SQL Server 2016 End of Support: Should You Buy ESU?

In July 2024, Microsoft officially ended support for SQL Server 2016, marking the end of an era for one of its most widely adopted database platforms. While your systems might still be running smoothly, the reality is that without regular security patches, updates, and vendor support, your organization faces rising risks, from cyberattacks to compliance violations. 

To help businesses buy time, Microsoft introduced Extended Security Updates (ESU). ESUs allow organizations to continue receiving critical security patches even after the official support window closes. But is relying on ESU a wise long-term strategy or just a short-term patch? 

This guide covers everything you need to know, including: 

• What ESU offers — and what it leaves out 

• How long ESU will be available for SQL Server 2016 

• Costs, eligibility, and the purchase process 

• Real benefits and major risks of depending on ESU 

• Expert tips to plan your next move 

If you're debating whether to invest in ESUs or fast-track your upgrade, this breakdown will help you make a smart decision.  

What are Extended Security Updates (ESUs)? 

Extended Security Updates (ESU) are Microsoft’s emergency safety net for organizations still running SQL Server 2016 after its end-of-support date. ESUs offer critical security patches only — no new features, no performance boosts, and no non-security bug fixes. 

Put simply, ESU keeps your systems protected from newly discovered threats while you work on a proper upgrade plan. It helps you maintain regulatory compliance and defend against cyberattacks during your transition window. 

But it’s important to understand the limits: 

• No free support: ESU doesn’t come with Microsoft support incidents. Support contracts are separate. 

• No performance improvements: ESUs only fix security flaws, not slowdowns or other technical issues. 

• Outdated systems stay outdated: Your infrastructure is still old — just slightly less vulnerable. 

How Long Will ESUs Be Available for SQL Server 2016? 

Microsoft offers ESUs for up to three years after a product reaches its end-of-support date. 

Here’s the official ESU timeline for SQL Server 2016: 

After July 2027, no more security patches will be available even if you purchased ESU. SQL Server 2016 will then become permanently unsupported, leaving systems exposed to serious security risks. 

Important to know: 

• Each year’s ESU must be purchased separately, and it’s not automatic. 

• Costs typically double every year, making the third year the most expensive. 

• Once the ESU program ends, there are no extensions or special exceptions. 

Who Is Eligible to Purchase SQL Server 2016 ESU? 

Not every SQL Server 2016 customer can simply opt in for ESUs. Microsoft has set clear rules about who can qualify, and missing these requirements can leave your environment without protection. 

Here’s a breakdown of the eligibility requirements: 

Licensing requirements 

• Volume Licensing:
  You must have SQL Server licenses through a Volume Licensing agreement, such as an Enterprise Agreement (EA) or Open License Program. 

• Software assurance (SA):
  An active Software Assurance (SA) subscription is typically required. This proves that your licensing is current and entitles you to upgrade benefits. 

• Eligible editions: 

 Only specific editions of SQL Server 2016 are eligible for ESU: 

• Standard
• Enterprise 

• Datacenter (in select configurations) 
• Special case: Azure deployments 

If you run SQL Server 2016 instances on Azure Virtual Machines, Microsoft provides ESUs at no additional cost. You don’t need to purchase anything extra as protection is built in until the ESU program ends. 

Critical reminders 

• Customers using OEM licenses or non-Volume Licensing agreements may not qualify without special arrangements. 

• Third-party hosting providers might offer ESU options, but eligibility can vary depending on the terms of your hosting agreement. 

How Much Does ESU Cost? 

In short: By the third year, you could pay four times the cost of a new license — without gaining any performance improvements or new features. 

Factors that affect ESU costs 

• Licensing model: 

• Core-based licenses are priced per core. 

• Server/CAL models require coverage for both servers and Client Access Licenses. 

• Edition type:
  Enterprise Edition ESUs are more expensive than Standard Edition. 

• Environment size:
  More instances mean higher total ESU costs. 

Hidden costs to watch for 

• Infrastructure maintenance on aging servers 

• Increased support expenses for legacy systems 

• Potential downtime and regulatory penalties if coverage lapses 

How to Purchase and Install ESU 

If you’ve decided to use ES, it's important to follow the right steps. Here’s how to handle the ESU process from purchase to installation: 

How to Purchase ESU 

1.  Confirm eligibility:

Check that you have valid Volume Licensing, active Software Assurance, and eligible SQL Server editions. 

2. Work with an authorized partner:

ESU must be purchased through a Microsoft partner or your Volume Licensing reseller — it’s not available directly through online stores. 

3. Purchase annually:

Each ESU year must be purchased separately. You cannot buy all three years upfront. 

4. Track licenses carefully:

Maintain accurate records for each instance and core covered. Good documentation is crucial during audits.

