# SQL Server 2016 is out of extended support: upgrade each instance or subscribe to Extended Security Updates

> Microsoft’s lifecycle page lists SQL Server 2016 extended support, including Service Pack 3, ending 7/15/2026 (Pacific Time), with paid Extended Security Updates in three yearly terms through July 2029. ESUs are released only if needed for Critical vulnerabilities, and for on-premises servers they generally require an Azure Arc connection.

- Canonical URL: https://update.dsesecurity.com/updates/sql-server-2016-end-of-support-july-2026-extended-security-updates-azure-arc/
- Publisher: Detection Systems & Engineering (DSE Security)
- Author: DSE Security Editorial Team
- Published: 2026-10-18T21:01:18+00:00
- Modified: 2026-10-18T22:22:08+00:00
- Last reviewed by DSE: 2026-10-18
- Resource type: Briefing
- DSE priority: Important
- Topics: Cybersecurity, IT
- Reading time: 2 minutes

## What you need to know

Microsoft’s lifecycle page lists SQL Server 2016 extended support, including Service Pack 3, ending 7/15/2026 (Pacific Time), with paid Extended Security Updates in three yearly terms through July 2029. ESUs are released only if needed for Critical vulnerabilities, and for on-premises servers they generally require an Azure Arc connection.

## Potentially affected

Organizations running SQL Server 2016 in any edition, including Express edition instances installed by other applications, and the vendors who support those applications.

## DSE recommendation

DSE recommends finding every SQL Server 2016 instance, including Express installs bundled with other software, and either upgrading it or covering it with ESUs until the upgrade is done.

## Article

Microsoft’s lifecycle page lists SQL Server 2016 extended support, including Service Pack 3, ending 7/15/2026 (Pacific Time), with paid Extended Security Updates in three yearly terms through July 2029. ESUs are released only if needed for Critical vulnerabilities, and for on-premises servers they generally require an Azure Arc connection.

## Source facts

Microsoft’s [SQL Server 2016 lifecycle page](https://learn.microsoft.com/en-us/lifecycle/products/sql-server-2016) lists it under the Fixed Lifecycle Policy for the Developer, Enterprise, Enterprise Core, Express, Standard and Web editions, with mainstream support ending in July 2021 and extended support, including Service Pack 3, ending 7/15/2026 at 6:59:59 AM Pacific Time. It lists Extended Security Updates Year 1 from July 15, 2026, Year 2 from July 14, 2027 and Year 3 ending July 17, 2029.

Microsoft’s [ESU guidance](https://learn.microsoft.com/en-us/sql/sql-server/end-of-support/sql-server-extended-security-updates) says the subscription protects servers for up to three years after support ends, that ESUs are released only if needed for vulnerabilities rated Critical by MSRC with no regular cadence, and that they exclude new features, functional improvements and customer-requested fixes. Customers who applied only GDR updates should install and validate the latest cumulative update when they subscribe.

For on-premises and other non-Azure environments, ESUs are available after connecting servers to Azure Arc, with Software Assurance under qualifying agreements or a pay-as-you-go option; instances that cannot connect may be eligible through volume licensing. Unlike SQL Server 2014, moving SQL Server 2016 to Azure VMs no longer provides free ESUs, and ESU licenses do not include support for the underlying SQL Server version.

## Applicability

Use this for any SQL Server 2016 instance. Some application vendors support only specific SQL Server versions, so confirm the upgrade target with each vendor before moving a database.

## DSE recommendation

DSE recommends finding every SQL Server 2016 instance, including Express installs bundled with other software, and either upgrading it or covering it with ESUs until the upgrade is done. Ask each application vendor which newer SQL Server version it supports, apply the latest cumulative update before subscribing to ESUs, test restores before any upgrade, and limit network access to instances still waiting.

## Verification

Inventory SQL Server instances on servers and workstations with version and edition, confirm each is upgraded or has an active ESU subscription, and recheck quarterly until none remain.

## Official references

[Microsoft Lifecycle — SQL Server 2016](https://learn.microsoft.com/en-us/lifecycle/products/sql-server-2016). [Microsoft Learn — What are Extended Security Updates for SQL Server?](https://learn.microsoft.com/en-us/sql/sql-server/end-of-support/sql-server-extended-security-updates). Reviewed October 18, 2026.

## Primary reference

- Name: Microsoft Lifecycle — SQL Server 2016
- Authority: Microsoft Learn
- URL: https://learn.microsoft.com/en-us/lifecycle/products/sql-server-2016
- Source publication date: Not stated by the source

## Citation and use

Preferred citation: “SQL Server 2016 is out of extended support: upgrade each instance or subscribe to Extended Security Updates,” DSE Security, https://update.dsesecurity.com/updates/sql-server-2016-end-of-support-july-2026-extended-security-updates-azure-arc/
Publishing principles: https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/
Usage and citation policy: https://update.dsesecurity.com/usage/
Copyright © 2026 Detection Systems & Engineering. All rights reserved.