Skip to content

Latest commit

 

History

History
334 lines (204 loc) · 33.3 KB

extended-security-updates.md

File metadata and controls

334 lines (204 loc) · 33.3 KB
title description author ms.author ms.reviewer ms.date ms.topic ms.custom
Extended Security Updates
Learn how to manage licensing and billing of Extended Security Updates for SQL Server.
MikeRayMSFT
sashan
randolphwest, maghan
09/25/2024
conceptual
references_regions

SQL Server Extended Security Updates enabled by Azure Arc

[!INCLUDE sql-migration-end-of-support]

After [!INCLUDE ssNoVersion] reaches the end of its support lifecycle, you can sign up for an Extended Security Update (ESU) subscription for your servers and remain protected for up to three years. When you upgrade to a newer version of [!INCLUDE ssNoVersion], you can terminate your ESU subscription and stop paying for it. When you migrate to Azure SQL, the ESU charges automatically stop but you continue to have access to the security updates.

This article explains how to manage a [!INCLUDE ssNoVersion] subscription to Extended Security Updates enabled by Azure Arc. For more information about the program, see What are Extended Security Updates for SQL Server?.

Subscribe to Extended Security Updates in a production environment

You can use one of the following three options to subscribe to ESUs in a production environment. The links in the list take you to sections in this article that provide more details.

The diagrams in the list use normalized cores (NCs) to illustrate the cost implications of the licensing options. One core license for the Standard edition is equivalent to one NC. One core license for the Enterprise edition is equivalent to four NCs. For more information, see How licenses apply to Azure resources.

  • License by virtual cores

    Use an Enterprise or Standard ESU subscription for the vCPUs (v-cores) of the virtual machine (VM) that runs one or multiple instances of [!INCLUDE ssNoVersion]. Each virtual machine is billed individually for the v-cores allocated to it.

    The following diagram illustrates this licensing method and the cost implications.

    :::image type="content" source="media/extended-security-updates/virtual-core-licensing.svg" alt-text="Diagram that illustrates the virtual core licensing option.":::

  • License by physical cores (p-cores) without virtual machines

    Use an Enterprise or Standard license for the p-cores of the host that runs one or multiple instances of SQL Server installed directly on the host without using VMs. Each instance has access to all p-cores supported by the installed edition limits, up to all p-cores of the host. Regardless of the instance limits, the host is billed for all the p-cores based on the highest [!INCLUDE ssNoVersion] edition installed on it. For details, see Compute capacity limits by edition of SQL Server.

    The following diagram illustrates the cost implications of deploying two Standard instances on a physical host without using VMs.

    :::image type="content" source="media/extended-security-updates/physical-core-licensing-without-vms.svg" alt-text="Diagram that illustrates physical core licensing without using virtual machines.":::

  • License by physical cores with unlimited virtualization

    Use an Enterprise ESU subscription for the physical cores of the host that runs any number of virtual machines with any number of out-of-support [!INCLUDE ssNoVersion] instances. A single p-core license is a separate Azure resource that represents all p-cores licensed for ESUs and is billed independently.

    The following diagram illustrates the cost implications of licensing a physical host and using unlimited virtualization.

    :::image type="content" source="media/extended-security-updates/physical-core-licensing-with-vms.svg" alt-text="Diagram that illustrates physical core licensing with unlimited virtualization.":::

To subscribe to ESUs, you must have active Software Assurance or enable a pay-as-you-go billing for [!INCLUDE ssNoVersion] software. The following table shows ESU availability for each license type that you use for [!INCLUDE ssNoVersion] software:

SQL Server license type ESU v-core subscription ESU p-core subscription without VMs ESU p-core subscription with unlimited virtualization
Subscribe to the service through Microsoft Azure by using a pay-as-you-go method Yes Yes Yes
Bring your own license with Software Assurance or a SQL Server subscription 1 Yes Yes Yes
Bring your own license without Software Assurance 2 No No No

1 You already have a license with active Software Assurance or an active SQL Server subscription.

2 You own a perpetual license or use a Server+CAL license.

Your choice of payment option might affect your outsourcing options. For more information, see the service-specific terms and the Flexible Virtualization Benefit licensing guide.

