Running a Microsoft ERP past its support date costs money in three places, and only one of them is visible on an invoice. Dynamics AX has had no vendor security patches since January 10, 2023, when AX 2012 R3 left extended support (endoflife.ai), so an AX customer is carrying almost four years of unpatched exposure today. Dynamics GP loses technical support and regulatory updates at the end of 2029, with security patches running into 2031 (ERP Today). The first cost is a compliance gap when regulatory updates stop. The second is a security exposure the audit committee will ask about. The third, and usually the largest, is a replacement program compressed into too little time, which is where overruns come from.
Dynamics AX has run without security patches since January 2023
Every version of Dynamics AX is past its support date. The last one, AX 2012 R3, lost extended support on January 10, 2023, and no newer AX release exists to upgrade to. An AX customer has therefore had no vendor security patches for almost four years. A new vulnerability in the platform or its supporting Windows and SQL Server stack is now the customer's problem to mitigate, not Microsoft's to fix.
This is the exposure to document now, before an auditor finds it. An ERP without security patches is a finding waiting to happen in any SOC 2, PCI, or cyber-insurance review, and insurers have begun pricing unsupported software into premiums or excluding it from cover. The honest line for the audit committee is that the system runs, the data is intact, and the vendor will do nothing if it is attacked.
Nothing about this is urgent in the way a crash is urgent, which is the trap. The software keeps working on the first of every month. What has stopped is the vendor standing behind it, and that absence costs nothing until the day it costs everything.
The regulatory cutoff turns into a compliance problem within a year
The security gap is the one boards notice. The regulatory gap is the one that forces a date. When a vendor stops shipping legal and tax updates, a finance team feels it the first time a payroll tax rate changes or a reporting rule moves and the system cannot take the update without hand-built code.
For Dynamics AX that line was crossed in 2023, and AX customers have been patching tax and regulatory logic themselves or through a partner ever since. For Dynamics GP the line is the end of 2029. An ERP that cannot absorb a payroll or sales-tax change becomes a compliance problem within a year of losing regulatory updates, whatever the vendor's lifecycle page says about security patches lasting longer. The GP security-patch window into 2031 is a grace period on one risk, not an extension of support, and it should not be read as time to spare.
The distinction matters for sequencing. A GP customer has until the end of 2029 before the regulatory gap opens, and the security window buys a little room after that. An AX customer has both gaps open already and is running on borrowed time on both.
A compressed replacement program is where the overruns come from
The replacement itself carries the third cost, and it grows the longer the decision waits. A tier 1 ERP program needs about 36 months from the decision to proceed to a stable go-live. Published ranges put large implementations at 12 to 36 months (ERP Research), and the short end of that range describes the technical build, not the whole program. Selection and contracting take six to nine months on their own, and data cleanup starts before the SI arrives.
Compression is what happens when the date arrives faster than the program can run. Teams cut testing, skip the dual-run, or go live in waves they did not plan. Redress Compliance, a license negotiation firm, estimates that using a planned bridge instead of a compressed migration avoids 25 to 40% of the cost (Redress Compliance), which says the same thing in reverse: compression tends to add a quarter to two-fifths to the bill. That figure comes from the SAP side of the market and from a source that sells support, so treat it as a direction, not a precise multiplier. The direction is not in doubt.
Working the 36-month rule back from each Microsoft date produces a calendar most boards have not seen written down.
| If you run | And the date that matters is | Replacement type and length | Decision needed by | Position in November 2026 |
|---|---|---|---|---|
| Dynamics AX | Already past (January 2023) | Dynamics 365, tier 1, about 36 months | Already past | Late. The program should already be running, and the bridge is self-support |
| Dynamics GP, moving to Business Central | End of 2029 (regulatory updates) | Business Central, tier 2, 12 to 18 months | 2027 to 2028 | Comfortable if the decision is made on schedule |
| Dynamics GP, moving to Dynamics 365 | End of 2029 (regulatory updates) | Dynamics 365, tier 1, about 36 months | End of 2026 | Tight. A tier 1 target leaves little slack |
An AX customer is late by definition and should plan the replacement as a program already in progress, with the current self-support arrangement treated as a bridge that has an end date, not a settled state. A GP customer who intends to move to Business Central has room, because a tier 2 program is shorter than the runway to 2029. A GP customer who instead wants the larger Dynamics 365 platform inherits the 36-month rule and the tighter calendar that comes with it.
The Microsoft paths are Dynamics 365 for AX and Business Central for GP
Microsoft offers two destinations, and they sit in different tiers. Dynamics 365 Finance and Supply Chain is the tier 1 successor to AX, built for larger and more complex operations. Dynamics 365 Business Central is the tier 2 successor to GP, built for small and mid-size companies. The split is not a rule, and some larger GP customers move up to Dynamics 365 while some smaller AX customers move down to Business Central, but the default path follows the size of the business the old system was running.
The two differ in price, scope, and program length.
| Path | Fits | List price | Program tier and length | Typical year-one program |
|---|---|---|---|---|
| Dynamics 365 Finance and Supply Chain | Former AX customers; complex, multi-entity, or global finance and operations | $210 per user per month (microsoft.com, read November 4, 2026) | Tier 1, about 36 months | $500,000 to $5M or more for a single region (SysGenPro) |
| Dynamics 365 Business Central | Former GP customers; small and mid-size finance and distribution | $70 to $80 per user per month, Essentials to Premium (microsoft.com) | Tier 2, 12 to 18 months | $300,000 to $3M for 200 to 1,000 users (SysGenPro) |
The program ranges are confidence C figures from an SI, not audited program accounts, so use them to frame a budget and not to set one. The published tier 2 range for mid-market programs runs 6 to 18 months; a GP to Business Central move usually lands in the upper half of that, at 12 to 18, because a ledger migration and years of GP history still have to be cleaned and carried.
Consider a 150-user distributor on Dynamics GP moving to Business Central at $75 per user per month. The subscription runs about $135,000 a year. A tier 2 program at the published range costs somewhere between $300,000 and $3M to get live, and the spread inside that range is set by custom code, integrations, and the state of the data, which the buyer controls more than the vendor does. Deciding in 2027 leaves two clear years before the 2029 regulatory cutoff, which is enough for a clean program rather than a compressed one.
When an AX or GP customer should look past Microsoft
A support date is a reason to decide, not a reason to stay inside one vendor. The replacement decision reopens the platform question, and for some AX and GP customers the right answer is not a Dynamics product.
An AX customer in discrete or process manufacturing should put Infor CloudSuite, IFS Cloud, and Epicor Kinetic on the list beside Dynamics 365. Infor CloudSuite carries deep industry function for manufacturing and distribution. IFS Cloud is strong where asset management and field service sit alongside finance, which fits an asset-heavy operator. Epicor Kinetic is a natural fit for a mid-size manufacturer that wants shop-floor depth without a tier 1 program. Each of those is the right answer in its own case, and each should be measured against Dynamics 365 on fit and five-year cost, not on brand.
A GP customer that has outgrown GP but does not need Dynamics 365 should weigh Oracle NetSuite against Business Central. NetSuite suits a multi-entity or multi-currency finance operation that wants a single cloud ledger, and it competes directly with Business Central in that band. Business Central wins where the company is already deep in Microsoft 365 and wants the tight fit with Outlook, Excel, and Teams. The test is where the company will be in five years, not where GP left it.
The one path that is not a path is staying on AX or GP past the dates while telling the board it is a decision. It is not a decision. It is the absence of one, and the three costs compound every year it holds. The full economics of waiting against moving, across every vendor, are set out in the pillar on ERP support deadlines.