News

Microsoft Offers 3-Year Security Reprieve for Older Server Products

• By Kurt Mackie
• 07/17/2018

Microsoft is replacing its "Premium Assurance" support offering for SQL Server and Windows Server with a new Extended Security Updates program.

Under the Extended Security Updates program, announced last week, organizations using SQL Server 2008/R2 and Windows Server 2008/R2 products can add three years of patch support. The program replaces the earlier Premium Assurance support plan, which Microsoft began offering in March 2017. The Premium Assurance plans had let organizations purchase extended product support for up to six years, although it was a nuanced and expensive option.

"We will no longer sell Premium Assurance, but we will honor the terms of Premium Assurance for customers who already purchased it," Microsoft explained in its FAQ document (PDF) for Extended Security Updates, dated July 2018.

Extended Security Updates plans only apply to SQL Server 2008/R2 and Windows Server 2008/R2 products. They don't apply to the older server products.

Organizations can use Extended Security Updates plans when moving workloads from their own datacenters ("premises" environments) or from hosted service providers. They can even use it when moving workloads to Azure Stack, Microsoft's cloud-in-a-box appliance sold by Microsoft's hardware partners.

Product Lifecycle Deadlines
Organizations soon will be facing product end-of-life issues for the 2008-branded server products as they will be falling out of "extended support," which is the last five-year phase of Microsoft's total 10-year product lifecycle support scheme. Losing such support means that quality and security updates won't arrive for these servers, leaving them potentially vulnerable to attacks.

Here are the product lifecycle deadlines that organizations are facing:

• SQL Server 2008/R2 will lose support on July 9, 2019
• Windows Server 2008/R2 will lose support on Jan. 14, 2020

Typically, moving such workloads and upgrading to new server software is big pain for IT departments, both in terms of planning and executing the move. For organizations seeking guidance on product support, Microsoft held an Azure Web presentation, "Prepare for Windows Server 2008 and SQL Server End of Support," on July 12. This presentation appears to be available on demand, with sign-up located at this page.

Microsoft also provides Azure Database migrations guides at this page.

Program Costs
Microsoft is sweetening the deal somewhat with its Extended Security Updates plans by offering the three years of patch support at no extra cost if an organization moves those workloads onto an Azure virtual machine (VM).

Under the plans, organizations have to pay for using the Azure VMs, but Microsoft doesn't charge for the three years of support, which kicks into effect when extended support ends for the 2008-branded server products. Here's how the FAQ explained the matter:

Customers who migrate workloads to Azure virtual machines will have access to Extended Security Updates for both SQL Server and Windows Server 2008 and 2008 R2 for three years after the End of Support deadlines, included at no additional charge over the standard VM pricing.

One catch is that the servers covered under Extended Security Updates program have to have Software Assurance coverage to be eligible. However, an organization doesn't have to have Software Assurance coverage across all of their servers. They just need it for the ones getting Extended Security Updates.

Microsoft is claiming that applications will work well when moved to Azure VMs. "You can rehost these workloads to Azure with no application code change," claimed Takeshi Numoto, corporate vice president of Cloud and Enterprise at Microsoft, in the announcement.

Organizations alternatively can move their SQL Server 2008/R2 or Windows Server 2008/R2 workloads to Azure SQL Database Managed Instance, a service that is hosted and managed by Microsoft. Azure SQL Database Managed Instance was released as a preview back in March, but it's expected to be generally available in "early Q4 of this calendar year," according to Numoto.

Microsoft is promising additional discounts for organizations moving their 2008-branded servers to Azure VMs through its Azure Hybrid Benefit program, formerly called the "Azure Hybrid Use Benefit." With Software Assurance coverage on the servers, the Azure Hybrid Benefit program lets organizations "save up to 55 percent on the cost of running SQL Server and Windows Server in Azure," according to Numoto. Discounts from the Azure Hybrid Benefit program also can be applied when moving 2008-branded server workloads to the Azure SQL Database Managed Instance service, according to the FAQ.

If an organization doesn't want to move their SQL Server 2008/R2 or Windows Server 2008/R2 workloads to Microsoft's datacenters, they can still use Extended Security Updates plans to add three years of support to their premises-based machines. However, this option adds costs that are somewhat like the maximum costs under the old Premium Assurance plans. Here's how Microsoft's FAQ described that nuance for organizations keeping the servers on premises:

Customers with active Software Assurance or subscription licenses can purchase Extended Security Updates for 75% of the full license cost annually. Customers pay for only the servers they need to cover, so they can reduce costs each year as they upgrade parts of their environment. Contact your Microsoft partner or account team for more details.

If an organization uses the 2008-branded servers as a service, as accessed from a hosting provider, then they can also get Extended Security Updates support. In such cases, organizations have to pay "75% of the full license cost annually" to get Extended Security Updates support.

It's Just Patch Support
Organizations don't get anything more than patch support from the Extended Security Updates program. No technical support is included. Organizations would have to establish a separate Microsoft Premier Support contract to get technical support. In addition, Microsoft won't add any new features to the products under the Extended Security Updates plans.

The patching varies somewhat under the Extended Security Updates program:

• SQL Server 2008/R2 users get "critical" updates for three years after the July 9, 2019 end-of-support date
• Windows Server 2008/R2 users get "critical" and "important" updates for three years after the Jan. 14, 2020 end-of-support date

For organizations moving workloads to Azure VMs, Extended Security Updates support can be purchased near the end-of-product-support time periods for the 2008-branded servers, although organizations can move their workloads at any time. The same Extended Security Updates purchasing timing will apply to workloads hosted by service providers.

System Center users should determine whether they'll be able to use components of that management suite with 2008-branded servers covered under the Extended Security Updates plans. Microsoft lists a few restrictions for Windows Server 2008/R2 at the end of its FAQ document, but SQL Server 2008/R2 products are supported.

Microsoft also advocates and supports upgrading to the most current SQL Server 2017 or Windows Server 2016 products, according to an announcement by Julia White, corporate vice president of Windows Azure. She noted that Microsoft also recently announced a public preview of Data Box Disk. It's a new addition to the Azure Data Box family, offering another way for organizations to transport data to Microsoft's datacenters via physical means.

Azure Data Box disk is a smaller capacity option. Organizations can get "up to five 8TB disks, totaling 40TB per order" under the Data Box Disk option. The Data Box Disk preview is currently available for organizations located in the European Union and the United States and it's free to try.