SQL Server Blog articles

Two additional controls with Automatic Plan Correction enabled

erinstellato — Wed, 22 Jul 2026 15:34:29 GMT

A few weeks ago I posted my first Friday Feedback about Query Store, and one of the responses referenced a stored procedure I hadn't used before: sp_configure_automatic_tuning. There was an assumption that this stored procedure wasn't documented and didn't work as expected. Knowing how much I love Query Store, Automatic Plan Correction and documentation, I went searching. If you aren’t familiar with the stored procedure, read on.

tl;dr

Good news! The sp_configure_automatic_tuning stored procedure is fully documented and supported.

What does sp_configure_automatic_tuning do?

If you’ve enabled Automatic Plan Correction (APC) for your database, sp_configure_automatic_tuning gives you granular control at the individual query level. Not sure if APC is enabled for your database? Run:

USE [dbname];
GO

SELECT *
FROM sys.database_automatic_tuning_options
WHERE name = 'FORCE_LAST_GOOD_PLAN'
                AND actual_state = 1;
GO

With APC enabled, you can use sp_configure_automatic_tuning to:

Exclude specific queries from APC monitoring
Apply an extended, time-based plan regression check to specific queries

Why you might need either option

As much as we try to design a feature for every scenario, there are always unique workloads and edge cases that don’t fit exactly into problems that the feature is designed to solve.

FORCE_LAST_GOOD_PLAN OFF

You may have a complex query (or small set of them) that has enough variability across executions that causes APC to detect a regression and force a plan. Once forced, APC monitors the performance of that forced plan, and it may detect that the plan regresses (because of the variability across executions) and then un-force it. The act of repeated forcing and un-forcing may be more problematic than just letting the natural execution variance occur.

Separately, workloads often have complex, critical queries that you may want to exclude simply because you’re not comfortable with a plan being automatically forced. In either scenario, you can tell the engine to skip a query, based on its query_id, because it either doesn’t benefit from automatic plan forcing, or you don’t want forcing even attempted.

To disable APC for a given plan, once you have the query_id (e.g. 422), simply execute:

EXECUTE sys.sp_configure_automatic_tuning 'FORCE_LAST_GOOD_PLAN', 'QUERY', 422, 'OFF';

FORCE_LAST_GOOD_PLAN_EXTENDED_CHECK ON

When a query’s plan changes, APC has a detection phase where it checks to see if the query’s performance has regressed. It monitors the query for a set number of executions, and if there is no regression for those executions, the detection phase is complete, and APC won’t look at the query again until the next plan change. However, there are scenarios where the initial executions of the query are acceptable, but concurrent or subsequent executions are slower, and may even timeout. In that case, we want APC to check the query’s performance again. Enabling FORCE_LAST_GOOD_PLAN_EXTENDED_CHECK for a query means that APC will check the query again, five minutes after the initial plan change.

This scenario is described in more detail in Derek’s post from April, Query plan regressions got you down? Here's how Automatic Plan Correction can turn it around, and if you use APC, I recommend taking time to read it (maybe even twice, because it has such great info).

To extend the check for a given query (e.g. 537), run:


EXECUTE sys.sp_configure_automatic_tuning 'FORCE_LAST_GOOD_PLAN_EXTENDED_CHECK', 'QUERY', 537, 'ON';

You can also enable this capability globally using trace flag 12656 (SQL 2022 CU4 and later).

Checking what queries have either option enabled

To see which queries have either option enabled, use sys.database_automatic_tuning_configurations:

SELECT * FROM sys.database_automatic_tuning_configurations;

Just in case you didn’t visit the documentation 😉 the sp_configure_automatic_tuning stored procedure is available in:

SQL Server 2022 and later
Azure SQL Database
Azure SQL Managed Instance
SQL database in Microsoft Fabric

The quest for feedback

If we haven’t met before 👋 I was previously the PM for SQL Server Management Studio (SSMS), and in that role I regularly reminded folks in blog posts to file feedback items for SSMS. While I’ve moved teams, it will come as no surprise that I’ll be asking folks to file feedback items for Query Store, Automatic Plan Correction, and anything in the Query Processing space on the SQL feedback site. If you filter for items in the Query Store group, you’ll see a few recent comments from me. Unfortunately, the feedback site doesn’t have a great way to tag those who originally posted, or who commented. I’m committed to figuring out a better solution (please be patient), but in the meantime, if you post something, please try and check back every so often in case there are follow up questions. And as always, feel free to make time to review existing requests and upvote those that resonate with you. We want to hear from you...about Query Store, APC, and whatever else is creating challenges in the SQL Engine space. Thanks for reading!

Cumulative Update #7 for SQL Server 2025 RTM

SrinivasSQL — Fri, 17 Jul 2026 00:30:30 GMT

The 7th cumulative update release for SQL Server 2025 RTM is now available for download at the Microsoft Downloads site. Please note that registration is no longer required to download Cumulative updates.
To learn more about the release or servicing model, please visit:

CU7 KB Article: https://support.microsoft.com/help/5096981

Starting with SQL Server 2017, we adopted a new modern servicing model. Please refer to our blog for more details on Modern Servicing Model for SQL Server

Microsoft® SQL Server® 2025 RTM Latest Cumulative Update: https://www.microsoft.com/en-us/download/details.aspx?id=108540
Update Center for Microsoft SQL Server: https://learn.microsoft.com/en-us/troubleshoot/sql/releases/download-and-install-latest-updates

Cumulative Update #26 for SQL Server 2022 RTM

SrinivasSQL — Fri, 17 Jul 2026 00:24:10 GMT

The 26th cumulative update release for SQL Server 2022 RTM is now available for download at the Microsoft Downloads site. Please note that registration is no longer required to download Cumulative updates.
To learn more about the release or servicing model, please visit:

CU26 KB Article: https://support.microsoft.com/help/5093420

Starting with SQL Server 2017, we adopted a new modern servicing model. Please refer to our blog for more details on Modern Servicing Model for SQL Server

Microsoft® SQL Server® 2022 RTM Latest Cumulative Update: https://www.microsoft.com/download/details.aspx?familyid=105013
Update Center for Microsoft SQL Server: https://learn.microsoft.com/en-us/troubleshoot/sql/releases/download-and-install-latest-updates

Security Update for SQL Server 2025 RTM CU6

SrinivasSQL — Wed, 15 Jul 2026 01:28:24 GMT

The Security Update for SQL Server 2025 RTM CU6 is now available for download at the Microsoft Download Center and Microsoft Update Catalog sites. This package cumulatively includes all previous security fixes for SQL Server 2025 RTM CUs, plus it includes the new security fixes detailed in the KB Article.

