Guide
Windows Server 2016 ESU: cost and eligibility
Published · 7 min read
Short answer
Windows Server 2016 Extended Security Updates (ESU) give up to three more years of Critical and Important security fixes after extended support ends on 12 January 2027, running through 2030. Through Azure Arc you can set them up from 3 August 2026 and billing starts on 13 January 2027. To buy them you need Software Assurance, or licences through a hosting provider's SPLA or a Server Subscription. Microsoft's published pay-as-you-go rate through Azure Arc is $0.007132 per core per hour for Standard (about $5.21 per core a month) and $0.041067 for Datacenter (about $29.98), effective 1 August 2026, with a minimum of 16 physical cores per server or 8 virtual cores per VM. ESU is a bridge for servers with a dated move plan, not a way to stay on 2016.
What ESU covers, and what it does not
Microsoft's lifecycle FAQ describes ESU as a last resort, paid option for running a product past the end of support, and a temporary bridge while you move to a supported platform. For Windows Server 2016, Microsoft's Azure Arc documentation says ESU provides Critical and Important security updates for up to three years, through 2030.
| Included | Not included |
|---|---|
| Security updates rated Critical and Important | New features |
| Standard and Datacenter editions | Non-security fixes you request |
| Up to three years, through 2030 | General technical support beyond the security updates |
ESU does not extend the product's lifecycle. Your software vendors may still stop supporting their applications on Windows Server 2016 after January 2027, whether or not the server gets ESU. Pegasus, for example, says its Opera 3 support ends when Microsoft extended support ends.
Who can buy it
Microsoft's Azure Arc documentation sets the rule for Windows Server 2016: to purchase ESU you need Software Assurance through a Volume Licensing programme (Enterprise Agreement, Enterprise Agreement Subscription, Server and Cloud Enrollment, Open Value and similar). If the servers are licensed through a hosting provider's SPLA or with a Server Subscription, Software Assurance is not required.
How it is delivered and billed
- 01
Connect the server to Azure Arc
Install the Azure Connected Machine agent, version 1.62 or later for Windows Server 2016. The server stays where it is; Arc only connects it to the Azure portal for management and billing.
- 02
Enrol from 3 August 2026
Microsoft says you can configure Windows Server 2016 ESU in the Azure portal from 3 August 2026, through the portal or Azure Policy.
- 03
Billing from 13 January 2027
Arc-enabled ESU is billed monthly through your Azure subscription from 13 January 2027, with no product keys to activate.
Microsoft also sells ESU through Volume Licensing for some products, and partners can cover SPLA-licensed servers. Which route applies depends on how your Windows Server licence was bought.
What it costs
Microsoft publishes the Azure Arc pay-as-you-go rates in its Azure Retail Prices API. For the meters "WS2016 Std 1C ESU" and "WS2016 DC 1C ESU", effective 1 August 2026 and checked on 21 October 2026:
| Edition | Per core per hour | Per core per month | Per core per month in GBP (API) |
|---|---|---|---|
| Standard | $0.007132 | about $5.21 | about £3.94 (£0.0054 an hour) |
| Datacenter | $0.041067 | about $29.98 | about £22.63 (£0.031 an hour) |
Microsoft's Arc licensing guidance sets minimums: licensing by physical cores needs at least 16 cores per machine, and licensing by virtual cores needs at least 8 virtual cores per virtual machine (Standard edition only). So the smallest bills are roughly $41.65 a month for one virtual machine (8 virtual cores, Standard) and $83.30 a month for one physical server (16 cores, Standard), before any discount or tax. A Standard licence covers up to two virtual machines on a host; Datacenter covers any number.
Microsoft's Azure Arc pricing page says the same list price applies wherever the server runs, including Azure, on-premises and other clouds, and however you buy it. The no-cost disaster recovery benefit and the Visual Studio dev/test benefit are not available for Windows Server 2016 ESU, according to the Arc licensing guidance.
Compare the quote with the alternative. Our Windows Server 2016 migration plan maps up to five servers to a destination for a fixed fee, and a Managed Windows Server has a fixed monthly price with licence, patching and backups included.
When ESU makes sense, and when it does not
| Situation | ESU? |
|---|---|
| An application that cannot move before January 2027, with a dated plan to move it | Yes, for the shortest term that covers the plan |
| A file server, print server or domain controller | Usually no: these move easily to a supported release |
| A server with an OEM licence and no Software Assurance | Not available through Volume Licensing |
| A server that also runs SQL Server 2016 | Not enough on its own: SQL Server 2016 support already ended on 14 July 2026 |
| No plan at all, just hoping to delay | No. Three years ends in 2030 regardless |
If you hold Cyber Essentials, check with your certification body how it treats a server covered by ESU; our Cyber Essentials guide explains the rule on unsupported software.
Sources
- Microsoft Learn: Prepare to deliver Extended Security Updates for Windows Server (Azure Arc) (opens in a new tab)
- Microsoft Learn: Lifecycle FAQ, Extended Security Updates (opens in a new tab)
- Microsoft Lifecycle: Windows Server 2016 (opens in a new tab)
- Microsoft Azure Retail Prices API: meters WS2016 Std 1C ESU and WS2016 DC 1C ESU (USD and GBP) (opens in a new tab)
- Microsoft Azure: Azure Arc pricing (opens in a new tab)
- Microsoft Learn: License provisioning guidelines for Extended Security Updates (Azure Arc) (opens in a new tab)
- Pegasus: Opera 3 Software Requirements Guide (June 2026), PDF (opens in a new tab)
Facts were checked against these sources on 21 October 2026. Vendor terms change; check the source before relying on a detail.