Share via

Purchasing Extended Security Update Licenses as a Cloud Solution Provider (CSP) partner

Appropriate roles: Admin agent

The Extended Security Update (ESU) program is a last resort option for customers who need to run certain legacy Microsoft products past the end of support. They aren't intended as a long-term solution, but rather as a temporary bridge to stay secure while one migrates to a newer, supported platform. It includes Critical* and/or Important* security updates up to three years after the product's End of Extended Support date. ESUs don't include new features, customer-requested nonsecurity updates, or design change requests. More about ESUs are in the Lifecycle FAQ for Extended Security Updates.

Important concepts to understand when purchasing ESUs:

  • Coverage dates are the start and end dates for ESU offers. The availability of ESU offers, and coverage start is to align to the End-of-support announcement and dates. The coverage start date specifies when subscribed updates are made available by the update service. The coverage end date is when your current ESU no longer receives updates. For example, SQL Server 2012, support ended on July 12,2023 and ESU updates become available from July 11,2023. In this example, there isn't a gap in coverage. Other notable coverage dates are:

Windows 10 Coverage Dates*: Available to purchase starting September 1, 2025

ESU year Coverage start date Coverage end date
Year 1 October 15, 2025 October 13, 2026
Year 2 October 14, 2025 October 12, 2027
Year 3 October 13, 2025 October 10, 2028

Windows Server 2012/R2*: Windows Server 1012 and 2012 R2 reached the end of extended support on October 10, 2023. The ESU program provides up to three more years of critical and important security updates, structured as follows:

ESU year Coverage start date Coverage end date
Year 1 October 10, 2023 October 8, 2024
Year 2 October 8, 2024 October 14, 2025
Year 3 October 14, 2025 October 13, 2026

  • Availability start and end date is when the offer is available in the price list and the catalog for purchase only. For software, there isn't a price list preview so purchase, and pricing availability aligns to calendar month (first). Partners are charged for the amount posted at time of purchase. Some ESUs are available to purchase before their coverage dates start.

  • Purchase date is shown in Partner center experience as the start and end date of a subscription. based on when you purchased. The purchase start date and end date define when the partner is billed for the ESU and are separate to the coverage and availability dates. Perpetual software purchases have no end dates, they don't renew, they're perpetually available. Perpetual purchases for ESUs for Windows 10 ESUs can be purchased well before their coverage dates provide updates for the year purchased.

Some ESU offers with active coverage dates are purchasable in the Partner Center catalog under software subscriptions. One example of a software subscription ESU is Win Server Std Core Ext Security 2012 8 Core Y2 (October 2024-2025). This offer is available to purchase until October 2025. Windows 10 ESUs are only perpetual and all coverage years can be purchased ahead of their coverage dates.

All ESU offers with expired coverage dates are purchasable in the Partner Center catalog under perpetual software. For example, Win Server Std Core Ext Security 2012 8 Core Y1 (October 2023-2024) can be purchased in the Partner Center catalog from November 2024 onwards.

Steps to purchase ESUs

If you're a CSP partner, here are the steps you need to follow to purchase SQL Server 2012 ESU licenses on behalf of your customers:

  1. CSP partners take the following steps to purchase ESUs on behalf of your customers: Sign in to Partner Center and select Customers.

  2. Select a customer from the list.

  3. From the customer’s detail page, select Software > Add new, then filter the results to either Type: Software subscriptions or Type: Perpetual software depending on the ESU the customer needs.

  4. Select the desired ESU product separate stock keeping unites (SKUs) from the list. You need to indicate the quantity desired, select Add to cart, and click Review to initiate completion of the transaction.

  5. Once the order is completed and processed, you see the purchased products and keys in the Software section of your customer’s detail page. The end customer sees them in the Microsoft 365 Admin Center.