Security Bulletins:

CVE-2026-54118 - Security Update Guide - Microsoft - Microsoft SQL Server Denial of Service Vulnerability

Security Update of SQL Server 2025 RTM CU6 KB Article: KB5101346
Microsoft Download Center: https://www.microsoft.com/download/details.aspx?familyid=8cbfc62d-9944-42ba-aac6-0c5fa9dae68e
Microsoft Update Catalog: https://www.catalog.update.microsoft.com/Search.aspx?q=5101346
Latest Updates for Microsoft SQL Server: https://learn.microsoft.com/en-us/troubleshoot/sql/releases/download-and-install-latest-updates

Security Update for SQL Server 2025 RTM

SrinivasSQL — Wed, 15 Jul 2026 01:27:26 GMT

The Security Update for SQL Server 2025 RTM GDR is now available for download at the Microsoft Download Center and Microsoft Update Catalog sites. This package cumulatively includes all previous security fixes for SQL Server 2025 RTM, plus it includes the new security fixes detailed in the KB Article.

Security Bulletins:

CVE-2026-54118 - Security Update Guide - Microsoft - Microsoft SQL Server Denial of Service Vulnerability

Security Update of SQL Server 2025 RTM GDR KB Article: KB5102333
Microsoft Download Center: https://www.microsoft.com/download/details.aspx?familyid=6a71f56f-474c-4c05-a420-f30ae538ebe7
Microsoft Update Catalog: https://www.catalog.update.microsoft.com/Search.aspx?q=5102333
Latest Updates for Microsoft SQL Server: https://learn.microsoft.com/en-us/troubleshoot/sql/releases/download-and-install-latest-updates

Security Update for SQL Server 2022 RTM CU25

SrinivasSQL — Wed, 15 Jul 2026 01:26:45 GMT

The Security Update for SQL Server 2022 RTM CU25 is now available for download at the Microsoft Download Center and Microsoft Update Catalog sites. This package cumulatively includes all previous security fixes for SQL Server 2022 RTM CUs, plus it includes the new security fixes detailed in the KB Article.

Security Bulletins:

CVE-2026-54118 - Security Update Guide - Microsoft - Microsoft SQL Server Denial of Service Vulnerability

Security Update of SQL Server 2022 RTM CU25 KB Article: KB5101347
Microsoft Download Center: https://www.microsoft.com/download/details.aspx?familyid=2c52560b-6fd0-4ceb-8d60-0c540d910d01
Microsoft Update Catalog: https://www.catalog.update.microsoft.com/Search.aspx?q=5101347
Latest Updates for Microsoft SQL Server: https://learn.microsoft.com/en-us/troubleshoot/sql/releases/download-and-install-latest-updates

Security Update for SQL Server 2022 RTM

SrinivasSQL — Wed, 15 Jul 2026 01:25:21 GMT

The Security Update for SQL Server 2022 RTM GDR is now available for download at the Microsoft Download Center and Microsoft Update Catalog sites. This package cumulatively includes all previous security fixes for SQL Server 2022 RTM, plus it includes the new security fixes detailed in the KB Article.

Security Bulletins:

CVE-2026-54118 - Security Update Guide - Microsoft - Microsoft SQL Server Denial of Service Vulnerability

Security Update of SQL Server 2022 RTM GDR KB Article: KB5102334
Microsoft Download Center: https://www.microsoft.com/download/details.aspx?familyid=db5e12bd-676a-4324-b736-10053a1d34cf
Microsoft Update Catalog: https://www.catalog.update.microsoft.com/Search.aspx?q=5102334
Latest Updates for Microsoft SQL Server: https://learn.microsoft.com/en-us/troubleshoot/sql/releases/download-and-install-latest-updates

Security Update for SQL Server 2019 RTM CU32

SrinivasSQL — Wed, 15 Jul 2026 01:24:28 GMT

The Security Update for SQL Server 2019 RTM CU32 is now available for download at the Microsoft Download Center and Microsoft Update Catalog sites. This package cumulatively includes all previous security fixes for SQL Server 2019 RTM CUs, plus it includes the new security fixes detailed in the KB Article.

Security Bulletins:

CVE-2026-54118 - Security Update Guide - Microsoft - Microsoft SQL Server Denial of Service Vulnerability

Security Update of SQL Server 2019 RTM CU32 KB Article: KB5102335
Microsoft Download Center: https://www.microsoft.com/download/details.aspx?familyid=0a742248-b0b1-4008-87ac-32af17ce5f2c
Microsoft Update Catalog: https://www.catalog.update.microsoft.com/Search.aspx?q=5102335
Latest Updates for Microsoft SQL Server: https://learn.microsoft.com/en-us/troubleshoot/sql/releases/download-and-install-latest-updates

Security Update for SQL Server 2019 RTM

SrinivasSQL — Wed, 15 Jul 2026 01:24:05 GMT

The Security Update for SQL Server 2019 RTM GDR is now available for download at the Microsoft Download Center and Microsoft Update Catalog sites. This package cumulatively includes all previous security fixes for SQL Server 2019 RTM, plus it includes the new security fixes detailed in the KB Article.

