You never bought a database. The one under your billing system went end of support in July.

On July 14, 2026, SQL Server 2016 reached the end of Microsoft's extended support. Billing for its Extended Security Updates began at midnight UTC the next day. That was three months ago, and most small offices running it did not notice — because nobody in the office ever bought SQL Server.

You bought utility billing. Or work orders, or records management, or a point-of-sale, or the software that prints the water bills. The database came underneath it, installed by the application's own setup program, and it has been running ever since without appearing on a purchase order anyone remembers. It has its own version number, its own edition, and its own end-of-support date, none of which are printed anywhere a clerk would look.

What end of support actually means here

Microsoft's language is worth reading exactly. Extended Security Updates for SQL Server deliver only updates rated Critical by the Microsoft Security Response Center, for a maximum of three years, and only “if and when available.” They include no new features, no customer-requested non-security hotfixes, and no general technical support.

And without ESUs, Microsoft's own FAQ says, you cannot open a support ticket for SQL Server 2014 or 2016 at all — “even with a support plan.” That is the clause that bites a city at four o'clock on a Thursday when the billing run will not finish and somebody needs an answer tonight.

This matters more than it used to. Verizon's 2026 Data Breach Investigations Report found vulnerability exploitation is now the leading way breaches begin — ahead of phishing and stolen credentials. Unpatched software is no longer the slow-burning risk it was treated as five years ago.

The door that does not exist

Here is the part that catches small offices. Extended Security Updates are sold only for SQL Server Standard and Enterprise editions. Microsoft is blunt about the rest: “Customers cannot subscribe to an ESU Plan for SQL Server Express, Developer or Web edition.”

A great many small-office applications ship on Express, because it is free and the data fits.

If yours does, the buy-more-time option is not expensive. It is unavailable, at any price. The only path forward is a newer database engine, which means your software vendor has to support one.

There is one narrow exception worth knowing. If an Express instance sits on the same physical or virtual machine as a licensed Standard or Enterprise instance of the same SQL Server version, the ESU plan covers the whole machine and the updates apply to every instance on it. That is a real exception, and it is also not a plan.

Three dates, two already behind you

• July 14, 2026 — SQL Server 2016 end of extended support. Paid ESU coverage runs in one-year terms ending July 13, 2027, July 18, 2028, and July 17, 2029.
• October 13, 2026 — six days ago. In Microsoft's words: “On October 13, 2026, the Extended Security Updates (ESU) program for Windows Server 2012 and Windows Server 2012 R2 ended.” There is no fourth year. Anything still running those operating systems is out of road entirely.
• January 12, 2027 — Windows Server 2016 end of extended support, 85 days from today. ESUs begin that day, delivered through Azure Arc.

If your city or your shop bought a server around 2016 and a billing package to go on it, there is a fair chance both halves are on this list.

What each way out costs

Microsoft does not publish per-core ESU prices on its public pages — it points you to a representative and the FAQ — so no honest article can quote you a number. What is published, and what matters more for budgeting, is the structure of each cost.

• Buy time. ESUs are billed hourly through Azure on a pay-as-you-go basis, priced per virtual core with a four-core minimum per virtual machine, or per physical core with a sixteen-core minimum per host if you take the unlimited-virtualization option. You need Software Assurance under an Enterprise Agreement, Enterprise Subscription Agreement, Server & Cloud Enrollment or Enrollment for Education Solutions, or else an Azure Arc connection. One detail to plan around: SQL Server 2016 billing began July 15, 2026, and subscribing now adds a one-time bill-back to that date. The meter started whether you signed up or not. Billing stops the day you upgrade or migrate. And the whole option caps out at three years.
• Upgrade the database, the server, or both. Microsoft's licensing is usually the smallest line in this. The real cost is your application vendor's supported-version matrix, their upgrade fee, and whatever custom reports and integrations have to be rebuilt afterward. That number comes from the vendor, not from Microsoft, and it is the number to go get first.
• Let the software vendor carry it. Moving the application to a vendor-hosted arrangement puts the lifecycle on a company whose business depends on keeping it current. Worth knowing before you assume cloud solves it: starting with SQL Server 2016, moving the workload to SQL Server on an Azure VM no longer comes with free ESUs. That was true for 2014 and is not true for 2016.

The honest comparison: door one has a bill-back clock behind it and a hard three-year ceiling. Door two costs money once. Door three hands the problem to somebody else, for a monthly fee. And door one is not open at all if you are on Express.

What to do, in order

1. Find out what you are actually running. Ask your IT provider for the SQL Server version and edition behind each line-of-business application, in writing. Edition is the word that decides whether door one exists, and it is the word most often left out.
2. Ask each software vendor three questions: which SQL Server versions does your current release support, what does the upgrade cost, and what is your own timeline for the January 12, 2027 Windows Server date.
3. Check whether you have Software Assurance. Many small governments and small businesses do not, which changes the ESU path to an Azure Arc connection and changes the conversation.
4. Put the operating system and the database on the same page of the same spreadsheet. They have separate dates, and budgeting for one and not the other is the usual way this goes wrong.
5. Decide before December. A January deadline handled in January is handled at whatever price is available in January, with whatever consultant is free.
6. Get a restorable backup of each database before anybody upgrades anything, and confirm somebody has restored one.
7. Write the answer down where the next clerk or administrator will find it: product, version, edition, end-of-support date, and which company is responsible. This is the document nobody has.

The question worth asking your current provider

If you already have an IT company, this is a fair thing to put to them, because answering it is the job: which of our systems are on a version that has already passed end of support, and what is your plan for each one? A good answer comes back as a list with dates on it. A vague answer is itself the finding.

Southern Technology Partners works with cities, counties, utilities, 911 centers, schools and small businesses across about a hundred miles of South Georgia, and we will put that list together for you — your servers, your databases, and the applications sitting on top of them — whether or not you are a client. We also build and maintain our own utility billing and work-order software, so we know exactly what these questions sound like from the vendor's side of the table, and what a straight answer looks like. Call (912) 209-4804 or reach us at southerntechpartners.net.

Sources

1. Microsoft Learn, “Extended Security Updates FAQ — SQL Server” — end-of-support dates, ESU availability windows, v-core and p-core minimums, billing start and bill-back, eligible editions, and the limits on technical support.
2. Microsoft Learn, “SQL Server Extended Security Updates FAQ” (Lifecycle) — the Express, Developer and Web edition exclusion, the same-machine exception, the year-by-year ESU term table, and what ESUs do and do not include.
3. Microsoft Learn, “What are Extended Security Updates for SQL Server?” — hourly Azure billing, and the change that removed free ESUs for SQL Server 2016 workloads moved to SQL Server on Azure VMs.
4. Microsoft, “End of Lifecycle for Windows Server 2012 and 2012 R2” — the ESU program for both ended October 13, 2026.
5. Microsoft, “Planning ahead for Windows Server 2016 end of support” — February 25, 2026; the January 12, 2027 date and ESUs delivered through Azure Arc.
6. Microsoft, Windows Server and SQL Server Extended Security Updates — product end-of-support and ESU dates, purchasing routes, and the absence of published per-core pricing.
7. Verizon, 2026 Data Breach Investigations Report — vulnerability exploitation as the leading initial-access vector.

Southern Technology Partners LLC

Managed IT, cybersecurity and compliance, cloud and telecom, low-voltage and security, fire and alarm systems, hardware, and custom software — serving municipal government, public safety, schools and libraries, and small business across South Georgia.

15 Latimer St., Hazlehurst, GA 31539· (912) 209-4804·southerntechpartners.net