Server Refresh, ESU or Azure: Renewal Decision Assessment

Any Windows Server or SQL Server estate facing a dated decision. The dates, per Microsoft's product lifecycle: Windows Server 2012 R2's Extended Security Updates end on 13 October 2026; SQL Server 2016 left extended support on 14 July 2026 and is already in its ESU period; Windows Server 2016 leaves extended support on 12 January 2027. Windows Server 2019 and 2022 estates use this assessment too, usually because a hardware refresh or a hosting renewal forces the question early. Urgency is per group: the memo gives each group a last responsible date to start the alternative, which is earlier than most people assume once migration or upgrade lead times are counted.

Not for the 2016 generation. Microsoft changed the rule on 1 April 2026: ESU programs starting after that date — Windows Server 2016 and SQL Server 2016 included — are priced the same wherever the server runs, in Azure, on-premises or another cloud, and Microsoft's SQL Server documentation states plainly that SQL Server 2016 on Azure VMs is not eligible for free ESU. Free ESU on Azure, Azure VMware Solution and Azure Local continues only for the older programs: Windows Server 2012 R2 until 13 October 2026, and SQL Server 2014. Plenty of advice written before April 2026 still says otherwise; our model reflects the current rule and cites it, because a CFO who discovers the difference after the migration will not care whose article it was.

Per core, at a price Microsoft publishes and steps up each year of the program, with minimums that matter for small servers: a Windows Server ESU license covers at least 16 physical cores, or at least 8 virtual cores per VM, and a SQL Server ESU subscription meters at least four cores per instance. Windows Server ESU on-premises requires Software Assurance or an equivalent server subscription, and for Windows Server 2016 it is not offered through SPLA; SQL Server ESU can be bought monthly through Azure Arc without Software Assurance. Buy it through Volume Licensing and you pay in yearly increments; buy it through Azure Arc and it is a monthly meter you switch off per server as that server is migrated — but enrol after the end-of-support date and Microsoft back-bills to that date. This page quotes no dollar figures on purpose; the model uses Microsoft's price list on the delivery date and shows its source. If ESU is the verdict for a group, enrollment through Azure Arc is its own fixed-price engagement — Windows Server or SQL Server 2016 — and running the bridged estate for you until it is retired is the Managed ESU and Legacy Server Lifecycle Service.

It lets Windows Server and SQL Server licenses with active Software Assurance or a qualifying subscription pay a reduced rate in Azure — the compute-only rate for Windows VMs, and a base rate on Azure SQL vCores, where a SQL Server Enterprise core with Software Assurance converts to more than one vCore on the general-purpose tiers. Qualification is a documents question: licenses bought OEM with the server, or through SPLA, generally do not qualify; licenses under an Enterprise Agreement, Open Value with Software Assurance, or a CSP subscription generally do. Edition matters too — Standard licenses cannot run on-premises and in Azure at the same time beyond a one-time 180-day migration window; Datacenter licenses can. We establish the position from your agreement and license statements and state the rule per group, so the Azure column contains only savings you can actually claim.

Azure Local — formerly Azure Stack HCI — is Microsoft's hyperconverged platform on validated hardware you own, operated through Azure Arc, with a per-core host fee billed to your Azure subscription. It wins when workloads must stay on your floor — latency, data residency, a regulator, a hardware dongle — but you want Azure's operating model and a refresh is due anyway. The lever is Azure Hybrid Benefit: with Windows Server Datacenter licenses under active Software Assurance covering every physical core, Microsoft waives the host fee and the Windows Server guest subscription, which turns an expensive-looking column into a plausible one. Without that licensing, or with an estate small enough that a plain refresh is cheaper, it loses — and the matrix will show it losing. Designing and deploying it is a separate engagement.

Different question, different evidence. The Azure Migrate assessment puts an appliance in your environment for two weeks to measure utilization and map dependencies — it answers "what would this cost in Azure, and what has to move together". This assessment answers "which of five paths should each server group take over the next three years, and what does the CFO need to know" — and it costs the on-premises paths too, which Azure Migrate does not. They chain naturally: if your inventory is trustworthy, do this one now; if it is not, do Azure Migrate first and this one reads its output. The memo tells you which groups need tool discovery before anyone commits money.

