SQL Server End-of-Support: What to know?

As you many of you are already aware SQL Server 2008 and SQL Server 2012 come to end-of-support as of July 19, 2019 and July 12, 2022 respectively. For regulated industry customers these dates are critical to manage to and the challenges that they create are acute. It is important that your organization understands the risks associated with operating a database platform that could contain customer/patient data where the software developer is no longer providing mainstream or extended support.

Microsoft Support Lifecycle

Detailed information about SQL 2008 and SQL 2012 support lifecycle can be found at the following links.

• SQL 2008/R2 Support Lifecycle Info
• SQL 2012 Support Lifecycle Info

With SQL 2008 the options are pretty straightforward. This version of SQL Server has reached end of mainstream and extended support. If you fall still have SQL 2008 in your environment your options are detailed under mitigation steps below.

SQL 2012 has reached the end of mainstream support and will reach the end of extended support in July 2022. While the specifics for any SQL 2012 ESU programs have not been announced customers should begin to plan for the end of support for SQL 2012 as the date will be here before you know it.

Mitigation Steps

Customers have a few different options with both SQL Server 2008/R2 server platforms to mitigate their risks. Those options are:

1. Upgrade the at-risk installations of SQL Server to a newer and supported version of SQL server, such as 2014, 2016, 2017 or 2019. Current lifecycle for SQL Server can be found here.
2. Purchase Extended Support Updates (ESUs) for your at-risk SQL Server installs. Be aware that for SQL Server 2008 you may need to "catch-up" with ESUs and therefore purchase year 1 and year 2. ESUs are only available for 3 years so the 2022 year will be the final year of extended support for SQL 2008.
3. Migrate your at risk SQL Server 2008 workloads into Azure and by doing so you will receive the ESUs at no-charge.

Some customers have chosen to purchase 3rd party products that limit access to their at-risk installs by reducing network access. This does not address the core security risk of holding customer/patient data on a system that is not supported and likely would not be mitigation for any sort of compliance risk.

Migration to Azure

With the option of receiving extended support updates at no-charge by migrating at-risk workloads into Azure, customers can begin to take advantage of the power of the cloud to optimize the footprint of these workloads at the same time. With Azure customers have a couple of options for when they own their SQL 2008 licenses and maintain software assurance coverage.

1. Migrate to IaaS - This option is the most similar to on-premise implementation. With this options customers has a few different migration choices for migrating workloads. Those can include self-install, using Azure Site Recovery to migrate the workload from on-premise or using the SQL Server marketplace installation and rebuild the implementation. When the "at-risk" workloads are covered with Software Assurance customers can take advantage of the Azure Hybrid Benefit. For more information and specifics see the ESU FAQ linked here.
2. Migrate or Modernize to PaaS - Further customers who have "at-risk" workloads can evaluate migrating to a PaaS offering, like SQL Managed Instance. SQL Managed Instance is a service in Azure that provides nearly 100% compatibility with SQL Server, however, customers should seek guidance from the application software vendor or thoroughly test the implementation for suitability to their needs. SQL Managed Instance provides a "version-less" experience and backwards compatibility which then may give you a longer period of time to evaluate new options for the modernization or application re-design.

In both of the above instances customers who continue to cover their "at-risk" SQL Server deployments with software assurance can use Azure Hybrid Benefit to optimize their specific ESU deployments.

For customers that own their SQL 2008 licenses but their "at-risk" workloads are not covered via software assurance customers can still take advantage of the above options with the following exceptions:

1. "At-risk" workloads moved to Azure IaaS must use pay-as-you-go pricing and a marketplace image. Azure Hybrid Use benefit cannot be applied to these VMs and therefore you cannot bring-your-own-license into Azure.
2. "At-risk" workload moved to Azure SQL Managed Instance do not qualify for Azure Hybrid use benefit.

As information becomes available on SQL 2012 extended security updates, further information will be provided. However, it is never too early to begin planning for the upgrade of what could become "at-risk" workloads or consider migrating them to Azure. Please work with you Microsoft team to better understand what options you might have to accelerate the adoption of cloud today that could alleviate the risk associated with end-of-support lifecycle.

To register or not to register?

Microsoft gives you a simple method to keep track of your SQL Servers in Azure that require and are eligible to receive SQL extended support updates. Creating a SQL Registry will give you the ability to track and download the updates as needed.

For those VMs that are created in Azure and configured for "automatic updates" these VMs will receive the ESUs automatically and patched accordingly. Further information about ESU in Azure can be found here.

Further information about your options can be found here on the blog post provided by the SQL marketing team.