How to get ESUs

Cloud Solution Provider (CSP) partners have two ways to obtain Extended Security Updates (ESUs) for SQL Server 2012 and Windows Server 2012 for their customers:

  1. Via Azure Arc: This option requires a server to have an Arc connection, which requires an Azure account. A key advantage of this option is new security updates are systematically deployed via the Arc connection. This document doesn't cover this option, but you can learn more here: Product Lifecycle FAQ - Extended Security Updates | Microsoft Learn
  2. Commercial Licensing: This option involves CSP partners buying ESU licenses via Partner Center (or API). After that, the process varies a bit between the two products. This topic covers the ESU Commercial Licensing option, including details for purchasing each product.

Windows 10 extended security updates

Windows 10 ESUs are available starting 9/1/20225. These ESUs greatly simplify the CSP partner experience. All three years of the ESUs will be available starting September 1, 22025. Partners can purchase future years 2 and 3 starting September 1, 2025 but their coverage dates will be in the future, meaning the customer won't get benefits until later. When year 2 coverage dates are current (September 2026), partners should purchase both year 1 and year 2 of the ESUs.

Windows 10 ESUs are only perpetual, different than other ESUs that are either software or perpetual. Windows 10 ESUs are all simply perpetual by year.

Partners get activation keys in their customers software details page. Once you or your customer have the Multiple Activation Key (MAK), customers can install and use the keys.

Enable Windows 10 extended security updates

SQL Server 2012 Extended Security Update (ESU) in Partner Center

Cloud Solution Providers can purchase SQL Server 2012 Extended Security Update (Year 1 and Year 2) licenses beginning Sunday, October 1, 2023. ESU licenses are available as SKUs for each of the 12-month periods in which they're offered. You need to purchase Year 1 and Year 2 of SQL Server 2012 ESU coverage separately.

Year 1 ESU (July 2022 to July 2023) is listed in the catalog as Perpetual Software while Year 2 (July 2023 to July 2024) us listed as 1-year term Software subscriptions. CSP partners see both the Perpetual Software and Software subscription ESU offers listed in the Software price list with a BillingPlan of ‘OneTime’.

Note

You need to purchase Year 3 of the SQL Server ESU when it becomes available to continue to receive Extended Security Updates. When clicking Get keys and downloads you see links to Key instructions and Activate instructions. However, there are no product keys or downloads with your purchase of SQL Server ESUs in Partner Center.

After a partner purchases SQL Server 2012 ESU, the ESU must be registered to enable access to previous or future Extended Security Updates. Follow the registration instructions found here: Register disconnected SQL Server instances on Azure portal - SQL Server.

When you get to the Link ESU invoice step in the registration process, instead of an Invoice ID, the Order id found on the Order history page in Partner Center should be entered. Example Order history page:

Windows Server 2012 Extended Security Update (ESU) via Partner Center

Cloud Solution Providers can purchase Windows Server 2012 Extended Security Updates (Year 1) beginning Sunday, October 1, 2023. Year 1 Windows Server 2012 ESU (October 2023 to October 2024) is listed in the catalog as 1-year term Software subscriptions. CSP partners see the Software subscription ESU offers listed in the Software price list with a BillingPlan of OneTime.

Once you or your customer have the Multiple Activation Key (MAK), install the new key on eligible servers. Delivery, download, and application of ESUs for Windows Server is no different than other Windows Updates. The updates provided through ESUs are only Security updates.

Before you can download and install ESUs, you need to install the latest Servicing Stack Update (SSU) and the Licensing Preparation Package. To learn more about the steps required to install the latest SSU and Licensing Preparation Package, see KB5031043 Procedure to continue receiving security updates after extended support ended on October 10, 2023.

You can install the updates using whatever tools and processes you already have in place. However, the system must be registered using the key generated after purchase for the updates to download and install. You use the keys found in the Software section of your customer’s detail page in Partner Center.

For VMs hosted in Azure, the process of enabling the server for ESUs is automatically completed for you. Updates should download and install without extra configuration. More resources: Product Lifecycle FAQ - Extended Security Updates

More resources

How can I learn more?

To learn more about the Extended Security Update Program, and End of Support and migration options, see the following articles: