Extended Security Updates represent one of the starkest examples of how Azure positioning shapes Microsoft's licensing economics. The same security patches that cost $3,500-$7,500 per server per year on-premises are provided completely free when workloads run in Azure or are enrolled in Azure Arc. For organisations managing hundreds of legacy Windows Server and SQL Server instances past their end-of-support dates, this differential is worth $500,000-$5,000,000 annually — and Microsoft uses it explicitly as a migration incentive. Understanding ESU mechanics, cost structures, and the Arc-enabled free ESU option is essential for every enterprise with legacy server estates.
Independent Advisory. Zero Vendor Bias.
500+ Microsoft EA engagements. $2.1B in managed spend. 32% average cost reduction. We help enterprises model ESU costs, Arc deployment, and migration economics.
View Advisory Services →ESU Programme Overview: Active and Upcoming
| Product | End of Extended Support | ESU Year 1 | ESU Year 2 | ESU Year 3 | Free in Azure | Free via Arc |
|---|---|---|---|---|---|---|
| Windows Server 2012/R2 | Oct 2023 | Oct 2023–Oct 2024 | Oct 2024–Oct 2025 | Oct 2025–Oct 2026 | ✓ Yes | ✓ Yes |
| SQL Server 2012 | Jul 2022 | Jul 2022–Jul 2023 | Jul 2023–Jul 2024 | Jul 2024–Jul 2025 | ✓ Yes | ✓ Yes (ended) |
| SQL Server 2014 | Jul 2024 | Jul 2024–Jul 2025 | Jul 2025–Jul 2026 | Jul 2026–Jul 2027 | ✓ Yes | ✓ Yes |
| Windows Server 2016 | Jan 2027 | Jan 2027–Jan 2028 | Jan 2028–Jan 2029 | Jan 2029–Jan 2030 | Expected | Expected |
| SQL Server 2016 | Jul 2026 | Jul 2026–Jul 2027 | Jul 2027–Jul 2028 | Jul 2028–Jul 2029 | Expected | Expected |
| Windows Server 2019 | Jan 2029 | Jan 2029+ | — | — | Expected | Expected |
The pipeline is significant. Windows Server 2016 end-of-support (January 2027) is less than a year away. Organisations that have not yet migrated WS2016 workloads face an impending ESU decision — start modelling now, not at the deadline.
On-Premises ESU Cost Structure
On-premises ESU costs follow a tiered pricing model designed to increase the migration incentive over time:
| ESU Year | Cost as % of Original Licence | WS2012 Datacenter (16-core) Annual ESU | SQL Server 2012 Enterprise (2-core) Annual ESU |
|---|---|---|---|
| Year 1 (post end-of-support) | 75% of licence price | ~$3,500 | ~$7,500 |
| Year 2 | 100% of licence price | ~$4,700 | ~$10,000 |
| Year 3 | 125% of licence price | ~$5,900 | ~$12,500 |
| 3-Year Total (per server/instance) | 300% of licence price | ~$14,100 | ~$30,000 |
Approximate figures based on 2023-2025 pricing; actual costs depend on existing licence agreements and SA status. SQL Server pricing per 2-core pack.
For a typical enterprise estate of 200 Windows Server 2012/R2 physical servers: 3-year on-premises ESU cost = $200 × $14,100 = $2,820,000. The same estate enrolled in Azure Arc for free ESU: implementation cost of $40,000-$80,000 (Arc agent deployment and management). Net saving: $2,740,000-$2,780,000. This is the Arc ESU business case in one calculation.
Free ESU via Azure Arc: The Optimal Path for Staying On-Premises
For workloads that genuinely cannot migrate to Azure (due to latency requirements, data sovereignty, application compatibility, or capital constraints), Arc-enabled free ESU provides security patch coverage without the on-premises licence cost.
Arc ESU Enrolment Process
The process to enrol existing servers for Arc-enabled free ESU:
- Azure subscription provisioning — any subscription tier works; the Arc management plane is free
- Arc agent deployment — install the Azure Connected Machine Agent on each legacy server (scripted deployment via Group Policy or DSC for scale)
- Server registration in Azure Arc — each server appears as an Arc-enabled resource in the Azure portal
- ESU licence creation — create a Windows Server ESU licence object in Azure (zero-cost for Arc-enrolled servers)
- Licence assignment — assign ESU licence to Arc-enabled server resources; patches are delivered via Windows Update
The entire process for a single server takes 15-30 minutes. Bulk deployment across 100 servers with scripting: 2-4 days of engineering effort. The $40,000-$80,000 implementation cost estimate for 200 servers includes scripting, testing, and documentation — but not the ESU licence cost, which is zero.
Get an Independent Second Opinion
Before purchasing on-premises ESU licences or committing to a migration timeline, validate the Arc-enabled free ESU option and migration economics with an independent adviser.
