Over the past few months I've noticed that the Windows 10 end of support date is finally getting attention outside the IT department. On October 14, 2025, regular security updates for Windows 10 stop, unless you pay for Extended Security Updates (ESU). That leaves one year, and planning should start now. Anyone who has been through a large Windows migration knows how quickly twelve months go.

Extended security updates for Windows 10 get more expensive every year

Microsoft has published the numbers. Commercial ESU for Windows 10 starts at $61 per device for the first year, and the price doubles each following year, for a maximum of three years (Microsoft's announcement). For most organizations that adds up fast, especially with a large fleet. As with Windows 7, ESU only covers critical and important security updates. You get no new features and no improved drivers. Cloud-first organizations do get a break, though: ESU is included at no extra cost for Windows 10 VMs running in Windows 365 or Azure Virtual Desktop. If you can't move certain legacy workloads to Windows 11 yet, that's a practical way to keep them secure.

Many devices still fail the Windows 11 hardware requirements

Before you think about ESU or migration, you need a reliable picture of how ready your devices actually are. I still come across plenty of endpoints that don't meet the Windows 11 requirements. TPM 2.0, Secure Boot and the CPU list are the usual blockers, and old lab or production machines tend to cause the most trouble. If you use Intune, the overview is easy to get. Under Reports → Endpoint analytics → Work from anywhere, the Windows 11 readiness report lists which devices can make the move and which can't (documentation).

This is the decision flow I often sketch for customers:

flowchart TD
    Inventory["Device inventory"] --> Analytics["Endpoint analytics"]
    Analytics --> W11Ready["Windows 11 ready?"]
    W11Ready -->|Yes| Upgrade["Upgrade to Windows 11"]
    W11Ready -->|No| ESU["Extended Security Updates"]
    Upgrade --> Done["Support through 2026+"]
    ESU --> Phaseout["Plan for phaseout"]

Figure: Decision path after Windows 10 support ends

Compatibility checklists only tell part of the story. Some devices look ready for Windows 11 and then cause driver or peripheral problems during testing. Sometimes a firmware update fixes it, and sometimes the only answer is a new device. A real pilot group pays off here every time.

Intune feature update policies handle the upgrade at scale

Once you know which endpoints can move to Windows 11, the upgrade itself is a separate project. Small companies can manage with hands-on upgrades or simple tools. For larger environments I use Intune. The Feature updates for Windows 11 policy lets you roll out the upgrade in a controlled way: you assign devices, set timelines and track the results. Now that Windows 11 24H2 is out, there's not much reason to hold back. I wrote up the practical details and the Intune pitfalls in my guide to rolling out Windows 11 24H2 with Intune.

Field tip: Check the support roadmap for your business-critical legacy apps early. Windows 11 compatibility problems usually show up well before the production rollout, and it's far easier to bring software vendors in at the start than to build workarounds at the last minute.

Staged rollouts and solid reporting help you spot problems while they're still small. The telemetry from Endpoint analytics gives you the data to fix upgrade issues quickly and adjust your deployment as you go.

Microsoft 365 Apps keep getting updates on Windows 10 only under one condition

I regularly hear the assumption that "Microsoft 365 Apps will still be supported on Windows 10, so we can take our time." That's only half right. Microsoft will ship security updates for Microsoft 365 Apps (and Office 2016/2019) on Windows 10 until October 2028 (details). The catch is that this only applies if the Windows 10 device itself still gets security updates, which means you're paying for ESU. Without ESU, the operating system stops receiving security updates in October 2025, even if Word and Excel keep working.

I think it's time to stop putting off the decision

In my experience, the last stretch is rarely a technical problem. It comes down to someone making a decision. The ESU pricing is deliberately steep to push organizations to act. Map your fleet, run pilot migrations under real conditions and get your Windows 11 preparations in order now. Windows 10 end of support isn't far off anymore. Deal with it on your own schedule so you don't end up rushing next autumn.