Inquiry about ESU for Windows Server 2016

Hi 伊藤 大悟(Daigo Ito),

Windows Server 2016 will reach the end of support on January 12, 2027. At that point, ESU will become available for customers who need continued security updates. Eligibility is limited to customers with active Volume Licensing agreements, Visual Studio (MSDN) subscriptions, or through Cloud Solution Provider (CSP) partners. Retail or OEM licenses are not eligible for ESU.

Coverage is offered for up to three years, beginning January 2027 and ending January 2029. ESU provides monthly security patches for critical and important vulnerabilities, but does not include feature updates or non-security fixes. Pricing is structured annually, with costs increasing each year. Typically, Year 1 starts at a lower rate, and the price doubles in Year 2 and again in Year 3. Enrollment is cumulative, meaning if you join late, you must pay for prior years retroactively.

Deployment of ESU updates is handled through the same channels as regular updates, such as Windows Update, WSUS, or the Microsoft Update Catalog. Microsoft also provides documentation and support for ESU deployment, though a standard support contract may be required for troubleshooting. ESU is intended as a temporary bridge to give organizations time to migrate to newer versions like Windows Server 2022.

In short, ESU for Windows Server 2016 starts in January 2027, lasts three years, and is available only through official licensing channels. I hope the response provided some helpful insight. If it clarified the issue for you, please consider marking it as Accept Answer so others with the same issue can find the solution.

Jason.

Extended Security Updates (ESU) are a last-resort, time‑limited option to keep certain legacy Windows Server versions secure after end of support. While the context does not list a Windows Server 2016–specific ESU program, it does define how ESU generally works for Windows Server and how to obtain and deploy it where available.

Eligibility requirements (general ESU for Windows Server)

1. Product and lifecycle status

• ESU is only offered for specific products that have reached end of support and for a limited period (up to three years after end of Extended Support).
• ESU does not extend the product lifecycle and does not include non‑security fixes or new features.

2. Licensing prerequisites (on‑premises / non‑Azure) To purchase and use ESUs for Windows Server on‑premises or in hosted environments, one of the following must apply:

• The server/OS is covered by active Software Assurance (SA) via a volume licensing program such as:
  • Enterprise Agreement (EA)
  • Enterprise Agreement Subscription (EAS)
  • Server & Cloud Enrollment (SCE)
  • Enrollment for Education Solutions (EES)
• Or the server has active subscription licenses (including via Cloud Solution Provider (CSP)).
• Or the server was acquired as a “License‑Included” service from a Service Provider License Agreement (SPLA) partner.

3. Azure scenarios

• For applicable Windows Server versions running as Azure virtual machines (including Azure Dedicated Host, Azure VMware Solution, Azure Nutanix Solution, Azure Local, Azure Stack Hub/Edge), ESUs are provided free of charge if the VM is configured to receive updates.
• No MAK key or extra ESU purchase is required for eligible Azure VMs.

Licensing and pricing options (general model)

1. Where and how ESUs can be obtained

• On Azure:
  • ESUs are free for eligible Azure VMs and certain Azure products.
• On‑premises / hybrid:
  • ESUs are purchased via specific Microsoft volume licensing programs or enabled via Azure Arc‑enabled servers.
  • ESU licenses (SKUs) can be acquired directly from Microsoft or via partners such as EA resellers or CSP partners.

2. Licensing basis (core‑based)

• ESU licenses correspond to the underlying Windows Server core licenses and must align with how Windows Server is licensed:
  • Physical core (pCore) licensing:
    • One ESU license per physical core on the server.
    • Windows Server has an 8‑core minimum per processor and 16‑core minimum per server.
    • All validly licensed guest VMs on that host are covered.
  • Virtual core (vCore) licensing:
    • One ESU license per virtual core assigned to each VM.
    • Windows Server has an 8‑core minimum per VM.
• ESU edition must match the Windows Server edition (for example, Datacenter ESU for Windows Server Datacenter when licensing by vCore).

3. Azure Arc–enabled servers

• For on‑premises or hosted servers that can connect to Azure:
  • Servers can be enrolled for ESUs via Azure Arc.
  • Billing is monthly through an Azure subscription.

4. Non‑Azure physical and virtual machines

• For servers that cannot use Azure Arc:
  • ESUs are applied using a Multiple Activation Key (MAK) obtained from the Microsoft 365 Admin Center after purchase.
  • The MAK signals eligibility to Windows Update so security updates continue.

5. Pricing

• The context does not provide specific ESU prices or net amounts.
• ESU pricing and commercial terms are handled via Microsoft Commercial Licensing and partners; no list prices are included in the provided material.

Duration of coverage

• ESU coverage is available for up to three years after the product’s end of Extended Support date.
• ESUs provide Critical and/or Important security updates only, during that ESU period.
• The context explicitly notes this three‑year window but does not list specific start/end dates for Windows Server 2016.

Limitations and special conditions

• ESUs are a temporary bridge, not a long‑term solution; upgrading to a supported Windows Server version is recommended.
• ESUs:
  • Include only Critical/Important security updates.
  • Do not include new features, non‑security hotfixes, or design changes.
  • Do not extend the official product lifecycle.
  • Do not provide standard technical support beyond security updates.
• For Commercial Licensing ESUs:
  • ESU core counts must match the underlying Windows Server licensing model (pCore or vCore) and edition.
  • Minimum core counts per server/VM apply as described above.
• For “License‑Included” SPLA scenarios:
  • Software obtained via SPLA can be covered by ESU licenses if otherwise eligible.
• For BYOL scenarios in other clouds:
  • ESUs can be applied if the underlying Windows Server is properly licensed under outsourcing or License Mobility policies.

Deployment and operational notes

1. Azure VMs

• ESUs are automatically enabled for applicable Azure VMs.
• No MAK or extra configuration is needed beyond ensuring the VM is configured to receive updates.

2. Azure Arc–enabled servers

• On‑premises or hosted Windows Server machines can be enrolled for ESUs via Azure Arc.
• Once enrolled, ESUs are billed monthly through the Azure subscription.

3. Non‑Azure machines using MAK

• After purchasing ESUs and waiting for the MAK to appear (typically 3–5 business days):
  • Sign in to the Microsoft 365 Admin Center.
  • Go to Your products → Volume licensing → View contracts → select agreement → More actions → View product keys.
  • Retrieve the ESU MAK and install it on eligible servers.
• Before ESU updates can be installed:
  • Install the latest Servicing Stack Update (SSU) and the Licensing Preparation Package as described in KB5031043.
• Once the system is registered with the MAK, ESU security updates are delivered via normal Windows Update mechanisms and existing patching tools.

4. Support scope

• ESUs provide security updates only.
• Standard support services (troubleshooting, non‑security bug fixes, general technical guidance) are not included beyond the original support lifecycle.

Availability and announcement timing

• The context describes the ESU framework and current offerings (for example, Windows Server 2012/2012 R2) but does not state an ESU program or dates specifically for Windows Server 2016, nor any future announcement schedule.
• No information is provided on when ESU availability or pricing for Windows Server 2016 would be announced.

References:

• Lifecycle FAQ - Extended Security Updates
• Extended Security Updates for Windows Server overview
• How to get Extended Security Updates (ESU) for Windows Server