extended Security Updates licenses (ESUs) do not include support unless the customer is covered by one of the following support plans: Pay Per Incident, Unified, Azure Support and Premier Support for Partners. This applies to SQL Server ESUs running in Azure, connected to Azure Arc, or in disconnected mode. Support for Products with ESU coverage is limited to the following issues:

• Deployment, installation, and activation of licenses and updates
• Bugs/regressions introduced with the installation of a security update

Support for Products with ESU coverage does not include general technical support and troubleshooting assistance for the underlying products except as specified above. Issue resolution is not guaranteed.

No, technical support isn't included in the ESU program. Microsoft will provide support for customers that encounter issues pertaining to ESU as defined here.

No. If a customer has an eligible SQL Server without ESUs, they cannot log a support ticket, even if they have a support plan.

When customers have purchased ESUs and have an existing paid support plan:

Scenario: Customer can open a support ticket regarding installation, licensing, or activation.

Response: Yes

Scenario: Customer can open a support ticket regarding problems introduced as a result of installation of an ESU.

Response: Yes, if it is determined that the issue is caused by the ESU, the Support Team will file a bug on the customer's behalf.

This program covers only the named product and the components that shipped with it. Unless explicitly stated the scope of this program does not extend to any other products or tools that the customer may be running on or with the covered product.

No, customers must purchase ESUs separately. Customers with Unified Support and ESUs can request technical support for issues per the scope noted above.

All customers must call Microsoft support with their Agreement number to be verified as having acquired ESU. A support incident will be created for ESU customers. Services Hub does not list any products that have reached end of support in the dropdown menu.

As we continue to work to fully automate the validation process, the tech routers will validate whether a customer purchased ESUs. Once the customer is validated, a case will be created and routed to the appropriate queue for ESU technical support. Customers should provide their Enterprise Agreement number or full customer name for validation.

This does not apply to SQL Server on Azure VM or ESUs subscriptions in Azure Arc.

If an investigation determines that resolution requires product enhancement available in a recent release, then a request will be made to the customer to upgrade to a more recent release where the capability is already available. No new product enhancements will be made after any product reaches end of support or retirement.

No. ESUs require online servicing (booted into the image taking the updates. See online servicing for more details).

ESUs are not supported in offline servicing mode. Applying ESUs in offline servicing mode will generate an error and updates will fail.

There are two options to get ESUs:

1. For servers subscribed to ESU Plan there are no keys needed; the Azure subscription performs all the authentication and replaces the need for acquisition, deployment, and management of patches. Additionally, an inventory view will show the Extended Security Update coverage of all SQL Server machines on Azure Portal. Learn more here.
2. Customers can also register disconnected servers in Azure Arc or call support to get the packages if they prefer to stay disconnected (non-Arc): What Are Extended Security Updates? - SQL Server | Microsoft Learn.