Windows 10 ESU Year One Ends 13 October 2026: The Year-Two Plan
Year one of Windows 10 Extended Security Updates (ESU) for organizations ends on 13 October 2026. From 14 October 2026 a domain-joined, Entra-joined or Intune-enrolled Windows 10 device receives no security updates unless it carries a year-two license, and the consumer extension to 12 October 2027 does not apply to it. This article gives the dates that still matter, how year-two licensing works, how to sort a fleet into five lists, and the order of work with a date against each step.
What ends on 13 October 2026 and what keeps running
Windows 10 reached end of support on 14 October 2025. Every operating system security update a Windows 10 device has received since then has come from the Extended Security Updates program. For organizations, Microsoft sells ESU in three one-year terms. Year one ends on 13 October 2026. Year two runs from 14 October 2026 to 12 October 2027. Year three runs from 13 October 2027 to 10 October 2028, and Microsoft has announced nothing after that.
Three things keep running on a device without a year-two license. Windows 10 itself keeps working. The upgrade path to Windows 11 stays open; ESU enrollment neither blocks nor is required for it. And the Microsoft 365 Apps keep receiving security updates on Windows 10 until 10 October 2028, three years after the operating system's end of support. One thing stops: the monthly Critical and Important security updates for Windows 10 itself.
ESU delivers Critical and Important security updates only: no feature updates, no non-security fixes, and no technical support for Windows 10 beyond help with activating the license and installing the updates.
| Date | What happens | Who it affects |
|---|---|---|
| 14 October 2025 | Windows 10 end of support; version 22H2 was the last version | Every Windows 10 device |
| 13 October 2026 | Commercial ESU year one ends | Devices licensed for year one |
| 12 October 2027 | Commercial ESU year two ends; consumer ESU program ends | Year-two devices; personal PCs |
| 10 October 2028 | Commercial ESU year three ends; security updates for Microsoft 365 Apps on Windows 10 end | Year-three devices; every Windows 10 device running Office |
The rule for a reader arriving after 14 October 2026: a managed Windows 10 device with neither a year-two ESU license nor a completed Windows 11 upgrade is unpatched today, and it is handled as unpatched (isolated or restricted) until one of the two is true.
The consumer extension to 12 October 2027 is not for managed devices
Microsoft's consumer ESU program now runs until 12 October 2027. It enrolls from Windows Update on a device running Windows 10 version 22H2 in the Home, Pro, Pro Education or Workstations edition, with the ESU Licensing Preparation Package (KB5126256) installed. There are three enrollment options: at no additional cost when the PC syncs its settings with a Microsoft account, by redeeming 1,000 Microsoft Rewards points, or by a one-time purchase. One consumer license covers up to 10 devices on the same Microsoft account, and enrollment stays open until the program ends.
Microsoft states that the consumer program cannot be used in commercial scenarios. Enrollment is not offered for devices in kiosk mode, devices managed by an organization or enrolled in an enterprise licensing program, or devices that already have an ESU license. If a consumer-enrolled device later becomes a commercial device, its consumer enrollment is suspended until it stops being used that way.
One case does qualify: a personally owned PC that is only Microsoft Entra registered, the state a device reaches when someone adds a work account to their own computer. Microsoft explicitly allows those devices to use the consumer program. That is a fair answer for an owner-operator or two contractors. It is not a plan for a fleet, and those personal devices still belong in your security scope: put the work data under Intune app protection without enrolling the device ($5 per user plus a $1,950 tenant fee, quoted in writing before work begins).
How year-two licensing works
Commercial ESU is licensed per device, per year, and bought through a Cloud Solution Provider partner or through volume licensing. Microsoft's ESU fee is Microsoft's charge to you, on your own agreement; a partner's fee for doing the work is a separate line. Windows 10 ESU is not on the October 2026 price list we publish prices from, so the per-device fee is quoted on request. Put your device counts into the Windows 10 ESU calculator to see what year two and year three add up to against the alternatives.
Four mechanics decide what year two costs and how fast you can turn it on.
The years are cumulative. A device that was not licensed in year one and needs coverage in year two is licensed for year one as well. Waiting did not avoid the year-one cost; it deferred it.
The prerequisites take a patch cycle. A device must be on Windows 10 version 22H2 with the current cumulative update and the ESU licensing preparation package installed before it receives ESU updates. A machine that is months behind on patching cannot be licensed on a Friday and be current on Monday.
Activation depends on how the device is managed. Devices enrolled in Intune or Windows Autopatch have the ESU entitlement applied from the cloud, with enrollment state visible in reporting. Estates patched through WSUS or Configuration Manager activate with a key, managed through the Volume Activation Management Tool or a script. If the fleet is not in Intune yet, that is the first fix, because Intune is also what delivers the Windows 11 upgrade.
