Extended Security Updates: Frequently asked questions

Applies to: SQL Server 2014 (12.x) SQL Server 2016 (13.x)

For general frequently asked questions about Extended Security Updates (ESUs), see the Extended security updates FAQ. This article lists SQL Server-specific frequently asked questions.

For more information, see:

• What are Extended Security Updates for SQL Server?
• Extended security updates enabled by Azure Arc
• ESU Pricing plans for Windows Server and SQL Server end of support

When is the end of support for SQL Server 2014 and SQL Server 2016?

The end of support date for SQL Server 2016 (13.x) is July 14, 2026. ESUs are available until July 17, 2029.

The end of support date for SQL Server 2014 (12.x) was July 9, 2024. ESUs are available until July 8, 2027.

What does end of support mean?

Microsoft Lifecycle Policy offers 10 years of support (five years for Mainstream Support and five years for Extended Support) for Business and Developer products, such as SQL Server and Windows Server. After the end of the Extended Support period, Microsoft doesn't provide patches or security updates. This lack of support might cause security and compliance problems and exposes your applications and business to serious security risks.

What editions of SQL Server are eligible for ESUs?

Enterprise and Standard editions of SQL Server 2014 (12.x) and SQL Server 2016 (13.x) are eligible for ESUs for both x86 and x64 versions.

Can customers subscribe to ESUs for SQL Server Express, Web, or Developer edition?

No. Customers can't subscribe to ESUs for SQL Server Express, Web, or Developer edition. However, customers who have ESUs for SQL Server production workloads can apply updates to their servers running SQL Server Developer edition solely for development and test purposes.

What happens when the edition changes?

When you downgrade an instance edition from Enterprise Edition to Standard Edition on the same machine, the billing meter automatically switches from Enterprise to Standard both for IP and ESU. For ESU, there's no additional bill-back. However, there's no refund of the original EE bill-back.

When you upgrade an instance edition from Standard Edition to Enterprise Edition on the same machine, the billing meter automatically switches from Standard to Enterprise both for IP and ESU. For ESU, there's no additional charge for the upgrade. However, you are billed for the difference between the original SE bill-back and the new EE bill-back going forward.

What do ESUs include?

ESUs include Security Updates and Bulletins rated Critical by the Microsoft Security Response Center (MSRC), for a maximum of three years after the end of extended support. Microsoft distributes ESUs if and when available. Technical support is limited to issues directly related to the released updates.

Why do ESUs only offer "critical" updates?

For End of Support events in the past, SQL Server provided only Critical Security Updates, which meets the compliance criteria of our enterprise customers. SQL Server doesn't ship a general monthly security update. Microsoft only provides on-demand SQL Server security updates (GDRs) for MSRC bulletins where SQL Server is identified as an affected product.

If there are situations where new SQL Server important updates aren't provided, and it's deemed critical by the customer but not by MSRC, Microsoft works with the customer on a case-by-case basis to suggest appropriate mitigation.

What Licensing programs are eligible for ESUs?

Software Assurance customers can subscribe to ESUs on-premises under an Enterprise Agreement (EA), Enterprise Subscription Agreement (EAS), a Server & Cloud Enrollment (SCE), or an Enrollment for Education Solutions (EES). Software Assurance doesn't need to be on the same enrollment.

How are ESUs licensed?

For SQL Server, licensing is based on the number of virtual cores (v-cores). If you have multiple virtual machines (VMs), you need to pay for all the v-cores used across those VMs. There is a 4-core minimum per VM. Licensing is based on physical cores (p-cores) of the host that runs one or multiple instances of SQL Server installed directly on the host without using VMs.

For unlimited virtualization, you can subscribe to ESUs by p-cores if SQL Server ESUs by v-cores is more expensive than subscribing by the p-cores of the host.

Do I need to be running the most current SQL Server Service Pack to benefit from ESUs?

Yes, you need to run SQL Server with the latest Service Pack to apply ESUs. Microsoft only produces updates that can be applied on the latest Service Pack.

What are my options for SQL Server without Software Assurance?

If you don't have Software Assurance, the alternative option to get access to ESUs is to migrate to Azure or connect to Azure Arc. Since you don't have Software Assurance, make sure to use a "License included" license type (pay-as-you-go).

Does this offer apply to older versions of SQL Server?

No. For SQL Server 2012 (11.x) and earlier versions, upgrade to the latest supported versions.

Can I deploy a brand new SQL Server 2016 instance on Azure and still get ESUs?

Yes, you can also deploy a SQL Server 2016 (13.x) instance on an Azure VM and subscribe to ESUs.

Can I deploy a brand new SQL Server 2014 instance on Azure and still get ESUs?

Yes, you can deploy a new SQL Server 2014 (12.x) instance on a SQL Server on Azure Virtual Machine and have access to ESUs for free until ESU availability ends for SQL Server 2014 (12.x).

Can I get technical support on-premises for SQL Server after the End of Support date, without subscribing to ESUs?

No. If you have SQL Server 2014 (12.x) or SQL Server 2016 (13.x), you can't log a support ticket even if you have a support plan.

