Extended Security Updates (ESUs) are Microsoft’s paid bridge for products that have passed the end of extended support. They buy time; they are not a support plan.
What ESUs include — and what they don’t
- Windows Server: security updates and bulletins rated critical and important, for a fixed period after extended support ends. No new features, no customer-requested non-security hotfixes, no design changes.
- SQL Server: released only if a vulnerability is rated Critical by the Microsoft Security Response Center, so there is no regular cadence. ESUs for SQL Server 2014 and 2016 include the most recent Cumulative Update, so Microsoft advises installing and validating the latest CU when you subscribe. No new features, functional improvements or customer-requested fixes.
How long
- Windows Server 2012 and 2012 R2: extended support ended October 10, 2023; ESUs end October 13, 2026 (three years), both in Azure and outside Azure.
- SQL Server: up to three years after the end of extended support. microsoft.com lists the SQL Server 2014 ESU end as July 12, 2027, and SQL Server 2016 ESUs starting after extended support ended on July 14, 2026.
- Windows Server 2016: extended support ends January 12, 2027, and microsoft.com says Windows Server 2016 ESUs start then.
- Windows 10: support ended October 14, 2025. Microsoft’s consumer ESU program provides security updates through October 12, 2027.
How you get them
- Move the workload to Azure. Windows Server 2012/2012 R2 ESUs are free of charge for servers hosted in Azure (including the Azure Stack portfolio). SQL Server 2014 gets free ESUs on Azure VMs; starting with SQL Server 2016, moving to Azure VMs no longer gives free ESUs.
- Buy them. For Windows Server outside Azure you purchase a subscription and install a product key on each server. For SQL Server, instances connected to Azure Arc or running on Azure VMs can subscribe; billing is hourly and the subscription is cancelled automatically when you migrate or upgrade. microsoft.com says customers with Software Assurance or subscription licences can buy ESUs for up to three more years.
When ESUs make sense — and when they don’t
- Make sense: a dated upgrade plan exists and only needs a few more months; a third-party application blocks the upgrade until its vendor certifies a newer version.
- Don’t: as an open-ended way to avoid upgrading. The period is capped, the scope is narrow (no non-security fixes), and costs and conditions can change; check current terms with Microsoft or your licensing partner.