Security Bulletins:

CVE-2026-54118 - Security Update Guide - Microsoft - Microsoft SQL Server Denial of Service Vulnerability

Security Update of SQL Server 2019 RTM GDR KB Article: KB5102336
Microsoft Download Center: https://www.microsoft.com/download/details.aspx?familyid=4f9970c0-88ef-4901-a471-851255f05be8
Microsoft Update Catalog: https://www.catalog.update.microsoft.com/Search.aspx?q=5102336
Latest Updates for Microsoft SQL Server: https://learn.microsoft.com/en-us/troubleshoot/sql/releases/download-and-install-latest-updates

Security Update for SQL Server 2017 RTM CU31

SrinivasSQL — Wed, 15 Jul 2026 01:23:13 GMT

The Security Update for SQL Server 2017 RTM CU31 is now available for download at the Microsoft Download Center and Microsoft Update Catalog sites. This package cumulatively includes all previous security fixes for SQL Server 2017 RTM CUs, plus it includes the new security fixes detailed in the KB Article.

Security Bulletins:

CVE-2026-54118 - Security Update Guide - Microsoft - Microsoft SQL Server Denial of Service Vulnerability

Security Update of SQL Server 2017 RTM CU31 KB Article: KB5102337
Microsoft Download Center: https://www.microsoft.com/download/details.aspx?familyid=22c8589d-8b4f-41a4-a7b3-072a8bd4aa3a
Microsoft Update Catalog: https://www.catalog.update.microsoft.com/Search.aspx?q=5102337
Latest Updates for Microsoft SQL Server: https://learn.microsoft.com/en-us/troubleshoot/sql/releases/download-and-install-latest-updates

Security Update for SQL Server 2017 RTM

SrinivasSQL — Wed, 15 Jul 2026 01:22:46 GMT

The Security Update for SQL Server 2017 RTM GDR is now available for download at the Microsoft Download Center and Microsoft Update Catalog sites. This package cumulatively includes all previous security fixes for SQL Server 2017 RTM, plus it includes the new security fixes detailed in the KB Article.

Security Bulletins:

CVE-2026-54118 - Security Update Guide - Microsoft - Microsoft SQL Server Denial of Service Vulnerability

Security Update of SQL Server 2017 RTM GDR KB Article: KB5102338
Microsoft Download Center: https://www.microsoft.com/download/details.aspx?familyid=fa1a9c50-337c-4351-88e3-0874a53e57bb
Microsoft Update Catalog: https://www.catalog.update.microsoft.com/Search.aspx?q=5102338
Latest Updates for Microsoft SQL Server: https://learn.microsoft.com/en-us/troubleshoot/sql/releases/download-and-install-latest-updates

Security Update for SQL Server 2016 SP3 Azure Connect Feature Pack

SrinivasSQL — Wed, 15 Jul 2026 01:22:22 GMT

The Security Update for SQL Server 2016 SP3 Azure Connect Feature Pack is now available for download at the Microsoft Download Center and Microsoft Update Catalog sites. This package cumulatively includes all previous security fixes for SQL Server 2016 SP3 Azure Connect Feature Pack, plus it includes the new security fixes detailed in the KB Article.

Security Bulletins:

CVE-2026-54118 - Security Update Guide - Microsoft - Microsoft SQL Server Denial of Service Vulnerability

Security Update of SQL Server 2016 SP3 Azure Connect Feature Pack KB Article: KB5102339
Microsoft Download Center: https://www.microsoft.com/download/details.aspx?familyid=6a7d7b5b-d102-4114-b131-899859ecc3cc
Microsoft Update Catalog: https://www.catalog.update.microsoft.com/Search.aspx?q=5102339
Latest Updates for Microsoft SQL Server: https://learn.microsoft.com/en-us/troubleshoot/sql/releases/download-and-install-latest-updates

Security Update for SQL Server 2016 SP3

SrinivasSQL — Wed, 15 Jul 2026 01:21:45 GMT

The Security Update for SQL Server 2016 SP3 GDR is now available for download at the Microsoft Download Center and Microsoft Update Catalog sites. This package cumulatively includes all previous security fixes for SQL Server 2016 SP3, plus it includes the new security fixes detailed in the KB Article.

Security Bulletins:

CVE-2026-54118 - Security Update Guide - Microsoft - Microsoft SQL Server Denial of Service Vulnerability

Security Update of SQL Server 2016 SP3 GDR KB Article: KB5102340
Microsoft Download Center: https://www.microsoft.com/download/details.aspx?familyid=a84c7105-2738-4d87-bea7-29846cb384ae
Microsoft Update Catalog: https://www.catalog.update.microsoft.com/Search.aspx?q=5102340
Latest Updates for Microsoft SQL Server: https://learn.microsoft.com/en-us/troubleshoot/sql/releases/download-and-install-latest-updates

A Programmatic Interface to the Query Hint Recommendation Tool

erinstellato — Tue, 14 Jul 2026 13:55:35 GMT

The Query Hint Recommendation Tool (QHRT), available in SQL Server Management Studio (SSMS) 22, evaluates query hints against a specific query and identifies the query hint that corresponds to the best-performing execution plan. With QHRT, customers no longer need to manually test different hints – simply invoke QHRT for your expensive query and let it efficiently explore a variety of query hints on your behalf. To extend automated hint identification even further, the team has developed a PowerShell script to expose the QHRT capability, so you can efficiently tune a set of queries programmatically without manual trial and error.

Because QHRT is built on a flexible backend library (DLL), you aren't limited to running it manually. You can easily integrate it into whatever automation system you already use. Imagine setting up a nightly background job that automatically scans your database for slow queries, passes them to QHRT to find the best performance hints, and generate a list of fixes for you to review the next morning. As you develop confidence in the recommendations, you can take it one step further and apply the fixes automatically using Query Store Hints. In short, you can build a completely automated, "hands-free" tuning pipeline.

