IT Partner enrolls your Windows Server 2016 machines in Extended Security Updates (ESU) through Azure Arc, so they keep receiving the security updates Microsoft rates Critical and Important after 12 January 2027 — the end of extended support per Microsoft's product lifecycle — without being upgraded or moved. ESU year 1 runs from that date into January 2028, and Microsoft offers up to three years, to January 2030. Windows Server 2016 ESU licenses can be configured in the Azure portal since 3 August 2026 and are billed from 13 January 2027; a license activated after that date is back-billed to it. In one week we establish each server's eligibility and licensing basis (Software Assurance or an equivalent server subscription), onboard or reuse the Azure Connected Machine agent, provision correctly sized ESU licenses in your own Azure subscription, link and activate them, verify enrollment on every machine, point Azure Update Manager at the estate, and leave you a cost model and a runbook for stopping the charge the day a server is migrated or retired. Pricing is an estimate at $35 per server plus a $1,450 base fee, confirmed in writing once the inventory is agreed; estates above about 100 servers are quoted per estate. Microsoft's ESU charge itself — metered per core and billed monthly by Microsoft to your Azure subscription — is yours and is not part of this fee. ESU for Windows Server 2012 and 2012 R2 ends on 13 October 2026; after that date those hosts need the exit plan in our Windows Server 2012 R2 Post-ESU Isolation and Exit Plan, not an enrollment.
Windows Server 2016 reaches the end of extended support on 12 January 2027 per Microsoft's product lifecycle. After that date Microsoft ships no security updates to it unless the machine is enrolled in Extended Security Updates — a paid, last-resort program that delivers only the updates Microsoft rates Critical and Important, for up to three years, with no new features, no non-security hotfixes and no design changes. Year 1 of Windows Server 2016 ESU runs from 12 January 2027 into January 2028, and the three years run to January 2030. Most estates we see carry a tail of servers that cannot be upgraded or migrated before the date: an application vendor that certifies nothing newer, a line-of-business box nobody dares touch, a domain controller pair that has been 'next quarter' for three quarters running. ESU is the honest bridge for that tail, and this engagement is the mechanics of getting onto it correctly in year 1 — with the arithmetic done before a license exists. There are two ways to buy Windows Server 2016 ESU. The classic route is through Volume Licensing, in yearly increments, with Multiple Activation Keys you deploy yourself. The route this service uses is ESU enabled by Azure Arc — Microsoft calls it pay-as-you-go: the Azure Connected Machine agent (version 1.62 or later for Windows Server 2016) connects each server outbound to Azure, you create an ESU license resource in your own Azure subscription — Standard or Datacenter and a core count, with the physical-or-virtual core type chosen for each server when it is enabled — and link it to the machines. Delivery is keyless: no product keys to obtain or activate. The security updates themselves still arrive through whatever patching channel you run — Azure Update Manager, WSUS, Microsoft Update or Configuration Manager — and for servers enrolled this way Microsoft provides Azure Update Manager, Change Tracking and Inventory, and Azure Policy guest configuration at no additional Azure charge. Billing is monthly and metered per core, it counts toward a Microsoft Azure Consumption Commitment if you have one, and it stops within days when you deactivate a license — which is what makes Arc the right channel for an estate that is actively shrinking through migration and upgrades. Microsoft's documentation describes a switch from key-based ESU into Arc for Windows Server 2012 R2 between years; for Windows Server 2016 it describes no such transition at the time of writing, so plan on choosing the channel once. The rules are where estates overspend or fall out of compliance, and encoding them is most of the value here. You must attest to Software Assurance or an equivalent server subscription for every on-premises or hosted server you enroll — SPLA-licensed hosting does not qualify for Windows Server 2016 ESU. Physical-core licenses carry a 16-core minimum per machine; virtual-core licenses an 8-core minimum per VM, and they cannot be used on physical servers. A Standard physical-core license covers up to two VMs on the host, a Datacenter license covers every VM on it, and 'Datacenter virtual cores' is not a valid combination at all — so a 16-node VMware cluster with forty-odd Windows Server 2016 VMs prices very differently as Datacenter physical cores than as Standard virtual cores, and the arithmetic has to be done before the license exists, because edition and core type cannot be changed afterwards. Billing starts when a license is activated, not when it is linked; licenses provisioned after the end-of-support date are back-billed to that date in a one-time charge that Microsoft says is never waived; deactivating and reactivating bills the gap; adding cores back-bills them too. Where a server runs changes the answer as well: from 1 April 2026 Microsoft applies the same ESU list price regardless of deployment location — Azure, on-premises or another cloud — and regardless of purchasing channel, for ESU offerings released on or after that date, Windows Server 2016 included (Microsoft's pricing-consistency notice of 27 March 2026). The older rule, ESU at no additional charge on top of