Windows 10 Extended Security Updates (ESU) is a paid subscription that provides security patches now that mainstream support of Windows 10 has ended. Free security updates and technical support are no longer available.
ESU only provides security patches. It is a paid service that extends “critical” and “important” security updates for Windows 10 for a maximum of three years, but does not include technical support, non-security fixes or new features. Additionally, customers experiencing technical issues with Windows 10 that are unrelated to the ESU updates will be advised to upgrade to Windows 11. ESU does not provide complete patching, as vulnerabilities rated as “moderate” or “low” will not be addressed.
Given these limitations, Gartner recommends that regulated organisations assess whether Windows 10 ESU is compliant with regulatory definitions and requirements regarding end-of-life software.
A deep dive into Windows 10 ESU
For organisations that were unable to migrate by 14 October 2025, Microsoft offers the Windows 10 ESU programme. ESU is a paid annual subscription that delivers only “critical” and “important” security patches until 14 October 2028. Microsoft provides Windows 10 ESU for consumers and commercial customers.
The Windows 10 ESU programme is strictly limited to delivering “critical” and “important” security patches for vulnerabilities discovered after the end-of-support date. Vulnerabilities rated as “moderate” or “low” may not be addressed, meaning only partial coverage is provided. No additional updates, such as new feature releases, enhancements or non-security bug fixes, are provided, and the operating system remains functionally unchanged apart from these specified security patches.
ESU does not maintain a business-as-usual state, as general technical support is excluded. Microsoft will assist only with licence activation, ESU installation and troubleshooting issues directly caused by those updates. All other IT support, ranging from usability questions and hardware or software compatibility to performance issues, must be handled internally or by third-party providers.
Regulated organisations must assess whether Windows 10 ESU is compliant with their governing regulations. Many regulatory frameworks have explicit requirements and definitions around end-of-life (EOL) software, and non-compliance might have an additional financial impact.
Support for Microsoft 365 on Windows 10
On 24 April, 2025, Microsoft confirmed that Microsoft 365 applications on Windows 10 will continue to receive “critical” and “important” security updates until 10 October 2028 and feature updates through to October 2026. Support for these apps will be limited, and any issue affecting only Windows 10 may prompt a recommendation to migrate to Windows 11 for full compatibility and ongoing assistance.
Support for third-party applications on Windows 10 ESU will vary by provider, but plan for support ending on 14 October 2025. Organisations planning to run business-critical applications on Windows 10 ESU must confirm with the supplier that they will be supported before committing to purchasing.
ESU pricing doubles every year
Microsoft’s Windows 10 ESU licensing is structured to encourage migration to Windows 11 or Azure virtual environments by doubling prices each year for all customer segments. ESU licences are cumulative, so year two subscribers must purchase both year one and year two licences, and year three subscribers must cover all three years.
Educational institutions benefit from a significant discount compared to commercial organisations. Commercial customers that manage Windows 10 devices through Microsoft Intune receive a 25% reduction, lowering the first-year ESU fee to $45 per device. This escalating cost model reinforces Microsoft’s position that ESU is a short-term bridge and underscores the need to prioritise Windows 11 deployment.
ESU is available at no charge for Azure Virtual Machines and Windows 365 Cloud PCs. ESU is also provided for up to three years at no additional charge for Windows 10 virtual machines running in multiple Azure services, such as:
- Windows 365
- Azure Virtual Desktop
- Azure Virtual Machines
- Azure Dedicated Host
- Azure VMware Solution
- Nutanix Cloud Clusters on Azure
- Azure Local (Azure Local is the new name for Azure Stack HCI)
- Azure Stack Hub
- Azure Stack Edge
Physical Windows 10 endpoints connecting to Windows 365 Cloud PCs – for instance, a Windows 10 laptop used to access Windows 365 – are also entitled to ESU for up to three years with an active Windows 365 subscription. Running Windows 10 in Azure does not change the lack of technical support.
ESU is a temporary bridge
Gartner recommends upgrading to Windows 11 as soon as possible. Gartner clients have reported that migrating to Windows 11 has been substantially easier and less effort than previous Windows upgrades.
The Windows 10 ESU programme provides only “critical” and “important” security updates, leaving “moderate” and “low” vulnerabilities unpatched. Costs double annually, and support is limited to security fixes, making ESU unsuitable for long-term use. Non-security issues require internal or third-party support, increasing the total cost of ownership. Gartner urges organisations using Windows 10 ESU to recognise that it is a temporary, incomplete approach to supporting an estate of Windows-based PCs long-term.
However, for devices that cannot immediately meet Windows 11 hardware requirements, ESU may serve as a temporary bridge. Gartner urges IT leaders to regard the 14 October 2025 end-of-support date as a catalyst for broader IT strategy discussions, prioritising migration to ensure a secure and supported environment.
This article is an excerpt of Gartner’s What is the Windows 10 Extended Security Updates program? Timon Watson is a director analyst at Gartner.
