On this page · 10 sections
Summary. October 13, 2026 is a hard deadline for a stack of Microsoft workloads. The final year of paid Extended Security Updates for Windows Server 2012 and 2012 R2 ends that day, with no further extension. SQL Server 2016 already left extended support on July 14, 2026, and its ESU program runs only to July 2029. SharePoint Server 2016 and 2019 also lost support on July 14, 2026, and Microsoft has announced no paid ESU for SharePoint, so that one is a straight cliff. ESU pricing climbs fast: per core, 75% of the Windows Server list price in year one, 100% in year two, and 125% in year three. One 2026 estimate puts three years of ESU on a single 16-core Datacenter server near $20,300, more than buying the current version outright. The real choice is not patch or migrate; it is migrate, use ESU as a short bridge, or modernize. This guide lays out the dates, the costs, and how to decide per workload.
For CTOs running legacy Microsoft estates, the temptation is to renew ESU one more year and move on. That math stops working in 2026, and for SharePoint it does not exist at all. Below is what expires when, why ESU gets expensive, the three real options, and how eCorpIT helps Indian and global teams get off the cliff without a rushed lift-and-shift.
The October 2026 end-of-life wave: what expires when
Several Microsoft products reach a support boundary within a three-month window in 2026. Some have a paid ESU bridge; some do not. The table below is the planning baseline.
| Product | Support boundary | ESU or bridge available? |
|---|---|---|
| SQL Server 2016 | Extended support ended July 14, 2026 | Paid ESU July 15, 2026 to July 2029 |
| SharePoint Server 2016 and 2019 | Support ended July 14, 2026 | No paid ESU announced |
| Windows Server 2012 / 2012 R2 | Final ESU year ends October 13, 2026 | None after that date |
| Windows Server 2022 | Mainstream support ends October 13, 2026 | Extended support to October 14, 2031 |
| Windows Server 2016 | Extended support ends January 12, 2027 | Plan upgrade now |
Windows Server 2012 R2 reached end of support back in October 2023, and the three-year paid ESU program has kept it patched since. BleepingComputer confirmed Microsoft extended those ESUs to October 2026, and October 13, 2026 is confirmed as the final date, with no further extension. Windows Server 2022 is a softer boundary: mainstream support ends the same day, but extended support continues to October 14, 2031, so it moves to a maintenance footing rather than off a cliff. The two genuinely urgent items are Windows Server 2012 R2, which loses its last safety net, and SharePoint Server 2016 and 2019, which have none.
Why "just buy ESU" gets expensive fast
Extended Security Updates are designed to be a bridge, and the pricing makes sure you treat them that way. ESU is billed per core as a rising share of the current Windows Server license price: 75% in year one, 100% in year two, and 125% in year three. By the third year you are paying more than the price of a full current license, every year, for an operating system that is already a decade old.
The absolute numbers make the point. One 2026 estimate puts paid ESU on a 16-core Windows Server Datacenter host at roughly $3,500 to $5,900 a year, and about $20,300 cumulatively across the three-year program, which exceeds the cost of licensing Windows Server 2025 Datacenter for the same host. For a fleet of dozens of servers, that is real budget spent on standing still. And for Windows Server 2012 R2 specifically, October 13, 2026 ends the option entirely, so ESU cannot be a long-term answer even if you wanted it to be.
There is one important exception. Microsoft provides ESU at no additional license cost for Windows Server and SQL Server running on Azure, and it extended the free ESU benefit to on-premises servers enrolled in Azure Arc, which need only the Arc agent and an Azure subscription. That changes the arithmetic: if a workload is moving to Azure anyway, the ESU cost can drop to zero, and Arc can cover the on-premises servers you cannot move immediately while you plan their migration.
Your three real options
Every legacy workload has three honest paths. The right one depends on the application, not on a blanket policy.
| Option | Best for | Cost trajectory | Main risk |
|---|---|---|---|
| Buy ESU as a bridge | Workloads you will retire within 1 to 2 years | Rises 75 to 125% per year, then ends | Paying to stand still; WS2012 R2 ends Oct 2026 |
| Migrate (rehost or replatform) | Workloads that must keep running as-is | One-time move, then normal support | Compatibility testing and cutover downtime |
| Modernize (refactor) | Strategic apps with a long future | Higher upfront, lower run cost | Scope creep if not sequenced |
Buying ESU makes sense only as a short, deliberate bridge for a workload you have already committed to retiring, or for on-premises servers you will move to Azure Arc for free coverage. Migrating, by rehosting to Azure infrastructure or replatforming to a managed service such as Azure SQL, keeps the application running while removing the support-cliff risk and, in the Azure case, the ESU bill. Modernizing, by refactoring an app onto current frameworks and managed services, costs more upfront but cuts long-run maintenance and unlocks capabilities the 2012-era stack cannot offer. Most real estates use all three across different workloads, which is exactly why a one-size migration plan fails.