an Azure VM's cost, continues for Windows Server 2012 R2 in Azure, Azure VMware Solution and Azure Local only to that program's end on 13 October 2026. Microsoft's Arc documentation at the time of writing still names Azure VMware Solution and Azure Local VMs as entitled without an Arc enrollment, while its Azure Local documentation places Windows Server 2016 under the new pricing and enrolls those VMs through Arc like any other; where Microsoft's documents differ we print the safer reading — budget for the charge — and confirm the current rule for your platform at kickoff. Every one of those rules becomes a line in the disposition list and the cost model you sign before we activate anything. What it costs to run the numbers. Microsoft's ESU charge is per core: through Arc, a monthly meter on your Azure subscription at the Standard or Datacenter rate, with the 16-core physical and 8-core virtual minimums; through Volume Licensing, an annual key priced as a share of the current license price that rises in each of the three years. Microsoft publishes the rates and revises them, so we print no dollar figure here. Our ESU cost calculator does the arithmetic for your core count — the Volume Licensing path from the current Windows Server 2025 list prices on this site, the Arc path from the per-core monthly rate you enter from Microsoft's current pricing — per year and in total, next to the upgrade and Azure paths. Run it before the call; it is the model we start from on day one. The enrollment work itself is $35 per server plus a $1,450 base fee, an estimate confirmed in writing, and the exit it recommends for each server is either the Windows Server 2016 to 2025 upgrade, a move to Azure, or retirement. This is a one-week enrollment engagement, deliberately narrow. It does not run your monthly patching afterwards, it does not upgrade or migrate the servers, and it does not include Microsoft's ESU charges — those are metered by Microsoft to your Azure subscription and belong to you. If the servers are not in Azure Arc yet, the enrollment includes the agent rollout for the ESU population; for the fuller Arc estate — tagging, policy baselines, Defender for Cloud — our Azure Arc Hybrid Server Management implementation is the broader project, and the two chain cleanly. If you have not yet decided which servers upgrade, which migrate and which bridge on ESU, the Windows Server 2016 End of Support Assessment and Roadmap makes that decision first and hands this engagement a settled list, and the Server Refresh, ESU or Azure decision assessment builds the three-year cost comparison when a hardware or hosting renewal lands at the same time. Windows Server 2012 and 2012 R2 are a closing note here, not the subject: their ESU program ends on 13 October 2026, and after that date there are no security updates for those hosts through any channel, Azure included. Those machines need the Windows Server 2012 R2 Post-ESU Isolation and Exit Plan, not an enrollment.
Inventory the candidate estate from your CMDB, hypervisor and Active Directory; confirm edition, cores, virtualization and hosting location per server; establish the licensing basis per group; separate out servers Microsoft covers through another channel because of where they run — confirmed against Microsoft's current rule per platform — and servers that should upgrade or migrate instead. You approve the disposition list and the licensing model before anything is created.
Open the outbound path where needed, deploy or upgrade the Connected Machine agent across the ESU population with the mechanism that fits your estate, and reconcile Connected status against the inventory. The oldest and the most isolated machines go first, so surprises surface on day two rather than day five.
Create the ESU licenses in a deactivated state, present the cost model — monthly projection, any back-billing exposure, the servers excluded as covered elsewhere — and activate only on your written acknowledgment. Link licenses to servers with the correct core type per machine.
Verify ESU status on every server, resolve link failures, configure Azure Update Manager assessment and maintenance windows (or confirm your existing channel), and patch the pilot group inside its window.
Exercise the billing-stop procedure on a test resource, assign the optional Azure Policy audit and deny rules, walk your team through the runbook and the portal views, and deliver the closeout report with the per-server exit recommendation.
Extended Security Updates is Microsoft's paid program for Windows Server versions past the end of extended support: Critical and Important security updates only, for up to three years, no features or non-security fixes. You can buy it the classic way — through Volume Licensing in yearly increments, with Multiple Activation Keys you deploy — or as ESU enabled by Azure Arc, Microsoft's pay-as-you-go route, where the entitlement follows an Azure license resource linked to the Arc-connected server, keyless, billed monthly per core to your Azure subscription, and stopped within days when you deactivate it. Arc also gives you the enrollment inventory in the portal and Azure Update Manager, Change Tracking and Inventory, and Azure Policy guest configuration at no additional Azure charge for enrolled servers. For an estate that will shrink as you migrate and upgrade, monthly beats annual. Microsoft's documentation describes a switch from key-based ESU into Arc for Windows Server 2012 R2 but no such transition for Windows Server 2016 at the time of writing, so we help you pick once — and if annual through your Microsoft representative is genuinely right for you, we say so.