For information about licensing your nonproduction out-of-support [!INCLUDE ssNoVersion] instances for ESUs through Azure Arc, see Manage SQL Server ESU subscriptions for nonproduction use later in this article.

Subscribe to SQL Server ESUs by virtual cores

Subscribing to ESUs by v-cores allows you to limit the scope of the subscription to a specific virtual machine and one or more out-of-support [!INCLUDE ssNoVersion] instances installed on the operating system environment (OSE) of that machine. It's optimized for the following scenarios:

  • Your out-of-service [!INCLUDE ssNoVersion] VMs are mixed with the VMs running other software on the same physical servers.
  • You run your out-of-service [!INCLUDE ssNoVersion] VMs in a hosted environment or in a non-Microsoft cloud where you don't control the physical infrastructure.

You manage a v-core ESU subscription for each VM by using the SQL Server configuration areas of the Azure portal. The Overview pane for each Azure Arc-enabled [!INCLUDE ssNoVersion] resource shows the ESU subscription status under SQL Server configuration.

The ESU subscription for the Standard edition is limited to a maximum of 24 v-cores, even if the OSE is configured with more v-cores. For more information about limits, see Compute capacity limits by edition of SQL Server.

Subscribe to SQL Server ESUs by physical cores without using VMs

The option of subscribing to SQL Server ESUs by physical cores without using VMs is optimized for the following scenarios:

  • You control your physical environment.
  • Your out-of-support [!INCLUDE ssNoVersion] instances are installed directly on a physical server to maximize the performance of your database application.
  • You aren't running virtual machines on that physical server.

In this option, the ESU subscription requirements are similar to subscribing to SQL Server ESUs by virtual cores. You manage the ESU subscription for each host by using the SQL Server configuration areas of the Azure portal. The main difference is that the [!INCLUDE ssNoVersion] software usage is reported based on the physical cores available to the OSE of that server. For details, see Metering software usage.

The ESU subscription for the Standard edition is limited to a maximum of 24 p-cores, even if the OSE is installed on a larger machine. For more information about limits, see Compute capacity limits by edition of SQL Server.

Important

If a physical machine without VMs is connected to Azure Arc in the scope that a [!INCLUDE ssNoVersion] ESU p-core license covers, the unlimited virtualization benefit doesn't apply to that machine. It's billed individually, based on the physical cores that the OSE can access.

Subscribe to SQL Server ESUs by physical cores with unlimited virtualization

The option of subscribing to SQL Server ESUs by physical cores with unlimited virtualization is most effective when:

  • You control your physical environment and run the out-of-support [!INCLUDE ssNoVersion] instances on different VMs for security isolation and better resource management.
  • Your infrastructure and the selected payment method support the unlimited virtualization benefit for ESU.
  • Subscribing to [!INCLUDE ssNoVersion] ESUs by v-cores is more expensive than subscribing by the p-cores of the host.

To use the unlimited virtualization benefit, you need to create a SQLServerEsuLicense resource that represents one or more physical hosts. The covered SQL Server instances must be connected to Azure Arc and configured to use the p-core ESU license. For details about managing SQLServerEsuLicense resources, see Manage the unlimited virtualization benefit for a SQL Server ESU subscription.

Caution

The unlimited virtualization benefit isn't available to VMs running on infrastructure from any of the listed providers. These VMs can be licensed only by v-cores. If you create a SqlServerEsuLicense resource with the intent of licensing these VMs by using unlimited virtualization, you'll be charged for the consumption of v-cores based on the [!INCLUDE ssNoVersion] configuration of the host. Any existing p-core licenses don't apply to offset such charges.

