How to obtain SQL Server 2016 Patches after subscribing for ESU

For an on-premises SQL Server 2016 ESU purchase, register each SQL Server instance in the Azure portal, link the ESU invoice, and then download available patches from the instance’s Extended Security Updates pane.

If the servers are not connected to Azure Arc

This is the documented workflow for disconnected instances purchased through volume licensing:

1. In the Azure portal, open SQL Server instances.
2. Select Add → Register SQL Server instances.
3. Select Single SQL Server Instance, or use Multiple SQL Instances to upload a CSV.
4. Enter the instance details:
   • Instance name—the output from SELECT @@SERVERNAME.
   • SQL Server version and edition.
   • Core count.
   • On-premises physical or virtual host type.
5. Confirm that you have rights to receive ESUs and finish registration.
6. Select the registered instances and choose Link ESU invoice.
7. Enter the Purchase Order Number shown under Invoice Summary on the Microsoft ESU invoice.
8. Confirm that each instance now displays a valid ESU expiration date.
9. Open the SQL Server instance’s Extended Security Updates pane and download the available package. ^1^

The Azure account performing registration needs Microsoft.AzureArcData/sqlServerInstances/read and /write, available through the Azure Connected SQL Server Onboarding, Contributor, or Owner role. The subscription must also have the Microsoft.AzureArcData resource provider registered. ^1^

If the servers are connected to Azure Arc

For Arc-connected servers:

1. Azure portal → Azure Arc → Machines.
2. Select the server.
3. Under Operations, select SQL Server Configuration.
4. Enable the ESU subscription and select Save.
5. If automatic updates are enabled, available ESUs install automatically. Otherwise, open the SQL Server instance’s Extended Security Updates pane to download them manually. ^2^

ESU patches can also arrive through the normal servicing channels: Microsoft Update, Windows Update, System Center Configuration Manager, or Azure Update Manager. ^3^

Important timing and servicing requirements

• SQL Server 2016 reaches end of support on July 14, 2026; ESUs are available through July 17, 2029. ^3^
• ESUs are not issued on a regular monthly schedule. Microsoft releases them when SQL Server is affected by a vulnerability rated Critical by the Microsoft Security Response Center.
• ESUs do not include new features, functional improvements, or ordinary customer-requested fixes.
• SQL Server must be on its latest Service Pack before an ESU can be applied.
• SQL Server 2016 ESUs include the latest cumulative update. If the instances have only received GDR updates, install and validate the latest CU when subscribing rather than waiting for the first ESU. ^2^

Therefore, if no package is currently displayed, first check whether SQL Server 2016 is still within regular Extended Support or whether Microsoft has released an applicable Critical ESU; purchasing the subscription does not create a separate patch immediately.

References

1. Register SQL Server instances for ESUs
2. What are Extended Security Updates for SQL Server?
3. Extended Security Updates: Frequently asked questions