SQL Server 2016 End of Support: It Ended July 14, 2026. Here’s What to Do Now

Key Takeaways

• July 14, 2026: SQL Server 2016 extended support ended. Mainstream support had already ended on July 13, 2021.
• ESU until July 17, 2029: up to three years of critical security fixes, paid, through Azure Arc or on Azure VMs. No bug fixes, no features, no support for the engine itself.
• SP3 first: Microsoft supports in-place upgrades to SQL Server 2022 and 2025 only from 2016 SP3 or later.
• MSOLEDBSQL 19, the OLE DB driver in SQL Server 2025, enforces encrypted connections and certificate validation out of the box.
• Linked servers using SQLNCLI can fail after upgrade because the new driver rejects untrusted certificate chains that the old provider silently accepted.
• Replication with a remote distributor needs a trusted certificate on the distributor, or the publisher can’t connect to it.
• Full-text catalogs must be rebuilt. SQL Server 2025 removes the version 1 full-text components, so existing indexes fail until you rebuild them.

The upgrade itself usually goes smoothly. The connection failures afterward are the problem.

SQL Server 2016 End of Support: What Ended on July 14, 2026

SQL Server 2016 reached the end of extended support on July 14, 2026. That closed Microsoft's standard ten-year lifecycle for the product: five years of mainstream support (functional, performance and security fixes), which ended July 13, 2021, then five years of extended support (security fixes only).

Here’s what that means for a 2016 instance still in production today:

• No security updates unless the instance is enrolled in Extended Security Updates. A vulnerability found from now on gets patched on supported versions, not on yours.
• No bug fixes. Mainstream support ended in July 2021, and SP3 (September 2021) was the last service pack. If you hit a 2016 bug today, the fix is a newer version.
• No Microsoft support for the engine. Even with ESU, support only covers the ESU patches themselves: installing them, or a regression one causes.
• Harder audits. Assessors working to PCI DSS, HIPAA or SOC 2 look for supported, patched software. An unpatched 2016 instance holding regulated data is something you’ll have to explain.

The server doesn’t stop. Nothing in SQL Server 2016 checks a date and shuts down. It keeps running exactly as before, with a growing list of vulnerabilities that won’t be patched unless you pay for ESU.

Source: Microsoft Lifecycle, SQL Server 2016 (checked October 22, 2026). Dates for every other version are on our SQL Server end of life dates page.

Extended Security Updates for SQL Server 2016

ESU is Microsoft’s paid bridge: up to three more years of security patches after extended support ends. For SQL Server 2016 the last ESU year ends July 17, 2029. It buys time to upgrade properly. It doesn’t fix anything else.

What ESU covers. Security updates for vulnerabilities the Microsoft Security Response Center rates Critical, released only when one turns up, so there’s no monthly cadence. No new features, no functional fixes, no customer-requested fixes.

How you get it:

• On-premises or another cloud: connect the server to Azure Arc (connecting is free), then turn on the ESU subscription for the instance. You need Software Assurance under an Enterprise Agreement, EAS, SCE or EES, or switch the instance to pay-as-you-go SQL Server licensing through Arc.
• SQL Server on Azure VMs: register the VM with the SQL IaaS Agent extension and subscribe there.
• Servers that can’t connect to Azure Arc: you may be able to buy ESUs through volume licensing. That goes through your Microsoft account team.

Four things that catch people out:

• It isn’t free on Azure. Moving SQL Server 2014 to an Azure VM came with free ESUs. Microsoft didn’t repeat that for 2016: on Azure VMs, 2016 ESUs are a paid subscription like everywhere else.
• Late sign-up is back-billed. The Arc subscription bills from the start of the current ESU year, so waiting until month six doesn’t save you the first five.
• Billing is hourly and per core, with core minimums, at the Standard or Enterprise rate.
• Patch to the latest CU first. 2016 ESUs ship on top of the most recent cumulative update. If you only ever applied GDR updates, install and test the latest CU when you subscribe, not when the first ESU lands.

We don’t quote an ESU price here because Microsoft prices it per core, per edition and per agreement. Get the number, then set it next to the cost of an upgrade you’ll have to do anyway before July 2029.

Upgrade Paths from SQL Server 2016

There are four ways off 2016. Most estates end up using two of them.