How to install and Activate ESU 

1. Apply prerequisite updates:

Before installing ESUs, make sure all your SQL Server 2016 instances are updated with the latest cumulative updates (CUs) and service packs. 

2. Install the ESU activation key:

After purchase, you’ll receive an activation key from Microsoft. Install this key on each server to enable ESU patch delivery. 

3. Deploy monthly security updates:

Once activated, servers will continue to receive security patches through Windows Update, WSUS, or manual deployment. 

4. Monitor and validate:

Regularly check that patches are applied correctly and systems remain protected. 

Critical reminders 

• Separate activation every year:
  Each year’s ESU must be installed and activated separately. Missing a renewal can disqualify you from future years. 

• Security patches only:
  ESUs do not fix non-security issues like performance problems or bugs. 

Benefits of Using ESU (Short-Term) 

Extended Security Updates are not a perfect solution, but they serve an important role for organizations that need more time to plan a safe upgrade. Used correctly, ESUs can buy critical breathing room without putting operations or compliance at immediate risk. 

Here are the biggest short-term benefits of ESU: 

1. Continued security protection 

ESUs keep your systems shielded from newly discovered vulnerabilities after the end-of-support date.
This reduces the risk of cyberattacks, ransomware, and breaches while you finalize your upgrade plans. 

2. Temporary compliance support 

In heavily regulated industries like healthcare (HIPAA) or finance (SOX, PCI DSS), ESUs help maintain security compliance for a limited time.
This can be the difference between passing or failing audits while transitioning to newer systems. 

3. More time to plan upgrades 

Major upgrades, whether on-premises or cloud migrations, require careful planning, testing, and execution.
ESUs give IT teams a safer window to work through hardware refreshes, application testing, and performance tuning without rushing. 

4. Reduced risk during complex transitions 

Large enterprises with many SQL Server instances, customized deployments, or integrated applications often face complex migration paths.
An ESU window reduces the pressure, allowing more methodical moves without risking downtime or service disruptions. 

Drawbacks of Relying on ESU 

While ESUs offer short-term protection, depending on them for too long creates serious risks: financial, operational, and security-related. 

Organizations that treat ESU as a long-term strategy often end up facing bigger problems down the road. 

Here are the main drawbacks to consider: 

1. High and escalating costs 

ESU pricing doubles each year.
By the third year, you could pay more than four times the cost of the original SQL Server license, all without getting any new features or performance improvements. 

This rising cost quickly becomes unsustainable for large environments. 

2. No performance improvements or bug fixes 

ESUs only patch critical security vulnerabilities.
They don’t address performance slowdowns, database bugs, or feature enhancements.
Over time, aging systems become harder and more expensive to maintain. 

3. Growing technical debt 

The longer you run unsupported platforms, the more technical debt you accumulate.
Upgrades become more complicated, costly, and risky the longer you wait.
Legacy systems also limit your ability to adopt new technologies or meet modern business needs. 

4. Incomplete security coverage 

ESUs patch only critical vulnerabilities.
They do not protect against lower-priority issues, misconfigurations, or application-level attacks — leaving gaps that attackers can exploit. 

5. Ongoing compliance and audit risks 

Regulators may view extended use of unsupported platforms as a higher risk even if ESUs are applied.
You could face more intense scrutiny during audits and may need to provide additional documentation or take extra mitigation steps. 

ESU vs. Full Upgrade Decision: Which Path Is Smarter? 

When SQL Server 2016 reached its end of support, many organizations faced the same tough question:
Should we buy ESUs or invest in a full upgrade right away? 

Both paths offer pros and cons — but the smarter move depends on your long-term goals, risk tolerance, and budget flexibility. 

Choosing ESU (short-term ONLY) 

• Best if you need extra time to complete complex migrations. 

• Helps maintain compliance when immediate upgrades aren’t possible. 

• Suitable if your team is actively working on a defined transition plan. 

Caution:
Prolonged reliance on ESU grows more expensive and risky every year.

Choosing full upgrade (strategic move) 

• Eliminates the need for costly temporary ESU purchases. 

• Unlocks better security, performance improvements, and modern features. 

• Strengthens compliance for healthcare, finance, and other regulated industries. 

• Future-proofs your infrastructure for growth, agility, and innovation.  

A quick comparison 

How Atlas Systems Supports Your SQL Server Modernization 

Atlas Systems has deep expertise helping organizations upgrade and modernize their SQL Server environments, whether on-premises, in the cloud, or through a hybrid approach. 

From strategic planning to execution, we help you: 

• Design a practical upgrade or migration plan based on your specific needs. 

• Strengthen security, compliance, and resilience across your systems. 
• Minimize downtime, control costs, and maximize long-term value. 

If you’re ready to leave SQL Server 2016 behind, partner with Atlas Systems to protect your business, future-proof your infrastructure, and unlock your next stage of growth. 

Explore SQL Server Modernization Services at Atlas Systems.