Requirements

Windows PowerShell 5.1 or higher with the SqlServer PowerShell module installed
SSMS 22 with the Query Hint Recommendation Tool component, or the Code Tools workload, installed

Getting started

To set up automated hint identification for your environment, follow these steps:

Save the script below as `ps_queryHint.ps1`
Create a file with one query in it, e.g., `C:\QHRT\query.sql`
Run the following PowerShell command, replacing `localhost` with the name of your database server, and `mydb` with the name of the database where the query executes:

.\ps_queryHint.ps1 -Server 'localhost' -Database 'mydb' -QueryFile 'C:\QHRT\query.sql'

Parameters

Parameter	Purpose	Default value
-Server	Target SQL server (Integrated Security)	localhost
-Database	Target database (Integrated Security)	mydb
-QueryFile	Path to .sql file that contains the query to tune. If a folder is specified, all .sql files in the folder are processed.	C:\QHRT\query.sql or C:\QHRT\
-Threshold	Minimum expected percentage improvement in elapsed duration	80
-HintsFile	Optional file with custom hints (one per line)	uses built-in 5 hints

Output

Running the script returns a PowerShell object with tuning results, for example:

Output from programmatic execution of QHRT

In this example, the output shows that the best hint for the query is a LOOP JOIN. You can then apply that hint to the query, either within your code or using a Query Store Hint.

Fields

QueryId: Query identifier (derived from filename)
LogFile: File with stepwise tuning logs with name using QueryId and timestamp, stored in the same folder as input query file
Success: Indicates whether tuning completed without any errors
BestHint: The query hint that led to the best performing execution plan
OriginalElapsedTime: Execution time of the plan without any hint (in milliseconds)
BestPlanElapsedTime: Execution time of the best plan found by QHRT (in milliseconds)
TuningTime: Total time spent searching for the best hint (in seconds)

Extended list of query hints

The script provided below includes only a small number of hints. If the user is interested in exploring more hints (listed below), they can be saved in a text file and passed using the “-HintsFile” parameter

OPTION(HASH JOIN)

OPTION(MERGE JOIN)

OPTION(LOOP JOIN)

OPTION(FORCE ORDER)

OPTION(IGNORE_NONCLUSTERED_COLUMNSTORE_INDEX)

OPTION(ORDER GROUP)

OPTION(HASH GROUP)

OPTION(CONCAT UNION)

OPTION(HASH UNION)

OPTION(MERGE UNION)

OPTION(EXPAND VIEWS)

OPTION(NO_PERFORMANCE_SPOOL)

OPTION(USE HINT ('DISABLE_OPTIMIZER_ROWGOAL'))

OPTION(USE HINT ('ASSUME_JOIN_PREDICATE_DEPENDS_ON_FILTERS'))

OPTION(USE HINT ('ASSUME_MIN_SELECTIVITY_FOR_FILTER_ESTIMATES'))

OPTION(USE HINT ('ASSUME_FULL_INDEPENDENCE_FOR_FILTER_ESTIMATES'))

OPTION(USE HINT ('ASSUME_PARTIAL_CORRELATION_FOR_FILTER_ESTIMATES'))

OPTION(USE HINT ('DISALLOW_BATCH_MODE'))

OPTION(USE HINT ('FORCE_DEFAULT_CARDINALITY_ESTIMATION'))

OPTION(USE HINT ('FORCE_LEGACY_CARDINALITY_ESTIMATION'))

Summary

This script provides a simple, standalone way to programmatically invoke the Query Hint Recommendation Tool from PowerShell. Save it, adjust the parameters to match your environment, and run it against any query or set of queries for which you want to improve performance using hints. Happy tuning!

Script

The script below can saved as a PowerShell file, for example, ps_queryHint.ps1.

