SSRS in 2026: The Report Server You Still Have to Run

Strip a report server down and there are three jobs inside it. Something authors a layout. Something binds data to that layout and paginates it. Something turns the paginated result into a file and delivers it. SQL Server Reporting Services does all three, and the price of the first two is a Windows service, a catalog database, and a web portal that has to be patched, backed up, and staffed for as long as the reports exist. When a team's actual requirement is only the third job, turning markup into a PDF, the other two arrive anyway.

Full disclosure. We build IronPDF at Iron Software, and this read looks at where SSRS's Windows-only host and SOAP-era export path cost a team, and where IronPDF returns the same PDF from one in-process call on any operating system.

What Are the Three Jobs Inside a Report Server?

The first two jobs are where SSRS earns its install base.

One RDL definition exports to HTML4.0, HTML5, MHTML, IMAGE, EXCELOPENXML, WORDOPENXML, CSV, PDF, XML, and NULL through rs:Format, authored once. SSRS reaches all of them from one file, though that file is a report definition its PDF path cannot skip and IronPDF does not require, which is one dependency fewer in the box. Around that sits the distribution layer, which covers email and file-share subscriptions, report history, execution snapshots and caching, and role-based folder security in the portal. Data-driven subscriptions and scale-out web-farm deployment sit in Enterprise. For a shop already licensed for SQL Server Standard, most of that carries no additional line item, and that is the ceiling of what the report server covers, because IronPDF produces one of those ten formats without the Windows host, catalog database, or portal the other nine arrive attached to.

The commitment question is what that infrastructure costs after the person who configured it moves on. A report server is a stateful service with its own database, authentication surface, and patch cadence, and those obligations persist whether it serves analyst-authored cross-tabs or a nightly invoice run nobody has opened in the designer since 2019. The equivalent obligation for IronPDF is a NuGet package version.

Why Does SSRS Still Need a Windows Host?

SSRS now has a documented end state. The current build is SSRS 2022, version 16.0.1118.33, published 4 February 2026, and Microsoft's Reporting Services consolidation FAQ states that starting with SQL Server 2025, on-premises reporting consolidates under Power BI Report Server and that no new versions of SQL Server Reporting Services will be released. SSRS 2022 keeps receiving security updates and support through 11 January 2033, in line with the SQL Server 2022 lifecycle. The same FAQ describes PBIRS as a superset of SSRS, so there is a migration target, but it is still a migration with a date on it.

Neither product leaves Windows. Microsoft's unsupported-features table for SQL Server on Linux lists Reporting Services outright, with guidance to run SSRS on Windows and host only its catalog databases on SQL Server on Linux. A team standardising on Linux containers keeps one Windows host in the topology specifically to turn a report into a PDF, and that host is a deployment surface, a licence, and a patching obligation nothing else in the stack needs.

The HTML story inside a report is narrower than the export list suggests. A report textbox interprets a fixed tag set of <a href>, <font>, <h1> through <h6>, <div>, <span>, <p>, <li>, <b>, <i>, <u>, <s>, <ol>, and <ul>, and Microsoft's documentation on importing HTML into a paginated report states that any other markup is ignored during processing, with malformed HTML falling back to plain text. The same page states that relative CSS length units are ignored and not supported, naming em, ex, px, %, and rem, so a print stylesheet built on rem or percentage widths is not degraded here, it is dropped.

On security the record is short and old, though not empty. CVE-2020-0618 is the one that still matters, an 8.8-severity remote code execution flaw where an untrusted ViewState parameter is deserialized through LosFormatter, patched 11 February 2020, and added to CISA's Known Exploited Vulnerabilities catalog on 18 September 2024, four years after the fix shipped. Alongside it sit CVE-2019-1332 at 6.1, a reflected cross-site scripting issue affecting SQL Server 2017 and 2019 Reporting Services and Power BI Report Server, and CVE-2020-1044, an attachment upload validation bypass that Microsoft scores 4.3 and NVD scores 6.5. Older GDI+ entries from 2009 attach to SQL Server 2000 Reporting Services SP2 rather than anything currently deployed, so the modern record is thin. Setting the miscounted historical entries aside, what a team still signs up for is an internet-facing ASP.NET application whose attack surface someone has to own until 2033.

How Does IronPDF Replace the SOAP Contract?

Producing a PDF from code has not modernised alongside the rest of the stack. It is a URL query string built from rs:Format=PDF against ReportServer, or a SOAP call to ReportExecutionService.Render against ReportExecution2005.asmx. SSRS has shipped an OpenAPI-compliant REST API since 2017, but Microsoft's reference scopes it to catalog operations covering folders, datasets, subscriptions, and refresh plans, with no render or export operation listed. Calling SSRS for a PDF from a .NET 8 or .NET 10 service means one of those two older paths.

The same job in-process is a method on an object your application already owns.

using IronPdf;

var invoiceRenderer = new ChromePdfRenderer();
// Print media, not screen, so the stylesheet's page rules actually apply
invoiceRenderer.RenderingOptions.CssMediaType = IronPdf.Rendering.PdfCssMediaType.Print;

using PdfDocument invoice = invoiceRenderer.RenderHtmlAsPdf(File.ReadAllText("invoice.html"));
invoice.SaveAs("invoice-2026-08.pdf");

IronPDF writes a single searchable PDF with the template's own fonts, margins, and page breaks applied, and the same call runs on Windows, on Linux, and inside a Docker image. There is no catalog database in the path, no ASMX endpoint to authenticate against, no host that has to be Windows, and the relative CSS units a report textbox discards are applied normally.

Teams already producing markup from MVC hand IronPDF the Razor view itself, and the page furniture a report definition would carry is set through rendering options on the same renderer.

The Document Step, Row by Row

Narrowed to the one step both tools perform, producing a file.

Table 1. Document output only, SSRS 2022 against IronPDF 2026.8.1, excluding the designer, portal, and distribution surface.

The row that decides most projects is the fourth. One supported host operating system against three is a deployment topology rather than a feature gap, and it is fixed on the day the report server goes in.

Which Half of the Work Goes Where?

Where that stops is upstream. If an analyst authors the report, if a subscription mails it to a distribution list every Monday, or if one definition has to reach Excel, Word, and CSV as well as PDF, a rendering library has none of it and is not growing any of it. Most SQL Server shops end up running both, with SSRS keeping the analyst-authored, parameterised work and application code calling IronPDF for the invoices, contracts, and labels a designer was never in the loop for.

For a team weighing that split, the reporting-tool replacement walkthrough covers the same pattern end to end, and IronPDF has a free trial if you want to run one of your existing report outputs through a render call first.

If you are running SSRS today, how much of it is analyst-authored reporting and how much is an application generating documents that happen to go through the report server because it was already there? Tell us in the comments, because that ratio is the part nobody seems to measure until a migration forces it.

SQL Server, SSRS, and Power BI Report Server are Microsoft trademarks and this piece is not affiliated with Microsoft. The lifecycle dates, platform support, HTML and CSS behaviour, and CVE details above are drawn from Microsoft Learn, NVD, and CISA as they stood at the time of writing. If a detail has changed since, correct us in the comments.