For Windows Server 2016: before 12 January 2027, the end of extended support per Microsoft's product lifecycle. Enrollment has been possible in the Azure portal since 3 August 2026, and Microsoft starts the charge on 13 January 2027 — a license activated before then is not billed until that date, and one activated after it is back-billed to 12 January 2027. For Windows Server 2012 and 2012 R2, ESU ends on 13 October 2026; after that date those hosts need an exit, not an enrollment, and the Windows Server 2012 R2 Post-ESU Isolation and Exit Plan is the service for it.
Yes. Microsoft keeps Arc enrollment open across the three ESU years; a Windows Server 2016 license activated after 12 January 2027 is back-billed to that date as a one-time charge, which Microsoft states is not waived, and it then bills monthly like any other. The server receives no security updates for the gap between the end of support and its enrollment, and because Windows Server 2016 updates are cumulative, the first patch cycle after enrollment installs the current month's update in one step. The cost model shows the back-billed line against your real enrollment date. Enrolling later is allowed; it is not cheaper, and the gap is yours.
Microsoft publishes the price, per core, and revises it, so we print no dollar figure on this page. Through Azure Arc it is a monthly meter on your Azure subscription at the Standard or Datacenter rate, with a 16-core minimum per physical machine or an 8-core minimum per virtual machine; through Volume Licensing it is an annual key priced as a share of the current license price that rises in each of the three years. Our ESU cost calculator does the arithmetic for your core count — the Volume Licensing path from the current Windows Server 2025 list prices on this site, the Arc path from the per-core monthly rate you enter from Microsoft's current pricing — per year and in total, next to the upgrade and Azure paths. The cost model you approve on day three carries the rate current at the time, per license, with any back-billing shown as the one-time line it will be; it counts toward a Microsoft Azure Consumption Commitment if you have one, and it is entirely separate from our $35-per-server plus $1,450 fee.
Not for what this engagement uses. Microsoft offers the Azure Arc control plane for servers — the Arc resource itself, management groups and tags, Azure Resource Graph search, Azure role-based access control, templates and extensions — at no extra cost, and for servers enrolled in ESU through Arc it provides Azure Update Manager, Change Tracking and Inventory, and Azure Policy guest configuration at no additional charge. What is charged: the ESU meter itself, per core per month; any Azure service you choose to attach to the server at that service's own price — Microsoft Defender for Servers, Log Analytics ingestion for Azure Monitor, Microsoft Sentinel; and your own network path, proxy or private link. So for an ESU estate, Arc pricing reduces to the ESU line plus whatever security tooling you decide to add, and the cost model lists both. Our article Azure Arc for the servers you are keeping walks through what Arc gives a server and which parts Microsoft charges for.
For on-premises and hosted servers, yes — Microsoft requires you to attest to Software Assurance or an equivalent server subscription when the ESU license is created, through programs such as an Enterprise Agreement, Server and Cloud Enrollment, or Open Value. Windows Server 2016 ESU is not available for SPLA-licensed servers. Servers running as Azure VMs need neither Software Assurance nor an ESU purchase to receive the updates. If your licensing position is uncertain, our Microsoft Volume Licensing advisory establishes it before you attest to anything.
Azure VMs sit outside the Arc enrollment — Arc is for machines that are not already Azure resources — but for Windows Server 2016 they no longer sit outside the bill. From 1 April 2026 Microsoft applies the same ESU list price regardless of deployment location for ESU offerings released on or after that date, Windows Server 2016 included; the older rule, ESU at no additional charge on top of the VM cost, continues for Windows Server 2012 R2 VMs in Azure, Azure VMware Solution and Azure Local only until that program ends on 13 October 2026. Microsoft's Arc documentation at the time of writing still names Azure VMware Solution and Azure Local VMs as entitled without an Arc enrollment, while its Azure Local documentation places Windows Server 2016 under the new pricing and routes those VMs through Arc like any other; the documents differ, so we budget for the charge and confirm the enablement path and the rule for your platform at kickoff. Whatever the channel, an Azure-hosted 2016 VM still needs a working update path — Azure Update Manager or Windows Update — and we confirm that in the disposition. Moving a 2016 server into Azure so that ESU costs nothing is advice from before April 2026.
Two valid ways, and the arithmetic decides. You can license the whole cluster with Datacenter physical cores — every physical core on every host — which covers unlimited VMs, or license each Windows Server 2016 VM with Standard virtual cores at the greater of eight or its actual vCPU count. When 2016 is a minority of what runs on the hosts, virtual cores are usually far cheaper; when the hosts are mostly 2016, Datacenter physical cores can win. Either way each VM is onboarded to Arc and linked to the license, and the model is worked out in writing before the license exists — because edition and core type cannot be changed afterwards, only cores added or removed.
