Windows 10 End of Support: What the Extended Security Updates (ESU) Program Means for Your Organisation

Microsoft will officially end support for Windows 10 on 14 October 2025 (with the exception of certain LTSC editions). After that date, devices running Windows 10 will no longer receive free security updates, leaving them exposed to critical vulnerabilities.

For many organisations, upgrading to Windows 11 or modernising endpoints with Windows 365 will be the best route forward. But for those who need more time, Microsoft has introduced the Windows 10 Extended Security Updates (ESU) program.

What is the Windows 10 ESU Program?

The ESU program is an annual subscription service that delivers critical and important security updates for Windows 10 beyond the end-of-support date. It extends protection for up to three years (2025–2028), giving organisations flexibility while they plan their transition.

Key details:

• Covers critical and important security updates only.
• Includes support for ESU activation, update installation, and regressions.
• Requires a one-year minimum commitment, up to three years maximum.
• If you join in Year 2 or Year 3, you must also pay for the preceding years.

What Does It Cost?

The baseline cost is $61 per device for Year One and the price doubles every consecutive year, for a maximum of three years. However, organisations that update via Microsoft Intune or Windows Autopatch can benefit from a 25% discount, reducing the per-device cost.  

Windows 10 devices that connect to Windows 365 Enterprise or Frontline Cloud PCs in dedicated mode are entitled to ESUs at no additional cost for up to three years, provided the user has an active Windows 365 subscription (see details below).

To qualify, the following conditions must be met:

• The device must be Microsoft Entra joined or hybrid joined. Devices that are only Entra registered or solely joined to on-premises Active Directory do not qualify.
• The user must sign in to the device with their Microsoft Entra ID, the same account used to access Windows 365, at least once every 22 days. If this does not happen, the device will stop receiving updates until the next successful sign-in.
• ESU licences are valid for 30 days and the renewal process begins on day 22 to prevent interruptions.

Personal or bring-your-own devices that are only Entra registered are not eligible. These devices should instead be covered by the Consumer ESU program.

ESU is included at no additional cost for Windows 10 virtual machines running in Microsoft-hosted or Azure-integrated services, with no need for extra configuration or activation keys. This covers:

• Azure Virtual Desktop
• Azure Virtual Machines
• Azure Dedicated Host
• Azure Local (formerly Azure Stack HCI)
• Azure Stack Hub
• Azure Stack Edge
• Windows 365 Cloud PCs

Other virtualization platforms

If you are using services such as Nutanix, Citrix, or Omnissa Horizon on Azure VMware Solution, ESUs must be activated manually. To do this, you will need to request a 5x5 activation key from your Microsoft account team. The key can be applied using the Volume Activation Management Tool or through a script.

Options Beyond ESUs

While ESUs are a safety net, they should be considered a temporary solution. Organisations should plan for a longer-term endpoint strategy:

• Upgrade eligible PCs to Windows 11 – preserving existing hardware investments.
• Purchase new Windows 11 PCs – offering the best security, performance, and user experience.
• Subscribe to Windows 365 Cloud PCs – providing a flexible, secure option to run Windows 11 from the cloud, while extending support for existing Windows 10 endpoints.

Next Steps

If your organisation is still running Windows 10, now is the time to assess your estate and plan the transition. The ESU program ensures you remain protected in the short term, but the focus should be on moving forward to Windows 11 or Windows 365 for a secure, modern workplace.