Getting a 20-Server Estate off Windows Server 2016: Upgrade in Place, Move to Azure, or Buy ESU for a Year, with the Cost Table

Upgrade in place keeps hardware and applications where they are and triggers Windows Server 2025 licenses and, if the CALs are 2016-era, a CAL refresh. Azure trades the hardware for monthly consumption that only discovery can size. ESU for a year buys security updates only and leaves every server where it was, with the same decision due in January 2028. Most estates mix them: upgrade what stays, move what fits Azure, enroll in ESU only what cannot make the date.

The worked estate: fourteen virtual servers on three 16-core Hyper-V hosts licensed with Windows Server 2016 Standard (five, five and four VMs per host), four 16-core physical servers, two servers whose vendors have not certified anything newer than 2016, 300 users with 2016-era CALs, no Software Assurance. Azure compute and storage are not priced; every Microsoft charge is billed by Microsoft to you.

The Windows Server calculator reprices the license lines for your cores and editions; the ESU calculator reprices the ESU lines for your channel and years.

Upgrade in place covers member servers and Hyper-V hosts. Microsoft lists Windows Server 2016 to 2025 as a supported in-place upgrade from installation media; since Windows Server 2025, nonclustered systems can move up to four versions in one step, and the Windows Update route is offered only to 2019 and 2022.

The three hosts are a failover cluster, and a cluster upgrades one version at a time through Cluster OS Rolling Upgrade, with the VMs live-migrated around the work: three hops from 2016, or a new Windows Server 2025 cluster built alongside. The Hyper-V Failover Cluster Upgrade to Windows Server 2025 chooses after validation, $1,250 per host plus a $2,950 tenant fee, three weeks.

Domain controllers are replaced, not upgraded: Microsoft's guidance is to promote new Windows Server 2025 domain controllers and demote the old ones, so the table prices them as $900 role transfers through the Domain Services and Active Directory Roles Migration; the order of operations is in replacing Windows Server 2016 domain controllers with Windows Server 2025.

The licensing it triggers: without Software Assurance there is no upgrade right, so every host and physical server needs Windows Server 2025 licenses at Microsoft's minimum of 16 core licenses per server, Standard covering two VMs per licensed host. CALs are needed for every user or device and must be the same version as or newer than the server they reach (Microsoft's Windows Server 2025 licensing guidance: 2025 CALs permit access to Windows Server 2025 and prior versions), so 2016-era CALs without Software Assurance become $50 per user; licensing a domain controller refresh has the rule. Timeline: domain controllers in November 2026, member servers through December 2026 under the four-week Windows Server 2016 to 2025 Upgrade Service, the cluster in the same window.

Not all twenty fit. The three file servers become Azure Files shares with identity-based access, plus an Azure File Sync cache if the office needs one. Application servers without a local dependency move as Azure VMs as they are, with Azure Hybrid Benefit taking the Windows price out of the VM rate where the licenses carry active Software Assurance or are qualifying subscription licenses, at least eight core licenses per VM and only for the license term. SQL Server goes to a managed option, Azure SQL Managed Instance or SQL Server on an Azure VM. What stays: the two uncertified servers, the hardware-key server, the two plant-network servers and one domain controller.

What changes the number: a one- or three-year reservation for servers that run all day, Azure Hybrid Benefit, data leaving Azure, and backup retention. Users reaching Windows Server in Azure do not need base Windows Server CALs, so the CAL refresh leaves this column; Azure Hybrid Benefit explained covers what qualifies.

The real figure comes from discovery: Azure Migrate collects two weeks of performance data, sizes each server on observed utilization and marks it ready, conditionally ready or not ready. The Azure Migrate Datacenter Discovery and Assessment, $1,950 over two weeks, hands the wave plan to the Hyper-V to Azure Virtual Machine Migration, from $4,950; the migration estimator gives a first pass, and moving the last on-premises servers to Azure walks the path for a three-server rack.

ESU buys one thing: the security updates Microsoft rates Critical and Important, for up to three years after 12 January 2027. Nothing else: no new features, no non-security fixes, no technical support beyond the original lifecycle; at the time of writing Microsoft's lifecycle FAQ limits help under an active support plan to deploying ESU and the regressions it causes. Eligibility is Software Assurance, a Server Subscription or SPLA licensing.

Two channels, and the choice is permanent: moving a 2016 ESU from volume licensing to Azure Arc is not supported. Through Azure Arc the license is per core, billed monthly to your Azure subscription at the rate on the Azure Arc pricing page, which is not in our price list; the portal has accepted 2016 licenses since 3 August 2026, billing starts 13 January 2027, and a license provisioned later is back-billed to 12 January 2027 with no exceptions. Through the annual channel the ESU is a yearly key priced as a share of the current license: on the October 2026 price list the Standard year-one pack is $124 per two cores against $147 for the Windows Server 2025 Standard pack, roughly five-sixths, so a 16-core Standard server is $992 for the year; Datacenter is $720 per two cores, $5,760 for a 16-core host.

