Azure Arc gives Windows Server 2012 ESU a simpler monthly-billed path

In early 2024 I still come across a lot of Windows Server 2012 and 2012 R2 machines running in production. They're domain controllers, file servers or hosts for line-of-business apps that can't be moved yet. Support officially ended in October 2023, so the security risk is clear, but real environments aren't always ready for a rushed migration. Where a direct upgrade or a move to Azure isn't possible (or doesn't make sense), Windows Server 2012 ESU Azure Arc has turned into a useful bridge.

ESU through Azure Arc removes the need for volume licensing

I'm still surprised by how many of the environments I review have 2012-era servers, warnings or not. The reasons hardly vary: legacy applications, vendors that are slow to support newer OS versions, or not enough time and staff. Until recently, Extended Security Updates (ESU) came only with volume licenses, which meant upfront commitments and managing licenses on-premises. Since autumn 2023 there's a much easier route. You can provision ESU through Azure Arc and pay monthly, and it covers on-prem servers as well as servers in other clouds. Nothing has to be physically migrated to Azure. Microsoft's overview is a good place to start, and they also have a solid guide on getting servers ready for ESU through Arc.

The Azure Arc Connected Machine agent holds everything together

Everything starts with onboarding the servers using the Azure Arc Connected Machine agent. The agent sets up a secure connection to Azure, and each server then appears as a resource in the Azure portal, whether it runs on-premises, with a hosting provider or in another cloud. With larger fleets you'll want automation. Onboarding with service principals and scripts spares you a lot of trouble. In my experience the network prerequisites cause the most problems, because tight segmentation or firewalls can bring a rollout to a halt. Microsoft's documentation on the agent and its architecture goes into more detail.

Pro tip: Plan time for the network configuration. The Arc agent needs access to specific Azure endpoints and ports. In heavily locked-down networks, that's usually where things get stuck.

This Mermaid diagram shows the main steps for enabling ESU through Azure Arc, from installing the agent to receiving updates again:

graph TD
  A["Server with Windows Server 2012"] --> B["Arc Connected Machine agent installed"]
  B --> C["Server appears in Azure Arc"]
  C --> D["Create ESU license in Azure portal"]
  D --> E["Assign license to server(s)"]
  E --> F["ESU updates are installed"]

Figure: Enabling Windows Server 2012 ESU through Azure Arc, step by step

ESU licenses are created and assigned in the Azure portal

After the servers are Arc-enabled, you do the rest in the Azure portal. You set the edition (Standard/Datacenter), physical or virtual cores, and the minimums (8 per VM, 16 per physical server, in line with standard licensing rules). Billing is monthly for each assigned license. Compared with the old three-year ESU purchase, that's a big relief. As soon as you assign an ESU license, security updates start flowing again. Microsoft's docs cover delivery in full.

If you want to automate it, a PowerShell snippet could look something like this (simplified example):

# Example: Assign ESU license
az connectedmachine license assign --machine-name <ServerName> --resource-group <ResourceGroup> --license-type 'ESU2022'

Assigned licenses still need close monitoring afterwards

After assigning the licenses, I always keep a close eye on the update logs and patch status of these servers. Quite often Windows Update or WSUS turns out to be misconfigured and doesn't pick up ESU patches straight away, so check the Azure Arc status and the local logs to be sure. Watch your ESU license inventory in Azure too, particularly when you remove or migrate servers. Over roughly the past year, both the Azure portal and the documentation have improved a lot, and the process is easier to follow now.

ESU buys time but does not replace an exit plan

Windows Server 2012 ESU Azure Arc is a bridge for legacy workloads and nothing beyond that. In many of my projects we use ESU to gain time for a planned migration or upgrade, with a roadmap and regular progress checks. In the long run nothing replaces modernization, for security and for governance. Once your environment shows up in Azure Arc, you can add cloud management, policy enforcement and later even automated patching on top. If you depend on ESU today, see it as a last resort and not as a strategy.