Windows Server 2016 ESU: After January 12, 2027, Through 2030
Yes, there is an ESU for Windows Server 2016: Microsoft's Extended Security Updates provide Critical and Important security updates for up to three years after extended support ends on January 12, 2027, through 2030. Microsoft announced the program on its Windows Server blog on February 25, 2026, and the working detail is on Microsoft Learn. ESU is a paid add-on enabled through Azure Arc. It covers the Standard and Datacenter editions, and buying it requires Software Assurance through a Volume Licensing program or an equivalent Server Subscription.
This page covers the ESU program only: what it delivers, who qualifies, how it is enabled, and what Microsoft has not yet said. For the release's own dates and the upgrade targets, see our Windows Server 2016 end of life guide.
The dates, in one table
| Milestone | Date | Source |
|---|---|---|
| Release | October 15, 2016 | Microsoft product lifecycle page |
| End of mainstream support | January 11, 2022 | Microsoft product lifecycle page |
| End of extended support (end of life) | January 12, 2027 | Microsoft product lifecycle page |
| ESU announced | February 25, 2026 | Windows Server blog |
| ESU can be configured in the Azure portal | August 3, 2026 | Microsoft Learn, Azure Arc ESU page |
| Billing begins for ESUs enabled by Azure Arc | January 13, 2027 | Microsoft Learn, Azure Arc ESU page |
| ESU coverage | Up to three years, through 2030 | Microsoft Learn, Azure Arc ESU page |
What ESU delivers, and what it does not
Microsoft Learn is specific. Extended Security Updates for Windows Server 2016 provide security updates rated Critical and Important. They do not include new features, customer-requested non-security hotfixes, or design change requests. ESU keeps a server patched against the serious vulnerabilities; it does not return the server to mainstream or extended support, and a functional bug found during the ESU period stays a bug.
Who qualifies
- Editions: Microsoft Learn states that Windows Server 2016 Extended Security Updates support the Standard and Datacenter editions. The lifecycle page for the release also lists Essentials and MultiPoint Premium; the ESU page does not name those two.
- Licensing: to purchase ESUs you must have Software Assurance through a Volume Licensing program, such as an Enterprise Agreement, Enterprise Agreement Subscription, Enrollment for Education Solutions, Server and Cloud Enrollment or a Microsoft Open Value program, or an equivalent Server Subscription. Microsoft adds that Software Assurance is required for on-premises workloads.
- Hosting providers: the Services Provider License Agreement (SPLA) is not available for Windows Server 2016 ESUs. That is a change from the Windows Server 2012 program, where Microsoft's page allows SPLA-licensed machines to purchase.
How it is enabled: Azure Arc
Microsoft's announcement says Extended Security Updates for Windows Server 2016 are delivered "through Azure Arc", with the updates made available through the Azure portal. The steps on Microsoft Learn:
- Connect the server to Azure Arc by installing the Azure Connected Machine agent. For Windows Server 2016 ESUs, Microsoft specifies agent version 1.62 or higher.
- Enroll it through the Azure portal or by using Azure Policy. Configuration in the portal opened on August 3, 2026.
- Pay through Azure. Microsoft describes ESUs enabled by Azure Arc as a pay-as-you-go monthly subscription, billed through Azure, which can draw down an existing Microsoft Azure Consumption Commitment. Billing begins January 13, 2027.
Three conditions from the same page are easy to miss. Azure VMware Solution machines and virtual machines on Azure Local are eligible for free ESUs and should not enroll through Azure Arc. Virtual machines running on Virtual Desktop Infrastructure should not receive ESUs through Azure Arc; Microsoft directs those to Multiple Activation Keys. And Azure Arc-enabled servers used for these ESUs are not available in Microsoft Azure operated by 21Vianet regions.
Price: not on Microsoft's pages
How this compares with the Windows Server 2012 program
The closest precedent is the ESU program for Windows Server 2012 and 2012 R2. It also ran for three years after the end of extended support, and Microsoft publishes its end date: October 13, 2026. Microsoft's warning on that program applies to this one as well: once the ESU period ends, the updates stop. Our Windows Server 2012 ESU guide covers what the end of an ESU program looks like for the servers still on it.
What to do with this
- Decide per server, not per estate. A server that can move to a supported release before January 12, 2027 needs no ESU. List only the ones held back by an application, a vendor certification or a change freeze.
- Check eligibility first. Standard or Datacenter edition, and Software Assurance or an equivalent Server Subscription. A server without either cannot buy ESU, and that changes its plan.
- Do the Azure Arc onboarding ahead of the deadline. The agent install, the network endpoints and the enrollment are the slow parts, and Microsoft opened configuration well before billing begins.
- Write the exit date down at enrollment. The program runs for up to three years. Every enrolled server needs a retirement or upgrade date inside that window.
Frequently Asked Questions
Is there an ESU for Windows Server 2016?
Yes. Microsoft announced Extended Security Updates for Windows Server 2016 on its Windows Server blog on February 25, 2026. Microsoft Learn describes them as Critical and Important security updates for up to three years after the end of extended support on January 12, 2027, through 2030.
When does Windows Server 2016 ESU end?
Microsoft's pages give the ESU period as up to three years, through 2030, and do not print the final calendar day. Coverage follows the end of extended support on January 12, 2027. Plan on 2030 as the outer limit and confirm the exact day with Microsoft before you depend on it.
How do I get ESU for Windows Server 2016?
Through Azure Arc. Microsoft Learn says to connect each server with the Azure Connected Machine agent, version 1.62 or higher, then enroll it in the Azure portal or with Azure Policy. To purchase ESUs you need Software Assurance through a Volume Licensing program or an equivalent Server Subscription. The Services Provider License Agreement is not available for Windows Server 2016 ESUs.
Which editions of Windows Server 2016 qualify for ESU?
Microsoft Learn states that Windows Server 2016 Extended Security Updates support the Standard and Datacenter editions. Microsoft's lifecycle page for the release also lists Essentials and MultiPoint Premium, and the ESU page does not name those two.
How much does Windows Server 2016 ESU cost?
The Microsoft pages we read do not print a price. They describe ESUs enabled by Azure Arc as a pay-as-you-go monthly subscription billed through Azure, with billing beginning January 13, 2027. Azure VMware Solution machines and virtual machines on Azure Local are eligible for free ESUs.
Related
- Windows Server 2016 End of Life — the release's dates and the three upgrade targets
- Windows Server 2016 — the live status page with its EOL Risk Score
- Windows Server · Windows Server End of Life — every version's dates
- Windows Server 2012 ESU — the program that ends first
- How we verify our dates — the rules every number on this site is held to