A great many organizations arrive at Arc not because they wanted a new management plane but because they needed a way to pay for security updates on a server that has outlived its support, and Arc is the vehicle Microsoft built for exactly that. This is the part of the story with real dates attached, and the dates are close. Extended Security Updates, pay-as-you-go licensing, and the attestation benefit that quietly makes everything else free are not a footnote to the platform. For a lot of estates they are the reason the platform gets adopted at all, and getting the rules and the timing right is worth more than getting any feature right.
The ESU machine Arc has become
Delivering Extended Security Updates through Arc is a clean model once you see its shape. You provision an ESU license as an Azure resource, sized in cores, activate it, and link it to the Arc-connected machines that need it, at which point the updates flow through whatever mechanism you already patch with. There are no keys to manage, which is a genuine improvement over the volume-licensing route, but there are rules that punish carelessness. The core counts have minimums, eight virtual cores per virtual machine and sixteen physical cores per physical server, so a small machine still carries a floor. The edition and core type are fixed once chosen. And the billing is unforgiving in one specific way: if you provision a license after the support end date, you are back-billed to that date, and activation alone starts the meter even before you link a single server. There is essentially no way to avoid the back bill, so the lesson is to enroll deliberately and on time rather than to experiment.
The one place the meter genuinely stops is narrow. Dev and test machines whose operating system licenses come from a Visual Studio subscription, and cold disaster-recovery instances covered by Software Assurance, can receive ESUs at no extra cost, but only by tagging them and linking them to a license you are already paying for on production machines. You cannot build an all-free license. Tags do not change the bill; cores do. Treat the free scenarios as the genuinely narrow exceptions they are, not as a loophole.
The 2012 endgame, which is now
If you are running Windows Server 2012 or 2012 R2 on Extended Security Updates, the clock is nearly out. The program reaches its end in October 2026, the third and final year of ESU coverage, after which no further updates are produced for that operating system by any purchasing route. That is not a distant planning horizon, it is the current one, and it changes the advice. For a machine that will retire before the deadline, ride it out. For one that will not, the honest work is migration or replacement, not another year of ESU, because there is no fourth year to buy. And when the program ends, do not assume Azure stops charging you on its own. The billing follows the license resource, not the calendar, so you deactivate and delete those license resources deliberately when you are done, or you keep paying for updates that no longer exist.
The 2012 ESU program ends in October 2026, and there is no fourth year to buy. Plan the machine, not another renewal.
The 2016 wave, and a pricing rule that changed
Right behind 2012 comes Windows Server 2016, whose extended support ends in January 2027, and Microsoft has confirmed that its Extended Security Updates will be delivered through Arc as well. At the time of writing the pricing and the enrollment mechanics for the 2016 program are not yet published, so resist quoting a number, and be especially wary of figures circulating from the client operating systems, which are priced per device and do not apply to servers. But there is a structural change worth understanding now, because it removes an old escape hatch. For Extended Security Updates released under the newer pricing model, the cost is the same whether you run the machine on Azure, on-premises, or in another cloud. The pattern where moving a workload into an Azure virtual machine made its ESUs free does not carry into this generation. The clearest signal of that is already visible in the SQL Server 2016 program, and the Windows 2016 wave sits under the same policy, so plan on paying for 2016 ESUs wherever the machine lives.
Pay-as-you-go, and its billing traps
For Windows Server 2025 specifically, Arc also offers pay-as-you-go licensing, where an unlicensed machine is billed per core per hour at the same rate Azure charges, which suits elastic or temporary capacity that does not justify a permanent license. It is a real option, and it has a few traps that catch people who treat it casually. Shutting down or deprovisioning the machine does not stop the billing; you have to disable pay-as-you-go explicitly. Uninstalling the agent does not stop it either. And a machine that falls off the network keeps billing until its certificate expires. The feature is honest about all of this, but only if you read it, so treat pay-as-you-go as something you turn off deliberately rather than something that stops when the machine does.
The quiet headline: management for free
The most valuable thing in this entire article is the least advertised. If your Windows servers carry active Software Assurance or subscription licenses, you can attest to that through a benefit called Windows Server Management enabled by Azure Arc, and in return the management stack this series has spent chapters describing comes at no additional cost: Update Manager, machine configuration, change tracking, Windows Admin Center, and more. Separately, hotpatching for Windows Server 2025 is now free to every Arc-enabled 2025 machine regardless of that attestation. Put those together and the picture inverts. For a properly licensed Windows estate, adopting Arc does not add a management bill, it unlocks a management capability you had already paid for through your licensing. The meter this series kept pointing at mostly bites the machines that were not licensed the way their owners assumed. That is why the licensing posture, not the feature list, is the first thing to establish, and it is the thread that ties the whole cost story together.
