Microsoft Windows 10 Extended Security Updates (ESU): Comparing all Licensing Options

Windows 10 will retire on October 14, 2025. After that date, most versions of Windows 10 (Windows 10 Enterprise and Education, Windows 10 Home and Pro, Windows 10 IoT Enterprise) will not get any security updates anymore, endangering your Windows 10 environments.

To extend your security updates on Windows 10 PCs, Microsoft offers Extended Security Updates (ESU), which can be licensed in various ways. These updates are essential for organizations that need extra time to transition to newer versions of Windows or to manage legacy applications that are not yet compatible with Windows 11.

In this article, you will learn about your options, and how to license correctly to save costs while securing your Windows 10 environments.

Overview

1. Virtualize in Azure
2. Standard ESU (“Windows 10 ESU” license)
3. Cloud Managed (“Windows 10 ESU Cloud Managed” license)
4. Windows 365

Licensing Options for Windows 10 Extended Security Updates (ESU)

There are four options to license Windows 10 Extended Security Updates (ESU), as shown below:

Let’s explore the available licensing options for Windows 10 ESU, in the order shown in the screenshot, with a clear explanation of what each option is, how it works, and who it is for:

1. Virtualize in Azure

• Pricing: No additional charge (available via SCHNEIDER IT MANAGEMENT).
• Availability: Automatically available for Windows 10 virtual machines hosted in Microsoft Azure. These include:
  • Azure Virtual Desktop
  • Azure virtual machines
  • Azure Dedicated Host
  • Azure VMware Solution (includes Citrix and Omnissa Horizon on Azure VMware Solution) (require manual ESU key activation)
  • Nutanix Cloud Clusters on Azure (require manual ESU key activation)
  • Azure Local (Azure Local is the new name for Azure Stack HCI)
  • Azure Stack Hub
  • Azure Stack Edge
• What is it?
  This option is designed for organizations already running workloads in the cloud. If your Windows 10 devices are virtualized in Azure, Microsoft automatically provides ESU updates free of additional charge. No separate license or activation is needed. Updates are delivered seamlessly as part of the Azure infrastructure. This is the simplest and most cost-effective ESU path for cloud-native environments.

2. Standard ESU (“Windows 10 ESU” license)

• What is it?
  • This is the traditional ESU license for on-premises Windows 10 devices. It uses 5×5 Multiple Activation Keys (MAK), which must be manually deployed to each device. These licenses are suitable for environments managed via System Center Configuration Manager (SCCM), Windows Server Update Services (WSUS), or other local tools. They provide critical security updates for devices that cannot yet migrate to Windows 11, ensuring compliance and protection beyond the official end-of-support date (October 14, 2025).
• Pricing:
  • Contact us for a quote, as pricing may vary.
  • Each year doubles in price, encouraging customers to migrate to Windows 11 sooner. This means, the price per year increases over time.
• Availability:
  • April 26, 2025: Available via Enterprise Agreement (EA) and Enterprise Subscription Agreement (EAS) (available via SCHNEIDER IT MANAGEMENT).
  • September 1, 2025: Available via Microsoft Cloud Solution Provider (CSP) (available via SCHNEIDER IT MANAGEMENT).
• Licensing: You need to purchase one Store Keeping Unit (SKU) per year. Each ESU year is a separate perpetual license, and you get security updates for that year only. That means:
  • Year 1: You buy the Windows 10 Extended Security 2025 Per Device SKU.
  • Year 2: You buy the Windows 10 Extended Security 2026 Per Device SKU.
  • Year 3: You buy the Windows 10 Extended Security 2027 Per Device SKU.

• You can purchase all three years, being three (3) SKUs, now but:
  • Year 2 and 3 SKUs will not deliver updates until their respective coverage periods begin.
  • If you want coverage for Year 2, they must also have purchased Year 1.

3. Cloud Managed (“Windows 10 ESU Cloud Managed” license)

• What is it?
  • This SKU is designed for organizations that manage devices using cloud-based tools like Microsoft Intune or Windows Autopatch. Unlike Standard ESU, no MAK keys are required—updates are delivered automatically and silently. This simplifies deployment and reduces administrative overhead. However, it is only available through EA/EAS, not CSP. Microsoft made no announcements, whether this will be added to CSP in the future (as of 2025-09-12).
  • Cloud Managed licenses allow you to conveniently manage Extended Security Updates (ESU) online via Windows Autopatch or Intune:

• Pricing:
  • Priced at an approximate discount of 25% compared to Standard ESU.
  • Contact us for a quote, as pricing may vary.
  • Each year doubles in price, encouraging customers to migrate to Windows 11 sooner. This means, the price per year increases over time.
• Availability:
  • April 26, 2025: Available via Enterprise Agreement (EA) and Enterprise Subscription Agreement (EAS) (available via SCHNEIDER IT MANAGEMENT).
  • Not available via CSP (subscribe to our Microsoft licensing newsletter to get informed if this changes).