For more information about licensing by physical cores with unlimited virtualization, see the section "Licensing for maximum virtualization" in the SQL Server licensing guide (download link).

A single SqlServerEsuLicense resource can cover multiple virtual machines connected to Azure Arc. It includes several properties that define how the license is applied and billed.

License details

The License details tab includes the standard Azure properties and the ESU license-specific settings:

  • The scopeType property sets the Azure scope in which the license covers all qualified Machine - Azure Arc resources. The following Azure scopes are supported:

    • Azure tenant (Tenant)
    • Azure subscription (Subscription)
    • Resource group (ResourceGroup)

    The specific scope is derived from the location of the license resource. For example, if you select Subscription, the subscription ID that hosts the license resource is used as the scope.

  • The billingPlan property is set to pay-as-you-go billing automatically, because an ESU subscription is always billed on an hourly meter.

  • The physicalCores property of the license resource represents the sum of physical cores of the servers in the selected scope to which the license is applied. The minimum size of the license is 16 p-cores.

  • The TenantID property is automatically set when the tenant scope is selected.

You can create the license resource in a resource group in any of the supported regions. The location of the resource is set to the location of the selected resource group by default, but you can change it to a different region.

The location of the license resource doesn't affect the scope. It applies to all Machine - Azure Arc resources in the selected license scope, regardless of the regions where these resources are onboarded. You can associate multiple license resources with the same scope or overlapping scopes. For example, you can add a new license when you deploy additional physical servers for the increased demand.

Important

When using the unlimited virtualization benefit, make sure that

  1. All the virtual machines on the licensed physical servers are connected to Azure Arc.
  2. They are in the scope specified in the license. For example, they are in the same subscription or resource group.
  3. They have the UsePhysicalEsuCoreLicense host configuration property set to True. For more information, review Use a physical core ESU license.

License activation

You use the License Activation tab to control when the license takes effect or is deactivated. You can activate the license during creation, or you can create the license first and then activate it later. Delaying the activation allows you to coordinate it with other events in the licensing life cycle, such as the expiration of an existing Enterprise Agreement. The activatedAt and deactivatedAt time-stamp properties show when the license was last activated and deactivated. For more information, see Update a SQL Server license resource.

After the license is activated:

  • You can't change the license version.
  • You can decrease the core count, but you can't increase it. To increase the core count, create another license resource.

After the license is terminated:

  • You can't reactivate the license. You can delete the resource if you don't need it.
  • The ESU subscriptions for the VMs in scope remain active and become billable at the VM level.

To stop all ESU charges, unsubscribe from ESUs on all virtual machines before you terminate the license. For details, review Manage resources in the scope of an ESU p-core license.

Manage SQL Server ESU subscriptions for nonproduction use

If you enabled ESU subscriptions in your production environment managed through Azure Arc, you can enable a [!INCLUDE ssNoVersion] ESU subscription in the nonproduction environment for free. You can take advantage of this benefit in the following two ways.

Use SQL Server Developer edition

[!INCLUDE ssNoVersion] Developer edition is free and can be used in any Azure subscription. If you enable the ESU subscription on the VM that's hosting a Developer edition, Azure Extension for [!INCLUDE ssNoVersion] detects it and reports the usage via a $0 Dev edition meter. The extension doesn't generate the ESU charges. At the same time, it installs the ESUs when they're released, as long as the ESU subscription is active. The Developer edition has the same feature set as the Enterprise edition.

Important

If the Developer edition is colocated on the same host with an instance of the Standard or Enterprise edition, the latter takes billing precedence as a production edition. The active ESU subscription generates the ESU charges according to that edition.

Use an Azure dev/test subscription

If you configure your nonproduction environment as a mirror of the production environment, and you want to use the same editions that you use in production, you must connect the hosting machines and the [!INCLUDE ssNoVersion] instances to an Azure dev/test subscription.