#requires -Version 5.1
#requires -PSEdition Desktop
param(
    [string]$Server = 'localhost',
    [string]$Database = 'dbname',
    [Parameter(Mandatory = $true)]
    [string]$QueryFile,
    [double]$Threshold = 80,
    [string]$IDE = '',
    [string]$HintsFile = ''
)
function Find-SSMSIDEPath {
    foreach ($base in 'C:\Program Files', 'C:\Program Files (x86)') {
        $result = Get-ChildItem $base -Filter "*SQL Server Management Studio*" `
            -Directory -EA 0 | Sort-Object Name -Descending |
            ForEach-Object { Join-Path $_.FullName 'Release\Common7\IDE' } |
            Where-Object { Test-Path $_ } | Select-Object -First 1
        if ($result) { return $result }
    }
}
# Auto-detect IDE path if not provided
if (-not $IDE) {
    $IDE = Find-SSMSIDEPath
    if (-not $IDE) {
        throw 'SQL Server Management Studio IDE folder not found. Please install SSMS or provide -IDE parameter with path.'
    }
    Write-Host "Auto-detected SSMS IDE path: $IDE" -ForegroundColor Cyan
}
function Get-CleanQueryText {
    param([string]$QueryText)
    $pattern = '(?is)\s*OPTION\s*\(.*?\)\s*;?\s*$'
    $cleaned = [regex]::Replace($QueryText, $pattern, '')
    return $cleaned.TrimEnd(';', "`r", "`n", ' ')
}
function Get-HintList {
    param([string]$HintsFilePath)
    if ($HintsFilePath -and (Test-Path $HintsFilePath -PathType Leaf)) {
        $content = Get-Content $HintsFilePath | Where-Object { $_.Trim() }
        return [System.Collections.Generic.List[string]]$content
    }
    return [System.Collections.Generic.List[string]]@(
        'OPTION (USE HINT (''FORCE_LEGACY_CARDINALITY_ESTIMATION''))',
        'OPTION (MAXDOP 8)',
        'OPTION (FORCE ORDER)',
        'OPTION (HASH JOIN)',
        'OPTION (LOOP JOIN)'
    )
function Initialize-QueryHintAssemblies {
    param([string]$IdePath)
    $qhPath = Join-Path $IdePath 'Extensions\Microsoft\SSMS.QueryHintTool'
    if (-not (Test-Path $qhPath -PathType Container)) {
        throw "QueryHint extension folder not found at: $qhPath"
    }
    Import-Module SqlServer -ErrorAction Stop
    $loadedAssemblies = [System.AppDomain]::CurrentDomain.GetAssemblies() |
        ForEach-Object { $_.GetName().Name }
    $dllNames = @('Microsoft.Scripting', 'Microsoft.Scripting.Metadata',
        'Microsoft.Dynamic', 'Microsoft.SqlServer.QueryHinting')
    foreach ($dll in $dllNames) {
        $dllPath = Join-Path $qhPath "$dll.dll"
        if (-not (Test-Path $dllPath -PathType Leaf)) {
            throw "$dll.dll not found at: $dllPath"
        }
        if ($loadedAssemblies -notcontains $dll) {
            Add-Type -Path $dllPath
        }
    }
}
function New-QueryTuningConfig {
    param(
        [string]$QueryId,
        [string]$QueryText,
        [System.Collections.Generic.List[string]]$HintList,
        [double]$ThresholdValue,
        [string]$WorkDir
    )
    $runStamp = Get-Date -Format 'yyyyMMdd_HHmmss'
    $config = New-Object QueryHinting.QueryTuningConfig
    $config.QueryId = $QueryId
    $config.QueryText = $QueryText
    $config.HintList = $HintList
    $config.Threshold = $ThresholdValue
    $config.LogToFile = $true
    $logFileName = "{0}_{1}.log" -f $QueryId, $runStamp
    $config.LogFile = Join-Path $WorkDir $logFileName
    $config.WorkDir = $WorkDir
    $config.Logging = 2
    return $config
}
function Show-TuningConfiguration {
    param([QueryHinting.QueryTuningConfig]$Config, [string]$ServerName,
        [string]$DatabaseName)
    Write-Host 'Starting tuning process...' -ForegroundColor Green
    [PSCustomObject]@{
        QueryId = $Config.QueryId
        Server = $ServerName
        Database = $DatabaseName
        Threshold = '{0}%' -f ([Math]::Round($Config.Threshold * 100, 0))
        LogFile = $Config.LogFile
    } | Format-List QueryId, Server, Database, Threshold, LogFile | Out-Host
}
function Show-TuningResult {
    param($Result, [QueryHinting.QueryTuningConfig]$Config)
    if ($Result) {
        Write-Host '--- Tuning Result ---' -ForegroundColor Green
        $Result | Select-Object Success, BestHint, `
            @{Name = 'OriginalElapsedTime'; Expression = { "$($_.OriginalElapsedTimeMs) msec" }},
            @{Name = 'BestPlanElapsedTime'; Expression = { "$($_.BestPlanElapsedTimeMs) msec" }},
            @{Name = 'ElapsedTimeImprovement'; Expression = { '{0}%' -f $_.ElapsedTimeImprovement }},
            @{Name = 'TuningTime'; Expression = { "$([Math]::Round($_.TuningTimeMs / 1000, 1)) sec" }},
            @{Name = 'Num of Hints'; Expression = { $_.HintCount }},
            @{Name = 'Distinct Plans'; Expression = { $_.ExecutedPlans - 2 }},
            @{Name = 'Successful Executions'; Expression = { $_.ExecutedPlans - $_.ExceptionPlans - 2 }} |
            Format-List | Out-Host
    }
    else {
        Write-Host "No tuning result returned. Check log file for details: $($Config.LogFile)" `
            -ForegroundColor Yellow
    }
}
function Invoke-QueryHintTuning {
    param([string]$ServerName, [string]$DatabaseName, [string]$QueryFilePath,
        [double]$ThresholdValue, [string]$IdePath, [string]$HintsFilePath)
    if (-not (Test-Path $QueryFilePath -PathType Leaf)) {
        throw "Query file not found at: $QueryFilePath"
    }
    if ($ThresholdValue -lt 0 -or $ThresholdValue -gt 100) {
        throw "Threshold must be between 0 and 100 (percentage). Received: $ThresholdValue"
    }
    $workDir = Split-Path -Parent $QueryFilePath
    $queryId = [IO.Path]::GetFileNameWithoutExtension($QueryFilePath)
    $thresholdRatio = [Math]::Round($ThresholdValue / 100, 2)
    $queryTextRaw = Get-Content $QueryFilePath -Raw
    $queryTextClean = Get-CleanQueryText -QueryText $queryTextRaw
    $hintList = Get-HintList -HintsFilePath $HintsFilePath
    Initialize-QueryHintAssemblies -IdePath $IdePath
    $config = New-QueryTuningConfig -QueryId $queryId -QueryText $queryTextClean `
        -HintList $hintList -ThresholdValue $thresholdRatio -WorkDir $workDir
    $conn = New-Object Microsoft.Data.SqlClient.SqlConnection
    $conn.ConnectionString = "Data Source=$ServerName;Initial Catalog=$DatabaseName;" +
        "Integrated Security=SSPI;TrustServerCertificate=True"
    $conn.Open()
    try {
        Show-TuningConfiguration -Config $config -ServerName $ServerName -DatabaseName $DatabaseName
        $result = (New-Object QueryHinting.QueryTuner).TuneQuery($conn, $config, $null)
        Show-TuningResult -Result $result -Config $config
        return $result
    }
    finally {
        $conn.Close()
    }
}
function Invoke-QueryHintBatch {
    param([string]$ServerName, [string]$DatabaseName, [string]$QueryPath,
        [double]$ThresholdValue, [string]$IdePath, [string]$HintsFilePath)
    if (-not (Test-Path $QueryPath)) {
        throw "Query path not found at: $QueryPath"
    }
    if (Test-Path $QueryPath -PathType Container) {
        $queryFiles = Get-ChildItem -Path $QueryPath -Filter '*.sql' -File | Sort-Object FullName
        if (-not $queryFiles -or $queryFiles.Count -eq 0) {
            throw "No .sql files found in folder: $QueryPath"
        }
    }
    else {
        if (-not (Test-Path $QueryPath -PathType Leaf)) {
            throw "Query file not found at: $QueryPath"
        }
        $queryFiles = @(Get-Item -Path $QueryPath)
    }
    $total = $queryFiles.Count
    $index = 0
    $failed = 0
    foreach ($file in $queryFiles) {
        $index++
        Write-Host ("[{0}/{1}] Processing {2}" -f $index, $total, $file.FullName) -ForegroundColor Cyan
        try {
            $result = Invoke-QueryHintTuning -ServerName $ServerName -DatabaseName $DatabaseName `
                -QueryFilePath $file.FullName -ThresholdValue $ThresholdValue -IdePath $IdePath `
                -HintsFilePath $HintsFilePath
            $resultObj = if ($result -is [array]) { if ($result.Count -gt 0) { $result[0] } else { $null } } else { $result }
            if (-not $resultObj -or -not [bool]$resultObj.Success) {
                $failed++
                Write-Warning "Tuning reported Success=False for: $($file.FullName)"
            }
        }
        catch {
            $failed++
            Write-Warning "Failed: $($file.FullName)`n$($_.Exception.Message)"
        }
    }
    $ok = $total - $failed
    Write-Host "Batch complete. Total: $total, Success: $ok, Failed: $failed" -ForegroundColor Green
}
Invoke-QueryHintBatch -ServerName $Server -DatabaseName $Database -QueryPath $QueryFile `
    -ThresholdValue $Threshold -IdePath $IDE -HintsFilePath $HintsFile

