Enable Windows 10 Extended Security Update

Hi All,

We are managing our Windows 10 workstation fleet using SCCM, with activation handled via KMS. Since we have not yet transitioned to Windows 11, we’ve purchased ESU licenses.

Microsoft provides detailed guidance on activating ESU through various methods — including Intune, phone, Internet, and the Volume Activation Management Tool (VMAT) for clients without Internet access — which is very helpful.

https://learn.microsoft.com/en-us/windows/whats-new/enable-extended-security-updates

Does anyone know the best method to enable ESU for enterprise workstations using SCCM/KMS, or through any alternative approach?

Thank you in advance.