The production [!INCLUDE ssNoVersion] meters are enabled to support the dev/test subscriptions and are automatically nullified when they're emitted from a dev/test subscription. The same conditions apply to the ESU meters. So it's safe to enable ESU subscription on these machines even if they run the Standard or Enterprise edition.

For information, see:

Manage SQL Server ESU subscriptions on high-availability and disaster recovery replicas

[!INCLUDE manage-passive-instance]

[!INCLUDE billing-after-failover]

For additional information on passive replica detection logic, review Manage passive license for high availability and disaster recovery.

Manage SQL Server instances that use a Server+CAL license

You can connect any licensed [!INCLUDE ssNoVersion] instance to Azure Arc, including instances that use the Server+CAL licensing model. However, the ESU subscription enabled by Azure Arc isn't available for the out-of-support Server+CAL licensing model. If you want to receive ESUs, you can set the license type to PAYG and then enable the ESU subscription.

Manage SQL Server ESU subscriptions for the associated services

SQL Server ESU subscriptions support the following associated services:

[!INCLUDE sql-server-associated-services]

For details, see Feature availability by service type.

The SQL Server associated services are billed for ESU using the regular ESU meters. For details, see Understand ESU usage meters.

Important

  • The SQL Server associated service installations are billed for the ESU subscription only when they are installed on the machine as a standalone instance (without SQL Server engine). Otherwise, the SQL Server engine instance is billed.
  • If a p-core ESU license is activated for the corresponding scope and the machine is configured to use it, the SQL Server associated service is not individually billed for ESU even if it is a standalone instance (without SQL Server engine). For details, see Manage resources in the scope of an ESU p-core license.

Manage the transition from a p-core ESU license to a v-core ESU license

Because the p-core ESU license is billed with an ESU meter for the Enterprise edition, it's cost-effective when the out-of-support [!INCLUDE ssNoVersion] instances are colocated on a set of designated physical hosts. As you upgrade the individual instances or migrate them to Azure, you might lose the cost-effectiveness of the p-core ESU license. Using the v-core ESU licensing might then become more attractive. You can terminate the p-core ESU license and switch to billing the individual VMs for the ESU subscriptions.

To properly manage this transition, use the following sequence of best practices:

  1. Ensure that the VMs with the out-of-support [!INCLUDE ssNoVersion] instances are connected to Azure Arc and configured to use the p-core ESU license after that license is activated.

  2. Continuously evaluate the cost benefits of using the p-core ESU license.

  3. Terminate the p-core ESU license if it's no longer financially beneficial, but keep the ESU subscription active on the individual VMs.

Important

If the VMs in scope are configured to use an ESU subscription while the p-core ESU license is active (as described in step 1), after the p-core license termination, they automatically switch to billing for ESU based on the installed [!INCLUDE ssNoVersion] edition and the v-core count of each VM. There are no additional bill-back charges.

If the VM is configured to use the ESU subscription after the p-core ESU license is terminated, it's treated as a new subscription and the appropriate bill-back charges apply.

Manage the transition from an ESU license purchased through Volume Licensing to an ESU subscription

The [!INCLUDE ssSQL11] ESU subscription requires you to purchase a Year 1 and Year 2 Volume Licensing ESU offer before you can activate it. That is, the transition from a Year 1 and Year 2 Volume Licensing ESU offer to an ESU subscription is the default pattern, and the bill-back charges reflect it. For details about the bill-back charges, see Billing for SQL Server 2012 ESUs later in this article.

If you want to purchase a Year 1 or Year 2 ESU offer through Azure because you have not previously purchased Year 1 or Year 2 through Volume Licensing, you must take additional steps to ensure that the bill-back is adjusted accordingly. Before you activate the ESU subscription on the machines, you must open a support ticket by using the subcategory Issues with SQL Server Extended Security Updates.