Some devices are covered without a separate ESU purchase. Microsoft's documentation lists Windows 10 session hosts in Azure Virtual Desktop, Windows 10 virtual machines in Azure, and Windows 365 Cloud PCs running Windows 10 as needing no additional configuration or keys. A physical Windows 10 device whose only job is to reach a Windows 365 Cloud PC also qualifies, but it must be enabled explicitly through an Intune policy or a registry setting before it receives ESU updates.
The decision rule we apply before licensing any device for year two: it fails the Windows 11 hardware check, it must stay in service after 31 December 2026, and it has a named owner and a written exit date. A device that meets only the first condition is a replacement, not an ESU purchase.
Sort every device into one of five lists
Windows 11 requires a processor at 1 GHz or faster with two or more cores on a compatible 64-bit processor, 4 GB of RAM, 64 GB of storage, UEFI firmware that is Secure Boot capable, and TPM version 2.0. Run the hardware check across the fleet and sort each device into one list.
| List | The device | The path | What it takes |
|---|---|---|---|
| A | Passes the Windows 11 check and runs standard applications | In-place upgrade through Intune feature update policy, in rings | Hours per device, keeps applications, settings and data |
| B | Fails only on a firmware setting: TPM switched off, legacy boot instead of UEFI | Fix the setting, then move to list A | Minutes per device, scripted or a single visit |
| C | Fails the hardware check and was due for replacement anyway | Replace; the new device enrolls through Windows Autopilot | Procurement lead time, near-zero build time |
| D | Fails the hardware check and must stay in service past 31 December 2026 | Year-two ESU with a named owner and an exit date | License order, prerequisites, activation, then a replacement plan |
| E | User needs a current managed desktop and there is no hardware budget | Windows 365 Cloud PC; the old device becomes a viewer | About two weeks to deploy, then per-user cutover |
List B is where the assessment pays for itself: many devices that fail a readiness scan fail on a BIOS setting rather than on silicon, and each one found needs neither a license nor a purchase order.
List E has list prices you can plan with. A Windows 365 Business Cloud PC with 2 vCPU, 8 GB and 128 GB is $32.40 per user per month on an annual commitment ($388.80 per year); the 4 vCPU, 16 GB, 128 GB size is $50.40 per month ($604.80 per year). Both are Microsoft list price, October 2026 price list, billed to you by Microsoft.
The order of work from 14 October 2026
- By 16 October 2026: count. Pull the device list from Intune, then reconcile it against your RMM tool, Active Directory and DHCP leases. Record edition, Windows 10 version, TPM state, Secure Boot state, processor, owner, and the date of the last installed cumulative update. The devices that hurt are the ones missing from one of those lists.
- By 23 October 2026: license list D. Order year-two ESU (and year one for any device that skipped it), confirm the licensing preparation package and the October 2026 cumulative update are installed, and confirm activation in Intune reporting or in the activation tool. Nothing on list D should wait for the upgrade project to finish.
- By 30 October 2026: contain everything else. Any Windows 10 device that is neither licensed nor upgraded gets a compensating control in writing: local administrator rights removed, access to email and VPN blocked by a Conditional Access policy that requires a compliant device, and a date by which it leaves list "unknown".
- 2 November to 18 December 2026: upgrade list A. A pilot ring of about ten devices whose users can tolerate a bad afternoon, then weekly waves through Intune feature update policy. Leave the finance workstation and the machine wired to the label printer until the pattern holds.
- By 31 March 2027: replace list C. New devices arrive Autopilot-ready, and device migration automation moves the user state across.
- By 1 September 2027: decide year three. Year two ends on 12 October 2027. Every device still on list D on 1 September 2027 needs either a year-three license order or a retirement date, chosen on purpose.
If the fleet is not in Intune at all, step 0 is Intune initial setup for Windows device management ($6,500 per project), because steps 2 through 5 all depend on it.
What the management layer costs at Microsoft list price
Every price below is Microsoft list price from the October 2026 price list, per user per month on an annual commitment, with the per-year figure in brackets. Microsoft bills these to you.
| What you need | Where it comes from | Price |
|---|---|---|
| Device management for upgrades, ESU activation and compliance | Microsoft Intune Plan 1 | $8.00 ($96.00); $9.60 month to month |
| The same, for a device with no named user | Microsoft Intune Plan 1 Device | $2.70 ($32.40) |
| Intune plus Entra ID P1 for Conditional Access, plus Defender for Business and Office | Microsoft 365 Business Premium | $22.00 ($264.00); $26.40 month to month |
| Enterprise equivalent | Microsoft 365 E3 | $39.00 ($468.00) |
| Endpoint protection on its own | Microsoft Defender for Business | $3.00 ($36.00) |
| Windows 10 ESU year two | Through CSP, per device | Quoted on request |
The IT Partner services that do the work are fixed price, quoted in writing before work begins: Windows 11 Migration and Windows 10 ESU Transition at $25 per device plus a $1,950 tenant fee, Intune initial setup for Windows Autopilot at $1,300 per project, Windows 365 Cloud PC implementation at $3,950 per project, and the managed Intune service at $5 per device per month once the fleet is in.
