Managed ESU and Legacy Server Lifecycle Service

A monthly service that keeps end-of-support Windows Server and SQL Server machines on an ESU bridge safe and accounted for until they are retired: a per-server ESU and patch compliance report from Azure Update Manager, Azure Arc agent and extension health checks, reconciliation of ESU licenses and SQL ESU meters so Microsoft's charges stop when a server goes, optional business-hours triage of Defender for Servers alerts, and a quarterly review of migration progress against the exit plan. It is $18 per server plus a $250 tenant fee per 30-day period, with no long-term contract, and Microsoft's ESU and Azure meters are billed to your own subscription outside this fee.

Windows Server 2016 and 2012 R2, and SQL Server 2016 instances, whether on-premises or in another cloud through Azure Arc or running as Azure VMs. Legacy means a version that has passed, or is about to pass, Microsoft's end of extended support and is being kept alive on Extended Security Updates: per Microsoft's product lifecycle, Windows Server 2012 R2 ESU ends 13 October 2026, Windows Server 2016 extended support ends 12 January 2027 with ESU through Arc running to January 2030, and SQL Server 2016 ESU runs to 17 July 2029. A current-version server with a broken patch process is a support problem, not a lifecycle one, and belongs in a different service.

Per server: the ESU and security updates Microsoft published that month, what installed, what is pending or failed, what is waiting on a reboot, the last Update Manager assessment time, Arc agent and extension health, and every exception with a named owner and reason — plus the ESU license reconciliation and, where enabled, the Defender alert summary. It is written for the person who has to attach it to an insurance renewal or hand it to an auditor, and it documents what was not fixed as honestly as what was, because that is what those readers respect. We do not promise any specific insurer's or auditor's verdict; those are their decisions.

ESU through Azure Arc is billed monthly by Microsoft per provisioned core and edition, and the licenses do not shrink themselves: Microsoft's guidance is explicit that adjusting them is the customer's responsibility. So the reconciliation compares provisioned cores to the servers that exist and finds licenses still billing for machines that were decommissioned, over-provisioned core counts, edition or core-type mismatches that cannot be fixed after creation, SQL ESU meters still running for instances that migrated, and Arc ESU licenses provisioned for Azure VMs that already receive ESU at no additional cost. Each finding becomes a decrement or deactivation you approve, executed in the cycle, with Microsoft's up-to-five-day post-deactivation billing tail noted so the next invoice is not a surprise.

Per Microsoft's product lifecycle, that is the end of the 2012 and 2012 R2 ESU program, and there is no fourth year to buy through any channel. Until then the service proves the ESU patches are landing; after it, there are no updates to prove, and any 2012 R2 server still in scope is carried for isolation and retirement tracking with a report line that says exactly that. The quarterly review treats it as a hard date, and a server whose exit slips past it needs containment work that is scoped separately — we say so in writing before the date, not after.

Windows Server 2016 extended support ends 12 January 2027 per Microsoft's product lifecycle, and Microsoft states that ESU enabled by Azure Arc bills from 13 January 2027 for up to three years. To use it, each server must be connected to Azure Arc and linked to an ESU license of the matching edition with Microsoft's core minimums, and Microsoft's provisioning guidance at the time of writing lists Software Assurance or an equivalent server subscription as a requirement for on-premises workloads. Licenses provisioned after the date carry back-billing to it. The enrollment itself is a one-time engagement; this service starts once the servers are enrolled — or beforehand, so the baseline and exit plan are in place before the billing clock starts.

Through SQL Server enabled by Azure Arc, Microsoft bills SQL ESU on an hourly per-core meter with its own minimums, available to licenses covered by Software Assurance, a SQL Server subscription, or pay-as-you-go through Arc, and running to 17 July 2029 per Microsoft's lifecycle. Subscribing after an ESU year starts triggers bill-back to the start of the year; terminating the subscription when an instance is migrated stops the meter. Each cycle we reconcile the running instances and their core counts against the meters, and the quarterly review carries the cost of any instance still in place at the next ESU year — the moment when moving it to a current SQL Server or to Azure SQL usually starts paying for itself.

