Extended support for SQL Server 2016 ended on 14 July 2026. The database engine keeps running, but Microsoft no longer issues security updates for it unless an Extended Security Updates subscription is in place. Australian businesses should find every 2016 instance, confirm what data it holds, and choose an upgrade path now.
Microsoft gave a decade of notice on this one. SQL Server 2016 shipped in June 2016, left mainstream support on 13 July 2021, and has been on security-fixes-only ever since. Every version carries a minimum of ten years of support under the Fixed Lifecycle Policy, and Microsoft has documented four clear destinations for anyone leaving 2016. The runway was generous. The date has simply arrived.
Why is a database end of support worse than a file server end of support?
An out-of-support file server holds documents. An out-of-support database holds the structured, queryable core of the business: customer records, contact details, invoices, payroll figures, order history, and in many Australian businesses, identity documents and health or financial information. It is the single richest target in the environment, and it is now accumulating unpatched vulnerabilities.
That changes the nature of the risk in three practical ways:
- Breach obligations. Under the Notifiable Data Breaches scheme, an eligible breach of personal information likely to result in serious harm must be reported to the Office of the Australian Information Commissioner and to affected individuals. A compromised database is the fastest route to that obligation, because the data is already collated and exportable.
- Cyber insurance. Renewal questionnaires routinely ask whether the business runs software the vendor no longer supports. An honest yes on a production database is a difficult answer at renewal, and an inaccurate one is worse.
- Essential Eight posture. The patch applications strategy assumes a vendor is still shipping patches. At Maturity Level Three, the Essential Eight requires applications no longer supported by vendors to be removed. An unpatched database engine caps the score however well the rest of the environment is run.
Where does SQL Server 2016 hide in an Australian business?
Very few businesses bought SQL Server 2016 as a deliberate purchase. It arrived underneath something else, which is why the instance count is almost always higher than the first estimate. Common hiding places:
- Under the ERP or accounting platform, installed by the vendor at implementation
- Under a practice management, case management or dispatch system in professional services, health and trades businesses
- Under a warehouse, inventory or point-of-sale application, often on a back-office server rather than in the comms room
- Behind a SharePoint Server 2016 farm, which reached its own end of extended support on the same day, 14 July 2026
- As a reporting or business intelligence database, along with Reporting Services, Integration Services or Analysis Services installations
- Inside a vendor appliance or turnkey system, where the business has no idea a SQL Server instance exists
Express edition deserves its own warning. SQL Server 2016 Express follows exactly the same lifecycle as Standard and Enterprise, and its extended support ended on the same date. Because Express is free and installs quietly alongside applications, these instances rarely appear in a licence register, a budget or an audit. They still hold real data, and they are now equally unpatched.
How do you find every SQL Server 2016 instance?
Discovery comes before any decision about upgrade paths, because the decision differs per instance. A practical sweep, cheapest steps first:
- 1Query the instances already known about. Running SELECT @@VERSION on each one returns the exact build; anything reporting 13.x is SQL Server 2016.
- 2Enumerate the registry across the server estate. Instance names sit under HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Microsoft SQL Server\Instance Names\SQL, which a short PowerShell loop can read on every machine that answers.
- 3Look for the SQL Server Browser service responding on UDP port 1434, which surfaces named instances nobody documented.
- 4Use Azure Migrate, Microsoft's current assessment service, which discovers SQL Server instances and databases across the environment. The older Microsoft Assessment and Planning toolkit is still downloadable but no longer actively developed, so it is a poor choice for a 2026 audit.
- 5Ask every application vendor in writing which database version their product runs on and which versions they certify. This catches the appliances and turnkey systems that scanning misses.
The output should be a single list: instance, host, edition, application it serves, data sensitivity, and vendor position. That list is the project plan.
Try it
Score the posture around the unpatched database
Unsupported software works directly against the patch applications strategy, and a production database is the worst place to carry that gap. Score the surrounding Essential Eight posture to see what the exposure looks like in context.
Score each of the 8 strategies
Where are you on the Essential Eight — honestly?
Eight strategies. Four levels each. Pick the statement closest to your reality today. We'll map it to the Microsoft 365 tooling that closes the gap.
What's your target Maturity Level?
Maturity Level 2 — most orgs' pragmatic target
- 01
Application control
Only approved applications can execute on workstations and servers.
- 02
Patch applications
Internet-facing apps, browsers, Office, PDF readers patched promptly.
- 03
Microsoft Office macros
Macros disabled unless from trusted locations and signed by a trusted publisher.
- 04
User application hardening
Web browsers and productivity apps hardened against the most common attacks.
- 05
Restrict administrative privileges
Admin accounts limited, separated and reviewed — the crown jewels of the tenant.
- 06
Patch operating systems
Operating system patches applied on a schedule that matches the risk.