mssql-python 1.11.0: Fixes for transaction semantics, Apple Silicon imports, and bulk copy

DavidLevy — Fri, 10 Jul 2026 17:00:00 GMT

This release is about removing friction in real production paths. It fixes transaction handling in with blocks, restores clean-machine imports on Apple Silicon, improves NULL binary parameter binding, removes a class of hangs in SSH-tunnel-style forwarding setups, and unblocks bulk copy with service principal authentication.

Upgrade

pip install --upgrade mssql-python

Highlights

with connection: now commits on success and rolls back on exception

The Connection context manager now implements the documented commit-on-success / rollback-on-exception behavior when autocommit=False. The connection still closes on exit.

Code like this now behaves the way most users already expected it to:

import mssql_python conn = mssql_python.connect(connection_string, autocommit=False) with conn: cursor = conn.cursor() cursor.execute("INSERT INTO dbo.audit_log(message) VALUES (?)", ("created",))

If the code in the block succeeds, the insert is committed. If the code in the block raises an error, the transaction is rolled back.

Apple Silicon imports work on clean machines again

We fixed the bundled macOS ODBC dylib configuration for every architecture shipped in the universal2 wheel.

For Apple Silicon users, this removes a frustrating failure mode where import mssql_python could point at a missing Homebrew unixODBC path on a clean machine. In 1.11.0, the bundled libraries resolve correctly without a separate unixODBC install.

NULL BINARY and VARBINARY parameters bind more reliably

We fixed the SQLDescribeParam ordinal remapping issue behind GitHub issue #627.

1.11.0 improves parameter binding for NULL binary values, especially in temp-table and table-variable scenarios. When automatic type resolution is not possible, the driver now gives actionable guidance instead of a vague failure, including cursor.setinputsizes() guidance for binary columns.

Bug fixes worth calling out

Shutdown and parameter-typing paths no longer hang SSH-tunnel-style forwarders

We fixed hangs caused by holding the GIL across blocking ODBC operations.

This matters most for users routing connections through an in-process Python TCP forwarder, including SSH-tunnel-style setups. Closing connections and cursors after parameterized queries, as well as executing parameterized queries containing None, no longer wedge the interpreter in those paths.

Bulk copy with service principal authentication no longer freezes

1.11.0 also picks up mssql-py-core 0.1.6, which fixes a freeze affecting bulk copy with Authentication=ActiveDirectoryServicePrincipal.

If you are using service principal authentication for bulk ingest workloads, this release is worth taking promptly.

Upgrading

For most users, pip install --upgrade mssql-python is all you need. If you had local workarounds for broken with connection: transaction behavior, Apple Silicon import issues, or binary NULL parameter binding, 1.11.0 is the release where those workarounds should become unnecessary.

This is not a feature-heavy release. We opted to focus on the friction you are reporting in real production workflows:

transactional with blocks now persist successful work
Apple Silicon setup is smoother on clean machines
binary NULL parameters are more reliable
SSH-tunnel and threaded forwarding scenarios are less fragile
service principal bulk copy is unblocked

Thank you

Thanks to everyone who filed issues, sent repros, and reviewed fixes in this cycle. Several of the changes in 1.11.0 came directly from concrete user reports in production-like environments, which made the failure modes easier to reproduce and fix.

If you upgrade to 1.11.0 and hit anything unexpected, please open an issue in the repository.

Repository: microsoft/mssql-python

Issue tracker: open an issue

Release notes: mssql-python v1.11.0

mssql-python 1.10.0: Service Principal Bulk Copy, More Reliable Arrow Text, and a Core Timeout Fix

DavidLevy — Fri, 26 Jun 2026 17:00:00 GMT

We have released mssql-python 1.10.0 with improvements focused on authentication flexibility, cross-platform text reliability, and bulk load stability.

Highlights

1) Bulk Copy now supports ActiveDirectoryServicePrincipal

Bulk Copy can now use Authentication=ActiveDirectoryServicePrincipal.

This release adds a token-factory callback path for Bulk Copy so tenant-aware tokens can be created during the FedAuth handshake, using the STS URL supplied by SQL Server.

Why this matters:

You can use service principals in Bulk Copy flows without switching auth modes.
The behavior aligns better with real enterprise automation scenarios and non-interactive jobs.