That one makes Azure you already run cheaper — reservations, right-sizing, waste — from billing and utilization data. This one decides whether on-premises workloads should go to Azure at all, against refresh, renewal, ESU and Azure Local alternatives. If you already have a meaningful Azure footprint the two complement each other: the FinOps assessment optimizes the existing estate, this one stops you adding to it badly.

Any export that lists each server with operating system, SQL Server version and edition, core count, host and role: vCenter or Hyper-V exports, an RMM report, a CMDB extract, or the assessment workbook from Azure Migrate. We reconcile it against licensing and against what your people believe exists — the deltas are always instructive. If the inventory is untrusted, or utilization and dependencies are unknown for a group where the Azure number is close, the memo says so and recommends the Azure Migrate discovery for that group before commitment. We would rather write "needs measurement" than invent precision.

Sometimes. Microsoft runs partner-led funding and incentive programs for qualifying Azure migrations — the Azure Accelerate offerings, carried into Microsoft's current partner framework — and eligibility, scope and amounts are Microsoft's decision, change by fiscal year and are never guaranteed. We assess whether your estate plausibly fits the current programs and say what Microsoft would need to see; the recommendation memo states it as assessed, and the model never depends on it. Plans built on incentives that then lapse are how migrations stall halfway.

Then that is what the memo says, per group, with the numbers. Refresh genuinely wins for small, latency-bound or hardware-licensed estates; renewal genuinely wins when a bigger decision is already scheduled and the contract is fair. Both earn us nothing — nobody at IT Partner is paid on commission, and the assessment is a fixed fee precisely so the verdict does not have to pay for itself with a migration. What we will add is the ESU exposure the on-premises path inherits, because a three-year renewal on 2016-generation servers is also a three-year ESU bill, or three years unpatched.

No, but the clock is billing. SQL Server 2016 entered its ESU period on 14 July 2026; enrol now and Microsoft's terms back-bill to the start of the current ESU year, so waiting does not save money — it delays the invoice. The assessment models the honest options: ESU through Azure Arc as a monthly bridge while an upgrade or migration completes; an in-place upgrade to a supported SQL Server release; or a move to Azure SQL, where the ESU charge stops automatically on arrival. Which one wins depends on the application vendor's certification, your Software Assurance position and the shape of the database estate — all of which the week establishes.

That group gets its own line and usually its own urgency, because its ESU ends on 13 October 2026 — after that there are no security updates at any price. Domain controllers are rarely a migrate-to-Azure decision; they are an upgrade decision — promote new controllers on a supported version, demote the old — sometimes paired with a longer-term move toward Microsoft Entra ID. The memo states the exposure and the next step; hardening what remains is the separate Active Directory Security Assessment, any 2012 R2 server that must outlive its ESU belongs in the Windows Server 2012 R2 Post-ESU Isolation and Exit Plan, and the identity transition is its own engagement.

Because the evidence already exists — quotes, contracts, licensing, inventory — and the work is reconciling and modeling it, not measuring anything new. One week is realistic when the intake paperwork arrives on day one and your IT owner and finance contact can each give us a session. If the inventory turns out to need tool discovery, that is a two-week Azure Migrate engagement in front of this one, and we say so at intake rather than stretching the week silently.

You decide, from evidence. Most clients convert the recommended path into fixed written quotes per group — migration, Azure Arc onboarding for ESU, an upgrade, a landing zone — and sequence them by the last-responsible dates; some do the refresh with their hardware vendor and bring us only the groups that move; some conclude that renewal plus a dated exit is right and revisit in a year. The workbook, matrix and memo are yours, built on Microsoft's published rules with sources shown, and there is nothing proprietary in them. We would like the migration work and we price it in fixed per-workload quotes so comparison is easy — but an assessment that only makes sense if you hire its author is an advertisement.