What you need to know
Microsoft’s lifecycle page lists SQL Server 2016 extended support, including Service Pack 3, ending 7/15/2026 (Pacific Time), with paid Extended Security Updates in three yearly terms through July 2029. ESUs are released only if needed for Critical vulnerabilities, and for on-premises servers they generally require an Azure Arc connection.
Potentially affected
Organizations running SQL Server 2016 in any edition, including Express edition instances installed by other applications, and the vendors who support those applications.
DSE recommendation
DSE recommends finding every SQL Server 2016 instance, including Express installs bundled with other software, and either upgrading it or covering it with ESUs until the upgrade is done.
Microsoft’s lifecycle page lists SQL Server 2016 extended support, including Service Pack 3, ending 7/15/2026 (Pacific Time), with paid Extended Security Updates in three yearly terms through July 2029. ESUs are released only if needed for Critical vulnerabilities, and for on-premises servers they generally require an Azure Arc connection.
Source facts
Microsoft’s SQL Server 2016 lifecycle page lists it under the Fixed Lifecycle Policy for the Developer, Enterprise, Enterprise Core, Express, Standard and Web editions, with mainstream support ending in July 2021 and extended support, including Service Pack 3, ending 7/15/2026 at 6:59:59 AM Pacific Time. It lists Extended Security Updates Year 1 from July 15, 2026, Year 2 from July 14, 2027 and Year 3 ending July 17, 2029.
Microsoft’s ESU guidance says the subscription protects servers for up to three years after support ends, that ESUs are released only if needed for vulnerabilities rated Critical by MSRC with no regular cadence, and that they exclude new features, functional improvements and customer-requested fixes. Customers who applied only GDR updates should install and validate the latest cumulative update when they subscribe.
For on-premises and other non-Azure environments, ESUs are available after connecting servers to Azure Arc, with Software Assurance under qualifying agreements or a pay-as-you-go option; instances that cannot connect may be eligible through volume licensing. Unlike SQL Server 2014, moving SQL Server 2016 to Azure VMs no longer provides free ESUs, and ESU licenses do not include support for the underlying SQL Server version.
Applicability
Use this for any SQL Server 2016 instance. Some application vendors support only specific SQL Server versions, so confirm the upgrade target with each vendor before moving a database.
DSE recommendation
DSE recommends finding every SQL Server 2016 instance, including Express installs bundled with other software, and either upgrading it or covering it with ESUs until the upgrade is done. Ask each application vendor which newer SQL Server version it supports, apply the latest cumulative update before subscribing to ESUs, test restores before any upgrade, and limit network access to instances still waiting.
Verification
Inventory SQL Server instances on servers and workstations with version and edition, confirm each is upgraded or has an active ESU subscription, and recheck quarterly until none remain.
Official references
Microsoft Lifecycle — SQL Server 2016. Microsoft Learn — What are Extended Security Updates for SQL Server?. Reviewed October 18, 2026.
Review the official source
Microsoft Lifecycle — SQL Server 2016 · Verified October 18, 2026
Need help applying this guidance safely?
DSE can help confirm applicability, protect service continuity, and validate the result across physical security and IT systems.
Talk with DSE