What to write down for your insurer, auditor and board
A cyber-insurance questionnaire asks whether every endpoint receives security updates. From 14 October 2026 the honest answer for a Windows 10 device is "yes, under ESU year two until 12 October 2027" or "no". Keep one register that your renewal and your audit can both read: device name, list (A to E), Windows version today, ESU license year and activation date if any, owner, exit date, and the compensating controls in force for anything unlicensed.
The same register answers the board's question, which is not "are we on Windows 11" but "what is still on Windows 10, why, until when, and at what cost per month". Three dates belong on the first page: 12 October 2027, 10 October 2028, and your own hardware refresh date. The other Microsoft retirements of the next two years are on our Microsoft deadlines page; several land close together, so plan them as one sequence.
Frequently asked questions
Is Windows 10 still getting security updates after 13 October 2026?
Only on devices with a valid ESU license for year two, which runs from 14 October 2026 to 12 October 2027, or on personal devices enrolled in the consumer program, which also ends on 12 October 2027. Every other Windows 10 device stopped receiving operating system security updates on 14 October 2025.
Can I buy ESU year two if I skipped year one?
Yes, but the years are cumulative: a device entering the program in year two is licensed for year one as well. The ESU fee is Microsoft's charge, billed to you, and is quoted on request because it is not on the published October 2026 price list.
Do Azure Virtual Desktop session hosts and Windows 365 Cloud PCs need an ESU license?
No. Microsoft lists Windows 10 session hosts in Azure Virtual Desktop, Windows 10 virtual machines in Azure, and Windows 365 Cloud PCs as needing no additional configuration or keys. A physical Windows 10 device used to reach a Cloud PC is also covered, but only after it is enabled through an Intune policy or registry setting.
Can I enroll company laptops in the consumer ESU program until October 2027?
No. Microsoft excludes devices managed by an organization or enrolled in an enterprise licensing program, devices in kiosk mode, and devices that already hold an ESU license. A personal PC that is only Microsoft Entra registered can use the consumer route.
Do the Microsoft 365 Apps keep working on Windows 10?
They keep working and keep receiving security updates until 10 October 2028. Feature updates for the apps are a separate matter, and the operating system underneath them is unpatched unless the device holds an ESU license.
How do I know which PCs can take Windows 11?
Check each device against Microsoft's minimum requirements: a 1 GHz or faster processor with two or more cores on a compatible 64-bit processor, 4 GB of RAM, 64 GB of storage, UEFI firmware that is Secure Boot capable, and TPM 2.0. Intune's feature update readiness report, or a scripted check through your RMM tool, does this across a fleet in a day.
Sources
- Windows 10 end of support — Microsoft, checked 2026-10-11
- Windows 10 Consumer Extended Security Updates (ESU) — Microsoft, checked 2026-10-11
- Windows 11 specifications and system requirements — Microsoft, checked 2026-10-11
- Windows 10 Extended Security Updates — Microsoft Learn, checked 2026-10-11
- Enable Extended Security Updates — Microsoft Learn, checked 2026-10-11
- Understanding Extended Security Updates (ESU) for Windows 10: Windows 365 deployment scenarios — Microsoft Learn, checked 2026-10-11
- Windows 10 Home and Pro lifecycle — Microsoft Learn, checked 2026-10-11
Key takeaways
- Commercial Windows 10 ESU year one ends on 13 October 2026; year two runs to 12 October 2027 and year three to 10 October 2028, with nothing announced beyond that.
- The consumer program's extension to 12 October 2027 excludes devices managed by an organization, kiosk devices and devices that already hold an ESU license; only a personal, Entra-registered PC qualifies.
- ESU years are cumulative, the prerequisites (version 22H2, the current cumulative update and the licensing preparation package) take a patch cycle, and Intune or Windows Autopatch applies the entitlement from the cloud.
- Windows 10 session hosts in Azure Virtual Desktop, Windows 10 Azure VMs and Windows 365 Cloud PCs are covered without a separate purchase; a physical device used only to reach a Cloud PC needs an Intune policy first.
- Sort the fleet into five lists: upgrade, fix firmware then upgrade, replace, bridge on ESU with an exit date, or move the user to a Windows 365 Cloud PC at $32.40 per month list price.
- Microsoft 365 Apps keep receiving security updates on Windows 10 until 10 October 2028, which is a reason the operating system date, not the Office date, drives the plan.
Put your device counts into the Windows 10 ESU calculator to see what year two and year three cost against upgrading or replacing. When you are ready to run the list, Windows 11 Migration and Windows 10 ESU Transition delivers the per-device assessment, the Intune upgrade rings, year-two ESU enrollment for the devices that need it, and a written exit date for each one, at $25 per device plus a $1,950 tenant fee, quoted in writing before work begins.
Questions this article didn’t answer?
Thirty minutes with Mike — our CEO, not a sales rep. Bring the hard version of the question.