Understand ESU usage meters

The usage of the [!INCLUDE ssNoVersion] ESU subscription is reported once an hour. The specific meter is automatically selected based on the [!INCLUDE ssNoVersion] edition and the number v-cores or p-cores visible to the OSE. The following rules apply:

  • If you install one or several [!INCLUDE ssNoVersion] instances on a virtual machine and don't specify the use of a p-core ESU license, [!INCLUDE ssNoVersion] ESU subscription usage is metered based on the total number of virtual cores available to the OSE. The minimum is four cores per OSE.

  • If you install one or several [!INCLUDE ssNoVersion] instances on a physical server without using virtual machines, [!INCLUDE ssNoVersion] ESU subscription usage is metered based on the total number physical cores available to the OSE. The minimum is four cores per OSE.

  • [!INCLUDE ssNoVersion] ESU subscription usage is reported per OSE whether one or multiple [!INCLUDE ssNoVersion] instances are installed on the same OSE.

  • If multiple out-of-support [!INCLUDE ssNoVersion] instances of the same version are installed on the same OSE, the highest [!INCLUDE ssNoVersion] edition defines the ESU subscription meter that's sent every hour.

  • If multiple out-of-support instances of both [!INCLUDE sssql11-md] and [!INCLUDE sssql14-md] are installed on the same OSE, with the same or different editions, one instance of the same version is billed separately because they have different prices and bill-back periods.

The following table shows the ESU subscription meters (also called SKUs) that are used for metering and billing for a [!INCLUDE ssNoVersion] ESU subscription on a single OSE:

Projected edition 1 SQL Server version Failover replica Use p-core license Meter SKU
Enterprise 2012 No No Ent edition - ESU
Ent edition - ESU back billing
Enterprise 2012 No Yes None
Enterprise 2012 Yes Yes or no None
Enterprise 2014 No No Ent edition - ESU 2014
Ent edition - ESU 2014 back billing
Enterprise 2014 No Yes None
Enterprise 2014 Yes Yes or no None
Standard 2012 No No Std edition - ESU
Std edition - ESU back billing
Standard 2012 No Yes None
Standard 2012 Yes Yes or no None
Standard 2014 No No Std edition - ESU 2014
Std edition - ESU 2014 back billing
Standard 2014 No Yes None
Standard 2014 Yes Yes or no None
Evaluation Any Yes or no Yes or no None
Developer Any Yes or no Yes or no None
Web Any Not applicable Yes or no None
Express Any Not applicable Yes or no None

1 For edition projection rules, see Metering software usage.

The next table shows the meter SKUs that are used for metering and billing for active p-core ESU licenses:

Azure resource SQL Server version Meter SKU
P-core ESU license 2012 Ent edition - ESU
Ent edition - ESU back billing
P-core ESU license 2014 Ent edition - ESU 2014
Ent edition - ESU 2014 back billing

Understand ESU subscription billing

The ESU subscription extends support for critical updates for up to three years. If you start the subscription after the end-of-support date, you must purchase the Volume Licensing offer or ESU subscription to cover any previous years. With an ESU subscription, you have the additional benefit of canceling the subscription and all future charges without penalty at any time.

Billing for SQL Server 2012 ESUs

To use the ESU subscription option, you must have purchased the Year 1  and Year 2 Volume Licensing ESU offer before signing up for the ESU subscription in Year 3. You can sign up for the ESU subscription at any time within Year 3, and your bill reflects the cost of continuous ESU coverage.

After you sign up for the ESU subscription, your next monthly bill includes a one-time bill-back charge for each machine that hosted a [!INCLUDE ssSQL11] instance or instances with an active ESU subscription from the beginning of the current ESU year, based on the timestamp when ESU was enabled, or when p-core ESU license got activated. From this point, you're billed for each machine on an hourly basis.

Both bill-back and regular hourly charges use the hourly rate from this formula: (Core count) x (100% of Year 3 ESU license price) / 730. So, the size of the bill-back charge depends on how much time passes from July 12, 2024, to the activation time.