If you migrate SQL Server 2014 to Azure or subscribe to ESUs for SQL Server 2014 (12.x) or SQL Server 2016 (13.x), you can get support using your existing support plan.

If I want to bring my own SQL Server license (BYOL), am I required to have Software Assurance coverage?

Yes, you need to have Software Assurance to take advantage of the BYOL program for SQL Server on Azure Virtual Machines as part of the License Mobility program. For customers without Software Assurance, we recommend that you move to Azure SQL Managed Instance for your SQL Server environments.

You can also migrate to pay-as-you-go Azure Virtual Machines. Software Assurance customers who license SQL by core also have the option of migrating to Azure using the Azure Hybrid Benefit (AHB).

Azure SQL Managed Instance is a service in Azure providing nearly 100% compatibility with SQL Server on-premises. SQL Managed Instance provides built-in high availability and disaster recovery capabilities plus intelligent performance features and the ability to scale on the fly. SQL Managed Instance also provides a version-less experience that takes away the need for manual security patching and upgrades. For more information on the Azure Hybrid Benefit program, see Azure SQL Managed Instance pricing.

What options do I have to run SQL Server in Azure?

To learn about options for running SQL Server instances on Azure, see SQL Server end of support.

Can I use Azure Hybrid Benefit for SQL Server 2014 or SQL Server 2016?

Yes, customers with active Software Assurance or equivalent Server Subscriptions can use Azure Hybrid Benefit to allocate on-premises license investments for discounted pricing for Azure SQL Database, Azure SQL Managed Instance, and SQL Server on Azure VMs.

Can I get free ESUs on Azure Stack?

Not for SQL Server 2016 ESUs but yes for SQL Server 2014 ESUs. If you have SQL Server 2014 (12.x) running on Azure Stack, you can get ESUs for free. If you have SQL Server 2016 (13.x) running on Azure Stack, you can purchase ESUs.

Can I get ESUs for SQL Server with a third-party hosting provider?

You can get ESUs for third-party hosted SQL Server by subscribing to ESUs after connecting your instance to Azure Arc. If you can't connect your instance to Azure Arc, you're not eligible for this offer.

You can't get ESUs if you move your SQL Server 2014 (12.x) environment to a PaaS implementation on other cloud providers. If your SQL Server is running on a virtual machine (IaaS) with License Mobility for SQL Server via Software Assurance, you can subscribe to ESUs enabled by Azure Arc.

Are all SQL Server enabled by Azure Arc features available in Azure Government?

No. Feature availability can differ in Azure Government compared to the commercial Azure cloud.

For current supported features and limitations, review SQL Server enabled by Azure Arc in US Government and Release notes - SQL Server enabled by Azure Arc.

How do US Federal Government customers register and obtain ESUs if they are running in Azure Government/O365 GCCH/O365 DOD?

For SQL Server 2016 (13.x), Azure Arc isn't currently supported in Azure Government regions. So if SQL Server 2016 (13.x) is in an Azure Government region, contact your account team to purchase ESUs through volume licensing, and then follow the steps to register your disconnected instance.

For both SQL Server 2014 (12.x) and SQL Server 2016 (13.x) ESUs, Federal Government customers can get ESUs by migrating their workloads to SQL Server on Azure VMs in supported Azure Government regions. ESUs are free for SQL Server 2014 (12.x) and purchasable for SQL Server 2016 (13.x).

Alternatively, you can migrate your workload to a SQL Server on Azure VM in the public cloud, and register with the SQL IaaS Agent extension to receive ESUs. SQL Server 2014 customers get free ESUs when they migrate their workloads to SQL Server on Azure VMs. SQL Server 2016 customers can subscribe to ESUs when they register with the SQL IaaS Agent extension, but they aren't eligible for free ESUs.

What are the benefits of subscribing to ESUs?

For the benefits of the ESU subscription, see SQL Server ESUs.

How do I subscribe to ESUs on multiple SQL Server instances?

If you want to subscribe to ESUs for multiple SQL Server instances, use an open source PowerShell script that you can use for different scopes, such as resource group, Azure subscription, multiple subscriptions, or the entire account. This option is currently only available to SQL Server instances enabled by Azure Arc.

Alternatively, you can assign an Azure policy to your Azure scope that enables ESU on all SQL Server resources in that scope.

How can I cancel the ESU charges?

Your ESU charges stop immediately in the following cases:

• You manually unsubscribe from ESUs for any reason. You lose access to future patches.
• You migrated your SQL Server to Azure; no manual cancellation is needed. You continue to have access to future ESUs.
• You upgraded your SQL Server to a newer version; no manual cancellation is needed. You have access to all SQL Server updates.

What happens if I accidentally cancel my subscription and need to reinstate it?

If you accidentally cancel your ESU subscription, you can reactivate it within 30 days as long as your server remains connected. You're billed back to the hour of when the ESU subscription was last active. After 30 days, the ESU subscription is terminated, and you lose access to future patches. To gain access to future patches, you need to re-enable ESUs, which is treated as a brand new ESU subscription.

What happens if I lose internet connectivity to Azure due to an outage?

