Windows 10 support ended on October 14, 2025. Since then, keeping those machines patched has meant paying Microsoft for Extended Security Updates, and the meter is about to jump. Year one costs $61 per device. On October 14, 2026, year two begins and the price doubles to $122. Year three doubles again to $244. And the charges are cumulative, so waiting to enroll does not save money, it stacks it.
For most organizations, the real answer is not paying that bill at all. This guide explains exactly what Windows 10 ESU costs, what you get for it, and the cheaper paths most companies have not fully worked through.
What is Windows 10 ESU?
Extended Security Updates are Microsoft’s paid program for keeping an operating system patched after its official end of support. When Windows 10 reached end of support in October 2025, it stopped receiving security updates by default. ESU buys those updates back, one year at a time, for up to three years.
It is important to be precise about what that includes. ESU delivers critical and important security updates only. It does not include new features, it does not include non-security bug fixes, and it does not include general technical support. It is a security bridge for machines you have not yet moved off Windows 10, not a way to keep running Windows 10 as if nothing changed.
How much does Windows 10 ESU cost?
For organizations, the pricing is straightforward and deliberately uncomfortable. It doubles every year, and you cannot skip a year to avoid it.
| ESU year | Coverage window | Price per device | Cost to enroll starting this year |
|---|---|---|---|
| Year 1 | Oct 15, 2025 to Oct 13, 2026 | $61 | $61 |
| Year 2 | Oct 14, 2026 to Oct 12, 2027 | $122 | $183 ($61 + $122) |
| Year 3 | Oct 13, 2027 to Oct 12, 2028 | $244 | $427 ($61 + $122 + $244) |
The cumulative rule is the part that catches teams out. ESU is sold as consecutive coverage, so if you skipped year one and decide to enroll in year two, you pay for both. A device that comes into the program in year three costs $427, not $244. There is no late entry at the current year’s price.
The math scales unpleasantly. A fleet of 2,000 Windows 10 devices is $122,000 in year one, $244,000 in year two, and $488,000 in year three, and close to $854,000 over the full three years if you carry every device the whole way. That is the number that makes migration look cheap.
One point that causes real confusion. This is the commercial pricing, for organizations. There is also a separate consumer ESU program for personal devices, and in June 2026 Microsoft extended it through October 12, 2027, free with settings sync, 1,000 Microsoft Rewards points, or a one-time $30 for up to 10 devices. It is tempting to assume that cheap consumer option covers the business too. It does not. Microsoft states the consumer program cannot be used in commercial scenarios and will not enroll domain-joined or MDM-managed devices, which is exactly what corporate machines are. The $30 route your employees can use at home is closed to the fleet you are responsible for.
Do you actually have to pay it?
This is the question most organizations skip past, and it is where the money is. There are three ways to avoid or reduce the ESU bill.
Move the devices that can move. Every Windows 10 device that meets the Windows 11 hardware requirements and can be migrated is a device you never pay ESU for. The blocker is usually inventory and effort, not licensing, and the deadline is a good forcing function to finally do it.
Use the cloud exception. Windows 10 running in Azure Virtual Desktop, Windows 365 Cloud PCs, and Azure virtual machines receives ESU at no additional cost. For organizations already moving workloads to virtual desktops, this quietly removes a chunk of the fleet from the paid program entirely. It is worth mapping which of your Windows 10 estate already qualifies.
Reserve paid ESU for the genuine holdouts. Some machines cannot move yet: hardware that fails the Windows 11 bar, devices tied to legacy applications, equipment on long refresh cycles. Those are the ones ESU is actually for. Paying $61 a device for a small, defined set of holdouts is a reasonable bridge. Paying it across an entire fleet because nobody made a plan is not.
What should you do before October 13?
The date that matters is October 13, 2026. After it, year two pricing applies and the cumulative clock starts working against you. Here is the sequence that keeps you in control of the number.
Inventory the Windows 10 fleet. You cannot make a cost decision without knowing how many devices are actually still on Windows 10 and which of them are even eligible for Windows 11.
