Extended Security Updates: What You Are Actually Buying

What ESU is

Extended Security Updates are a paid programme that continues delivering security patches for a Microsoft product after its extended support period has ended. It exists for exactly one reason: to give organisations that cannot migrate in time a way to stay patched while they finish.

It applies to specific products with specific windows. SQL Server 2016 has three annual ESU windows running from July 15, 2026 to July 17, 2029, per Microsoft's lifecycle data. Windows Server versions have their own programmes with their own dates. The windows are fixed and published in advance; ESU does not extend indefinitely.

What it covers, and what it does not

This is where the misunderstanding usually sits. ESU is much narrower than most people assume.

It covers security updates that Microsoft rates as Critical or Important, for the specific product, for the duration of the window you have paid for.

It does not cover new features, performance improvements, ordinary non-security bug fixes, or requests for changes. It also does not include technical support — if you need help with a problem, that requires a separate active support agreement. And it does not extend to third-party software running on the platform, which keeps its own support lifecycle regardless.

The practical implication: ESU keeps a system patched against newly published vulnerabilities. It does not keep the system supported in the ordinary sense. If something breaks that is not a security issue, you are on your own with it.

Why the price escalates on purpose

ESU is priced annually, and the price rises each year of the programme. This is deliberate design, not opportunism.

The pricing is structured to make ESU cheaper than an emergency migration in year one, comparable to a planned migration by year two, and clearly more expensive than migrating by year three. The intent is to make ESU attractive as a bridge and unattractive as a destination — because an organisation that treats it as a permanent arrangement ends up paying escalating fees to run software that is falling further behind every year.

The useful way to think about it: ESU buys time, and time is worth buying when you have a concrete plan that needs a few more months. It is poor value when bought as a way of avoiding making the decision, because the decision does not get cheaper and the fee does not stop rising.

The Azure exemption that changes the maths

The detail that most changes the calculation for small businesses: Extended Security Updates are included at no additional cost for workloads running on Azure.

Move the same unchanged SQL Server instance or Windows Server onto an Azure virtual machine and the ESU fee disappears, because the security updates come with the platform. The workload does not need modernizing to qualify. A straight lift-and-shift is enough.

This reframes the comparison in a way that is easy to miss. The choice is often presented as pay for ESU and stay put, versus spend on a migration project. But there is a third option: rehost to Azure, which removes the hardware risk and includes the security updates. For an organisation weighing an escalating annual fee against a one-off rehost, the rehost frequently wins on cost alone within a year or two — before counting the hardware that no longer needs replacing.

That is precisely the shape of a straight rehost, and the manufacturing rehost case study is an example of one: a stable application moved to Azure without code changes, in a single planned maintenance window.

When buying time is the right call

ESU is genuinely the correct choice in a few situations, and it is worth naming them rather than treating it as always wrong.

A migration is already underway and will not finish before the deadline. This is what ESU is for. Paying for a few months of patches to avoid rushing a cutover is a good trade.

The application is being retired on a known date. If the system genuinely goes away in fourteen months, migrating it is wasted effort and ESU is cheaper than the project.

A contractual or regulatory constraint blocks the move temporarily. Sometimes the timing is not yours to control, and staying patched while the constraint resolves is the responsible option.

What all three have in common is a defined end point. ESU works as a bridge to something specific. Where there is no end point — where the plan is to keep paying and see how it goes — the escalating fee funds an increasingly outdated system, and the eventual migration still has to happen, from a worse starting position. The migration guide covers what that eventual project looks like.

Frequently asked questions