Year one of the Windows 10 Extended Security Updates program ends on October 13, 2026, and year two costs twice as much per device. The three trade-offs, the consumer-program trap, and the cases where coverage is already included at no extra cost.
Three dates, three prices
Windows 10 reached end of support on October 14, 2025, but many organizations bought themselves a year with ESU licences. That reprieve ends on October 13, 2026, and what comes next costs twice as much. The decision has to be made now, not in October.
The Extended Security Updates (ESU) program is split into three coverage years, documented to the day by Microsoft in Partner Center: year one runs from October 15, 2025 to October 13, 2026, year two from October 14, 2026 to October 12, 2027, and year three from October 13, 2027 to October 10, 2028. After that last date, there is nothing left to buy.
The price doubles at every step: US$61 per device for year one, US$122 for year two, US$244 for year three (Microsoft Learn, Windows 10 ESU program). Two details change the math. First, the years are cumulative: an organization that has bought nothing so far and enrols now pays for year one on top of year two. Second, in CSP, Windows 10 ESUs are perpetual licences billed once, with no proration. Keeping a device three extra months costs a full year.
The consumer program is not an option here
Since June 2026, Microsoft has offered ESU free of charge to consumers through October 12, 2027, via Windows settings backup, 1,000 Microsoft Rewards points, or a one-time US$30 purchase. That route comes up in almost every internal discussion, and it does not apply.
The official page is unambiguous: the consumer program cannot be used in commercial scenarios and excludes devices joined to an Active Directory or Entra domain, devices enrolled in a mobile device management solution, and kiosk mode. In other words, just about any managed fleet.
Windows 10 end of support: three trade-offs, not four
The common mistake is treating these three options as a single choice for the whole fleet. In practice they coexist: most devices migrate, a handful stay on ESU, and the truly stuck cases move to a virtual desktop.
- Migrate to Windows 11: the only option that solves the problem instead of renting a solution by the year. It runs into hardware, not software, devices without TPM 2.0 or outside the supported processor list will not make it.
- Buy year two: defensible for a small batch of genuinely stuck devices, machine tools, uncertified line-of-business software, instrumentation workstations. Much harder to justify beyond a few dozen devices, especially with year three at US$244 waiting behind it.
- Move the workload to a virtual desktop: Windows 365 or Azure Virtual Desktop, where coverage is included.
Coverage you may already have, if you know where to look
Microsoft grants ESU at no additional cost to Windows 10 virtual machines hosted in Windows 365, Azure Virtual Desktop, Azure virtual machines, Azure Local and Azure VMware Solution. No key to buy, no activation to perform.
The entitlement even extends to physical devices. A user holding a Windows 365 Enterprise licence with an assigned Cloud PC, or a Windows 365 Flex Dedicated licence, also covers the physical device they connect from. Two conditions to keep in mind: eligibility is revalidated at each connection, and the user must connect at least once every 22 days to keep it. Microsoft also notes that no admin tool lists the endpoints that claimed ESU this way, which leaves tracking entirely manual.
What is left to do before mid-October
An unpatched device is not just a technical risk. In front of a cyber insurer, a prime contractor or Quebec's Commission d'accès à l'information, an unsupported fleet handling personal information is hard to defend. Better to settle it while it is still a budget trade-off.
- Inventory: how many devices are still on Windows 10, and how many are on version 22H2. That is an absolute prerequisite, no other version receives the fixes, even paid ones.
- Sort into three piles: Windows 11 compatible, incompatible but replaceable before October, genuinely stuck.
- Cost it over two years, not one: year three at US$244 per device often flips the conclusion of a one-year calculation.
- Decide before the end of September: the switch happens on October 14 and nothing is prorated.
Want to talk it through?
Let's spend 30 minutes on your situation.
A free assessment with an io4 architect. No commitment, no pressure.
Book my assessment