• Licensing: You need to purchase one Store Keeping Unit (SKU) per year. Each ESU year is a separate perpetual license, and you get security updates for that year only. That means:
  • Year 1: You buy the Windows 10 Extended Security 2025 Per Device SKU.
  • Year 2: You buy the Windows 10 Extended Security 2026 Per Device SKU.
  • Year 3: You buy the Windows 10 Extended Security 2027 Per Device SKU.

• You can purchase all three years, being three (3) SKUs, now but:
  • Year 2 and 3 SKUs will not deliver updates until their respective coverage periods begin.
  • If you want coverage for Year 2, they must also have purchased Year 1.

4. Windows 365

• Pricing: No additional charge (available via SCHNEIDER IT MANAGEMENT).
• Availability: Automatically included with a Windows 365 Cloud PC subscription.
• What is it?
  This option is ideal for customers who want to extend the life of their existing Windows 10 hardware without purchasing ESU licenses separately. Here’s how it works:
  • The customer uses a Windows 10 device (e.g. a physical laptop running Windows 10) to connect to a Windows 11 Cloud PC hosted in Windows 365.
  • The Cloud PC is fully supported and secure.
  • The local Windows 10 endpoint (e.g. the physical laptop) receives ESU updates at no extra cost, as long as the customer has a Windows 365 subscription with at least a 1-year commitment.
  • No MAK keys or manual patching required.

  This is a modern, cloud-first solution that enables customers to stay secure while transitioning to Windows 11 at their own pace.

  • Hence, you could license your Windows 10 device for a Windows 11 Cloud PC via Windows 11 Enterprise/Business, and get the ESU for your Windows 10 device at no additional cost. Is the Windows 11 Enterprise/Business less expensive than the Standard ESU/Cloud Managed ESU alternative, this could be a great workaround. Until October 31, 2025, there is even a promotion available, offering 20% discount on all Cloud PC configurations of Windows 365 in CSP via SCHNEIDER IT MANAGEMENT: https://www.schneider.im/microsoft-windows-365-csp-promotion-save-20/.
• Requirements:
  • The Windows 10 device is either Microsoft Entra joined or Microsoft Entra hybrid joined. Devices that are only Entra registered aren’t eligible for commercial ESU access. Personal or BYOD devices that are not managed by the organization and are only Entra registered will not qualify for this entitlement.
  • The user must sign in to the Windows 10 device using their Microsoft Entra ID account at least once every 22 days to maintain ESU access. If this 22-day window lapses without sign-in, the device will no longer be entitled to new ESU updates until the user signs in again. The ESU license is valid for 30 days once issued, and the system attempts to renew it starting at day 22 to avoid service interruption.

Conclusion & Recommendation from SCHNEIDER IT MANAGEMENT

With Windows 10 reaching end-of-support on October 14, 2025, organizations must act decisively to maintain security and compliance. Microsoft’s Extended Security Updates (ESU) offer flexible paths to bridge the gap, but choosing the right licensing option depends on your infrastructure, management tools, licensing programs and migration timeline. Also, as Standard ESUs and Cloud Managed ESUs double in price every year, you should consider switching to Windows 11 as soon as possible.

• Cloud-first organizations already using Azure or Windows 365 should leverage these platforms to receive ESU updates at no additional cost. This is the most seamless and cost-effective route.
• On-premises environments should evaluate whether they are better suited for Standard ESU or Cloud Managed ESU:
  • If you use Intune or Autopatch, the Cloud Managed ESU offers a simpler deployment and is 25% more cost-efficient than Standard ESU. Cloud Managed ESU are only available in EA/EAS.
  • If you rely on SCCM or WSUS, the Standard ESU remains the reliable choice. These are available in EA/EAS/CSP.
  • Consider using Azure or Windows 365 to get ESU for Windows 10 at lower total cost.

Where can I find more information about Windows 10 lifecycle management?

Find a refresher on Windows lifecycle management by Microsoft here: https://www.youtube.com/live/NBzGmcGth9E.

Windows 10 retirement: https://learn.microsoft.com/en-us/lifecycle/end-of-support/end-of-support-2025.

How to enable ESU: https://learn.microsoft.com/en-us/windows/whats-new/enable-extended-security-updates.

How can I purchase Windows 10 ESU licensing options?

Contact our Microsoft licensing experts for licensing consultancy and procure all licensing options at the best conditions for your specific business case.