In late June 2026, Microsoft quietly updated its Windows 10 Extended Security Updates (ESU) documentation to show consumer coverage running through 12 October 2027 — a full year beyond the October 2026 cutoff that home users had been planning around. When pressed, Microsoft confirmed to Windows Latest that it was not a documentation error: "Windows 10 Extended Security Updates (ESU) program for personal use devices is being provided for an additional year, with coverage now available through Oct. 12, 2027." Reminder emails announcing the extension started landing in inboxes in mid-July.
That single sentence changes the calculus for hundreds of millions of PCs still running Windows 10. But it is easy to over-read: the extension applies to the consumer program only. If you manage domain-joined or MDM-enrolled fleets, the commercial ESU terms — escalating per-device pricing, cumulative back-billing, a hard three-year ceiling — are unchanged, and the Year 2 window opens this October. This article separates what actually changed from what did not, and lays out the decision.
What changed: the consumer program gets a second year
Windows 10 reached end of support on 14 October 2025. The consumer ESU program was originally a one-year bridge: critical and important security updates through 13 October 2026, no renewal option. That is the part Microsoft has now rewritten:
- Coverage now runs through 12 October 2027. One extra year of monthly security-only updates for Windows 10, version 22H2 (Home, Pro, Pro Education, and Pro for Workstations).
- Already enrolled? You do nothing. Microsoft states that existing enrollments automatically continue through the new end date.
- Enrollment stays open until the program ends. You can enroll any time up to 12 October 2027 — though an unenrolled device is unpatched in the meantime, so later is worse.
- The price did not go up. The three consumer enrollment routes are unchanged: free if you sync your PC settings with a Microsoft account, 1,000 Microsoft Rewards points, or a one-time $30 USD purchase. One consumer ESU license covers up to 10 devices.
Enrollment is built into the OS: Settings > Update & Security > Windows Update > Enroll now. Devices joined to a work domain or managed by MDM are not eligible for the consumer program — they fall under the commercial terms below.
What did not change: the commercial ESU clock is still ticking
For organisations buying ESU through Volume Licensing, nothing about the June announcement altered the schedule or the pricing. The commercial program remains a maximum of three years, priced per device, doubling each year:
| Commercial ESU year | Coverage window | Price per device | Cost if you join in that year |
|---|---|---|---|
| Year 1 | Nov 2025 – Oct 2026 | $61 | $61 |
| Year 2 | Oct 2026 – Oct 2027 | $122 | $183 (Year 1 billed retroactively) |
| Year 3 | Oct 2027 – Oct 2028 | $244 | $427 (Years 1 and 2 billed retroactively) |
Two rules bite hardest. First, ESU is cumulative: Microsoft's own FAQ states that if you purchase in Year 2, you must also pay for Year 1. There is no discount for arriving late — the opposite. Second, purchases are whole years only; you cannot buy six months to cover a migration that finishes in spring. The minimum purchase is one license, so small fleets are not locked out — but a 500-device estate that waits until November 2026 to decide is looking at $91,500 for Year 2 coverage, versus $30,500 if it had bought Year 1 and migrated before October.
The free ESU paths most admins overlook
Before budgeting a single ESU dollar, check whether your devices already qualify at no additional cost. ESU is included free for Windows 10 virtual machines running in Windows 365, Azure Virtual Desktop, Azure VMs, Azure Dedicated Host, Azure VMware Solution, Nutanix Cloud Clusters on Azure, Azure Local, Azure Stack Hub, and Azure Stack Edge. Separately — and this is the one that surprises people — physical Windows 10 endpoints that connect to a Windows 365 Cloud PC are entitled to ESU for up to three years with an active Windows 365 subscription. If you were already considering Cloud PCs for part of the estate, the ESU entitlement on the ageing endpoint hardware effectively rides along.
How to decide: a framework for the October 2026 checkpoint
Every Windows 10 device you still own falls into one of four buckets. The work between now and October is sorting the estate into them:
- Upgrade in place. Hardware meets Windows 11 requirements (TPM 2.0, supported CPU). This is the default answer — the upgrade is free, and every month on ESU is money spent standing still. Use Intune, Autopatch, or your deployment tooling to schedule waves before the Year 2 invoice, not after.
- Replace. Hardware fails Windows 11 requirements and the device matters. Compare the refresh cost against the ESU treadmill: $183 per device gets a late joiner through October 2027, and $427 through 2028 — before factoring in the operational risk of running a frozen OS. For most refresh cycles, that math favours replacement by Year 2.
- Cloud. Workloads that can move to Windows 365 or AVD take ESU off the bill entirely and give users Windows 11 regardless of what is on the desk.
- Pay for ESU — deliberately. Legitimate for devices tied to legacy applications, regulated validation cycles, or OT-adjacent systems that cannot move yet. The key word is deliberately: ESU should be a per-device decision with an exit date, not the default state of the fleet.
