Windows Server 2016 ESU Through Azure Arc: A Practical Guide

Windows Server 2016 reaches end of support on January 12, 2027. For servers that can't be upgraded or moved by then, Microsoft offers Extended Security Updates (ESU) through Azure Arc. This guide walks through how Windows Server 2016 ESU through Azure Arc works: who's eligible, how to size and provision licenses, how billing runs, and the steps to get enrolled. Each section links to the Microsoft Learn pages it draws on.

If you're still working out which servers need ESU at all, start with our post on Windows Server 2016 end of support, which covers the dates and the upgrade paths.

What ESU Through Azure Arc Is

Azure Arc-enabled servers let you enroll existing Windows Server machines in ESU after they reach end of support, including machines in non-Azure environments. For Windows Server 2016, ESU provides Critical and Important security updates for up to three years, through 2030. It's a monthly, pay-as-you-go subscription billed through Azure, so you can migrate mid-year rather than commit to a full year up front.

ESU keeps a server patched while you plan its exit. It doesn't add features or non-security fixes.

Who's Eligible

• Supported editions. Windows Server 2016 Standard and Datacenter editions are supported.
• Agent version. Each server needs the Azure Connected Machine agent version 1.62 or higher.
• Licensing. You must attest to Software Assurance or an equivalent server subscription. For Windows Server 2016 you can also attest through SPLA; servers licensed through SPLA or a server subscription don't need Software Assurance to purchase ESUs.
• Not for AVS or Azure Local. Azure VMware Solution machines and VMs on Azure Local are eligible for free ESUs and shouldn't enroll through Azure Arc.

Sizing: Physical vs. Virtual Cores

When you provision ESU licenses, you choose physical or virtual core licensing, and Standard or Datacenter. You also attest to the number of cores, broken down into 2-core and 16-core packs. Microsoft's guidance comes down to a few rules:

• Physical cores: a minimum of 16 physical cores per machine. Most organizations match the edition to their original Windows Server licensing.
• Standard vs. Datacenter: Standard can be applied to up to two VMs, while Datacenter has no limit. If a host carries many VMs, Datacenter may make more sense.
• Virtual cores: a minimum of eight virtual cores per VM. Microsoft suggests this model for VMs on third-party hosts or clouds, or where the OS was licensed on a virtualization basis.
• Virtual core limits: you can't use virtual core licensing on physical servers, and virtual core licenses should always use the Standard edition, even if the OS is Datacenter.
• No free DR or dev/test cover for 2016. The no-cost disaster recovery benefit and the Visual Studio dev/test benefit aren't available for Windows Server 2016 ESUs. DR and non-production servers need paid cores.

Provisioning and Linking Licenses

ESU licenses are created as Azure resources and then linked to Arc-enabled servers. For Windows Server 2016, you set the SKU and number of cores when you create the license, then choose physical or virtual cores when you enable ESUs on your machines. You can provision a license in a deactivated state so it doesn't start billing yet, and you can change its core count later.

Each license covers up to 10,000 cores, and a resource group can hold up to 800 licenses. Once servers are linked, you can use the patching tool you already have. Microsoft lists Update Manager, WSUS, Microsoft Update, Configuration Manager, or a third-party tool.

Keyless Delivery

With Arc, enrollment doesn't require acquiring or activating keys. Linking a server to an active license is what entitles it to updates. To check a server, run azcmagent show and confirm the Extended Security Updates status is Active.

How Billing Works

• Start date. Billing for Windows Server 2016 ESUs enabled by Azure Arc begins January 13, 2027. Configuration in the portal opened on August 3, 2026.
• Back-billing. Licenses provisioned after January 12, 2027 are back-billed to that date, and adding cores later is back-billed the same way. Enrolling late doesn't avoid the cost. Back-billing appears as a separate invoice line, and a discount on your recurring ESU charge might not apply to it, so check that it does.
• What drives cost. Cores provisioned, license edition, and any eligible discounts. Billing is monthly.
• Reductions aren't instant. Decreasing, deactivating or deleting a license keeps charges running for up to five more calendar days, and billing doesn't shrink on its own as servers are upgraded. You need to adjust the licenses yourself.
• Deactivating doesn't dodge charges. If you deactivate a license and reactivate it later, you're billed for the time it was deactivated.

For pricing on your agreement, check with your licensing partner.

A Short Checklist

1. List every Windows Server 2016 machine with its edition, physical or virtual status, core count and host.
2. Exclude AVS and Azure Local VMs. Microsoft lists them as eligible for free ESUs, so they shouldn't enroll through Arc.
3. Confirm licensing: Software Assurance, a server subscription, or SPLA.
4. Onboard to Azure Arc with agent 1.62 or higher. Microsoft publishes a reduced subset of endpoints for servers that use Arc only for Windows Server 2016 ESUs.
5. Choose physical or virtual core licensing per host or VM, and Standard or Datacenter.
6. Create the licenses, deactivated if you aren't ready to bill.
7. Link servers and verify with azcmagent show.
8. Give each server an exit date, and reduce license cores as servers move.

Done early, most of this is inventory and paperwork. The servers that get missed are the ones that cause trouble in January.

Book a Windows Server review. We can help you size ESU correctly and plan the upgrades that end it.