One boundary to keep clean: SQL Server licensing and SQL Server Extended Security Updates through Arc are a separate program with their own meter and their own rules, and they are out of scope here. When a server also runs SQL, remember that onboarding it to Arc can enroll the SQL instance too, with its own licensing consequences, so decide that deliberately rather than by default.
The whole cost picture, in one table
The cost story has been arriving one article at a time, which is the right way to learn it and the wrong way to budget from it. So here is the series in a single table, with the figures as checked in July 2026. Treat the rates as perishable and the shape as durable: what moves is the number, what does not move is the pattern that the plane is free, the management meters, and licensing posture decides whether the meter reads anything at all.
| Capability | Basic Arc cost | Possible additional charge | Common waiver |
|---|---|---|---|
| Arc resource and Connected Machine agent | None. Projection, resource groups, tags, Resource Graph, role-based access control, and Policy that does not reach into the guest are all free | None directly | Not applicable, it is already free |
| Azure Update Manager | Metered per managed server per day. About sixteen cents per server per day, roughly five dollars per month, checked July 2026 | A day counts as managed if the machine is patched, assessed, or attached to a schedule, and periodic assessment alone is enough to bill | Windows Server Management attestation, Windows Server pay-as-you-go, Defender for Servers Plan 2 on the subscription, or the machine being enrolled in ESUs through Arc |
| Machine configuration, with change tracking and inventory | Metered per server on a combined meter. About six dollars per server per month, checked July 2026 | Change tracking and inventory needs a Log Analytics workspace, so ingestion and retention ride on top | Windows Server Management attestation or Windows Server pay-as-you-go. Also included with Defender for Servers Plan 2 and with ESU enrollment |
| Azure Monitor and the Azure Monitor Agent | The agent and the extension are free | Ingestion and retention for what your data collection rules actually collect. This is the line that surprises people, because it scales with your appetite rather than your server count | None. Attestation does not waive ingestion, and no licensing posture will. The only control is a deliberately scoped rule |
| Defender for Servers | A paid plan, Plan 1 or Plan 2, enabled per subscription | Plan 2 adds capability and a daily free ingestion allowance; agentless disk scanning does not reach on-premises Arc machines regardless of plan | None, this is the thing you are buying. It does, in turn, waive Update Manager and machine configuration |
| Arc gateway | No separate gateway charge | Whatever the connected services and your own networking cost. The gateway shortens the allowlist, it does not change service pricing | Not applicable |
| Extended Security Updates through Arc | Core-based monthly charge, with an eight virtual core floor per virtual machine and a sixteen physical core floor per physical server | Back-billing to the support end date on provisioning, activation, reactivation, or recreation. Reductions, deactivation, and deletion carry a tail of up to five more calendar days | Narrow and specific: Visual Studio subscription dev and test machines, and Software Assurance cold disaster-recovery instances, tagged and linked to a license you are already paying for |
| Windows Server 2025 hotpatching | Free to every Arc-enabled Windows Server 2025 machine since May 19, 2026 | None | Not needed. This one is explicitly outside the attestation and licensing requirements that gate the rest of the table |
| Windows Server pay-as-you-go | Per core per hour, at the Azure rate, for Windows Server 2025 Standard or Datacenter | Billing does not stop when the machine does. Shutting down, deprovisioning, or uninstalling the agent do not end it; you disable it explicitly, and a disconnected machine bills until its certificate expires | Not applicable. Enrolling in pay-as-you-go is itself a waiver route for the management services above |
Read the fourth column and the pattern is unmistakable. Nearly every management meter in this series is waived by the same two things, an attested Software Assurance or subscription posture, or pay-as-you-go enrollment, and the exceptions are the two that scale with consumption rather than headcount: log ingestion and Extended Security Update cores. That is a genuinely coherent pricing design, and it means the cost conversation with a client is not a feature-by-feature negotiation. It is one question about licensing, asked first, followed by a much shorter conversation about how much telemetry you actually intend to keep.
To the build
That is the money story: an ESU model with sharp billing edges and a closing 2012 deadline, a 2016 wave arriving under a pricing rule that closed an old loophole, a pay-as-you-go option you must switch off on purpose, and an attestation benefit that makes the management plane free for the estates already licensed for it. The companion build sheet walks the ESU enrollment itself, from provisioning the license resource through the core math and the deliberate deactivation at program end. After that, the series turns to the security attach, Defender for Servers delivered through Arc, before closing on the decision this all builds toward.
Azure Arc
‹ Previous: [ARC 5.1] Build Sheet: Operating an Arc Server
Next: [ARC 6.1] Build Sheet: ESU Enrollment Through Arc ›
