The short answer
Microsoft ends extended support for Windows Server 2016 on January 12, 2027. After that, servers running it no longer receive regular security updates unless you buy Extended Security Updates. For custom applications on those servers, the right move is not the same for every app. Before you migrate anything, assess each app and decide whether to upgrade, rebuild, replace, retire or leave it alone. That decision depends on five things: how current the app’s framework is, how secure it is, how safely you can change it, who understands it, and what it connects to. A custom application isn’t just hosted on a server, it’s built on a stack comprising of operating system (OS), runtime, framework and database. January 12 is the OS deadline, but when we look at the rest of the stack, we often find two or three other components are out of support as well.
Key dates for Microsoft-based custom apps
| Product | End of support | Status | What it means |
| .NET Core 3.1 | December 13, 2022 | Out of support | Already unsupported; no security fixes for over three years |
| SQL Server 2016 | July 14, 2026 | Out of support | Extended support has ended; Extended Security Updates available |
| .NET 8 (LTS) and .NET 9 | November 10, 2026 | Approaching end of support | Apps on these versions need a plan to move to .NET 10 |
| Windows Server 2016 | January 12, 2027 | Approaching end of support | Extended support ends; Extended Security Updates available, including through Azure Arc |
Source: Microsoft Lifecycle documentation and the Microsoft Windows Server and .NET blogs. Always confirm dates on the Microsoft Lifecycle site for your specific product and edition.
Why are end-of-support dates important?
End of support dates mark the last day that security updates are released for a specific piece of software. If a critical vulnerability is discovered in the software after that date, it’s not guaranteed that a security patch will be released. That could mean that your infrastructure, applications, and data are left vulnerable. Securing your applications in that situation generally involves a mad scramble to update your software, application downtime, and disrupted operations. It’s in your company’s best interests to make sure you’ve upgraded your software well before the end-of-support date arrives.
Why is Windows Server 2016 end of support a problem for custom apps?
For infrastructure, the path is well understood: upgrade the operating system, move to Azure, or buy Extended Security Updates to gain time. Custom applications are harder. In the conversations my team has with IT leaders, the server is rarely the only issue. The app itself is often built on a framework that’s already out of support, such as .NET Core 3.1, an older version of Angular or ASP.NET Web Forms. Documentation is thin, testing is manual, and the knowledge of how the app really works sits with one or two people.
Moving that app to a newer server, or even to Azure, doesn’t fix any of that. You end up paying for new infrastructure while the underlying risk remains the same. The move to new infrastructure is easy; the decision to update a custom application is more difficult, so the following paragraphs will cover how to best make that call.
Should every app be migrated or upgraded?
No. The real question isn’t “how do we migrate?” It’s “what should we do with each app?” In practice, every custom app falls into one of five outcomes:
- Upgrade: move to a current, long-term-support framework and runtime, with security fixes, automated tests and CI/CD.
- Rebuild: rewrite the app or a module when patching it would cost more or carry more risk than starting fresh.
- Replace: retire the custom app in favor of a SaaS or low-code option such as Power Platform or Dynamics 365.
- Retire: shut it down because its value no longer justifies the cost.
- Keep and monitor: leave a stable, supported app alone for now and set a review date.
Treating every app the same way is how modernization budgets get misspent. An honest “leave it alone” is just as valuable as an upgrade plan.
What five questions should you ask about every custom app?
- Is it current? Check the framework, runtime, database server version and hosting OS against Microsoft’s support dates.
- Is it secure? Look for outdated or vulnerable packages and how secrets and credentials are handled.
- Can you change it with confidence? Consider automated test coverage, your release process and whether you can roll back.
- Who understands it? Assess documentation quality and how much depends on one or two people.
- What does it touch, and what happens if it breaks? Map integrations with ERP, CRM, APIs and shared databases, and weigh the business impact of downtime.
If you can answer those questions for each app, you’ll know where your risk is concentrated and where to spend first. If you can’t, that’s an area of risk too.
Can AI speed up an application modernization assessment?
Yes, with the right guardrails. Agentic AI tools can scan a codebase, inventory dependencies and map integrations far faster than a person reading through it by hand. On my team, we use them to do that heavy lifting.
But AI output still needs to be checked. A wrong finding, or a recommendation that ignores how the business actually uses an app, can send a project in the wrong direction. Speed also shouldn’t cost you control. Our rules are simple: an engineer verifies every AI finding, no production secrets or credentials go to AI agents, only client-approved data goes to approved AI services, and the client owns everything we produce. We also don’t promise speed or savings up front. We measure, then report what we actually find.
How does the Covenant App Health Check work?
We built the App Health Check, part of Covenant Accelerate, around that model. It’s a fixed-fee, timeboxed application modernization assessment for one app or a whole portfolio. Our AI tooling analyzes your code, dependencies and integrations with read-only access, and our engineers validate every finding before it reaches you.
You get a readiness scorecard for each app, a recommended outcome, a risk register, a prioritized backlog and a 12-month roadmap, presented in an executive readout. Packages are sized by the number and complexity of apps, starting with a single application in about two weeks. Microsoft partner funding may be available for qualifying organizations. When you’re ready to act, we can deliver the upgrade or build, and our Covenant Modernize team can provide ongoing support.
Frequently asked questions
When does Windows Server 2016 support end? Microsoft ends extended support for Windows Server 2016 on January 12, 2027. After that date, security updates are available only through paid Extended Security Updates.
Will my apps stop working after January 12, 2027? No. Applications keep running, but the server stops receiving regular security updates, which increases security and compliance risk over time.
Is buying Extended Security Updates enough? Extended Security Updates buy time for the operating system. They don’t update the app’s framework, fix its dependencies or reduce key-person risk, so they work best as a bridge while you modernize.
What is an application modernization assessment? It’s a structured review of your custom applications that scores their readiness and recommends what to do with each one, such as upgrade, rebuild, replace, retire or leave alone.
How long does an App Health Check take? It starts at about two weeks for a single application. Larger portfolios take longer, depending on the number and complexity of apps.
Do my apps need to be on Azure? No. We assess the application wherever it runs, and the recommendation may or may not include moving to the cloud.
Start with a 30-minute conversation
January 12 is close, but there’s still time to make a clear decision instead of a rushed one. Book a 30-minute scoping call and we’ll talk through your apps, confirm the right package and tell you honestly whether a Health Check makes sense. [Book a scoping call]
About the author
Liam Baisley is a Senior Consultant who helps businesses modernize and build custom applications through a combination of AI-accelerated development and experienced engineering oversight. He has 6 years of experience helping businesses achieve their application development goals, and holds multiple Azure certifications. Linkedin
Sources
- Microsoft Windows Server Blog, “Planning ahead for Windows Server 2016 end of support,” February 25, 2026
- Microsoft Lifecycle, Windows Server 2016 (learn.microsoft.com/lifecycle/products/windows-server-2016)
- Microsoft, Extended Security Updates for SQL Server and Windows Server (microsoft.com/windows-server/extended-security-updates)
- Microsoft Lifecycle, Microsoft .NET and .NET Core (learn.microsoft.com/lifecycle/products/microsoft-net-and-net-core)
- Microsoft .NET Blog, “.NET Core 3.1 will reach End of Support on December 13, 2022”
Estimates and timelines depend on app complexity, access and client team availability. Results are measured and reported during the engagement; no savings or speed figure is guaranteed. Microsoft funding is subject to eligibility and checked per customer.