When to use Windows 10 Extended Security Updates
Published Apr 02 2024 09:00 AM 73.2K Views

Editor’s note 4.3.2024: The details and pricing structure outlined in this post apply to commercial organizations only. Details will be shared at a later date for consumers on our consumer end of support page. Educational organizations can find tailored information about Windows 10 end of support in the Microsoft Education Blog.

Mark your calendars! By now, you've probably heard that Windows 10 will reach end of support on October 14, 2025 (except certain LTSC editions). If your organization must continue using Windows 10 for part of your device estate after support ends, you can enroll those PCs in the paid Extended Security Update (ESU) program. ESUs allow you to receive critical and/or important security updates for Windows 10 PCs when you need extra time to move to Windows 11.

In December, we outlined a plan for Windows 10 End of Support with Windows 11, Windows 365, and ESU to help you continue to move forward and keep all your devices protected. Today, let's review your options, including a special offer for those using cloud-based update management. Read on for details!

Stay on a supported version of Windows

Organizations that run legacy software are at a higher risk of security breaches and potential compliance violations. While Windows 10 PCs will continue to function after they reach end of support, they will no longer receive security updates, bug fixes, feature improvements, or security issue resolutions. Upgrading to Windows 11 or transitioning to a new Windows 11 PC will help you deliver the best, most secure computing experience to your employees—and help protect your organization.

With Windows 10 end of support nearing, you have three options to stay on a supported version of Windows:

  • Upgrade existing eligible PCs that meet Windows 11 hardware requirements. Just use Windows Autopatch or Microsoft Intune!
  • Purchase new Windows 11 PCs. They offer powerful security features turned on by default, numerous accessibility, productivity, and AI enhancements, and are built for hybrid work.
  • Migrate to the cloud and subscribe to Windows 365. Make Windows 11 available to users on any device with a Cloud PC. ESUs are available at no additional cost to those Windows 10 PCs that are used to access a Windows 365 Cloud PC running Windows 11.

Extended Security Updates are intended to help you make the transition

Enrolling in the Windows 10 ESU program enables you to continue receiving monthly security updates for your Windows 10 devices. That way, you have more time to complete your move to Windows 11.

Extended Security Updates are not intended to be a long-term solution but rather a temporary bridge. ESUs do not include new features, non-security fixes, or design change requests. The ESU program does not extend technical support for Windows 10. Technical support is limited to the activation of the ESU licenses, installation of ESU monthly updates, and addressing issues that may have been caused due to an update itself.

You can purchase ESU licenses for Windows 10 devices that you don't plan to upgrade to Windows 11 starting in October 2024, one year before the end of support date.

Note: The price will double every consecutive year, for a maximum of three years. If you decide to jump into the program in Year Two, you'll have to pay for Year One too, as ESUs are cumulative.

Three options to receive Extended Security Updates

You'll have three options to activate ESU for your Windows 10 estate: the traditional 5-by-5 activation key method, a cloud-based activation method, and activation included with your Windows 365 subscription.

Traditional 5-by-5 activation

With the 5-by-5 activation method, you'll download an activation key and apply it to individual Windows 10 devices that you've selected for your ESU program. Manage it via scripting or the Volume Activation Management Tool (VAMT), among other methods. You can use on-premises management tools such as Windows Server Update Services (WSUS) with Configuration Manager to download and apply the updates to your Windows 10 devices.

The 5-by-5 activation subscription will establish the Year One list price of ESU for Windows 10.

This is the base license and will cost $61 USD per device for Year 1, similar to the Windows 7 ESU Year 1 price.[1]

ESU through Windows 365

Windows 10 devices accessing Windows 11 Cloud PCs through Windows 365 will automatically be activated to receive security updates without any additional steps.

This license is included in the Windows 365 subscription at no additional cost with a one-year commitment.

A cloud-based way for PCs to receive Extended Security Updates

Today we're announcing a special offer for those organizations using a Microsoft cloud-based update management solution (i.e., Microsoft Intune or Windows Autopatch). You can receive a ~25% discount[2] on ESU licensing. Save time and money, as well as simplify activation!

Simply assign an ESU cloud activation license to enable Windows 10 devices to receive Year One ESU updates (no 5-by-5 key is necessary). You can manage and monitor the complete update process as usual in Microsoft Intune or utilize Windows Autopatch to fully automate the update process for you. With Windows Autopatch, there is no required action on your part. Simply check the monthly update reports to understand the status of your environment.

This license has a ~25% discount and will cost $45 USD per user (up to five devices) for Year 1.[1]

Benefits of cloud-based Windows management

Many organizations experience improvements for both employees and the IT organization by shifting Windows endpoint management to the cloud. For example, Westpac, Australia's first bank and oldest company, used Windows Autopatch to upgrade from Windows 10 to Windows 11 Enterprise. The industry-leading banking and financial services company supports more than 40,000 people across diverse locations. For their employees, Windows 11 Enterprise has delivered features that make it easy for them to stay organized and work securely from anywhere.

"With Windows Autopatch, we cut deployment time from 90 minutes to 25. So if you apply that across our 40,000+ strong workforce, that's a lot of time saved."

Paul McKenna: Head of Workplace and Contact Centre Infrastructure


You can learn from others, such as Petrobras, and their Windows 11 migration journeys by visiting the Microsoft Customer Stories site.

Simplifying the road to Windows 11

If you need support on your journey to cloud management, take advantage of Microsoft FastTrack or approved partners. FastTrack is a service that helps you move to the cloud faster and with more confidence. It offers free guidance and resources to help you identify and prioritize scenarios, as well as set business goals to measure success as you plan for rollout. It can also include guidance from Microsoft specialists, best practices, and tools. Get it all to help you migrate, deploy, and adopt Microsoft 365 solutions, including Windows 11, Windows 365 and Microsoft Intune.

Questions about the solutions that can help? Tune in April 10th to a special edition of Windows in the Cloud on Windows 365, Windows Autopatch, and ESUs!

Continue the conversation. Find best practices. Bookmark the Windows Tech Community, then follow us @MSWindowsITPro on X/Twitter. Looking for support? Visit Windows on Microsoft Q&A.

[1] All prices are in US dollars. Regional prices will vary based on foreign exchange rates at the moment of ordering SKUs.

[2] There will be special pricing for nonprofits.

Version history
Last update:
‎Apr 03 2024 01:37 PM
Updated by: