Windows 11 Migration and Windows 10 ESU Transition

A per-device compatibility assessment of your Windows 10 fleet, Intune-driven in-place upgrades to Windows 11 for qualifying devices, commercial ESU enrollment as a documented bridge for devices that must stay on Windows 10 temporarily, a replacement or Windows 365 Cloud PC recommendation for devices that cannot upgrade at all, and a closeout report with an ESU exit plan. Pricing is $25 per in-scope device plus a $1,950 tenant fee, over a planned 4 weeks.

Microsoft ended Windows 10 support on October 14, 2025. A Windows 10 device that is not enrolled in Extended Security Updates has received no security patches since then, while attackers keep working. That exposure is silent — everything still functions — which is exactly why unmanaged Windows 10 fleets persist. The assessment gives you a factual picture of the exposure within the first week.

Extended Security Updates is Microsoft's paid program that delivers security-only patches to Windows 10 after end of support — no new features, no non-security fixes, no general support. Microsoft's published commercial list price starts at $61 per device for the first year and doubles each subsequent year, and the commercial program runs only until October 2028. It is engineered to make staying more expensive every year, so we enroll only the devices that genuinely need time and write an exit date for each one.

No — the consumer program, which Microsoft extended for personal devices into 2027, is aimed at individuals and is not designed for company-managed fleets; commercial devices under management need the commercial ESU path. We handle commercial enrollment and activation as part of the service, and we confirm Microsoft's current pricing and eligibility rules before any purchase rather than relying on headlines.

Windows 11 requires TPM 2.0, UEFI with Secure Boot, a supported CPU, and minimum memory and storage. Some 'incompatible' devices are actually configuration problems — TPM or Secure Boot disabled in firmware on hardware that supports them — and we fix those rather than writing the device off. The assessment gives you a per-device verdict, not a fleet-level guess.

An in-place upgrade preserves applications, settings, and user data by design, and we run it that way — staged in rings with a pilot first. We still require current backups or OneDrive/Known Folder Move as a rollback story, because a per-device failure rate above zero is a planning assumption, not a surprise.

The upgrade itself runs through Intune during agreed maintenance windows, typically requiring one or more restarts per device. Users sign back in to the same applications and files on Windows 11. We schedule waves around your business calendar and handle failed devices individually through the exceptions log.

You get two costed options per device: replacement hardware — we specify what to buy and prepare Autopilot enrollment readiness, but procurement is yours — or a Windows 365 Cloud PC, where the old device becomes a viewer for a managed cloud-hosted Windows 11 desktop. One detail worth knowing for the Cloud PC route: Microsoft has stated that Windows 10 endpoints accessing Windows 365 Enterprise Cloud PCs can be entitled to ESU at no additional Microsoft charge, subject to Microsoft's conditions — which can make that path cheaper than it first looks.

The service is $25 per in-scope device plus a $1,950 tenant fee, fixed and quoted in writing before work begins — you pay after you approve delivery. The per-device fee covers assessment and disposition of every device in scope, whichever of the three paths it lands on. Microsoft's charges — ESU license fees, Windows 365 licensing if you choose that route — are separate and quoted transparently before purchase.

The upgrade machinery in this service is Intune-driven, so yes — devices need to be enrolled or enrollable. If your fleet is not there yet, our Microsoft Intune Initial Setup for Windows Device Management service establishes management first, and the two engagements chain cleanly.

Those services moved organizations onto Windows 10 while it was the standardization target, and they remain in the catalog honestly rather than silently vanishing. If your problem in 2026 is being on Windows 10, this service — off Windows 10, onto Windows 11 or a managed bridge — is the one you need.

The engagement is planned as 4 weeks: assessment and pilot in the first half, staged waves, ESU enrollment, and closeout in the second. Fleet size, maintenance-window availability, and how quickly disposition decisions get approved are the main variables; very large fleets get their own quoted schedule.

A fleet where every device has a documented disposition: upgraded and reporting compliant in Intune, ESU-enrolled with a written exit date, or flagged for replacement/Cloud PC with a recommendation. Plus the exceptions log, the ESU exit plan, and a closeout report your leadership and your cyber-insurance questionnaire can both live with.