- 07
Multi-factor authentication
MFA everywhere that matters — privileged accounts, remote access, important data.
- 08
Regular backups
Backups of important data, configuration and software — and restores you have actually tested.
What do Extended Security Updates actually cover?
Extended Security Updates buy time, not a solution. For SQL Server 2016 the terms are clear and worth understanding before anyone treats ESUs as the easy option:
- Coverage runs for up to three years past end of support, in annual periods, with the third year finishing in July 2029.
- Only fixes rated Critical by the Microsoft Security Response Center are released, with no set cadence and no new features, functional improvements or customer-requested bug fixes. Support covers the updates themselves, not the underlying SQL Server version.
- Instances must be connected to Azure Arc to subscribe, which Microsoft provides free of charge. Instances that genuinely cannot connect may be able to buy through volume licensing and register manually, which is a conversation with a Microsoft account team.
- Billing is per core, with a minimum of four cores per operating system environment. Standard edition subscriptions cap at 24 cores, and the physical core option with unlimited virtualisation has a 16 physical core minimum at Enterprise rates.
- Eligibility requires active Software Assurance or a SQL Server subscription, or pay-as-you-go billing through Azure Arc.
- Microsoft's own documentation puts the cost at approximately 75 per cent of the on-premises licence cost annually.
One point catches people out, because it changed. With SQL Server 2014, moving the workload to an Azure virtual machine earned free ESUs. That benefit does not carry across to 2016. A lift into Azure is still a sound move for other reasons, but it is not a free patching shortcut.
"Starting with SQL Server 2016 (13.x), migrating your workload to SQL Server on Azure VMs no longer provides free access to ESUs for SQL Server 2016 (13.x) instances."
What are the upgrade options?
Upgrade in place to a supported SQL Server version
SQL Server 2017, 2019, 2022 and 2025 are all in support, with SQL Server 2025 generally available since November 2025 and extended support running to 2036. SQL Server 2025 accepts a direct upgrade from SQL Server 2016 Service Pack 3 or later, so a well-patched instance can move in one step rather than staging through intermediate versions. It is 64-bit only. Keeping the database compatibility level where it is protects existing applications from behaviour changes.
Migrate to Azure SQL Managed Instance or Azure SQL Database
Azure SQL Managed Instance is versionless under the always-up-to-date policy, so end of support stops being a recurring project. Patching, backups and high availability are handled by the service. The step that cannot be skipped is a compatibility assessment: there are documented Transact-SQL differences from on-premises SQL Server, some features are unsupported, and the networking needs either a VPN gateway or ExpressRoute. The SQL Server migration component in SQL Server Management Studio and Azure Database Migration Service both assess and execute this path.
Lift and shift to an Azure virtual machine
For an application whose vendor has not certified anything newer, moving the instance onto an Azure VM removes the ageing hardware risk, adds automated patching and backup at the operating system layer, and buys room to plan. ESUs are subscribed to separately and charged, so this is a pressure valve rather than a saving. Registering the VM with the SQL IaaS Agent extension enables the subscription.
Replace the application
Where the database is old because the application on top of it is old, the database project is the wrong project. If the vendor has stopped developing the product, or annual support has drifted past what a modern alternative would cost, this deadline is a reasonable trigger to reassess the application rather than fund another three years of life support underneath it.
What should happen this week?
The long pole in this project is never the database work. It is vendor certification. A business can plan a flawless migration to SQL Server 2025 and still be blocked because the ERP vendor has only certified up to 2019, or because moving requires an application upgrade carrying its own cost, testing and training. That answer takes weeks to obtain, which is why it goes first.
- 1This week: email every line-of-business application vendor and ask which SQL Server versions they certify, whether Azure SQL Managed Instance is supported, and what an application upgrade would cost. Put a date on the reply.
- 2This week: run the discovery sweep and produce the instance list, including Express and anything behind an appliance.
- 3Within two weeks: rank instances by data sensitivity and exposure. Anything holding personal information or reachable from outside the network goes to the top.
- 4Within four weeks: decide the path per instance and price it, including ESU coverage for anything that cannot move yet.
- 5Then execute in order of risk, starting with the instances holding the most sensitive data.
There is one more reason to move quickly. Extended support for Windows Server 2016 ends on 12 January 2027, and in a great many Australian businesses SQL Server 2016 is sitting on a Windows Server 2016 box. Two deadlines, six months apart, one machine. Frontrow covers that operating system deadline separately at /insights/windows-server-2016-end-of-support-january-2027, and the sensible approach is to scope both as a single project. Rebuilding the same server twice wastes a change window.
Frontrow runs this as one exercise: the discovery sweep, the vendor certification chase, a costed path for every instance, and the migration itself. A short scoping call is enough to size the job and to work out whether the database and the operating system underneath it should move together.