So it has actually happened. Windows 10 end of support used to be a date on a roadmap, and today it's simply the situation we're in. Most tenants I work with still have a handful of Windows 10 devices hanging on, sometimes because of a technical dependency and sometimes because nobody got round to them. Windows 10 isn't alone, either. Office 2016, Office 2019 and Exchange Server 2016/2019 also reach end of support today, which puts security teams and compliance managers under more pressure. So what changes right away, and what should you actually be doing from tomorrow?

Windows 10 devices without ESU stop getting security updates tomorrow

From tomorrow, Windows 10 devices get no more security updates unless they're enrolled in an Extended Security Updates (ESU) program. There's no grace period. I've watched attackers go after unpatched systems very soon after official support ends. Microsoft's lifecycle page for Windows 10 doesn't soften it: without ESU there's no more protection, and patching and mitigation are your problem. That has consequences for compliance and liability, and it can even affect basic insurance coverage.

Office and Exchange reach end of support on the same day

Office 2016/2019 and Exchange Server 2016/2019 hit their end-of-support date today as well, so hybrid environments and older on-prem systems are now more exposed than they've ever been. Once neither the backend servers nor the client apps get security patches, you have attack surface that nobody is closing. In my projects I still see organizations rushing to finish migrations to Exchange Online or to get Microsoft 365 Apps rolled out. The deadline isn't moving, and the pressure will only grow from here. I went into this in more depth in my earlier post on Office 2016 and 2019 end of support.

Defender cannot replace operating system patches

I keep getting asked whether Defender Antivirus or Defender for Endpoint will keep working on Windows 10 after today. Technically they will, because signature updates continue for now. But even very good endpoint protection doesn't make up for an operating system that isn't patched. Defender will stop some threats. If the OS itself has unpatched vulnerabilities, though, attackers will eventually get in that way. With the number of new exploits we've seen in 2025, I wouldn't bet on Defender alone.

The last Windows 10 devices still have a few sensible options

For the Windows 10 devices you still have, these are the options I'd consider responsible:

  • Buy and deploy ESU: If you need more time, Extended Security Updates (Microsoft's ESU documentation) keep devices protected for now, provided the setup is correct, including via Azure Arc.
  • Isolate them on the network: For special-purpose devices such as lab PCs, kiosks or old hardware, tight network segmentation and firewall rules can buy you time. Check your network policies.
  • Speed up replacement: Make Windows 11 your standard client, or look at Windows 365 if hardware or application requirements stand in the way of an upgrade right now.
  • Migrate Office and Exchange: Old Office clients and on-prem Exchange servers have to go. In practice, Microsoft 365 Apps and Exchange Online are what replace them.

And for devices that are genuinely obsolete, ask yourself honestly whether anyone still needs them, or whether they can finally be retired.

Auditors and insurers will start asking questions now

From tomorrow, every Windows 10 device running without support or ESU counts as a compliance risk, whether you're looking at internal policy, external audits or cyber insurance. I regularly get asked to prove that only supported operating systems can reach business data. One simple measure goes a long way here:

Tip from my projects: In Intune, create a compliance policy that requires a minimum OS version (e.g. 11.0.0). Unsupported devices are then marked noncompliant automatically, and combined with Conditional Access they lose access to company data.

This gives you more than audit evidence. It also protects you against forgotten legacy endpoints and shadow IT.

Example: Intune compliance policy with a minimum OS version:

{
  "@odata.type": "#microsoft.graph.windows10CompliancePolicy",
  "osMinimumVersion": "11.0.0"
}

You create this policy in the Intune portal under Devices → Policies → Create policy → Platform: Windows 10 and later.

I've covered practical migration steps and readiness checks in more detail in Four Months to Go: Windows 11 Migration Readiness in Intune.

A simple decision flow helps me sort the remaining devices

A question I hear constantly is how to deal with the last Windows 10 endpoints. Should they get ESU, be replaced or simply be switched off? This is the quick decision flow I now use in projects after the end of support.

flowchart TD
  Start["Windows 10 device found"] --> ESU["ESU possible and required?"]
  ESU -- "Yes" --> EnrollESU["Purchase and enroll ESU"]
  ESU -- "No" --> SpecialCase["Special case? (kiosk, lab)"]
  SpecialCase -- "Yes" --> Isolate["Isolate on network"]
  SpecialCase -- "No" --> Replace["Windows 11 rollout or cloud"]
  EnrollESU --> Done["Device continues (temporary)"]
  Isolate --> Done
  Replace --> Done

Figure: How I decide what happens to Windows 10 devices after end of support.

I recommend staying calm but acting decisively

There's no reason to panic about the Windows 10 end of support date, but it does draw a clear line. Any device still on Windows 10 now has to be visible and assessed. After that it either gets secured properly, with ESU or isolation, or it gets replaced. This isn't theoretical anymore. Audits and insurers will check, and so will actual attackers, which matters most. My advice is to pair a solid compliance policy in Intune with an accurate device inventory, so you don't end up doing a hectic cleanup later. If you want some perspective, have a look at my post from a year ago, Windows 10 end of support: One year left – what's the plan?. It shows how fast a year goes when action keeps getting postponed.