Nothing, automatically — and that is the trap. Billing is tied to the activated license and its core count, not to whether a server still exists. When a server is migrated to Azure, upgraded or decommissioned, someone has to decrement the cores or deactivate the license; the reduced rate applies within about five days of the change. The runbook we leave you covers exactly that, with a monthly checklist, and the handover includes doing it once on a test resource so it is not theoretical.
Microsoft's rule that a license provisioned after the end-of-support date is charged, in a one-time line item, for the time elapsed since that date — for Windows Server 2016, back to 12 January 2027. Microsoft states there are no cases in which it is waived: deactivating a license and reactivating it bills the gap, deleting and recreating one does not escape it, adding cores back-bills the new cores, and moving a license to another region or tenant triggers it too. The cost model shows your exposure against your real enrollment date so the first invoice is not a surprise.
Arc provides the entitlement, keyless — it does not become your patch pipe. Once a server is linked to an activated license, the ESU-classified updates flow through whatever channel you already run: Azure Update Manager, WSUS, Microsoft Update, Configuration Manager, or a third-party tool. Azure Update Manager is provided at no additional Azure charge for servers enrolled in ESU through Arc, so it is the natural choice if you have no channel or want to retire one — retiring WSUS for the whole estate is our WSUS Replacement with Azure Update Manager project — and we configure it here for the ESU population with assessment, maintenance windows and a pilot group. If you keep WSUS or Configuration Manager, we confirm the security classifications reach these servers instead.
Anything other than Windows Server 2016 Standard or Datacenter — and Windows Server 2012 or 2012 R2 once its program ends on 13 October 2026; servers without Software Assurance or an equivalent server subscription, or licensed under SPLA; servers with no outbound path to Azure; and VDI workloads, where Microsoft recommends Multiple Activation Keys instead. Each of these is named in the disposition list with the alternative — classic key-based ESU, upgrade, migration or retirement — rather than discovered when a link fails.
Safer, not safe. ESU delivers only the updates Microsoft rates Critical and Important; lower-rated vulnerabilities are not fixed, there is no product support, and everything else on the machine — the application stack, the drivers, the configuration — is as old as it was. That is why the closeout gives every server an exit recommendation, and why it is worth a deliberate decision about Defender for Servers through Arc for the ones staying longest.
Upgrade where you can; bridge where you cannot. ESU buys Critical and Important updates only, for up to three years at a price that rises each year, and every enrolled server still has to leave eventually. Where a server's hardware and application vendor allow it, the Windows Server 2016 to 2025 Upgrade Service ends the dependency instead of renting time; when the answer differs by server group — a refresh quote, a hosting renewal and an ESU bill arriving together — the Server Refresh, ESU or Azure decision assessment builds the three-year cost comparison across refresh, renew, ESU, Azure and Azure Local before anyone enrolls. This engagement takes the servers that come out of that decision as 'bridge', and its closeout names the exit for each one. For the longer read on what stops on 12 January 2027 and the order to work in, see Windows Server 2016 end of support.
SQL Server ESU is a separate Microsoft program with its own enrollment, and SQL Server 2016 reached the end of extended support on 14 July 2026 per Microsoft's product lifecycle. Enrolling the operating system does nothing for the database engine. We flag every SQL Server instance the assessment finds and scope its enrollment through SQL Server 2016 ESU Enrollment through Azure Arc — or its move to Azure, which the SQL Server to Azure migration assessment evaluates — as its own piece of work rather than quietly folding it in.
Not inside this engagement — it is an enrollment, and we keep it that way so the price stays honest. The runbook and handover make your team self-sufficient: enrolling a new server, decrementing cores, reading compliance. If you would rather have the monthly cycle operated for you, that is the Managed ESU and Legacy Server Lifecycle service — its own terms, scoped explicitly rather than bundled as a retainer into a one-week project.
This engagement onboards only what ESU needs — the Windows Server 2016 population — and does the licensing, linking and update-channel work. The Azure Arc Hybrid Server Management implementation is the estate-wide project: every server, a tagging taxonomy, an Azure Policy baseline, Update Manager schedules across Windows and Linux, and optional Defender for Cloud. If you already have Arc, this service is a licensing and enrollment exercise on top of it; if you do not, it is a clean first step, and the agent rollout carries straight into the broader project.
An estimate of $35 per in-scope server plus a $1,450 base fee, confirmed as a written quote once the inventory is agreed on day one — and you pay after you approve delivery. The per-server fee covers every server we assess and disposition, whether it ends up enrolled, covered through another Microsoft channel, or routed elsewhere. Estates above about 100 servers are quoted per estate. Microsoft's ESU charges are metered to your Azure subscription and are never part of our fee; the ESU cost calculator shows that side before you talk to us.