Windows 10 Extended Security Updates move into Year Two around November 2026, and Microsoft doubles the price every consecutive year. Year One is 61 US dollars per device. Year Two is roughly double that, Year Three double again, and if you skipped Year One you have to buy it retroactively before you can buy Year Two.
So this autumn is a decision point rather than a renewal. Paying again is a legitimate answer. Paying again without having decided is the expensive one.
What ESU actually gives you
Less than most people assume. Under the Microsoft ESU programme, an enrolled device receives critical and important security updates. That is the whole offer.
Microsoft is explicit that ESU does not include new features, customer-requested non-security updates, design change requests, or general technical support for Windows. Support is limited to the activation and installation of ESU itself and any regressions it causes. It keeps the machine patched; it does not make Windows 10 a supported operating system again.
When does Year Two start, and can we buy part of it?
Windows 10 reached end of support on 14 October 2025, and Microsoft states that Year One starts in November 2025. Year Two therefore begins around November 2026.
You cannot buy part of a year. Microsoft states that the programme must be purchased by year and that customers cannot buy partial periods, for instance only six months. There is no half-year option to bridge a migration that slips.
What does it cost?
Microsoft's published price for organisations through Volume Licensing is 61 US dollars per device for Year One, and the page states the price doubles every consecutive year, for a maximum of three years.
| ESU year | Microsoft list price, per device | Runs from |
|---|---|---|
| Year One | $61 USD | November 2025 |
| Year Two | Doubles, so around $122 | Around November 2026 |
| Year Three | Doubles again, around $244 | Around November 2027 |
| Year Four | Does not exist | Maximum is three years |
Those are Microsoft's list prices in US dollars, not ours. What you actually pay depends on your licensing route and reseller, so treat the table as the shape of the problem rather than a quote. The shape is the point: the third year costs four times the first, and then the option disappears entirely.
The part that catches people out: ESU is cumulative
This is the detail worth circulating to whoever signs off the spend. Microsoft states that if you decide to purchase the programme in Year Two, you have to pay for Year One too, because ESUs are cumulative.
So an organisation that decided to "wait and see" through Year One has not saved anything. It has accrued a bill it must clear before it can buy the year it actually wants, and it has spent twelve months running unpatched machines to get there. If that describes you, the sooner you act the smaller the number gets, which is the opposite of how most deadlines behave.
Where ESU is already included
Worth checking before you buy anything. Microsoft provides ESU at no additional cost for Windows 10 virtual machines running in Windows 365, Azure Virtual Desktop, Azure virtual machines, Azure Local and several other Azure services. Windows 10 endpoints connecting to a Windows 365 Cloud PC are also entitled to ESU for up to three years with an active subscription.
If a move to Windows 365 was already somewhere on your roadmap, the ESU saving changes the arithmetic on bringing it forward.
Is your hardware even eligible?
A device must be running Windows 10 version 22H2 to install ESU updates. Anything on an older build needs bringing up to 22H2 first. Check this before buying licences, because a licence you cannot apply protects nothing.
So should you pay again?
There is no universal answer, but there is a sensible way to reach yours. Split the estate into three groups:
- Machines that can take Windows 11. Upgrade them. Paying doubled ESU on hardware that could simply be moved is the worst outcome on this page.
- Machines that cannot, but are due for replacement anyway. Replace them and skip the ESU line entirely. A device near the end of its life is rarely worth a doubling annual fee.
- Machines that cannot be upgraded and cannot yet be replaced. This is the group ESU exists for, usually because a line-of-business application pins them. Buy ESU for these, and use the year to solve the application problem rather than to defer it, because Year Three doubles again and Year Four does not exist.
Most estates we audit turn out to have far fewer machines in group three than the finance conversation assumed. The bill is usually being driven by group one.
What about Cyber Essentials?
Cyber Essentials requires that software on in-scope devices is supported and receiving security updates, and an enrolled ESU device is receiving security updates. We would not tell you that settles it: keep your evidence of enrolment for the assessor, confirm the position with your certification body rather than assuming, and remember the clock still runs out after three years. If you are weighing certifications more broadly, see Cyber Essentials vs ISO 27001.
This is not the only January deadline
If you are planning estate work this winter, two other dates land close together. Windows Server 2016 reaches end of life on 12 January 2027, and the PSTN and ISDN switch-off follows on 31 January 2027. Three separate projects, one narrow window, one set of engineers. Planning them together is considerably cheaper than meeting them one at a time.
Frequently asked questions
When does Windows 10 ESU Year Two start?
Microsoft states that Year One starts in November 2025, and Windows 10 reached end of support on 14 October 2025. Year Two therefore begins around November 2026. ESU must be bought a year at a time; Microsoft is explicit that customers cannot buy partial periods such as six months.
How much does Windows 10 ESU cost?
Microsoft's published price for organisations through Volume Licensing is 61 US dollars per device for Year One, and Microsoft states the price doubles every consecutive year for a maximum of three years. That means roughly 122 dollars per device in Year Two and 244 in Year Three. Those are Microsoft's list prices in US dollars, not a Mastercopy price; what you actually pay depends on your licensing route, so ask for a quote.
What happens if we skipped Year One and want to join now?
You pay for Year One as well. Microsoft states plainly that if you decide to purchase the program in Year Two, you have to pay for Year One too, because ESUs are cumulative. Waiting does not save money, it increases the bill and leaves the devices unpatched in the meantime.
What does ESU actually include?
Critical and important security updates, and nothing else. Microsoft is explicit that ESU does not include new features, customer-requested non-security updates, design change requests, or general technical support for Windows itself. Support is limited to activation, installation and regressions caused by the ESU. It is life support, not a supported operating system.
Are our devices even eligible?
To install ESU updates a device must be running Windows 10 version 22H2. Machines on older builds need updating to 22H2 first, which is worth checking before you buy anything, because a licence you cannot apply is money spent for no protection.
Is ESU ever free?
Yes, in specific cloud scenarios. Microsoft provides ESU at no additional cost for Windows 10 virtual machines in Windows 365, Azure Virtual Desktop, Azure virtual machines and several other Azure services. Windows 10 endpoints connecting to a Windows 365 Cloud PC are also entitled to ESU for up to three years with an active subscription. If a migration to Windows 365 was already on your roadmap, the ESU saving changes the maths.
Does ESU keep us compliant for Cyber Essentials?
Cyber Essentials requires that software on in-scope devices is supported and receiving security updates, and an enrolled ESU device is receiving security updates. The safe approach is to treat ESU as buying time rather than as a settled answer, keep evidence of enrolment for your assessor, and confirm the position with your certification body rather than assuming it. ESU runs out after three years regardless.
Sources: pricing, the cumulative rule, the November 2025 start, the 22H2 prerequisite and the exclusions all follow Microsoft's Extended Security Updates programme documentation for Windows 10, with end-of-support dates from the Windows Lifecycle FAQ. Year Two and Year Three figures are Microsoft's stated doubling applied to its published Year One price.
