When to use Windows 10 Extended Security Updates

2.14.2025: This post has been updated to provide clarity and updated information related to the options available for activating ESUs: traditional ESU activation and ESU activation via Windows 365 and Azure Virtual Desktop.

10.31.2024: On November 1, we will begin offering the traditional 5-by-5 Extended Security Update offer through the Volume Licensing price list. The first ESU will be available in November 2025. We’ll share more details on availability of the cloud-based Extended Security Update offer on our price list in the future.

4.2.2024: The details and pricing structure outlined in this post apply to commercial organizations only. Details will be shared at a later date for consumers on our consumer end of support page. Educational organizations can find tailored information about Windows 10 end of support in the Microsoft Education Blog.

Mark your calendars! By now, you've probably heard that Windows 10 will reach end of support on October 14, 2025 (except certain LTSC editions). If your organization must continue using Windows 10 for part of your device estate after support ends, you can enroll those PCs in the paid Extended Security Update (ESU) program. ESUs allow you to receive critical and/or important security updates for Windows 10 PCs when you need extra time to move to Windows 11.

In December, we outlined a plan for Windows 10 end of support with Windows 11, Windows 365, and ESU to help you continue to move forward and keep all your devices protected. Today, let's review your options, including a special offer for those using cloud-based update management. Read on for details!

Stay on a supported version of Windows

Organizations that run legacy software are at a higher risk of security breaches and potential compliance violations. While Windows 10 PCs will continue to function after they reach end of support, they will no longer receive security updates, bug fixes, feature improvements, or security issue resolutions. Upgrading to Windows 11 or transitioning to a new Windows 11 PC will help you deliver the best, most secure computing experience to your employees—and help protect your organization.

With Windows 10 end of support nearing, you have three options to stay on a supported version of Windows:

• Upgrade existing eligible PCs that meet Windows 11 hardware requirements. Just use Windows Autopatch or Microsoft Intune!
• Purchase new Windows 11 PCs. They offer powerful security features turned on by default, numerous accessibility, productivity, and AI enhancements, and are built for hybrid work.
• Migrate to the cloud with Windows 365 or Azure Virtual Desktop. Make Windows 11 available to users on any device.

Extended Security Updates are intended to help you make the transition

Enrolling in the Windows 10 ESU program enables you to continue receiving monthly security updates for your Windows 10 devices. That way, you have more time to complete your move to Windows 11.

Extended Security Updates are not intended to be a long-term solution but rather a temporary bridge. Extended Security Updates do not include new features, non-security fixes, or design change requests. The ESU program does not extend technical support for Windows 10. Technical support is limited to the activation of the ESU licenses, installation of ESU monthly updates, and addressing issues that may have been caused due to an update itself.

You can purchase ESU licenses for Windows 10 devices that you don't plan to upgrade to Windows 11 starting in October 2024, one year before the end of support date.

Note: The price of the ESU program will double every consecutive year, for a maximum of three years. If you decide to jump into the program in Year Two, you'll have to pay for Year One too, as ESUs are cumulative.

Two options for Windows 10 Extended Security Updates

There are two options for ESUs for your Windows 10 estate: the traditional license using a 5-by-5 activation key or activation as part of your Windows 365 or Azure Virtual Desktop subscription.

Traditional ESU activation

With the 5-by-5 activation method, you'll download an activation key and apply it to individual Windows 10 devices that you've selected for your ESU program. Manage it via scripting or the Volume Activation Management Tool (VAMT), among other methods. You can use on-premises management tools such as Windows Server Update Services (WSUS) to download and apply the updates to your Windows 10 devices.

The 5-by-5 activation subscription will establish the Year One list price of ESU for Windows 10.

This is the base license and will cost $61 USD per device for Year 1, similar to the Windows 7 ESU Year 1 price.^[1] It is now available through Volume Licensing.

For those organizations using a Microsoft cloud-based update management solution (i.e., Microsoft Intune or Windows Autopatch), there is a special offer.^[2]  You can manage and monitor the complete update process in Microsoft Intune or utilize Windows Autopatch to fully automate the update process for you. With Windows Autopatch, there is no required action on your part. Simply check the monthly update reports to understand the status of your environment.

This license has a ~25% discount and will cost $45 USD per user (up to five devices) for Year 1.^[1] This will be available through Volume Licensing on April 1, 2025.

ESU through Windows 365 and Azure Virtual Desktop

Windows 10 Cloud PCs in Windows 365 and virtual machines in Azure Virtual Desktop are automatically entitled to ESUs at no additional charge. 

Additionally, Windows 10 devices accessing Windows 11 Cloud PCs through Windows 365 will automatically be activated to receive security updates without any additional steps.

Benefits of cloud-based Windows management

Many organizations experience improvements for both employees and the IT organization by shifting Windows endpoint management to the cloud. For example, Westpac, Australia's first bank and oldest company, used Windows Autopatch to upgrade from Windows 10 to Windows 11 Enterprise. The industry-leading banking and financial services company supports more than 40,000 people across diverse locations. For their employees, Windows 11 Enterprise has delivered features that make it easy for them to stay organized and work securely from anywhere.

"With Windows Autopatch, we cut deployment time from 90 minutes to 25. So if you apply that across our 40,000+ strong workforce, that's a lot of time saved."

- Paul McKenna, Head of Workplace and Contact Centre Infrastructure, Westpac

You can learn from others, such as Petrobras, and their Windows 11 migration journeys by visiting the Microsoft Customer Stories site.

Simplifying the road to Windows 11

If you need support on your journey to cloud management, take advantage of Microsoft FastTrack or approved partners. FastTrack is a service that helps you move to the cloud faster and with more confidence. It offers free guidance and resources to help you identify and prioritize scenarios, as well as set business goals to measure success as you plan for rollout. It can also include guidance from Microsoft specialists, best practices, and tools. Get it all to help you migrate, deploy, and adopt Microsoft 365 solutions, including Windows 11, Windows 365 and Microsoft Intune.

Questions about the solutions that can help? Tune in April 10th to a special edition of Windows in the Cloud on Windows 365, Windows Autopatch, and ESUs!

Continue the conversation. Find best practices. Bookmark the Windows Tech Community, then follow us @MSWindowsITPro on X/Twitter. Looking for support? Visit Windows on Microsoft Q&A.

^[1] All prices are in US dollars. Regional prices will vary based on foreign exchange rates at the moment of ordering SKUs.

^[2] There will be special pricing for nonprofits.