1. In-place upgrade to SQL Server 2022 or 2025. Microsoft supports it directly from SQL Server 2016 SP3 or later; older service packs patch to SP3 first. It’s the fastest route with no new hardware, and the riskiest: there’s no clean fallback if something breaks mid-upgrade, and an old Windows Server release may need its own upgrade first.
2. Side-by-side migration to a new server. Build 2022 or 2025 on a new server or VM, move the databases with backup and restore or log shipping, cut over, and leave the 2016 server untouched as a fallback until you sign off. Once the new server takes writes, going back means reconciling data, because a newer version’s backups won’t restore on 2016. More work, far safer. It’s our default for anything with linked servers, replication or a tight downtime window.
3. Azure SQL Managed Instance or Azure SQL Database. No version to fall out of support again. Managed Instance is the closer fit for an existing instance (SQL Agent jobs, cross-database queries). Azure SQL Database can mean application changes.
4. Stay on 2016 with ESU while one of the above is planned and tested. Fine for a quarter or a year. Not a plan on its own.

Which version to land on? SQL Server 2022 is supported until January 11, 2033 and SQL Server 2025 until January 6, 2036. We’d skip 2019 for a 2016 estate: its mainstream support already ended on February 28, 2025, and its extended support ends January 8, 2030, so you’d be planning the next upgrade almost immediately.

Compatibility level is your safety net. Upgraded or restored databases keep their existing compatibility level (130 for databases created on 2016) until you raise it, which limits how much the query optimizer changes on day one. Raise it later, one database at a time, after testing.

Our SQL Server upgrade services cover both routes, in place and side by side. If you’re moving to new hardware or to Azure at the same time, see our SQL Server migration services.

Default That Changes Everything

SQL Server 2025 includes MSOLEDBSQL 19 as its OLE DB driver. Previous versions shipped with SQLNCLI or earlier MSOLEDBSQL builds that were permissive about encryption: connections worked whether or not you had valid certificates.

MSOLEDBSQL 19 flips two critical defaults:

• Encrypted connections are now required (Encrypt defaults to True)
• Certificate validation is now enforced (TrustServerCertificate defaults to False)

Any connection that relied on unencrypted communication, self-signed certificates, or internal certificate authorities missing from the trust store will be rejected. Not a warning. A hard failure.

The scope covers anything that connects through the new driver: linked servers, replication with a remote distributor, log shipping monitors, SSIS packages, and applications moved to MSOLEDBSQL 19 without explicit encryption settings. Existing applications on older drivers keep their old behavior until their driver changes.

Where Connections Will Fail

Linked Servers

Linked servers provisioned with SQLNCLI or SQLNCLI11 (the default provider for most of SQL Server’s history) will throw certificate trust errors after the upgrade:

Msg 7303, Level 16, State 1
Cannot initialize the data source object of OLE DB provider
"MSOLEDBSQL" for linked server "LinkedServerName".

TCP Provider: The certificate chain was issued by an authority
that is not trusted.

Two options: deploy properly signed certificates, or explicitly set TrustServerCertificate=yes on each linked server definition. The second option keeps the connection encrypted but skips certificate validation, which is the protection the new default adds.

Replication

Replication with a remote distributor breaks when the distributor’s certificate isn’t trusted, because the publisher reaches the distributor through a linked server. Microsoft lists transactional, snapshot, merge and peer-to-peer replication as affected:

OLE DB provider "MSOLEDBSQL19" for linked server "repl_distributor" returned message "Client unable to establish connection".

 Msg -2146893019, Level 16, State 1
 SSL Provider: The certificate chain was issued by an authority
 that is not trusted.

If deploying trusted certificates across all replication nodes isn’t immediately feasible:

EXEC sp_changedistributor_property
 	@property = N'trust_distributor_certificate',
 	@value = N'yes';

This is a workaround, not a permanent fix. SSMS Replication Monitor will also fail to connect if it can’t validate the distributor’s certificate.

Full-Text Search

SQL Server 2025 removes the legacy (version 1) word breakers, stemmers and filters. After an in-place upgrade, existing full-text indexes are still version 1, and queries and populations against them fail:

Msg 30010, Level 16, State 2
An error has occurred during the full-text query. Common causes include: word-breaking errors or timeout, FDHOST permissions/ACL  issues, service account missing privileges, malfunctioning IFilters...