The following billing rules apply:

  • If you install a [!INCLUDE ssSQL11] instance or instances on a virtual machine, and you don't use the unlimited virtualization benefit, you're billed for the total number of virtual cores of the machine, with a minimum of four cores. If the virtual machine is eligible to receive failover rights, the virtual cores of that machine aren't billable.

  • If you install a [!INCLUDE ssSQL11] instance or instances on a physical server without using virtual machines, you're billed for all physical cores of the machine, with a minimum of four cores. If the physical server is eligible to receive failover rights, the physical cores of that server aren't billable. For more information, see the service-specific terms.

For more information about [!INCLUDE ssSQL11] ESU pricing, see Plan your Windows Server and SQL Server end of support.

Billing for SQL Server 2014 ESUs

The ESU subscription for [!INCLUDE ssSQL14] is available from Year 1 of the extended support period, which started on July 10, 2024. If you signed up before that date, you see only the hourly ESU charges starting at midnight on July 10, 2024. If you signed up after July 10, 2024, your next month's bill includes a bill-back charge from the beginning of the current ESU year, based on the timestamp when ESU was enabled, or when p-core ESU license got activated.

The following billing rules apply:

  • If you install a [!INCLUDE ssSQL14] instance or instances on a virtual machine, and you don't use the unlimited virtualization benefit, you're billed for the total number of virtual cores of the machine, with a minimum of four cores. If the virtual machine is eligible to receive failover rights, the virtual cores of that machine aren't billable.

  • If you install a [!INCLUDE ssSQL14] instance or instances on a physical server without using virtual machines, you're billed for all physical cores of the machine, with a minimum of four cores. If the physical server is eligible to receive failover rights, the physical cores of that server aren't billable. For more information, see the service-specific terms.

  • If you install both instances of [!INCLUDE ssSQL11] and [!INCLUDE ssSQL14] on the same physical or virtual machine, you're billed for the total number of physical or virtual cores of the machine, for both [!INCLUDE ssSQL11] and [!INCLUDE ssSQL14] ESU subscriptions, with a minimum of four cores. The billing for each version is based on the ESU price for that version. If the virtual machine is eligible to receive failover rights, the virtual cores of that machine aren't billable.

For more information about [!INCLUDE ssSQL14] ESU pricing, see Azure Arc pricing.

Billing during connectivity loss and other disruptions

If your Azure Extension for [!INCLUDE ssnoversion-md] loses connectivity, the billing stops, and the subscription is suspended.

To make sure that intermittent disconnection doesn't negatively affect your ESU coverage, we automatically reactivate it without penalty if the [!INCLUDE ssnoversion-md] instance reconnects within 30 days. In that case, you see an additional bill-back charge for the days since the last day that your server was connected.

If you manually terminate the ESU subscription and then reactivate it within 30 days, there's also no penalty. Your bill includes an additional charge for the time since you canceled the subscription. If the server reconnects after 30 days of disconnection, the subscription is terminated. To resume the ESU coverage, you need to activate a new ESU subscription and pay all the associated bill-back charges.

If the Arc enabled machine goes offline and reconnects to Azure in a different subscription, in a different resource group, or with a different name, it will be treated as the same machine as long as the VMID property remains unchanged and the machine resource is in the same Azure location as the original machine resource.

Important

The bill-back charges are recorded within the first hour of the ESU subscription and look like single hourly charges for the [!INCLUDE ssnoversion-md] instances that have the ESU subscriptions enabled. Because the amount reflects the accumulated costs since one of the following dates, it's much higher than the regular hourly ESU charges:

  • July 10, 2024, for [!INCLUDE ssSQL11] (prior to the October, 2024 release this date was July, 2023)
  • July 10, 2024, for [!INCLUDE ssSQL14]

This difference is expected, and it should be a one-time charge.

During the following months, you should see only the regular hourly charges. Additional bill-back charges could be added in cases of connectivity disruptions, but they're typically much smaller amounts.

Related content