SQL Server 2016 left extended support on 14 July 2026, so any instance not enrolled in Extended Security Updates now receives no security fixes at all. Many of these instances sit behind line-of-business applications, reporting servers and vendor products that nobody has touched for years, often on Windows Server 2016, which itself leaves extended support in January 2027. This guide sets out the official Microsoft timeline as published on the Microsoft Lifecycle site (checked 8 November 2026), who is affected, how to find every instance and the identities attached to it, and the realistic choices: upgrade in place, migrate, move to Azure, or buy time with ESU. It is written for database administrators, infrastructure leads and vulnerability managers who own the remediation plan. Hardening a supported instance is covered separately in the Microsoft SQL Server Security Guide.
This is an independent guide from NHI Mgmt Group, based on Microsoft's public documentation as of November 2026. It is not sponsored or reviewed by Microsoft. Product features change, so confirm settings against Microsoft's current documentation.
Key takeaways
- The deadline has passed. Extended support for SQL Server 2016 ended on 14 July 2026 (Pacific Time). Unenrolled instances are now permanently unpatched for any new vulnerability.
- ESU is a bridge, not a fix. Extended Security Updates run for up to three years, to 17 July 2029, cover only vulnerabilities Microsoft rates Critical, and are limited to Enterprise and Standard editions on the latest service pack.
- Azure no longer means free ESU. Unlike SQL Server 2014, moving SQL Server 2016 to an Azure virtual machine does not include free ESUs; you subscribe and pay.
- In-place upgrade is supported from SP3. SQL Server 2016 SP3 or later can upgrade directly to SQL Server 2022 or SQL Server 2025, but Web edition does not exist in 2025 and the operating system underneath may also be near end of support.
- Inventory decides the timeline. Shadow instances, Express editions bundled with applications and forgotten reporting servers are the ones that stay vulnerable; find them, and the service accounts and logins they hold, first.
What is changing and why
SQL Server follows Microsoft's Fixed Lifecycle Policy: five years of mainstream support (functional, performance, scalability and security updates) followed by five years of extended support (security updates only). End of support means Microsoft no longer provides servicing or support for the product. For SQL Server 2016 that second five-year period has now finished.
The practical change is simple and severe. Cumulative updates and GDR security updates stopped at the end of extended support. When a new vulnerability in the Database Engine, SQL Server Reporting Services (SSRS), Integration Services or Analysis Services is published, Microsoft will fix it only for supported versions and for customers paying for ESU. Your vulnerability scanner will keep reporting the finding, and there will be no patch to close it. Microsoft support also changes: according to the ESU FAQ, without ESU you cannot log a support ticket for SQL Server 2016 even if you hold a support plan.
This matters for security because database servers are a frequent target and old flaws keep being exploited years after a patch exists. Microsoft publishes security updates through the Security Update Guide; after end of support, unenrolled instances stop receiving them, so plan to enrol, upgrade or migrate.
Official timeline and current status
All dates below come from the Microsoft Lifecycle page for SQL Server 2016, as published when checked on 8 November 2026. Microsoft lists times in Pacific Time; an end date shown as "15 July 2026 6:59:59 AM PT" means support ran to the end of 14 July 2026. Lifecycle dates can be revised, so confirm against the Lifecycle page before quoting them in contracts.
| Milestone | Date (as announced by Microsoft) | Status on 8 Nov 2026 |
|---|---|---|
| General availability | 1 June 2016 | Historical |
| Service Pack 1 support ends | 10 July 2019 | Ended |
| Mainstream support ends | 14 July 2021 (listed 7/14/2021 6:59:59 AM PT) | Ended |
| Service Pack 3 released (final service pack) | 15 September 2021 | Only SP3 was supported to the end |
| Service Pack 2 support ends | 12 October 2022 | Ended |
| Extended support ends | 14 July 2026 (listed 7/15/2026 6:59:59 AM PT) | Ended |
| ESU Year 1 | 15 July 2026 to 13 July 2027 | Current |
| ESU Year 2 | 14 July 2027 to 18 July 2028 | Future |
| ESU Year 3 | 19 July 2028 to 17 July 2029 | Future, final |
| Windows Server 2016 extended support ends | 13 January 2027 (listed 1/13/2027 6:59:59 AM PT) | Approaching |
The lifecycle applies to the Developer, Enterprise, Enterprise Core, Express, Standard and Web editions. Two related dates shape planning: SQL Server 2017 is listed by Microsoft as reaching extended end of support in 2027, so upgrading to 2017 only buys months; and an instance on Windows Server 2016 faces a second deadline in January 2027 for the operating system. The Operating System End of Life and Extended Support Guide covers the Windows side.
