SQL Server 2016 End of Support: What to Do Now

SQL Server 2016 stopped getting security patches on July 14, 2026. If a database on that version is still running your accounting system, your line-of-business app, or anything holding customer records, you have three real choices: move it to Azure SQL, upgrade to SQL Server 2025, or buy Extended Security Updates and put a hard deadline on the calendar.

Doing nothing is the fourth choice, and it's the one that shows up in breach reports.

At a glance

• Support ended July 14, 2026. No more security patches, no technical support.
• Three real paths: Azure SQL, SQL Server 2025, or Extended Security Updates through mid-2029.
• ESUs need Azure Arc plus either Software Assurance or pay-as-you-go billing.
• Free Express editions count, and they're the instances nobody knows they have.
• Your application vendor's supported-version list decides this, not your preference.

What does end of support actually mean?

No more security updates. Microsoft's own announcement is blunt about it: "As of today, July 14, 2026, SQL Server 2016 has reached end of support," and Microsoft "no longer provides regular security updates or technical support for the product" (Microsoft SQL Server Blog).

The server keeps running. That's what makes this dangerous. Nothing breaks on day one, so it slides down the priority list until a vulnerability gets published and there's no patch coming.

Two other things quietly break with it. Your cyber insurance application asks whether you run supported software, and your auditors ask the same question if you're under HIPAA, PCI DSS, SOC 2, or NYDFS Part 500. An unsupported database engine is a finding.

How do I know if we're still running it?

Most owners don't know, because SQL Server usually got installed by a software vendor, not by IT. Check three places.

• Your servers. Run SELECT @@VERSION against each SQL instance. SQL Server 2016 reports as version 13.x.
• SQL Server Express. The free edition ships bundled inside accounting, dental, legal, and ERP applications. Microsoft's lifecycle page lists the same end-of-support date for Developer, Enterprise, Enterprise Core, Express, Standard, and Web editions (Microsoft Lifecycle). Express is the copy everyone forgets.
• Old virtual machines. The reporting server nobody logs into is still on the network and still reachable.

If you don't have a current inventory of what's installed where, that's the real problem, and it's bigger than this one product. IT asset management is what turns end-of-support announcements from fire drills into scheduled work.

What are my three options?

Microsoft names three paths: move to Azure SQL (Database, Managed Instance, or SQL Server on Azure VMs), upgrade to SQL Server 2025, or subscribe to Extended Security Updates. ESUs buy time rather than solve anything — they keep patches flowing while you plan the real move. Pick based on whether your application vendor supports the newer version.

That last sentence is the whole decision. Small businesses rarely control the database directly; the application on top of it does. Call the vendor before you price anything.

How long do Extended Security Updates last?

Up to three years. Microsoft's documentation states you "can sign up for an Extended Security Update (ESU) subscription for your servers and remain protected for up to three years," and that for SQL Server 2016 the subscription "is available from Year 1 of the extended support period, which starts on July 14, 2026" (Microsoft Learn). That puts the hard wall in mid-2029.

There are two conditions worth knowing before you budget. ESUs for on-premises and multicloud servers are delivered through Azure Arc, so the server needs to be Arc-connected. And to subscribe you need either active Software Assurance or pay-as-you-go SQL Server billing enabled.

Price varies by version and licensing agreement, so get a real quote rather than a rule of thumb. In our experience the conversation usually ends the same way: three years of ESU costs enough that migrating starts to look cheap.

Which option fits a 20-to-100-person business?

Azure SQL Managed Instance, most of the time. It takes the patching, backup, and high-availability work off your plate permanently, which is the actual reason you're reading this post — so you stop having this conversation every few years.

Upgrade in place to SQL Server 2025 when your vendor certifies it and you already own the hardware. You get another decade of support and nothing else about your environment changes.

Stay on-premises with ESU only when a vendor app is hard-pinned to 2016 and the vendor has a dated roadmap to something newer. Get that date in writing.

If the server running SQL is also past its own support date, combine the projects. Plenty of businesses are carrying both at once — see Windows Server 2016 end of support for how those timelines overlap. Our managed IT and cloud services teams handle these as one migration rather than two.

What breaks when you upgrade?

Less than people fear, but check four things.

1. Compatibility level. A database restored onto SQL Server 2025 keeps its old compatibility level. Raising it changes how the query optimizer behaves, which is where slow queries appear after an otherwise clean upgrade.
2. Deprecated features. Old data types and discontinued syntax in vendor code or custom reports need fixing before cutover, not during.
3. Authentication. Hard-coded SQL logins and service accounts in config files have to be recreated. Write them down first.
4. Integration and reporting services. SSIS packages and SSRS reports are separate installs with their own upgrade steps. They're the most common thing forgotten on migration day.

Test in a copy of the environment. Restore a backup onto the new version, point a test client at it, and let the people who use the application every day try to break it.

What should we do in the next 30 days?

Four steps, in order.

1. Inventory every SQL instance, including Express editions bundled in applications.
2. Ask each application vendor which SQL versions they support today, and get the answer in email.
3. Price both paths for each instance: migrate versus ESU for three years.
4. Put a cutover date on the calendar for every instance, even the ones taking ESU.

The businesses that handle this well aren't the ones that move fastest. They're the ones that know exactly how many instances they have.

Frequently asked questions

Is SQL Server 2016 Express also out of support?

Yes. Microsoft's lifecycle listing applies the same end-of-support date to Express as to the paid editions. This catches a lot of businesses out, because Express gets installed silently by vendor applications and never appears on a software purchase record. Check for it specifically.

Can we just leave it running behind the firewall?

It reduces the risk but doesn't remove it. Ransomware operators move laterally from a compromised workstation, and an unpatched database is exactly what they look for once inside. Network segmentation and strict access control buy you time, not safety. Treat it as a deadline extension, not a fix.

Do we need Software Assurance to buy ESUs?

You need either active Software Assurance or pay-as-you-go SQL Server billing enabled, and on-premises servers must be connected through Azure Arc. If you have neither in place today, factor that setup work into the timeline — it isn't a same-week purchase.

Is moving to Azure SQL cheaper than staying on-premises?

It depends on how your database is used, not on list price. Always-on transactional workloads with steady load often cost more per month in Azure but remove server hardware, patching labor, and backup licensing. Databases that sit idle overnight usually come out ahead. Model your actual usage before deciding.

How long does a SQL Server migration take?

For a single small database with a cooperative vendor, a few weeks including testing. For several instances tangled into line-of-business applications, plan a quarter. The database copy itself is fast; vendor certification and application testing is what sets the schedule.

Still running SQL Server 2016 and not sure what depends on it? Request a complimentary IT assessment and we'll inventory your SQL instances, confirm what each application supports, and price the options side by side.