Whichever bucket a device lands in, remember what ESU actually buys: critical and important security updates only. No new features, no non-security fixes, no general technical support. And the ceiling is real — commercial coverage ends for good in October 2028, and the consumer program ends 12 October 2027 with no announced renewal.
Operational notes worth knowing
- Secure Boot certificate expiry. The 2011 Secure Boot certificates shipped with most Windows devices are expiring, and Microsoft is distributing the replacement 2023 certificates through the normal update channel. ESU-enrolled Windows 10 devices receive them with monthly updates; unenrolled devices do not, and outdated certificates can cause boot-validation problems on some hardware. This is a quiet but concrete reason enrollment matters even for "we accept the risk" machines.
- Version prerequisite. ESU requires Windows 10 22H2. Anything older must be brought current before it can receive ESU patches at all.
- Update pause behaviour. Windows 10 devices not enrolled in ESU have lost the ability to pause updates — which has caught out users mid-way through unintended Windows 11 upgrade prompts.
- Patch cadence has held. Microsoft has shipped a Windows 10 security update every Patch Tuesday since ESU launched in October 2025, including the July 2026 update with its RDP security improvements. The program is functioning as advertised — for those enrolled.
The bigger picture
The extension is a rare public concession that the Windows 11 hardware bar left too many working PCs behind, and that users are upgrading on their own timeline rather than Redmond's. For home users, it is an unambiguous win: another year of patches, same price, no action needed if already enrolled. For IT, it changes less than the headlines suggest — the commercial clock never moved, and the expensive year starts in October. If your estate still has meaningful Windows 10 numbers, the next 90 days decide whether Year 2 is a line item you chose or one you defaulted into. While you are rationalising licences, our Microsoft 365 E3 vs E5 vs E7 comparison covers the July 2026 licensing changes on the productivity side, and the Zero Trust cheat sheet is the reference for limiting the blast radius of the legacy devices you decide to keep.
Frequently asked questions
Did Microsoft extend Windows 10 support to 2027?
Yes, for consumers. In June 2026 Microsoft confirmed that the Windows 10 consumer Extended Security Updates (ESU) program now provides coverage through 12 October 2027 — one year beyond the original 13 October 2026 end date. Devices already enrolled are extended automatically, and new enrollment remains open until the program ends. Windows 10 itself reached end of support on 14 October 2025; ESU provides security updates only, not features or general support.
Does the extension apply to businesses?
No. The extension covers the consumer ESU program only. Commercial ESU purchased through Volume Licensing is unchanged: $61 per device for Year 1 (through October 2026), $122 for Year 2 (through October 2027), and $244 for Year 3 (through October 2028), with a three-year maximum. Purchases are cumulative — an organisation joining in Year 2 must also buy Year 1 — and must be bought in whole years. Domain-joined and MDM-managed devices are not eligible for the consumer program.
How much does Windows 10 ESU cost for home users?
Consumer enrollment is free if you sync your PC settings with a Microsoft account. Alternatively you can redeem 1,000 Microsoft Rewards points or make a one-time purchase of $30 USD. A single consumer ESU license covers up to 10 devices, and coverage now runs through 12 October 2027. Enrollment is in Settings > Update & Security > Windows Update > Enroll now, and requires Windows 10 version 22H2.
Can organisations get Windows 10 ESU for free?
In several scenarios, yes. ESU is included at no additional cost for Windows 10 virtual machines in Windows 365, Azure Virtual Desktop, Azure VMs, Azure Dedicated Host, Azure VMware Solution, Nutanix Cloud Clusters on Azure, Azure Local, Azure Stack Hub, and Azure Stack Edge. In addition, physical Windows 10 endpoints that connect to a Windows 365 Cloud PC are entitled to ESU for up to three years with an active Windows 365 subscription.
What happens if an organisation waits until Year 2 to buy ESU?
It pays for Year 1 retroactively. ESU purchases are cumulative, so joining in Year 2 (October 2026 – October 2027) costs $61 + $122 = $183 per device, and joining in Year 3 costs $61 + $122 + $244 = $427 per device. Partial-year purchases are not available, which is why the decision point is before the Year 2 window opens in October 2026 — waiting does not defer the cost, it increases it.
Is Windows 10 safe to use with ESU?
ESU keeps Windows 10 meaningfully safer than running it unpatched: enrolled devices receive critical and important security updates every month, and Microsoft has not missed a Patch Tuesday since the program launched. It also delivers the updated 2023 Secure Boot certificates. But ESU does not include new features, non-security fixes, or technical support, and coverage ends permanently — 12 October 2027 for consumers, October 2028 for commercial Year 3. Treat ESU as a bridge with a fixed end, not a destination.