How to decide per workload
Start with an application portfolio analysis: list every workload on an affected product, its business owner, its dependencies, and its planned lifespan. That inventory turns a scary date into a ranked backlog. A workload you plan to sunset in a year gets ESU or Azure Arc coverage and no more investment. A workload that must keep running unchanged gets a rehost or replatform. A strategic application with a five-year future is a modernization candidate.
Sequence the backlog by risk and dependency, not by convenience. SharePoint Server 2016 and 2019 sit at the top, because they have no ESU and, as we cover in the SharePoint RCE machine-key remediation runbook, on-premises SharePoint is under active exploitation right now. Windows Server 2012 R2 comes next, because its bridge ends in October. This is the same cost-versus-risk discipline we apply to other end-of-life decisions, such as the MySQL 8.0 end-of-life and RDS extended-support cost trade-off and the Azure reserved VM instance retirement and migration. Getting the sequence right is where a modernization partner earns its fee, and it is the core of our cloud migration and modernization service.
A 90-day plan to beat the deadline
With October 13, 2026 fixed, a 90-day plan is realistic if you start now. In the first two weeks, run the application portfolio analysis: inventory every workload on Windows Server 2012 R2, SQL Server 2016, and SharePoint Server 2016 or 2019, and record each one's business owner, dependencies, data sensitivity, and planned lifespan. In parallel, enroll eligible on-premises servers in Azure Arc so they get free Extended Security Updates immediately, which buys breathing room without a rushed cutover.
From roughly day 15 to day 45, sequence and decide. Rank the backlog by risk, with unsupported SharePoint first and Windows Server 2012 R2 next, and assign each workload a path: rehost, replatform, refactor, or retire with a short bridge. Build the per-workload cost comparison so the migrate-versus-ESU-versus-modernize call is made on numbers, not habit.
From day 45 to day 75, execute the first wave on the highest-risk workloads, moving SharePoint to SharePoint Online or Subscription Edition, or isolating and hardening the farm as an interim step. In the final two weeks, validate: confirm no workload is running unsupported without Azure Arc coverage, document the support status of every platform as evidence for DPDP and ISO 27001 audits, and schedule the second wave for the January 12, 2027 Windows Server 2016 boundary. The deadline is fixed; the plan is what makes it manageable.
SharePoint is the sharp edge of this wave
Of everything expiring, SharePoint Server on-premises is the one that cannot wait. It lost support on July 14, 2026, Microsoft has announced no paid ESU for it, and it is being actively attacked through unauthenticated remote code execution flaws. A SharePoint Server that stops receiving patches while attackers are exploiting deserialization bugs and stealing machine keys is not a deferred risk; it is an open door. The realistic paths are migration to SharePoint Online in Microsoft 365, a move to SharePoint Server Subscription Edition if you must stay on-premises, or replacing the intranet with a modern content platform. Whichever you choose, the interim step is to harden and isolate the existing farm, because leaving an unsupported, internet-reachable SharePoint server running is the highest-risk item in this entire list.
India-specific considerations
For Indian enterprises and the Global Capability Centres that run large Microsoft estates, running an unsupported operating system or database is not only an operational risk, it is a compliance exposure. Under the Digital Personal Data Protection Act, 2023, a failure to keep reasonable security safeguards that leads to a personal data breach can draw penalties up to ₹250 crore, and an unpatched, out-of-support server is a textbook example of an unreasonable safeguard. Auditors and enterprise customers increasingly ask directly whether your platforms are in support.
The cost picture in India favours planning over panic. Azure Arc can cover on-premises servers with free ESU while you sequence migrations, so teams do not have to choose between an expensive ESU renewal and a risky rushed cutover. Because most GCCs already hold Microsoft volume licensing, the Azure Hybrid Benefit can reduce the cost of moving these workloads to Azure. Folding this migration into a broader cost programme, as covered in our guide to how Indian teams cut cloud spend, keeps the modernization from becoming a budget shock. The security steps are the same worldwide; only the reporting duties under DPDP differ.
FAQ
How eCorpIT can help
eCorpIT is a Gurugram-based technology organisation, founded in 2021, certified for CMMI Level 5, MSME, and ISO 27001:2022, with senior-led engineering teams and a Microsoft partnership. We help enterprises get off the October 2026 end-of-life cliff without a rushed lift-and-shift: an application portfolio analysis to rank every affected workload, a risk-sequenced plan across rehost, replatform, and refactor, Azure and Azure Arc setup so ESU coverage drops to zero where possible, and modernization of the applications with a long future. We design migrations aligned with ISO 27001 and DPDP requirements. To scope your Windows Server, SQL Server, and SharePoint estate before the deadline, contact our team.
References
_Last updated: August 2, 2026._