Example:

import mssql_python conn = mssql_python.connect( "Server=tcp:myserver.database.windows.net;" "Database=mydb;" "Authentication=ActiveDirectoryServicePrincipal;" "UID=<client-id-guid>;" "PWD=<client-secret>;" "Encrypt=yes;" ) cur = conn.cursor() cur.bulkcopy("mytable", [(1, "a"), (2, "b")])

2) Arrow text fetching is more robust across locale and OS differences

In the Arrow fetch path, SQL_CHAR values are now requested as SQL_C_WCHAR to ensure consistent Unicode handling. This makes Arrow-based reads more predictable across Windows, Linux, and macOS, including different encoding and locale configurations.

3) Updated mssql-py-core to 0.1.5

This release bumps the bundled Rust core dependency from 0.1.4 to 0.1.5, bringing in fixes for bulk load connection timeout scenarios.

Additional quality updates

Non-ASCII VARCHAR data in Arrow fetch path

The Arrow fetch path now requests SQL_CHAR as SQL_C_WCHAR (UTF-16LE) instead of using the narrow character path. This ensures correct decoding independent of encoding settings, locale, or operating system, with no significant performance impact observed.

Bulk Copy connection timeouts

Bulk copy timeout fixes from Rust core are now included by bumping bundled mssql_py_core from 0.1.4 to 0.1.5.

Upgrade

pip install --upgrade mssql-python

If you use Azure Entra ID authentication with Bulk Copy, you'll want this update.

Thank you

Thanks to everyone who reported issues, validated fixes, and contributed code and tests.

Announcing Microsoft.Data.SqlClient 7.0.2 and 6.1.6

DavidLevy — Thu, 25 Jun 2026 20:23:58 GMT

We are pleased to announce the release of Microsoft.Data.SqlClient 7.0.2 and 6.1.6, stable servicing updates now available on NuGet.

Both releases include:

WAM broker support for supported Microsoft Entra ID authentication modes on Windows
TDS parsing security hardening with strict data-length bounds checks
Key bug fixes, including a SqlDataReader null-reference path and an Always Encrypted signature verification cache fix

Install or update from NuGet:

dotnet add package Microsoft.Data.SqlClient --version 7.0.2 or dotnet add package Microsoft.Data.SqlClient --version 6.1.6

Full release notes:

What's in these releases

WAM broker support for supported Entra ID authentication modes (Windows)

Both servicing releases add support for the Web Account Manager (WAM) broker in supported Entra ID authentication flows on Windows. This enables OS-brokered token handling, better single sign-on behavior with the signed-in Windows account, and improved support for Conditional Access and Windows Hello scenarios.

For application code, this is exposed through ActiveDirectoryAuthenticationProviderOptions, including the UseWamBroker property.

Hardened TDS token parsing

The TDS parser now validates declared token data lengths against the available input buffer before reading. This improves resilience against malformed or hostile protocol payloads and helps prevent out-of-bounds token parsing behavior.

For well-formed SQL Server responses, behavior is unchanged.

SqlDataReader null-reference fix

These releases include a fix for a SqlDataReader null-reference path in buffer-based reads. Calls that previously could fail with NullReferenceException now correctly surface argument validation errors.

Always Encrypted signature-cache fix

The Always Encrypted column master key signature verification cache logic was corrected so cached verification results are read and applied using the correct key and value. This prevents stale or mismatched cache outcomes from being treated as valid signature verification results.

Additional note for 7.0.2 users

Starting with version 7.0.2, Microsoft.Data.SqlClient and companion extension packages are version-aligned to 7.0.2. If your application references extension packages (for example Microsoft.Data.SqlClient.Extensions.Azure), upgrade them to the same version for compatibility.

Getting started

If you are new to Microsoft.Data.SqlClient, check out the introduction documentation: https://learn.microsoft.com/sql/connect/ado-net/introduction-microsoft-data-sqlclient-namespace

For users of System.Data.SqlClient, see the porting cheat sheet: https://github.com/dotnet/SqlClient/blob/main/porting-cheat-sheet.md

If you encounter any issues, please report them on GitHub: https://github.com/dotnet/SqlClient/issues

Microsoft Django backend for SQL Server - mssql-django 1.7.3 is now available

DavidLevy — Wed, 24 Jun 2026 20:04:55 GMT

We are happy to announce the release of mssql-django 1.7.3.

This release improves SQL Server connection compatibility for modern authentication scenarios and fixes a subclassing edge case in backend server-property caching.

Highlights

1) Authentication parsing and connection string handling improvements

We fixed how extra_params authentication settings are interpreted and now parse ODBC-style key/value segments more robustly.

What changed:

Authentication mode is parsed from extra_params using a spec-aligned parser.
Trusted_Connection and SSPI injection now respects explicit Authentication= modes.
Password injection behavior is driven by authentication mode, so password-based modes still receive PWD correctly.
Parser behavior is hardened for cases like braced values, embedded semicolons, escaped braces, whitespace, and empty values.

Why it matters:

Prevents invalid combinations such as appending Trusted_Connection=yes when an explicit authentication mode is provided.
Avoids ODBC driver failures (including FA001) in authentication flows such as ActiveDirectoryIntegrated.
Improves predictability for advanced connection-string configurations.

2) Server-property cache fix for DatabaseWrapper subclasses

We fixed a KeyError when subclassing DatabaseWrapper and accessing server-property cached values.

What changed:

Replaced mutable default-argument cache patterns with explicit class-level cache dictionaries.
Added regression coverage for subclass access paths.

Why it matters:

Custom backend wrapper subclasses now behave correctly when reading cached server properties.
Prevents runtime failures in extensibility scenarios.

Upgrade

pip install --upgrade mssql-django==1.7.3

If you are building an application that uses Entra authentication, you'll want this as your minimum version.

Compatibility

1.7.3 continues the same compatibility range introduced in 1.7.x:

Django 3.2 through 6.0
Python 3.8 through 3.14
All supported versions of Microsoft SQL

Thank You

Thank you to everyone who reported issues, validated fixes, and contributed improvements.

As always, please open an issue if you hit regressions or have connection/authentication scenarios you want us to look into.

