Windows Server 2016 reaches the end of extended support on 12 January 2027. After that date Microsoft stops releasing security updates for it unless you pay for Extended Security Updates. Two months is not long for a server estate, and many South African organisations still run file servers, domain controllers and line-of-business applications on 2016. This article sets out what changes, what Microsoft offers as a bridge, and how we decide the path for each server in an Azure migration.
What ends on 12 January 2027
Mainstream support for Windows Server 2016 ended in January 2022. Extended support, the phase that keeps security updates flowing without new features, ends on 12 January 2027. From then on, a vulnerability in the operating system stays open on every unprotected 2016 server you run.
Windows Server 2012 and 2012 R2 went through the same cycle: their three-year Extended Security Update period closed on 13 October 2026, and the Arc licences were deactivated the following day. The end date is firm, the bridge is finite, and the servers still running at the end had to move anyway.
The ESU bridge, and what it costs
Microsoft has announced Extended Security Updates for Windows Server 2016. They cover Critical and Important security updates for up to three years, through 2030, and nothing else: no new features, no non-security hotfixes and no design changes. For on-premises servers, ESUs are delivered through Azure Arc. The Azure portal has allowed configuration since 3 August 2026, and billing starts on 13 January 2027.
The Arc route needs the Azure Connected Machine agent at version 1.62 or later on each server, Standard or Datacenter edition, and Software Assurance or a subscription licence under a volume licensing programme. Billing is a monthly subscription with no activation key, and enrolled servers get Azure Update Manager and change tracking and inventory at no extra charge. Machines on Azure Local and Azure VMware Solution are eligible for free ESUs and should not be enrolled through Arc, and VDI virtual machines use Multiple Activation Keys instead. Confirm the terms for your hosting arrangement with your licensing partner before you budget.
ESU is a last resort for a server you cannot change in time, not a plan. Treat it as the cost of a few more months for a specific application, and keep that server's migration date on the calendar.
Path one: upgrade in place to a supported version
A 2016 server that is otherwise healthy can be upgraded. Azure Migrate can upgrade the operating system during a migration to Azure, moving a Windows Server 2016 source to 2019 or 2022 as part of the cutover. The feature is still labelled preview, and its limits are plain: Standard, Datacenter and Enterprise editions only, English (US) installations only, no evaluation licences, at least 32 GB free on the operating system disk, and antivirus and firewalls disabled during the upgrade. A test migration checks the result before the production move.
In-place upgrade suits infrastructure roles with no application dependency on the old version. It suits an old line-of-business application far less well, because the vendor's support statement decides whether the upgraded server is supported at all. Ask for that statement in writing first.
Path two: rehost in Azure South Africa
The second path is to move the server as it is to an Azure virtual machine in South Africa North, with South Africa West for disaster recovery, and deal with the operating system afterwards. This lift-and-shift approach removes the hardware dependency at once and keeps the data in the country, which matters for POPIA.
Two licensing points help here. Azure Hybrid Benefit lets you apply existing Windows Server core licences with active Software Assurance or a qualifying subscription to Azure virtual machines at a reduced rate. Each machine needs at least eight core licences, larger machines need one licence per core, and the benefit lasts only as long as the Software Assurance term. Second, Microsoft's ESU page describes a three-year Azure offer that includes all Azure destinations; for the 2012 generation, ESUs on Azure virtual machines carried no extra charge. Check the current terms for 2016 before relying on them in a business case.
Rehosting a 2016 server does not make it supported. It makes it easier to replace: the next step is a new 2022 or 2025 virtual machine in the same virtual network and a planned cutover.
Path three: replace the role with a managed service
Some 2016 servers should not be migrated at all. A file server can become Azure Files. A SQL Server instance can become Azure SQL Managed Instance. This is the re-platform approach, and it is where the long-term saving sits, because there is no next end-of-support date to plan for. It also takes longer, so it rarely fits the two months left. For a busy estate the practical sequence is often rehost first, then replace each role at a steady pace once the hardware risk is gone.
A checklist for the next eight weeks
- Count the servers. Inventory every Windows Server 2016 instance, physical and virtual, including branch offices. N-able N-central's asset inventory is the quickest source; our cloud and infrastructure services start here.
- Classify each one. Infrastructure role, in-house application or vendor application, with the vendor's supported operating system list.
- Decide the path per server. Upgrade, rehost, replace, or ESU with a dated exit.
- Check licensing. Software Assurance status, core counts for Azure Hybrid Benefit, and ESU eligibility where needed.
- Prepare the landing zone. Subscriptions, network, identity and the security baseline come before the first server moves; the cloud migration planning guide covers the sequence.
- Set cost controls at the same time. Budgets and owner tags before production traffic, as the Azure cost governance checklist describes.
- Book the change windows now. December and early January are short working months in South Africa, so the cutover calendar is tighter than it looks.
Sources
- Microsoft: Planning ahead for Windows Server 2016 end of support
- Microsoft Learn: Prepare to deliver Extended Security Updates for Windows Server through Azure Arc
- Microsoft Learn: Azure Migrate Windows Server upgrade (preview)
- Microsoft Learn: Explore Azure Hybrid Benefit for Windows VMs
- Microsoft: Windows Server Extended Security Updates
Plan the move off Windows Server 2016 with OAS Azure migration services.