What ESU does and does not give you
| Aspect | What Microsoft documents |
|---|---|
| Fixes included | Security updates released only when the Microsoft Security Response Center rates a vulnerability Critical; no regular cadence |
| Not included | New features, functional improvements, customer-requested fixes |
| Eligible editions | Enterprise and Standard (x86 and x64); Express, Web and Developer are not eligible (Developer may be patched for dev and test if production instances hold ESU) |
| Patch level required | The latest service pack (SP3); if you applied only GDR updates, install and validate the latest cumulative update when subscribing |
| Licensing prerequisite | Software Assurance or subscription licences |
| Billing | Per virtual core (4-core minimum per VM) or per physical core; pay as you go; a late subscription is billed back to the first day of the ESU term |
| Azure VMs | Subscribe through the SQL IaaS Agent extension; no free ESU for SQL Server 2016 |
| Support | Limited to deploying, installing and activating ESU updates, including regressions they cause |
"Important" and "Moderate" rated vulnerabilities, which include many privilege escalation and information disclosure flaws, will not be fixed even with ESU. Plan compensating controls for those regardless of enrolment.
Who and what is affected
- Production databases on SQL Server 2016: any version 13.x instance, whatever the edition. Express and Web instances are the hardest case because ESU is not available to them at all.
- Applications that embed SQL Server: backup consoles, monitoring tools, building management systems, security products and line-of-business packages often install their own Express instance. The software vendor's support statement for newer SQL Server versions decides how fast you can move.
- Reporting and BI components: SSRS, SSIS and SSAS 2016 share the product lifecycle. SSRS servers are often internet-adjacent, so include them in the same plan.
- Instances below SP3: anything still on RTM, SP1 or SP2 lost support years earlier, cannot take ESU until patched to SP3, and must reach SP3 before an in-place upgrade to 2022 or 2025.
- Compliance obligations: frameworks that require supported software (for example NIST SP 800-53 SA-22 Unsupported System Components, NIST CSF 2.0 PR.PS-02) turn every unenrolled instance into an audit finding with a documented exception or a dated plan.
Finding affected systems and identities
Most organisations undercount their SQL Server estate. Combine several discovery sources rather than trusting the CMDB alone; see the Asset Inventory and CMDB Security Guide.
- Query known instances. Microsoft documents several ways to read the version: SSMS Object Explorer, the first lines of the ERRORLOG file,
SELECT @@VERSION, andSERVERPROPERTY('productversion'),SERVERPROPERTY('productlevel')andSERVERPROPERTY('edition'). A product version beginning 13. is SQL Server 2016; product level shows RTM, SP1, SP2 or SP3. - Run the local discovery report. The "Installed SQL Server features discovery report" on the Tools page of the SQL Server Installation Center lists every instance and feature on a host, including SSRS and SSIS.
- Use agent and scanner data. Endpoint management, software inventory and authenticated vulnerability scans find installs the database team never registered. Network discovery of TCP 1433 and the SQL Browser service on UDP 1434 catches default and named instances on unmanaged hosts.
- Use cloud inventory where connected. Azure Arc and Azure Migrate both discover SQL Server instances; Arc is also the route to ESU for on-premises servers. See the Azure Arc-Enabled Servers Security Guide.
- Record ownership and dependencies. For each instance capture the edition, patch level, host OS, owning application, data classification, internet exposure and whether the software vendor supports a newer SQL Server version.
