Summary
Microsoft’s March 2026 Product Terms update rewrites the licensing restrictions for Windows Server pay-as-you-go via Azure Arc, relaxes the prerequisites for Windows 10 ESU Cloud Managed, and rebrands one of the Entra ID Governance SKUs.
Windows Server pay-as-you-go via Azure Arc licence restrictions rewritten, resolving the contradictions we flagged in December 2024
Windows 10 ESU Cloud Managed no longer requires Windows Enterprise/Education or Entra ID P1/P2
Microsoft Entra ID Governance for External Identities renamed to Governance for Guests
The changes are effective 1 March 2026.
Windows Server Pay-as-you-go via Azure Arc: Licence Restrictions Rewritten
When Microsoft launched Windows Server 2025 with Azure Arc pay-as-you-go in November 2024, the Product Terms made no sense. The licence restrictions required a valid Windows Server licence alongside the pay-as-you-go subscription, which defeated the purpose of offering a subscription alternative. The licensing community flagged the contradiction immediately; the Windows Server Product Group remained silent. We recommended against using pay-as-you-go in production to avoid non-compliance risk.
Sixteen months later, Microsoft has substantially rewritten the Windows Server pay-as-you-go enabled by Azure Arc section in the Product Terms. Both the Use Rights and the Licence Restrictions have changed, and the new text is significantly shorter than the old.
The Licence Prerequisite Is Gone
The most significant change is what disappeared. The old text opened with: “Customer must have a valid Windows Server Standard or Windows Server Datacenter License to use the pay-as-you-go option.” That was the sentence that created the contradiction: why would anyone pay for both a licence and a subscription?
The new text reads: “Customer may use either Windows Server Standard or Windows Server Datacenter edition, subject to the respective licence model terms.” The requirement to hold a pre-existing licence is gone. The sentence now states which editions are available under pay-as-you-go, not that you must already own one.
Pay-as-you-go via Azure Arc no longer requires a pre-existing Windows Server licence — resolving a contradiction flagged since November 2024.
Outsourced Servers Are Now in Scope
The Use Rights clause previously stated that the customer may use the pay-as-you-go option as long as the server was registered and connected to Azure. The March update adds a qualifying scope: “For Servers subject to the Outsourcing Software Management clause.”
In December 2024, we wrote that pay-as-you-go could not be used on hosting. That has changed — but not through SPLA. The Outsourcing Software Management clause covers servers that are under the management or control of a third party on behalf of the customer. This is the same model Microsoft already uses for SQL Server enabled by Azure Arc, where the customer holds the Azure subscription and pays per use while the servers sit with an outsourcer.
Datacenter Unlimited Virtualisation Does Not Apply
The old licence restrictions included “additional virtualisation rights are not granted.” The new text is more explicit: “When using Datacenter edition with physical core licensing, unlimited virtualization does not apply.”
Under standard Windows Server licensing, a Datacenter edition licence grants unlimited virtualisation rights on the licensed server. That is one of the primary reasons organisations choose Datacenter over Standard. The new Product Terms text removes any ambiguity: this right does not carry over to the pay-as-you-go model.
However, it leaves one question open: what about the two virtual machines allowance for Windows Server Standard?
From Seven Rules to Two Sentences
The old Licence Restrictions contained a detailed paragraph:
Customer must have a valid Windows Server Standard or Windows Server Datacenter licence
No restrictions on the number of pay-as-you-go virtual machines that can be deployed
Additional virtualisation rights are not granted
One instance per operating system environment
A separate licence is required for each guest
Reassignment within the same Server Farm is unrestricted
Cross-Server Farm reassignment subject to a 90-day restriction
All of that has been replaced with two sentences. The phrase “subject to the respective licence model terms” is doing heavy lifting — it delegates the specifics to the underlying Standard and Datacenter licence model documentation. The detailed rules have not necessarily disappeared; they may now live in the licence model terms rather than in the pay-as-you-go-specific section.
The rewrite is a welcome simplification, but it does not answer every question we raised in December 2024. Whether Windows Server CALs are required under pay-as-you-go, what the minimum billed core count is, and how billing changes propagate remain outside the scope of the Product Terms.
🖐 Need help navigating Windows Server licensing under Azure Arc? Learn more: Microsoft Licensing Services for Enterprises.
Windows 10 ESU Cloud Managed: Prerequisites Relaxed
The Windows 10 ESU Cloud Managed eligibility requirements have been significantly reduced. The change applies to both the Microsoft Customer Agreement (MCA) and Enterprise Agreement/Enterprise Agreement Subscription (EA/EAS) Product Terms.
What Changed
The old text required any user accessing a device licensed with Windows 10 ESU Cloud Managed to be licensed with each of the following: Windows 10/11 Enterprise/Education, Intune, and Microsoft Entra ID P1/P2. It also noted that these licences are included in Microsoft 365 F3/E3/G3/E5/G5/A3/A5/Business Premium/Student Use Benefit.
The new text requires only: Intune and Microsoft Entra ID. Three things were removed:
The Windows 10/11 Enterprise/Education prerequisite is gone. Organisations no longer need an Enterprise or Education edition of Windows to qualify for ESU Cloud Managed.
The Entra ID requirement has been relaxed from P1/P2 to just Microsoft Entra ID, which includes the free tier.
The sentence listing Microsoft 365 bundles that include these prerequisites has been removed entirely.
Any organisation with Intune and any tier of Entra ID now qualifies for ESU Cloud Managed, regardless of Windows edition.
Who Benefits
Windows 10 ESU Cloud Managed is the Intune-delivered variant of Extended Security Updates for Windows 10, which reached end of support in October 2025. The “Cloud Managed” version allows organisations to deploy ESU patches through Intune rather than through traditional on-premises update mechanisms.
The prerequisite relaxation makes ESU Cloud Managed accessible to a much wider range of organisations. Previously, you needed Windows Enterprise or Education editions, which meant either a volume licensing agreement with Software Assurance or a Windows subscription. Now, any organisation with Intune and any tier of Microsoft Entra ID qualifies, regardless of their Windows edition.
This is particularly relevant for organisations running Windows 10 Pro under MCA or through OEM licensing. These organisations previously could not use ESU Cloud Managed without upgrading to Enterprise. That barrier is now removed.
Microsoft Entra ID Governance: Rebranding
Microsoft has renamed “Microsoft Entra ID Governance for External Identities” to “Microsoft Entra ID Governance for Guests” in the Microsoft Azure Product Terms. The change appears in both MCA and EA/EAS terms.
The functional definition remains identical: customers may use this SKU (including any applicable add-on) only for their External Users. The only change is the product name. This aligns with Microsoft’s broader pattern of consolidating “External Identities” terminology under “Guests” across the Entra ID product family.
No action is required unless your internal documentation or procurement records reference the old SKU name. If so, update them to avoid confusion during licence reconciliation.
If you have questions about how the Windows Server pay-as-you-go changes affect your Azure Arc deployment, or need help evaluating ESU Cloud Managed for your Windows 10 estate, get in touch. We don’t sell Microsoft licences or cloud services, so our advice is independent.