Segment by what can move. Split the fleet into three buckets: devices that can migrate to Windows 11 now, devices that qualify for the free cloud-based ESU, and devices that genuinely cannot move and will need paid ESU.
Cost each path. Put the real numbers side by side: the migration effort versus one, two, or three years of doubling, cumulative ESU for each bucket. The comparison usually makes the decision obvious, and it is a decision finance should see before the bill arrives, not after.
Decide before the deadline, not at it. A plan made after October 13 is more expensive by definition, because the pricing has already stepped up.
The cost view, and where UMS fits
Windows 10 ESU is not really a security question. Your security team already knows unsupported machines need patching. It is a budget question, and it is one Microsoft has priced to reward the organizations that plan and penalize the ones that drift.
That is the discipline we bring. We have spent years pulling apart Microsoft estates and finding the difference between what a company is about to pay and what it actually needs to pay. ESU sits alongside your broader Microsoft spend, and the same principle applies to all of it: know your numbers, model the alternatives, and decide before the vendor’s deadline decides for you. For the wider picture, see software cost optimization and how we approach Microsoft optimization.
We are paid only from the savings we find. If you are staring at a Windows 10 fleet and an ESU quote, the time to run the numbers is before October 13, not after.
Frequently asked questions
How much does Windows 10 ESU cost? For organizations, Windows 10 Extended Security Updates cost $61 per device for year one, $122 for year two, and $244 for year three. The price doubles each year. These are Microsoft’s commercial list prices, separate from the consumer program for personal devices, which Microsoft extended to October 2027 but which cannot be used for business.
Are Windows 10 ESU charges cumulative? Yes. ESU is sold as consecutive years, and you cannot skip one. If you did not enroll in year one and you sign up in year two, you must buy year one as well. That makes a year two entry $183 per device, and a year three entry $427 per device. Waiting does not save money, it stacks it.
When is the Windows 10 ESU deadline? Windows 10 support ended on October 14, 2025. ESU year one runs to October 13, 2026, and year two begins October 14, 2026. October 13, 2026 is the date to have your decision made, because that is when year one pricing ends and the doubled, cumulative year two pricing begins.
What do you actually get with Windows 10 ESU? Critical and important security updates only. ESU does not include new features, non-security bug fixes, or general technical support. It is a security bridge for unsupported machines, not a continuation of full support.
Can you get Windows 10 ESU for free? In some cases, yes. Windows 10 running in Azure Virtual Desktop, Windows 365 Cloud PCs, and Azure virtual machines receives ESU at no additional cost. Individuals can use the consumer ESU program, which Microsoft extended through October 2027, but that program is barred from business use. For most on-premises corporate devices, the commercial per-device pricing applies.
Can my business use the $30 consumer ESU option? No. Microsoft extended the consumer Windows 10 ESU program through October 12, 2027, with free and low-cost enrollment, but it explicitly cannot be used in commercial scenarios and will not enroll domain-joined or MDM-managed devices. Corporate fleets fall under the commercial program, where year one is $61 per device, year two $122, and year three $244, cumulative. The cheap consumer route your staff can use on a home PC is not available to the business.
Is paying for Windows 10 ESU the right move? Usually only as a bridge. Because the cost doubles and stacks every year, paying ESU across a large fleet gets expensive fast. The cheaper answer for most organizations is to migrate the devices that can move to Windows 11, use the free cloud-based ESU where it applies, and reserve paid ESU for the machines that genuinely cannot move yet.
Source notes
- Lifecycle FAQ, Extended Security Updates (Microsoft Learn): Microsoft’s documentation for the Windows 10 ESU program, coverage scope, the year one to year three pricing structure, cumulative enrollment, and the no-additional-cost coverage for Windows 10 in Azure and Windows 365.
- Windows 10 Extended Security Updates for consumers (Microsoft): the consumer ESU program extended through October 12, 2027, and its explicit exclusion from commercial scenarios and domain-joined or MDM-managed devices.
- UMS Microsoft 365 optimization: the UMS service for modeling Microsoft estate costs and alternatives across licensing, cloud, and device lifecycle.