Where identity fits
An old SQL Server is rarely just a database: it holds credentials that reach elsewhere. Before migrating, inventory the non-human identities attached to each instance, because they are moved, re-created or quietly left behind during upgrades.
- Service accounts: the Database Engine, SQL Server Agent and SSRS service accounts, often domain accounts with static passwords set in 2016. Upgrades are a good moment to move them to group managed service accounts. See the Group Managed Service Accounts (gMSA) Guide.
- SQL logins: the
saaccount and application SQL logins, which migrations re-create in the targetmasterdatabase; side-by-side migrations must carry or deliberately retire them. - Stored credentials: linked server logins, SQL Agent credentials and proxies, SSIS package connection strings and SSRS data source credentials, all of which can reach other systems.
- Application connection strings: passwords in configuration files on application servers that point at the old instance. See the Database Credential and Access Security Guide.
Migration options
Microsoft's end of support guidance lists six paths. They are not mutually exclusive: many estates buy ESU for a year to cover a migration programme.
| Option | What it involves | Choose it when | Watch out for |
|---|---|---|---|
| In-place upgrade to SQL Server 2022 or 2025 | Run Setup on the existing host; SP3 or later required | The host OS is supported and the application vendor certifies the new version | Hard to roll back; Windows Server 2016 hosts reach end of support in January 2027; Web edition is not available in 2025 |
| Side-by-side migration on-premises | New host and OS, restore or log ship databases, cut over | You also need to replace the OS or hardware | Logins, Agent jobs, linked servers and credentials must be moved explicitly |
| SQL Server on Azure VMs | Lift and shift, as-is or upgraded | You want to leave the data centre but keep full instance control | SQL Server 2016 still needs a paid ESU subscription in Azure |
| Azure SQL Managed Instance | Near full-instance compatibility as a managed service that does not reach end of support | Applications use instance features such as Agent jobs or cross-database queries | Feature gaps must be assessed first |
| Azure SQL Database (Hyperscale) | Refactor to database-level PaaS | Modern applications with no instance-level dependencies | Most application change; identity model moves to Microsoft Entra authentication |
| Extended Security Updates | Stay on 2016 and pay for Critical fixes to July 2029 | Migration cannot finish quickly, or a vendor product is not yet certified | Enterprise and Standard only; Critical fixes only; cost per core and bill-back |
Microsoft also lists Azure VMware Solution, with the same ESU terms as Azure VMs. For assessment, Microsoft names Azure Migrate (discovery, sizing and Azure SQL recommendations), the SQL Server migration component in SSMS (compatibility problems in the target version), Query Tuning Assistant (workloads affected by compatibility level changes) and Azure Database Migration Service.
Decision guidance: a small organisation with a handful of Standard instances behind a supported packaged application usually does best with an in-place or side-by-side move to SQL Server 2022, since 2017 runs out in 2027. Large estates should triage by exposure and data sensitivity: internet-facing and SSRS servers first, then instances with regulated data, then internal low-value systems. Express and Web instances cannot buy ESU, so they must be upgraded, replaced or isolated. Upgrading the database without the OS leaves you facing the January 2027 Windows Server 2016 deadline.
Testing and rollback
- Patch to SP3 and the latest update first. This is a prerequisite for both ESU and in-place upgrade, and gives you a stable baseline.
- Back up everything, including system databases. Take full backups of user databases and of
master,msdbandmodel, script logins with their SIDs and password hashes, and export Agent jobs, linked servers and SSRS encryption keys. Verify a restore before you start. - Check Setup blockers. Microsoft documents that Setup is blocked by a pending restart or a stopped Windows Installer service, that the SQL Server Agent must use Windows authentication with its account in sysadmin, that 2022 and 2025 are 64-bit only, and that features cannot be added during the upgrade.
- Test in a copy first. Restore production backups to a test instance of the target version, run the compatibility assessment, and replay representative workload. Leave databases at their existing compatibility level (130 for 2016) at cutover and raise it later, so query plan changes are separated from the version change.
- Pilot with low-risk systems. Upgrade internal, low-impact instances before customer-facing ones and keep a change window long enough to restore.