Request a Consultation →Migration Economics: ESU vs Migration Investment
The standard decision framework for ESU vs migration:
| Migration Timeline | Recommended Approach | Cost Model |
|---|---|---|
| Already in Azure | Free ESU automatically — ensure Hybrid Benefit applied | $0 ESU cost |
| Arc deployment feasible | Deploy Arc immediately for free on-premises ESU | $40-80K implementation vs $500K-$2M ESU |
| Migration within 12 months | Year 1 ESU (bridge) + accelerate migration | ESU Year 1 cost + migration investment |
| Migration 12-24 months | Arc ESU (if feasible) or Year 1-2 ESU; evaluate parallel workstream | Arc cost or Year 1-2 ESU vs migration acceleration |
| Migration 24+ months | Arc ESU required; use ESU cost as migration velocity incentive with business | Arc implementation + Azure migration investment |
| No migration planned | Arc ESU for up to 3 years; then mandatory upgrade decision | Arc implementation; plan major upgrade before Year 3 end |
Using ESU Costs to Fund Migration
One of the most effective internal business cases for cloud migration uses the ESU line item directly: "The on-premises ESU cost for our legacy estate is $800,000 over 3 years. Migrating to Azure replaces this with zero-cost ESU and $600,000 in Azure consumption. Net 3-year saving: $200,000 plus decommissioned data centre costs." The ESU cost converts from a sunk cost into a migration investment fuel — present it this way to budget holders.
ESU and Software Assurance: The Misconception
This bears emphasising because we encounter it regularly: active Software Assurance does not provide ESU entitlement. SA provides upgrade rights, deployment benefits (home use rights, training vouchers, licence mobility), and step-up rights — none of which extend the support life of an out-of-support product. An organisation with active SA on Windows Server 2012 still needs ESU or migration after October 2023. SA is not a substitute for ESU and should not be modelled as such.
Related: organisations that drop SA on legacy products before fully utilising ESU provisions may find that re-purchasing SA to access ESU is no longer possible after end-of-support. The interaction between SA, ESU, and licence state at end-of-support is complex — validate your specific configuration before any SA renewal decisions involving legacy products.
📄 Free Guide: Azure Licensing Advanced Guide 2026
ESU, Arc, Stack HCI, Dedicated Host — complete cost models and migration economics for Azure's most complex licensing scenarios.
Download Free Guide →Windows Server 2016: Preparing for the Next ESU Wave
Windows Server 2016 reaches end-of-extended-support in January 2027. Organisations should begin planning now for this next wave of ESU exposure. Key planning actions:
- Run Azure Migrate or other discovery tools to inventory all WS2016 instances across on-premises, IaaS, and hosting providers
- Classify instances by migration feasibility: lift-and-shift to Azure vs in-place upgrade to WS2022/2025 vs Arc enrolment for free ESU
- Budget for WS2016 ESU in FY2027 as a worst-case scenario if migration slips
- Negotiate Azure migration credits as part of current EA renewal if WS2016 migration workloads are in scope
- Evaluate Windows Server 2022/2025 Hybrid Benefit implications for on-premises instances being upgraded rather than migrated
Frequently Asked Questions
Are Extended Security Updates free in Azure?
Yes. ESU for Windows Server 2012/R2 and SQL Server 2012 are free when workloads run in Azure. The same ESUs require paid licences on-premises (without Arc). This free-in-Azure ESU benefit is available for up to 3 years after end-of-support.
How does Azure Arc enable free ESU for on-premises servers?
Starting with WS2012/R2 ESUs (October 2023), Microsoft extended the free ESU benefit to on-premises servers enrolled in Azure Arc. Servers connected to Azure Arc receive security patches at no additional licence cost — only requiring Arc agent installation and an Azure subscription.
What are the on-premises ESU costs without Arc?
ESU pricing tiers: Year 1 = 75% of original licence price; Year 2 = 100%; Year 3 = 125%. For WS2012 Datacenter (16-core), this is approximately $3,500-$5,900/year per server. For 200 servers over 3 years: $2.8M. Arc implementation cost: $40-80K. The ROI case for Arc ESU is overwhelming at scale.
How does ESU interact with Software Assurance?
Active Software Assurance does NOT provide ESU entitlement. SA covers upgrade rights and deployment benefits — not out-of-support product patches. ESU must be purchased separately (on-premises) or the workload must move to Azure or Arc.
What is the migration vs ESU financial decision framework?
If migration is under 12 months away: Year 1 ESU as a bridge. 12-24 months: Arc ESU or Year 1-2 paid ESU. 24+ months or no migration planned: Arc ESU is the optimal path — implement immediately. Use ESU cost as a migration velocity business case with budget holders.
Related Azure Licensing Guides
- Azure Licensing Advanced Topics: Complete Guide
- Azure Arc Licensing and Cost Model
- Azure Stack HCI Licensing: TCO vs VMware
- Microsoft Software Assurance: Complete Guide
- Azure Hybrid Benefit: Windows Server and SQL Server Savings
- Windows Server Licensing Complete Guide
- SQL Server Licensing Complete Guide