If your SQL Server instance loses connectivity, the billing stops, and the subscription is suspended. We automatically reactivate it if the instance reconnects within 30 days. Your bill includes a charge for the days since the last day your server was connected. If the server reconnects after 30 days of disconnection, the subscription is terminated.

What happens if my machine's Virtual Machine ID (VMID) changes?

If your machine's VMID changes (due to VM rebuild, migration, hardware changes, or cloning), Azure Arc treats it as an entirely new machine, even if it's running on the same physical or virtual infrastructure. This change can result in double billing because:

• The original machine resource continues to be billed for ESU if you don't manually deactivate it.
• The machine with the new VMID is treated as a new ESU subscription and triggers backbill charges.

To avoid double billing:

1. Before performing any operation that might change the VMID, unsubscribe from ESU on the original machine.
2. Disconnect the machine from Azure Arc.
3. After the VMID change, onboard the machine as a new resource to Azure Arc.
4. Subscribe to ESU on the new machine resource.

If you already experienced double billing due to a VMID change, contact Microsoft Support immediately to resolve the billing discrepancy.

Can I reactivate an ESU subscription if I migrated to Azure, but then decide to move back to on-premises?

If you migrated an instance to SQL Server on Azure VM, and then moved back and restarted the SQL Server on the same machine, Azure Arc treats this case as a temporary disconnection. You must ensure that the original server reconnects to Azure Arc by using the same Azure subscription, resource group, and machine name. The SQL Server instance must have the same instance name. Under those conditions, the ESU subscription is automatically reactivated if the SQL Server reconnects within 30 days. After 30 days of disconnection, a new ESU subscription is required.

What happens if I have an active ESU subscription, but unintentionally disconnect SQL Server from Azure Arc by uninstalling the extension?

You don't have access to the patches until you reinstall the Azure extension for SQL Server. The following rules apply:

• If the SQL Server instance resource is still present as Offline, you incur an extra charge for the period while the instance was disconnected, because the ESU subscription remains active.
• If you reinstall the Azure extension for SQL Server in the same subscription or resource group, you pay an extra charge for the period while the instance was disconnected, because the ESU subscription remains active.
• If you reinstall the SQL Server instance to a different subscription, resource group, or region, the instance is considered to be a new resource. You must enable ESUs and pay for it.

What happens if I take a SQL Server VM with an active ESU subscription offline for some time, and then bring it back online?

You don't have access to the patches until the VM is online. When the VM is back online and the SQL Server instance shows a status of Connected, the following rules apply:

• You're charged for the period of downtime (back to the previous ESU charge).
• The ESU subscription is reactivated.

Does billing start automatically when I subscribe to ESUs?

It depends on your ESU subscription:

• The SQL Server 2014 (12.x) ESU subscription is currently available, so billing starts immediately when you subscribe. You receive a one-time bill-back charge to the beginning of the current ESU term.
• Billing for SQL Server 2016 (13.x) starts at midnight UTC on July 15, 2026. If you subscribe before the end of the support period, billing starts on the first day of the ESU term. If you subscribe after the end of the support period, billing starts on the day you subscribe and includes a one-time bill-back charge to the first day of the ESU term.

For more information about ESU pricing, see Plan your Windows Server and SQL Server end of support.

Is Microsoft extending SQL Server 2008 / 2008 R2 and Windows Server 2008 ESUs?

Microsoft hasn't extended SQL Server and Windows Server 2008 ESUs. Support for SQL Server 2008 (10.0.x) and SQL Server 2008 R2 (10.50.x) in Azure ended on July 9, 2023, and these servers need to be upgraded to maintain support.

Can I subscribe to asynchronous notifications about the published ESUs?

The SQL Server ESUs are included in the Security Update Guide published by the Microsoft Security Response Center (MSRC). Customers can subscribe to the RSS feed, use automation services like IFTTT to create automated actions, or subscribe to direct email notifications from that page.

Does SQL Server ESU license resource for unlimited virtualization support Standard edition?

No. The SQL Server ESU license resource for SQL Server enabled by Azure Arc is an implementation of the unlimited virtualization benefit for ESU. Once activated, the license is billed using an Enterprise edition ESU meter based on the number of physical cores of the servers that host the virtual machine with ESU-eligible SQL Server instances.

Does SQL Server ESU license resource for unlimited virtualization support virtual cores?

No. The SQL Server ESU license resource for SQL Server enabled by Azure Arc is an implementation of the unlimited virtualization benefit for ESU. It applies to physical cores of the servers that host the virtual machine with ESU-eligible SQL Server instances with a minimum of 16 cores. The SQL Server instances in the virtual machines hosted by the servers get access to the ESUs without an additional charge.

Can I use 3rd-party application control solutions to protect my SQL Server environment, instead of installing SQL Server security updates after the end of support date?

Third party application control solutions aren't a replacement for product security fixes.

Does Software Assurance benefits include ESUs?

No. Software Assurance (SA) is a prerequisite for ESUs but the ESU subscription must be activated separately. Review What Licensing programs are eligible for ESUs?

SQL Server ESU License uses pay-as-you-go (PAYG) billing plan.

Related content

• What are Extended Security Updates for SQL Server?
• Extended Security Updates enabled by Azure Arc