SQL Server 2016 Extended Security Updates: Stay Protected While You Modernize

Venkata_Raj_Pochiraju — Tue, 23 Jun 2026 12:41:38 GMT

SQL Server 2016 reaches the end of extended support on July 14, 2026. After that date, instances that remain on SQL Server 2016 no longer receive regular security updates unless they are covered through Extended Security Updates (ESUs)). ESUs provide a time-bound security bridge for customers who need to maintain existing workloads while they upgrade to a supported SQL Server release or modernize to Azure SQL.

SQL Server 2016 Extended Security Updates can be managed across multiple deployment models, including SQL Server enabled by Azure Arc for on-premises and other clouds, and SQL Server on Azure Virtual Machines. This provides a consistent protection path while customers assess modernization options and operational readiness.

Today, we are making the Extended Security Updates subscription experience available in Azure so customers can enroll ahead of SQL Server 2016 reaching end of support, and be ready to receive Extended Security Updates when they are released.

Why this matters now

SQL Server follows a fixed lifecycle policy with mainstream support followed by extended support. Once SQL Server 2016 exits extended support, Extended Security Updates become the only for continued security coverage on that version. Extended Security Updates are intended as a temporary option for risk reduction, not as a long-term alternative to upgrade or modernization.

For many production environments, the constraint is not awareness of the deadline but the complexity of the upgrade path. Application dependencies, validation requirements, change windows, and compliance controls sometimes make immediate migration impractical. Extended Security Updates help teams maintain security coverage during that transition period while they sequence remediation, testing, and platform changes.

How SQL Server 2016 Extended Security Updates work

Support window: SQL Server 2016 exits extended support on July 14, 2026. Extended Security Updates are available for up to three additional years, with coverage periods defined by the SQL Server 2016 lifecycle schedule through July 17, 2029.

Supported scope and update model

Eligible versions: SQL Server 2016. Extended Security Updates are also available for SQL Server 2014 until July 12, 2027.
Eligible editions: Standard and Enterprise
Update content: Extended Security Updates deliver critical security updates when applicable. They do not include new features, non-security bug fixes, non-critical security updates, or design changes.
Operational note: SQL Server ESUs are not published on a fixed monthly cadence. They are released when qualifying vulnerabilities require a release.

For Azure Arc-connected environments, Extended Security Updates subscriptions can be aligned to the deployment model, including virtual cores for VM-based deployments and physical cores for host-based scenarios. This gives organizations flexibility to match ESU coverage to how SQL Server is deployed and managed.

How to acquire Extended Security Updates coverage

Customers can acquire SQL Server ESU coverage in different ways depending on where SQL Server is running and how they prefer to purchase. For on-premises, edge, and other cloud environments, SQL Server enabled by Azure Arc provides the control plane to onboard instances, manage eligibility, and apply ESU subscription settings. For workloads already running on Azure Virtual Machines, customers can subscribe to ESU coverage through Azure-based controls. Customers can purchase that coverage as pay-as-you-go through Azure or through Volume Licensing on an annual basis for eligible licenses with active Software Assurance. When customers choose Volume Licensing, Azure Arc registration is still required to activate access to ESUs.

SQL Server enabled by Azure Arc: Use Azure Arc to onboard eligible SQL Server instances outside Azure, manage Extended Security Updates subscription settings, and support both connected and qualifying disconnected scenarios.
SQL Server on Azure Virtual Machines: Use Azure-based controls to subscribe to Extended Security Updates coverage for workloads running on Azure Virtual Machines. For SQL Server 2016, this now requires a paid ESU subscription rather than the previous no-additional-cost experience.

Supported regions: Subscribing to Extended Security Updates for SQL Server on Azure VMs is only available in the supported regions listed. To subscribe to ESUs in an unsupported region, contact Microsoft Support to determine the appropriate ESU acquisition path.

Volume Licensing: If you cannot subscribe to Extended Security Updates via Azure Arc, you can purchase through the Volume Licensing channel on an annual basis for eligible licenses with active Software Assurance. Talk to your Microsoft seller for more information. Azure Arc registration is still required to activate access to ESUs.
Migrate to Azure SQL: Customers that are ready to modernize further can move to Azure SQL Database or Azure SQL Managed Instance, which removes Extended Security Updates dependency by moving to fully supported, cloud-managed SQL services.

The following diagram summarizes how customers can obtain SQL Server 2016 Extended Security Updates coverage through Azure Arc and Azure Virtual Machines.

What to do next

Organizations still running SQL Server 2016 should use the remaining support window to assess estate readiness, determine the right Extended Security Updates subscription model, and define the target modernization path for each workload. For some environments, that means upgrading in place to a supported SQL Server version. For others, it means migrating and upgrading to Azure Virtual Machines or Azure SQL to simplify long-term operations. The important step is to make the transition plan executable before support ends.

Learn more

SQL Server end of support options

SQL Server Extended Security Updates enabled by Azure Arc

SQL Server enabled by Azure Arc

Extend support for SQL Server with Azure VM

SQL Server on Azure VM overview

Migrate to Azure SQL

Cumulative Update #6 for SQL Server 2025 RTM

SrinivasSQL — Thu, 18 Jun 2026 00:43:37 GMT

The 6th cumulative update release for SQL Server 2025 RTM is now available for download at the Microsoft Downloads site. Please note that registration is no longer required to download Cumulative updates.
To learn more about the release or servicing model, please visit:

CU6 KB Article: https://learn.microsoft.com/troubleshoot/sql/releases/sqlserver-2025/cumulativeupdate6

Starting with SQL Server 2017, we adopted a new modern servicing model. Please refer to our blog for more details on Modern Servicing Model for SQL Server

Microsoft® SQL Server® 2025 RTM Latest Cumulative Update: https://www.microsoft.com/download/details.aspx?familyid=69e0b8fc-1c50-41bd-a576-b9c66b2f302a
Update Center for Microsoft SQL Server: https://learn.microsoft.com/en-us/troubleshoot/sql/releases/download-and-install-latest-updates