As support for Windows 10 officially ended on October 14, 2025, it is important that organizations with devices remaining on Windows 10 stay as protected as possible through the Windows 10 Extended Security Updates (ESU) program.
To help ensure your Windows 10 devices are activated with an ESU license, here is a quick guide on:
- Where to find the Multiple Activation Key (MAK) included with your Windows 10 ESU purchase.
- How to activate those licenses on your devices.
- How to prepare Windows 10 physical endpoints utilized by users with an active Windows 365 subscription.
For complete details on how to prepare your Windows 10 devices, see Enable Extended Security Updates.
Activating a Windows 10 ESU license on a physical device
Prerequisites for ESU activation
To activate the Windows 10 ESU MAK on a device, ensure the following requirements are met:
- Windows 10, version 22H2 with KB5066791, or a later update installed
- Local administrative privileges required
- Devices must be able to reach Microsoft activation endpoints:
- https://go.microsoft.com
- https://login.live.com
- https://activation.sls.microsoft.com
- http://crl.microsoft.com
- https://validation.sls.microsoft.com
- https://activation-v2.sls.microsoft.com
- https://validation-v2.sls.microsoft.com
- https://displaycatalog.mp.microsoft.com
- https://licensing.mp.microsoft.com
- https://purchase.mp.microsoft.com
- https://displaycatalog.md.mp.microsoft.com
- https://licensing.md.mp.microsoft.com
- https://purchase.md.mp.microsoft.com
Additional endpoints needed for Windows 10 devices accessing Windows 365 Cloud PCs:
- https://dls.microsoft.com
- https://login.windows.net
Locating your Windows 10 ESU Multiple Activation Key
Note: You must be assigned either the Product Key Reader or VL Administrator role in the Microsoft 365 Admin Center to view MAK keys. More information can be found at Manage volume licensing user roles.
After ensuring that your account has the necessary admin role:
- Sign in to the Microsoft 365 admin center at https://admin.microsoft.com.
- Navigate to Billing > Your Products > Volume licensing.
- Select View contracts and locate your ESU purchase.
- Click View product keys to display all available MAK keys.
If you cannot find your organization’s Windows 10 ESU MAK key, contact Microsoft volume licensing support.
Activating the ESU license on each device
You manage licensing and activation on devices using slmgr.vbs. To activate the ESU key on the client device, you have the following options:
- Use a management tool such as Microsoft Intune or Microsoft Configuration Manager to run the script.
- Use the Volume Activation Management Tool (VAMT) as a proxy activation server.
- Manually run a command line script on the device.
- Activate ESU keys via telephone.
For complete details on how to activate an ESU license for your Windows 10 devices, see Enable Extended Security Updates.
Verifying device licensing and ESU enrollment via MAK
To verify that the ESU key is installed and activated, run the following command from an elevated Command Prompt:
slmgr.vbs /dlv
The output should show the Name of the corresponding ESU program and the License Status as “Licensed” for that program.
Windows 365 and Windows 10 ESUs
Cloud PCs running Windows 10, version 22H2 in Azure are automatically entitled to Windows 10 ESUs at no additional cost and do not require license activation.
If your users connect to a Windows 365 Cloud PC from a physical Windows 10 endpoint, that endpoint may be entitled to ESUs at no additional cost. However, there are some requirements to enable the physical endpoint to receive ESUs:
- Devices must be Microsoft Entra joined or Microsoft Entra hybrid joined.
- Users with a Windows 365 subscription associated with their Microsoft Entra ID must sign in to the Windows 10 endpoint with their Microsoft Entra ID at least once every 22 days.
- A policy or registry key must be enabled on each physical device to enable the verification of the Windows 365 subscription.
Extended Security Updates for local devices accessing Windows 365
Windows 10 devices accessing Windows 365 Enterprise Cloud PCs and Windows 365 Frontline Cloud PCs in dedicated mode are automatically entitled to ESU for the duration of the ESU offer if the user has an active Windows 365 Enterprise license assigned or Windows 365 Frontline Cloud PC in dedicated mode provisioned, provided the following conditions are met:
- The local Windows 10 device is either Microsoft Entra joined or Microsoft Entra hybrid joined.
- Devices that are only Microsoft Entra registered or on-premises Active Directory joined aren't eligible for commercial ESU access with Windows 365. Windows Autopatch enrollment is not a requirement.
- Personal or BYOD devices that are not managed by the organization and are only Microsoft Entra registered will not qualify for this entitlement. These devices should be enrolled via the Consumer ESU program. An eligible user can activate up to 10 devices.
- Users must sign in to their physical Windows 10 device using the same Microsoft Entra ID account they use for Windows 365 Cloud PCs at least once every 22 days to maintain eligibility for ESU updates on that device.
Note: IT administrators must use Microsoft Intune or another MDM provider to deploy a custom policy that enables the EnableESUSubscriptionCheck flag. This policy helps verify whether a device is enrolled in the Windows 10 ESU subscription program. For complete details on how to prepare your Windows 10 devices, see Enable Extended Security Updates.
Verifying device licensing and ESU enrollment
You can verify that Windows 10 ESU entitlements are assigned to your users’ Windows 10 Cloud PCs and their physical Windows 10 endpoints in these locations:
- Windows 365 Enterprise - In the Microsoft 365 admin center, navigate to Billing > Licenses. Select your Windows 365 Enterprise subscription. Select the user you'd like to verify, then select Manage apps & services. In the flyout, confirm the user has the Windows 10 ESU Commercial listed and enabled for the user. To learn more, see Verify ESU enrollment for Windows 365 users and devices.
- Physical Windows 10 endpoints - In the Registry Editor, navigate to HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform\ESU. There should be a DWORD value for EnableESUSubscriptionCheck. The data should be 1. Or, in the Event Viewer, look for Event ID 113 under Applications and Services Logs > Microsoft > Windows > ClipESU.
Note: This event log is specific to the Windows 10 Cloud PC scenario and not MAK key scenarios in general.
Azure Virtual Desktop and Windows 10 ESUs
Windows 10 ESUs are available at no additional cost for Windows 10 virtual machines in the following Microsoft-hosted or Azure-integrated environments:
- Azure Virtual Desktop
- Azure virtual machines
- Azure Dedicated Host
- Azure Local (formerly Azure Stack HCI)
- Azure Stack Hub
- Azure Stack Edge
No additional configuration or keys are needed for these environments.
Other virtualization platforms that run on Microsoft Azure, (such as Nutanix, Citrix, or Omnissa Horizon on Azure VMware Solution) may require manual ESU key activation. Contact your Microsoft account team to obtain a 5x5 key. Activation can be managed with the VAMT or with a script.
Continue the conversation. Find best practices. Bookmark the Windows Tech Community, then follow us @MSWindowsITPro on X and on LinkedIn. Looking for support? Visit Windows on Microsoft Q&A.
Microsoft