ESU is the right call when the date belongs to a vendor, a datacenter exit is already scheduled for after January 2027, or a migration is in flight and a few servers will miss the window. It is a trap as a plan that never starts: the table's ESU column reaches January 2028 with $16,143 spent and nothing moved. Windows Server ESU Enrollment through Azure Arc enrolls a list in one week, $35 per server plus a $1,450 tenant fee.

This is the first table once each group gets the path it fits, every date set back from 12 January 2027.

Two rules: the ESU channel chosen in December 2026 is the channel those two servers keep, and any server that moves after 12 January 2027 needs ESU for the gap, back-billed from 13 January 2027, the safety valve the dates are set to avoid.

The table prices licenses and our fixed fees. It does not price the following. Your people's hours: application owners running month-end on a test migration, the change board, the overnight windows. Application testing: vendor certification for Windows Server 2025, and the 2025 defaults, SMB signing required and NTLMv1 removed among them, that stop older NAS devices, scan-to-folder printers and Linux hosts authenticating until reconfigured. The backup and recovery rebuild, with a restore test on both sides before old hardware is powered off. Monitoring, including Log Analytics ingestion as a Microsoft meter. The firewall: outbound HTTPS to the Arc endpoints and a site-to-site VPN to Azure. The CAL refresh, $15,000 at list for 300 users and in a larger estate often more than the services fee. SQL Server 2016 where it still runs, out of extended support since 14 July 2026 with its own ESU to 17 July 2029. And the one server nobody can touch, which needs its own decision between ESU through Arc, a rebuild on Windows 10 IoT Enterprise LTSC where the vendor supports it, $295 on the October 2026 price list, and isolation with no inbound access; the one server you cannot replace is the decision table for it.

A hardware manufacturer with six sites on three continents runs one forest and one domain on about ten Windows Server 2016 domain controllers, with Entra Connect on one of them. The first answer is that domain controllers are not an upgrade-in-place line: each is replaced by a new Windows Server 2025 domain controller, demoted, and its IP address and DNS registration moved onto the replacement. Two per site turns twelve into fourteen once two new sites are added, so the licensing line is twelve to fourteen Windows Server 2025 licenses at the 16-core minimum plus a CAL refresh for every user or device if the 2016-era CALs carry no Software Assurance, which can cost more than the services.

The year-end target becomes two phases: Phase 1 replaces the ten 2016 domain controllers before 12 January 2027, starting with adprep against the schema master as the first gated production change and a compatibility-testing stage for the equipment the Windows Server 2025 defaults are expected to break; Phase 2 adds the new sites and redesigns the site links in the first quarter of 2027. ESU is priced per domain controller as a paid safety valve, through Arc and back-billed from 13 January 2027; it is not the plan. That is the shape of the Multi-Site Domain Controller Migration to Windows Server 2025, from $12,500.

A medical practice of about 200 users being acquired by a hospital group, with a possession date about four weeks out and a checklist row requiring central management of all servers, mixes rebuild and Arc, not Azure: about a dozen servers are rebuilt on Windows Server 2022 and connected to Azure Arc as each reaches a supported OS, with Azure Update Manager on after-hours windows and one-year Windows Server subscription licenses on the servers that retire after the conversion, since the acquirer will retire the tenant. The one legacy system, a digital-signage server on a Windows Server 2016 VM the vendor will not move, stays supported on a Windows 10 IoT Enterprise LTSC license instead of ESU.

What does it cost to get a 20-server estate off Windows Server 2016: upgrade in place, Azure, or ESU for a year?

For the worked estate at October 2026 list prices and our fixed fees: upgrade in place $38,716 in the first year, $53,716 with a CAL refresh; Azure from $10,404 plus Azure consumption; ESU for a year $16,143 with the decision due again in January 2028.

ESU vs migration: which is cheaper?

ESU is the smaller first-year figure and the only path that solves nothing: year two is a second purchase and every server is a year older. Compare per server group over three years.

Can we mix the three paths?

Yes, and most estates do: upgrade what stays, move what fits Azure, enroll only the stragglers. Two constraints: a 2016 ESU bought through volume licensing cannot move to Azure Arc later, and Azure Hybrid Benefit needs Software Assurance or subscription licenses.

What does the number leave out?

People hours, application testing, the backup and monitoring rebuild, the firewall, the CAL refresh, Azure consumption, SQL Server and the one server nobody can touch.

If we will not finish before 12 January 2027, what does Windows Server 2016 ESU cost and how fast can we enroll?

Through the annual channel a 16-core Standard server is $992 for year one; through Azure Arc it is the per-core monthly rate on the Azure Arc pricing page, billed from 13 January 2027 and back-billed to 12 January 2027. Enrollment through Arc takes one week at $35 per server plus $1,450.