Windows 10 Consumer ESU to October 2027: What Offices Need

Microsoft has extended Windows 10 Consumer Extended Security Updates (ESU) by one year, so enrolled personal devices now receive security updates through October 12, 2027. The extension does not give a small office a sanctioned free path for its business PCs, because Microsoft describes the program as one for personal use and excludes managed devices by name. This post covers what changed, which office PCs qualify, and the business path for the rest.

Most offices planned around the news that Windows 10 support ends in October 2025, and Windows 10 end of support arrived on October 14, 2025. Consumer ESU was set to end on October 13, 2026, until a June 2026 documentation update extended it. That original date has now passed without enrolled devices losing coverage.

Microsoft documents no separate Windows 10 ESU enrollment deadline. Its consumer page states that you can enroll “any time until the program ends on October 12, 2027,” and that already-enrolled devices continue automatically with “no action needed.” Updates stop on that date however late a device enrolls.

Microsoft describes eligibility in two places, and they do not use the same test. The End of support page states that “any individual using a Windows 10 device on version 22H2 for personal use is eligible,” and that this “excludes devices managed by an organization.” The consumer ESU page states that the program “can’t be used in commercial scenarios” and lists the technical setups where enrollment won’t be offered.

For eligible personal devices, Microsoft lists these requirements: Windows 10, version 22H2 in the Windows 10 Home, Professional, Pro Education, or Workstations edition; the latest Windows update installed; the Windows 10 ESU Licensing Preparation Package, KB5126256; and a Microsoft account that is an administrator account and not a child account. Enrollment starts from the Enroll now link in Windows Update. Microsoft’s United States page lists three ways to enroll: using Windows Backup to sync PC settings, redeeming Microsoft Rewards points through the Microsoft Rewards program, or a one-time purchase. One license covers up to 10 devices on the same Microsoft account, and options may vary by region, such as in the European Economic Area.

The table applies Microsoft’s published exclusions to common small office setups. The business-use row on the right is WME’s reading of the personal use wording; the other rows are Microsoft’s.

On a phone, scroll the table sideways to see both columns.

If you are not sure which column your office PCs fall into, WME can inventory your Windows 10 devices and map each to consumer ESU, Windows 11, commercial ESU, or Windows 365. Request an assessment to scope it.

Microsoft does not describe how the suspension is shown to the user. The rule also reaches employee home PCs: Entra registration alone keeps eligibility, but where a tenant automatically enrolls registered devices into Intune, the device becomes MDM-enrolled and the suspension applies.

For PCs that don’t meet the Windows 11 requirements, commercial ESU is sold through the Microsoft Volume Licensing Program, with a minimum purchase of one license, and Microsoft’s lifecycle FAQ lists Pro “in Commercial use” as eligible. It is cumulative, so an office buying now pays for Year 1 as well as Year 2. The commercial ESU Year 2 end date is October 12, 2027, and Year 3 ends October 10, 2028. Microsoft calls the program “a last resort paid option.”

ESU is included at no additional cost for Windows 10 virtual machines in Windows 365, Azure Virtual Desktop, Azure virtual machines, Azure Dedicated Host, Azure Local, Azure Stack Hub, and Azure Stack Edge. Earlier versions of that list included Azure VMware Solution and Nutanix Cloud Clusters on Azure, and the current page states that such platforms may require manual ESU key activation. A physical Windows 10 PC that connects to Windows 365 is also entitled, but only for Windows 365 Enterprise or Windows 365 Flex in dedicated mode, with the PC Microsoft Entra joined or hybrid joined and the user signing in “at least once every 22 days.” Microsoft’s configuration page omits Windows 365 Business.

ESU delivers critical and important security updates as defined by the Microsoft Security Response Center (MSRC). It brings no new features, customer-requested nonsecurity updates, or design change requests, and no technical support beyond ESU activation and installation. Microsoft states that antivirus software can help, but “it’s not enough on its own” without regular security updates.

Microsoft 365 Apps keep their own timeline, with security updates on Windows 10 through October 10, 2028, and Microsoft recommends backing up files to OneDrive with Windows Backup before moving to Windows 11. Neither replaces Windows 10 patches.