Free Extended Security Updates (ESU) through Azure Stack HCI
Applies to: Azure Stack HCI, version 22H2
The Extended Security Update (ESU) program enables you to get important security patches for legacy Microsoft products that are past the end of support. Getting ESU through Azure Stack HCI comes with additional benefits and implementation steps. This article explains the specifics for Azure Stack HCI.
To get general information about the ESU program, products that are covered, and support dates, see the Product Lifecycle FAQ.
Tutorial: Get free ESUs through Azure Stack HCI
This tutorial walks you through how you can use Azure Benefits to automatically unlock free ESUs on Azure Stack HCI. Azure Benefits is a feature on Azure Stack HCI that enables you to extend supported Azure-exclusive benefits to your cluster, including getting ESUs for free.
Prerequisites
- Review and install the installation prerequisites section for ESUs in KB5031043: Procedure to continue receiving security updates after extended support has ended on October 10, 2023 - Microsoft Support.
- Install the August 8th, 2023 SSU or later:
- Windows Server 2012 R2 (KB5029368)
- Windows Server 2012 (KB5029369)
Step 1: Turn on Azure Benefits on the host
Follow these instructions to turn on Azure Benefits on the host:
- Using Windows Admin Center: Manage Azure Benefits using Windows Admin Center.
- Using PowerShell: Manage Azure Benefits using PowerShell.
Step 2: Turn on Azure Benefits on the VM
You must also turn on Azure Benefits on each VM that requires ESU. Follow these instructions:
- Using Windows Admin Center: Manage access to Azure Benefits for your VMs - Windows Admin Center. Check that your ESU VMs (highlighted) are in the bottom table for VMs with Azure Benefits.
- Using PowerShell: Manage access to Azure Benefits for your VMs - PowerShell.
Step 3: Install Extended Security Updates
Once Azure Benefits is set up, you can install free Extended Security Updates for eligible VMs on your cluster. Install updates using your current method of preference; for example, Windows Update, Windows Server Update Services (WSUS), Microsoft Update Catalog, or other. The following screenshot shows installation of security updates using Windows Update:
FAQ
What ESU products does this cover?
ESU covers Windows Server and Windows client products under the ESU program. For more information, see the product lifecycle FAQ.
Does this cover ESUs for Windows Server 2012?
Yes it does.
Does my VM need to be connected to get ESUs?
No, you don't need internet connectivity to install ESUs, unless you're using an update method that requires internet connectivity to download ESU packages. Only the Azure Stack HCI host needs to maintain 30-day internet connectivity for Azure Benefits to remain active.
Can I still use MAK keys to get ESUs for VMs on Azure Stack HCI?
Yes. If you have already bought MAK keys, you can still apply them with the instructions outlined in Obtaining Extended Security Updates for eligible Windows devices. However, MAK keys are not free. Consider switching to the Azure Benefits approach so that you can automatically get free ESUs through your Azure Stack HCI cluster going forward.
Can I discover ESUs if I don't have Azure Benefits?
Yes. You can discover ESUs even if you don't have Azure Benefits. For the installation, you must set up Azure Benefits (or MAK keys).
Can I get ESUs through Azure Virtual Desktops (AVD) on Azure Stack HCI?
The operating systems currently supported for AVD on Azure Stack HCI aren't yet eligible for ESUs.
Do I need to do anything to renew for Year 1/Year 2/Year 3, etc.?
No. Once you have set up Azure Benefits, you don't need to renew or do anything else.