SQL Server 2016 Extended Security Updates (ESU) Enrollment through Azure Arc

Any SQL Server 2016 instance not enrolled in ESU has received no security updates since 14 July 2026, per Microsoft's product lifecycle. Whether that has bitten yet depends on whether Microsoft has published a Critical fix since — ESU releases appear only when one is needed — but the exposure is structural: the next Critical vulnerability will be patched on enrolled instances and not on yours. And because Arc enrollment bills back to the start of the ESU year, there is no financial reason to wait either.

Security fixes for vulnerabilities the Microsoft Security Response Center rates Critical, packaged cumulatively with the latest cumulative update, for up to three years after end of support — through 17 July 2029 for SQL Server 2016 and 12 July 2027 for SQL Server 2014. Nothing else: no Important-rated fixes, no new features, no non-security hotfixes, no support incidents. It keeps an unsupported version patched against the worst; it does not make it supported.

Three reasons. Arc bills per host, metered by the hour and invoiced monthly, and stops the day you unsubscribe — Volume Licensing sells ESU annually, in advance, for the whole year. Arc is available without Software Assurance through Microsoft's pay-as-you-go license type, while the Volume Licensing route requires active SA under an Enterprise Agreement, Enterprise Subscription, Server and Cloud Enrollment, or Enrollment for Education Solutions. And the connected host is reusable: the same agent gives you Azure Update Manager, inventory and policy over the server if you want them. The one case where Volume Licensing wins is a host that cannot reach Azure at all.

Yes, through Arc — by setting the host's license type to pay-as-you-go, which makes it ESU-eligible. The catch is that pay-as-you-go also meters the SQL Server license itself through your Azure subscription, per core, per hour, on top of the ESU charge. For some hosts that is cheaper than buying Software Assurance for a version you are leaving; for others it is not. The cost model shows both numbers per host before you choose, and buying SA or licenses, if that turns out to be the better answer, starts with our Volume Licensing consulting rather than a guess.

You do, on your own Azure subscription. Microsoft meters ESU per core — with a minimum of four cores per host — reported hourly and invoiced monthly, at a Year 1 price Microsoft sets at roughly 75% of the current license price and raises in Years 2 and 3. We print no rate on this page on purpose, because Microsoft revises them; the cost model in the design carries the current number per host, including the bill-back for the months since the ESU year began, and nothing is activated until you have seen it. Physical hosts running many VMs may be cheaper under Microsoft's physical-core ESU license, which we evaluate rather than defaulting to per-VM billing.

Yes. Under Microsoft's Arc ESU terms, subscribing after the ESU year began adds a one-time bill-back from the start of that year to the activation timestamp. It is the same money whether you enroll this week or in three months — the difference is how many of those months you were unpatched. We record the activation timestamp per host so the first invoice can be reconciled line by line.

Yes — that is the point of the Arc route. Unsubscribing a host stops its ESU charges immediately; you lose access to future ESU releases for that host, which no longer matters once the instance is gone. The runbook covers the exact steps, and the instance inventory's exit dates tell you when each host should come off. One rule to know: if a virtualization host is covered by a physical-core ESU license, its VMs must be unsubscribed before that license resource is removed, or they revert to per-VM billing.

No. Under Microsoft's current terms the free-in-Azure ESU applies to SQL Server 2014, not to SQL Server 2016 — a 2016 instance on an Azure VM subscribes to ESU through the SQL IaaS Agent extension and pays. The only ways off the charge are a version upgrade or a move to a platform without a version to support, Azure SQL Managed Instance or Azure SQL Database. That is why the inventory names an exit route per instance rather than assuming a lift-and-shift ends the problem. Verify against Microsoft's lifecycle pages before committing; the terms are Microsoft's.

SQL Server 2014, yes — the same Arc enrollment, with ESU available through 12 July 2027 per Microsoft's product lifecycle, so its exit date is closer. SQL Server 2012, no: Microsoft's ESU program for it ended in July 2025, and there is no patch path at any price. Those instances are named in the inventory with the only honest options — isolate, migrate, or retire — and we scope that work separately.

It has its own clock. Windows Server 2016 leaves extended support on 12 January 2027 per Microsoft's product lifecycle, after which the operating system under your database needs Windows Server ESU — also available through Azure Arc, on the same connected host, as a separate enrollment with its own per-core charge. This engagement enrolls SQL Server; the Windows Server ESU Enrollment through Azure Arc is the matching service for the operating system, and when both are in scope we run them in the same week on the same hosts.

Installing the Connected Machine agent and the Azure extension for SQL Server adds two services that connect outbound to Azure and read instance metadata. Neither install is designed to restart SQL Server or reboot the host, and we run the pilot host inside a maintenance window to prove that on your estate before touching the rest. The one change with real impact is deliberate: bringing an instance that is behind on servicing up to SP3 plus the latest update, which does restart SQL Server and is scheduled in your window.

One host — a physical machine or a virtual machine — regardless of how many SQL Server instances it runs; named instances on the same host count once. It matches how Microsoft meters ESU (by the host's cores) and how Arc onboarding works (per machine). Ten hosts is $950 plus the $1,450 tenant fee, $2,400 in total as an estimate; large estates are quoted per estate.

Three checks, all handed over. The Arc resource for each host shows the ESU subscription state — active, with a timestamp. Azure Update Manager, or your existing patch tooling, is confirmed to see SQL Server updates on the host. And the runbook tells you what to check when Microsoft releases the first ESU after enrollment, because ESU updates ship only when a Critical vulnerability requires one — there may be nothing to install on handover day, and that is normal. If you would rather have that checked every month with evidence you can hand an auditor, the Managed ESU and Legacy Server Lifecycle Service does exactly that, as a separate monthly agreement.

For every instance: the recommended exit route — in-place upgrade to a supported version, migration to SQL Server on an Azure VM, Azure SQL Managed Instance or Azure SQL Database, retirement, or a deliberate stay on ESU to a named date — and the date it should happen, chosen against Microsoft's ESU price steps and your project calendar. We propose; you decide. It is the document that keeps ESU a plan rather than a habit, and it is written so the migration engagement can pick it up without re-discovery.

Not to enroll ESU. We need local administrator on each host to install the agent and extension; the extension runs under the host's system account to discover instances and report their state. Some optional Arc features for SQL Server need a login inside the instance, and we ask for those separately only if you want them — we do not take sysadmin by default, and everything we do is recorded on the host and in Azure's activity log.