After 13 October 2026, Windows 10 splits in two directions. Home users enrolled in Microsoft's free consumer Extended Security Updates program keep receiving security patches until 12 October 2027. Business devices need commercial ESU Year 2 at US$122 per device, an upgrade to Windows 11, or ESU entitlement through Windows 365.
The date matters because it is when the first year of Extended Security Updates runs out, not when Windows 10 support ends. That already happened, on 14 October 2025. What changed in late June 2026 is who gets a second year for free, and the answer has caused genuine confusion among Australian business owners.
What did Microsoft announce in June 2026?
On 25 June 2026, Microsoft updated its Windows 10 ESU documentation and added an editor's note to its original announcement blog: the consumer ESU program, originally due to end on 13 October 2026, now runs for a second year at no cost, with coverage through 12 October 2027. There was no launch event. The change appeared quietly in the documentation and was picked up by outlets including BleepingComputer and Tom's Hardware within a day.
It is a genuinely generous move. Microsoft could have let the free program lapse and pointed households at new hardware. Instead, personal devices that cannot take Windows 11 get another full year of security coverage. Enrolment for eligible home PCs stays simple:
- Free, by syncing PC settings with Windows Backup
- Free, by redeeming 1,000 Microsoft Rewards points
- A one-time purchase of US$30 or the local equivalent
Does the free extension cover business devices?
No, and this is the detail catching small business owners out. The consumer ESU program is limited to personal devices running Windows 10 version 22H2 in the Home, Pro, Pro Education or Pro for Workstations editions. A device joined to an Active Directory domain or to Microsoft Entra ID is excluded, and so is any device enrolled in mobile device management. The one carve-out is Microsoft Entra registered devices, the lightweight state common on personal machines that access work email, which remain eligible for the consumer program.
In practice, if your PCs are set up the way a competent IT provider sets up business PCs, with managed identities and device management, Microsoft classes them as commercial devices and the free extension does not apply. Assuming otherwise is the most expensive mistake available here, because it means arriving at 14 October 2026 unpatched and unbudgeted.
What does ESU Year 2 cost for a business?
Commercial ESU is sold per device, per year, through Microsoft Volume Licensing and through CSP partners, where it has been available since 1 September 2025. Microsoft's US-dollar list pricing doubles each year:
- Year 1: US$61 per device, coverage to 13 October 2026
- Year 2: US$122 per device, 14 October 2026 to 12 October 2027
- Year 3: US$244 per device, coverage to 12 October 2028
ESU is cumulative. An organisation that skipped Year 1 and wants Year 2 must buy both years. For a 25-device business already covered in Year 1, Year 2 comes to US$3,050 at list. A business enrolling for the first time pays US$183 per device, or US$4,575 across those 25 machines. These are US-dollar list prices: Australian businesses buy through a CSP partner, which quotes in Australian dollars, and the AUD figure depends on Microsoft's pricing model and the current exchange settings. Treat the USD list as the anchor and get a live quote rather than estimating a conversion.
The doubling is deliberate, and Microsoft has been open about the logic: ESU is priced to encourage the move to Windows 11 rather than to be a comfortable place to stay. Businesses, unlike households, have managed upgrade paths available, so the commercial program is a bridge with a visible toll that rises each year. Worth asking your CSP partner about discounts too. In Year 1, Microsoft offered 25 per cent off for devices receiving updates through Microsoft Intune or Windows Autopatch, so confirm what applies to Year 2 orders.
What ESU does and does not include
ESU delivers security updates rated critical or important by the Microsoft Security Response Center, and nothing else. Specifically excluded:
- No new features or feature updates
- No non-security fixes or design changes
- No general technical support; Microsoft assists only with ESU activation, installation, and regressions caused by an ESU itself
Should you pay for Year 2 or move to Windows 11?
For most fleets the arithmetic answers this. A device that meets the Windows 11 hardware requirements upgrades at no licence cost, while staying on Windows 10 costs US$122 this year and US$244 the next. ESU Year 2 is not a bad product; it is a deliberate holding pattern, and it suits a specific minority of devices.
Start with a hardware audit
Windows 11 requires TPM 2.0, UEFI with Secure Boot, 4 GB of RAM, 64 GB of storage and a supported processor, which in practice means roughly Intel 8th generation or AMD Ryzen 2000 series and newer. Most business machines sold from 2019 onward qualify. Microsoft Intune reports Windows 11 hardware readiness across an entire fleet, so this audit is a report to run, not a spreadsheet to build by hand.
When paying for ESU Year 2 is the right call
- The device drives specialised hardware that is certified only for Windows 10, common in manufacturing, pathology, medical imaging and point-of-sale settings
- A line-of-business application the vendor has not yet certified on Windows 11, where upgrading would breach support terms
- Hardware already scheduled for replacement partway through the coverage year, where US$122 is cheaper than replacing early
- A fleet too large to refresh inside one budget cycle, where ESU covers the tail of the rollout rather than the whole estate
Plan the rollout before the deadline
The decision date is 14 October 2026, when Year 2 coverage begins, and the safe approach is to work backwards from it. A staged rollout using Microsoft Intune starts with a pilot ring of a few forgiving users, confirms the line-of-business applications behave, then upgrades the remainder in waves. Devices that fail the hardware audit get replaced, and Windows Autopilot lets the new machines ship straight to staff and build themselves into a managed, compliant state on first sign-in. For a typical 25 to 50 device fleet, Frontrow's experience is that the whole exercise fits comfortably inside a quarter, provided it starts before September rather than in it.
Is there a third path through Windows 365?
Yes, and it is easy to miss. ESU is included at no additional cost for Windows 10 virtual machines running in Windows 365, Azure Virtual Desktop and Azure. More usefully for a small fleet, a physical Windows 10 device is also entitled to ESU at no extra charge, for up to three years, when its user holds an active Windows 365 Cloud PC licence. Microsoft's conditions are that the device is Microsoft Entra joined or hybrid joined and that the user signs in with the same Entra ID account at least once every 22 days.
This suits businesses heading toward cloud desktops anyway. The ageing Windows 10 machine becomes a patched, secure terminal for a Windows 11 Cloud PC, and the hardware refresh question detaches from the operating system deadline entirely.
Frontrow plans and runs staged Windows 11 rollouts with Microsoft Intune and Windows Autopilot for Australian businesses, and will say plainly when ESU Year 2 is the cheaper answer for part of a fleet. Thirty minutes on the phone is usually enough to sort a fleet into upgrade-now and hold-with-ESU groups and put an Australian-dollar figure beside each; Frontrow offers that half hour without charge.