Windows 10 ESU now costs $122 per device. Plan the exit instead.

On October 13, 2026, the first year of commercial Windows 10 ESU (Extended Security Updates) ends. From October 14, every Windows 10 device that should keep receiving security fixes needs a year 2 licence, and Microsoft’s list price doubles from $61 to $122 per device.

For most organisations this is not a technical event. It is a purchasing decision, and it is often made by default: last year’s quantity, renewed. That default is expensive, because the device count from 12 months ago rarely matches the devices that still matter.

What changes on October 14, 2026

Microsoft sells Windows 10 ESU in fixed annual coverage periods. Year 1 ends on October 13, 2026, year 2 on October 12, 2027 and year 3, the last one, on October 10, 2028. There is no year 4.

Partial years are not available. A device that will be replaced in December still needs the full year 2 licence if it should be patched in November. Eligible are devices on Windows 10 version 22H2 in the Enterprise, Education and Pro editions in commercial use.

ESU contains critical and important security updates as rated by the Microsoft Security Response Center. It does not contain new features or non-security fixes. Support is limited to activation, installation and regressions caused by the ESU itself, and only with a paid Microsoft support plan.

Windows 10 ESU is cumulative, so late enrolment costs more

Microsoft only sells year 2 to customers who also hold year 1. An organisation that skipped year 1 and now needs coverage pays both years at once: $183 per device at list price. Year 3 then adds another $244.

Coverage year	Coverage ends	List price per device	Cumulative per device
Year 1	October 13, 2026	$61	$61
Year 2	October 12, 2027	$122	$183
Year 3	October 10, 2028	$244	$427

Take a typical environment with 400 remaining Windows 10 devices. Year 2 alone costs $48,800 at list price. If the same 400 devices were never enrolled in year 1, coverage from October 14 costs $73,200. Year 3 for the same fleet would be $97,600.

None of these numbers is dramatic for a large group. They become a problem when they are paid for devices that nobody needs.

The real cost sits in devices nobody can account for

In a typical environment the remaining Windows 10 devices fall into 3 groups. First, devices that could run Windows 11 but were never upgraded. Second, devices that cannot, because of TPM 2.0, processor or firmware requirements. Third, devices without a real owner: spare laptops, kiosk PCs, a test machine under a desk, the one PC that still runs a single production application.

Each group needs a different answer. The first group is an upgrade task, not an ESU case. The second group is a replacement or Cloud PC decision. The third group is where the money goes: licences bought for devices that should have been retired, isolated or documented a year ago.

The data to separate these groups usually exists already. Intune, Configuration Manager and the Entra ID sign-in logs show which devices still check in, who still signs in and which hardware fails the Windows 11 requirements. What is often missing is someone who reads that data before the order is placed, and who can say for each device why it stays.

Microsoft 365 Apps keep updating, Windows does not

Microsoft has separated the application lifecycle from the operating system. Microsoft 365 Apps on Windows 10 receive security updates until October 10, 2028. Feature updates and Copilot support end with Version 2608; after that the apps stay on this version and receive security fixes only.

Microsoft also announced that Defender Antivirus security intelligence updates continue on Windows 10 through October 2028. This creates a false sense of safety. Office patches arrive, signatures update, the device looks maintained in every dashboard. Without ESU, the operating system underneath receives no security fixes at all.

Support is limited as well. If a Microsoft 365 Apps problem occurs only on Windows 10 and not on Windows 11, Microsoft support asks the customer to move to Windows 11, with or without ESU.

Cloud PCs change the ESU calculation

Microsoft includes ESU at no additional cost for Windows 10 virtual machines in Windows 365, Azure Virtual Desktop and Azure virtual machines. Windows 10 endpoints that connect to a Windows 365 Cloud PC are also entitled to ESU for up to 3 years, as long as the Windows 365 licence stays active.

This is relevant for the second group: hardware that cannot run Windows 11 but still works. A Cloud PC moves the actual workload to Windows 11 and covers the old endpoint at the same time. It is not automatically cheaper. Compare the full Windows 365 cost over 12 months with ESU plus a later replacement, per device and per user, not as a flat average.

What to do now

1. IT Operations, this week: export every device still on Windows 10 with last sign-in, primary user, hardware model and Windows 11 readiness. Devices without a sign-in in the last 90 days do not belong in the ESU count until someone confirms they are needed.
2. CIO, before the order: split the list into upgrade, replace, Cloud PC and retire. Buy year 2 only for what remains, and give every covered device an owner and a planned exit date.
3. Security: require a current patch level in the Intune compliance policy and enforce it through Conditional Access. A Windows 10 device without ESU then loses access to Microsoft 365 instead of quietly staying online with a valid token.
4. CFO and CIO: put year 3 into the 2027 budget discussion now. At $244 per device, compare it with today’s replacement cost. Another year of waiting makes this comparison worse, not better.
5. Board: ask for a single number: how many Windows 10 devices will still exist on October 12, 2027, and who is responsible for each of them.

We treat end of support as an inventory question before it becomes a licensing question. Our agents read device, sign-in and licence data with read access only, and a senior partner signs off the final list: which devices keep ESU, which move and which go. That keeps licence spend tied to devices that are actually in use. This is part of our AI-Managed Operations and Cloud & AI Cost Reduction work; for a single assessment of your environment, see the Executive IT & AI Review.