No — both are one-time projects that finish before the monthly rhythm starts. Arc onboarding is the Azure Arc Hybrid Server Management Implementation, and ESU enrollment for Windows Server and SQL Server is scoped separately. Keeping them out of a per-server monthly fee is deliberate: an enrollment project has a defined end, and folding it into a subscription hides its cost. What this service does do is confirm every month that the enrollment is still intact — licenses linked, agents connected, extensions healthy.

Whether each server's Connected Machine agent is connected rather than disconnected or expired, whether the agent version is inside Microsoft's supported window, and whether the extensions the bridge depends on are provisioned and healthy: Azure Update Manager, the ESU license link, SQL Server enabled by Azure Arc where SQL is in scope, and Defender for Servers and monitoring agents where you run them. Faults we can fix from the Azure side are fixed in the cycle; faults on the server itself — broken WMI, a proxy change, a firewall rule — are escalated to their owner as a named exception, because a disconnected agent is a server nobody is patching.

Where you have Microsoft Defender for Servers enabled on the legacy estate through Defender for Cloud, we review the alerts it raises on those machines during business hours, classify them, give first-response guidance, and escalate to your incident process or MDR provider when an alert warrants it, with the month's summary in the report. It is included for in-scope servers when you turn the option on. It is not around-the-clock monitoring, containment, or forensics — that is Multi-Platform Managed Detection and Response, and the two are complementary: MDR watches for the attack, this service shrinks the number of unpatched legacy targets the attack needs.

Every legacy server carries a disposition — in-place upgrade to a current Windows Server or SQL Server release, migration to Azure, rebuild, or retirement — with an owner and a target date. The review measures what moved since last quarter, what slipped and why, the exposure against the hard Microsoft dates, and what each server still standing at the next ESU program year will cost, since Microsoft's ESU price rises each year. Its output is decisions: which migration or upgrade engagements to schedule next, which retirements to approve, and which dates to move honestly rather than silently. The projects themselves are separate, quoted work; the review is what keeps them from being postponed a quarter at a time.

Reading is read-only: Arc resources, Update Manager assessment and deployment data, ESU license resources, and Cost Management for the subscription that carries the meters. Acting needs two narrow change rights — Update Manager schedules and maintenance configurations, and the ESU license resources for the decrements and deactivations you approve. We request it through Azure Lighthouse or scoped role assignments you approve on the relevant subscriptions and resource groups, consistent with our published least-privilege access policy, and never standing Owner.

Microsoft provides ESU at no additional license cost for Windows Server and SQL Server running in Azure, which removes the billing problem but not the other three: the patches still have to land and be proven, the exit plan still has to move, and the auditor still asks. For Azure-VM estates the service delivers the patch proof, health, and quarterly review, and the reconciliation's job is simply to confirm no Arc ESU license was provisioned for a machine that never needed one. If the estate is small and the exit is weeks away, we will tell you the service is not worth starting.

Per in-scope server plus the tenant fee, invoiced per 30-day period, with the server count reconciled every cycle — so the fee falls as servers retire, and it stops when the last one is gone. Large estates are quoted per estate in writing. There is no long-term contract: stop any month, and all we ask is payment of previously approved invoices. Every report, the reconciliation ledger, and the exit plan stay yours.

Yes, as separate engagements, which is why this page does not price them: Windows Server migration to Azure, VMware to Azure, the SQL Server paths to Azure SQL Managed Instance or a current SQL Server on an Azure VM, and Azure Migrate discovery where the disposition is undecided. The quarterly review is where they get scheduled. Keeping the migration out of the monthly fee keeps the monthly fee honest, and keeps us from having an incentive to let the bridge last longer than it should.