The fix is rebuilding your full-text indexes. Plan for this to take significant time on large catalogs. If an application needs version 1 behavior for a while:

ALTER DATABASE SCOPED CONFIGURATION
SET FULLTEXT_INDEX_VERSION = 1;

That setting alone doesn’t bring version 1 back. It stops rebuilds from switching to version 2; you also have to copy the legacy word breaker, stemmer and filter binaries from an older instance’s Binn folder (not an option on Linux). Treat it as a bridge, not a plan.

Database Mail

The first release of SQL Server 2025 CU1 (KB5074901, January 15, 2026) broke Database Mail. Microsoft replaced it with KB5078298 on January 29, 2026, as its CU1 release notes explain. Verify Database Mail in your test environment before committing to the production upgrade.

Pre-Upgrade Audit Checklist

Before scheduling anything, verify each of these:

• Linked Servers: Which provider is configured (SQLNCLI vs MSOLEDBSQL)? Are encryption parameters set? Is the certificate chain trusted? Are non-sysadmin SQL Logins using pass-through?
• Replication: Map the full topology: publisher, distributor, subscribers. Does every node have a trusted certificate?
• Log Shipping: Remote monitor servers face the same TLS requirements as linked servers.
• Full-Text Indexes: What version are your catalogs on? How long will rebuilds take for your largest catalogs?
• Connection Strings: Do application and tool connection strings specify Encrypt and TrustServerCertificate? Strings that omit these inherit the new defaults as soon as the application moves to the new driver.
• SSIS Packages: Execute SQL Tasks and SMO-based tasks using the Dts.Runtime API need updated provider references and a rebuild.

Run this to identify linked servers still using the legacy provider:

SELECT s.name AS linked_server
	,s.provider
	,s.data_source
FROM sys.servers s
WHERE s.is_linked = 1;

Every result returning SQLNCLI or SQLNCLI11 as the provider needs reconfiguration before you upgrade.

Planning the Migration

SQL Server 2025 supports in-place upgrades directly from 2016 SP3. The upgrade process itself is well documented and generally reliable. The failures usually come after, when production connections hit the new encryption defaults.

A phased approach (see our full migration strategy guide for detailed planning):

1. Inventory everything that connects to SQL Server. Not just the database: linked servers, replication, SSIS, application connection strings, monitoring tools.
2. Deploy certificates or configure explicit encryption parameters for each connection.
3. Run the full upgrade in a test environment. Then test every downstream connection, not just the database itself.
4. Schedule full-text index rebuilds with realistic time estimates for your catalog sizes.
5. Build in buffer. Replication topologies that span multiple sites and certificate chains nobody has audited in years always take longer than expected.

SQL Server 2016 End of Support FAQ

Is SQL Server 2016 still supported?

No. Extended support ended on July 14, 2026. The only security patches still coming are for instances enrolled in Extended Security Updates, which Microsoft offers until July 17, 2029.

Can I upgrade SQL Server 2016 directly to SQL Server 2022 or 2025?

Yes, from SQL Server 2016 SP3 or later, as long as the edition path is supported. On an earlier service pack, apply SP3 first, or migrate side by side with backup and restore. Either way, test linked servers, replication and full-text search before the production cutover.

Are SQL Server 2016 ESUs free on Azure?

No. Free ESUs on Azure VMs were a SQL Server 2014 offer. For SQL Server 2016, ESUs are a paid subscription on Azure VMs, Azure VMware Solution and Arc-connected servers alike.

What happens if I keep running SQL Server 2016 without ESU?

It keeps working. Nothing shuts off. But any vulnerability found after July 14, 2026 stays unpatched on that server, Microsoft won’t help with engine problems, and you should expect compliance reviews to ask about it. If the instance holds customer or payment data, that exposure grows every month you wait.

Bottom Line

SQL Server 2016 support ended July 14, 2026. ESU can cover critical security fixes until July 17, 2029, at a price. Microsoft tightened encryption defaults in newer versions, and if you’re jumping from 2016, you hit all those changes at once.

Audit your linked servers, replication, full-text catalogs, and connection strings before you touch production.

The migration plan isn’t “upgrade the engine.” It’s “make sure everything still connects after you do.”

If you’re planning the move, here’s our CTO guide to migrating SQL Server without risk. It covers the full process from planning through validation.

Need a hand? Our SQL Server upgrade services cover both the in-place and side-by-side routes, and our SQL Server migration services cover moves to new hardware or Azure.