- Plan rollback realistically. An in-place upgrade cannot be reversed by uninstalling: rollback means rebuilding the old version and restoring backups, and a database restored or attached to a newer version cannot be moved back to 2016. Side-by-side migration is the safer pattern because the old instance stays intact, read-only, until sign-off.
- Decommission properly. After cutover, disable the old instance's service and SQL logins, remove its service accounts and stored credentials, and update the inventory so it is not counted twice.
Risks of doing nothing
| Risk | How it shows up | Compensating control while you migrate | Framework reference |
|---|---|---|---|
| Exploitation of an unpatched flaw | Remote code execution on the database or SSRS host (ATT&CK T1190 Exploit Public-Facing Application) | Remove internet exposure, restrict TCP 1433 to application hosts, virtual patching at the network layer | NIST SP 800-53 SI-2, SA-22 |
| Credential abuse | Brute force against SQL logins (T1110), reuse of old service account passwords (T1078 Valid Accounts) | Disable or rename sa, enforce Windows authentication, rotate service account passwords | NIST SP 800-53 CM-8, RA-5 |
| Persistence in the database | Malicious stored procedures or Agent jobs (T1505.001 SQL Stored Procedures) | Audit object and job creation, alert on xp_cmdshell being enabled | NIST CSF 2.0 ID.RA-01 |
| No vendor support | No support ticket possible without ESU, longer outages | Documented risk acceptance with an end date | NIST CSF 2.0 PR.PS-02 |
| Audit and contract findings | Unsupported software flagged by auditors, insurers and customers | Exception register entry with owner and migration date | CIS Controls v8.1 Control 2; ISO/IEC 27001:2022 A.8.8 |
Compensating controls reduce exposure but do not replace patches. Treat them as time-limited and record each in an exception register; see the Virtual Patching and Compensating Controls Guide and the Hardening Exceptions and Compensating Controls Template.
Detection and measurement
- Monitor: failed logins in the SQL Server error log and audit, enabling of
xp_cmdshellor CLR, new sysadmin role members, new Agent jobs and linked servers, and network connections to 1433 from unexpected sources. See the Database Audit Log Detection Guide. - Metric: number of SQL Server 2016 instances, split into ESU-enrolled, unenrolled and decommissioned, reported monthly.
- Metric: percentage of 2016 instances with a named owner, approved target and migration date.
- Metric: unenrolled instances that are internet-reachable (target: zero).
- Metric: ESU cost per month against migration progress, so the bridge does not become permanent.
- Metric: service accounts and stored credentials from retired instances removed within 30 days of cutover.
Practitioner checklist
- Build a complete inventory of version 13.x instances from at least two discovery sources, including Express and SSRS.
- Record edition, patch level, host OS, owner, data classification and exposure for each instance.
- Patch every remaining instance to SP3 and the latest update now.
- Decide per instance: upgrade, migrate, move to Azure, ESU or retire, and record a date.
- Enrol Enterprise and Standard instances that cannot move before July 2027 in ESU, remembering the bill-back.
- Upgrade, replace or isolate Express and Web instances, which cannot receive ESU.
- Align the database plan with Windows Server 2016 end of support on 13 January 2027.
- Inventory and migrate service accounts, logins, linked servers and stored credentials; move service accounts to gMSA.
- Apply compensating controls to every unsupported instance and log each in the exception register.
- Decommission old instances and their identities after cutover and report progress monthly.
Standards and references
- Microsoft Learn: SQL Server 2016 lifecycle
- Microsoft Learn: What are Extended Security Updates for SQL Server?
- Microsoft Learn: Extended Security Updates frequently asked questions
- Microsoft Learn: End of support options for SQL Server
- Microsoft Learn: Supported version and edition upgrades (SQL Server 2022)
- Microsoft Learn: Supported version and edition upgrades (SQL Server 2025)
- NIST: SP 800-53 Rev. 5
- Microsoft: Security Update Guide
Related NHI Mgmt Group resources: Microsoft SQL Server Security Guide · Operating System End of Life and Extended Support Guide · Database Security Guide · Patch Management Guide