Skip to content

sql-server-extended-security-updates.md

Latest commit

 

History

History
140 lines (88 loc) · 9.34 KB

sql-server-extended-security-updates.md

File metadata and controls

140 lines (88 loc) · 9.34 KB
Raw
title What Are Extended Security Updates?
description Learn about Extended Security Updates enabled by Azure Arc, for your end-of-support and end-of-life SQL Server products such as SQL Server 2014 and SQL Server 2016.
author rwestMSFT
ms.author randolphwest
ms.date 06/22/2026
ms.service sql
ms.subservice install
ms.topic concept-article
ms.custom
references_regions

What are Extended Security Updates for SQL Server?

[!INCLUDE SQL Server end of support]

This article provides information on how to receive Extended Security Updates (ESUs) for versions of [!INCLUDE ssnoversion-md] that are out of extended support.

ESUs are available for [!INCLUDE sssql14-md], and [!INCLUDE sssql16-md]. [!INCLUDE sssql16-md] ESUs introduce a change to the price structure.

For more information, see:

Overview

When [!INCLUDE ssNoVersion] reaches the end of its support lifecycle, you can subscribe to Extended Security Updates. The subscription protects your servers for up to three years after the support lifecycle ends. Keep the subscription until you're ready to upgrade to a newer version of [!INCLUDE ssNoVersion] or migrate to Azure SQL.

ESUs released for [!INCLUDE sssql14-md] and [!INCLUDE sssql16-md] include the most recent Cumulative Update (CU). If you only applied General Distribution Release (GDR) updates during the normal support period, install and validate the latest CU at the time you subscribe to receive ESUs, instead of waiting until the first ESU is released. This preemptive validation avoids potential problems when installing the ESU later.

Microsoft makes ESUs available if needed once a security vulnerability is discovered and rated as Critical by the Microsoft Security Response Center (MSRC). Therefore, there's no regular release cadence for [!INCLUDE ssNoVersion] ESUs.

ESUs don't include:

  • New features
  • Functional improvements
  • Customer-requested fixes

Changes to SQL Server 2016 ESUs

Starting with [!INCLUDE sssql16-md], migrating your workload to SQL Server on Azure VMs no longer provides free access to ESUs for [!INCLUDE sssql16-md] instances.

ESU availability by platform

SQL Server instances connected to Azure Arc, or hosted on SQL Server on Azure VMs, can subscribe to receive ESUs.

Consider the following:

  • Coverage is continuous until canceled. You can cancel the subscription at any time.
  • Azure bills on an hourly basis.
  • The subscription is automatically canceled when you migrate your instance to Azure or upgrade to a supported version of SQL Server.
  • You can install patches automatically or manually.

Alternatively, for [!INCLUDE sssql14-md] only, you can migrate your SQL Server workloads to an Azure VM as-is and receive free ESUs through the Windows Update channel. For more information, see Extend support for SQL Server 2014.

The method of receiving ESUs depends on where you're running your [!INCLUDE ssNoVersion] instance.

SQL Server on Azure VMs

SQL Server on Azure VM customers can subscribe to receive ESUs when they register with the SQL IaaS Agent extension.

ESUs are available in all regions supported by the SQL IaaS Agent extension.

SQL Server 2014 customers receive free ESUs when they migrate their workloads to SQL Server on Azure VMs. SQL Server 2016 customers can subscribe to receive ESUs when they register with the SQL IaaS Agent extension, but they aren't eligible for free ESUs.

To get started, see ESUs for SQL Server on Azure VMs.

Other Azure environments

For other Azure resources, you have access to ESUs for [!INCLUDE ssSQL16] if you connect your instance to Azure Arc. If you can't connect your [!INCLUDE ssnoversion-md] instance to Azure Arc, you don't qualify for this offer.

SQL Server 2014 customers receive free ESUs when they migrate their workloads to Azure VMware VMs. SQL Server 2016 customers can subscribe to receive ESUs when they migrate to Azure VMware VMs, but they aren't eligible for free ESUs.

To subscribe and receive ESUs, review the documentation for the specific service:

All other environments

For all other environments, including on-premises, non-Azure cloud infrastructure, or hosted environments, you can subscribe to receive ESUs after connecting your servers to Azure Arc. If you can't connect your [!INCLUDE ssnoversion-md] instance to Azure Arc, you don't qualify for this offer.

To qualify to receive ESUs, you must have Software Assurance under one of the following agreements:

  • Enterprise Agreement (EA)
  • Enterprise Agreement Subscription (EAS)
  • Server and Cloud Enrollment (SCE)
  • Enrollment for Education Solutions (EES)

Alternatively, you can connect your instances to Azure Arc and enable a pay-as-you-go billing option to receive ESUs without Software Assurance. For more information, see Subscribe to ESUs enabled by Azure Arc.

For resources:

Note

Connecting SQL Server instances to Azure Arc is free of charge.

Subscribe to ESUs for SQL Server instances

[!INCLUDE esu-enable-sql-server-instances]

Register disconnected SQL Server instances in Azure portal

If you can't connect your [!INCLUDE ssnoversion-md] instance to Azure Arc, you might be eligible to purchase ESUs through volume licensing. Contact your Microsoft account team for more information.

After purchasing, you can manually register your instance in the Azure portal to enable access to the ESUs. For more information, see Register disconnected instances for ESUs.

Support

ESU licenses don't include support for the underlying SQL Server version. Support for products covered by ESUs is limited to issues related to deploying, installing, and activating the updates released as part of the ESU subscription, such as bugs or regressions introduced by a specific update.

Supported regions

In Azure, you can subscribe to ESUs in any region supported by SQL Server on Azure VMs, AVS, or Nutanix. For details, see Product availability by region.

Outside of Azure, you can subscribe to ESUs in any region that supports SQL Server enabled by Azure Arc. For details, see Supported Azure regions.

Frequently asked questions

For a full list of frequently asked questions, see the SQL Server ESUs: Frequently asked questions.

Related content