Windows 10 extended updates have a second year. The renewal is not a renewal.
Microsoft prints one price and one rule — sixty-one dollars a device, doubling every consecutive year, three years maximum. What it does not print in the same place is that each year carries its own activation ID, so the invoice renews itself and nothing else does.
Sixty-one dollars a device is not the number that will hurt.
That is the year-one price for Windows 10 Extended Security Updates through volume licensing, and it sits on Microsoft's own documentation next to the sentence that governs the next two budgets: the price doubles every consecutive year, for a maximum of three. You can do the arithmetic. The arithmetic is the easy part.
The verdict, since you are deciding rather than browsing. If you still have machines that cannot take Windows 11 and cannot be retired this quarter, buy the second year. It is cheap against every alternative and the programme does what it says on the tin, which is more than most things do. But do not put it on the board paper as a renewal, because it is not one. Each ESU year carries its own activation ID. Year two is not a line somebody ticks in a portal. It is a second pass across every device in the estate, and it is the same pass you did last autumn, with a different GUID.
The renewal is a re-enrolment
Read the enablement instructions rather than the pricing page. To turn ESU on you
take a Multiple Activation Key out of the Microsoft 365 admin center, which
requires somebody on your tenant to hold either the Product Key Reader or the VL
Administrator role. Budget an hour for discovering that nobody does. You then
install the key on each device with slmgr.vbs /ipk and activate it with
slmgr.vbs /ato against an activation ID.
There are three activation IDs, one per year, printed in a table on the same page so you can see all three at once. It is the most honest thing in the document. Microsoft is telling you plainly that this happens three times.
The device has to reach the activation servers to do it, and the documentation lists thirteen endpoints your proxy needs to allow — twelve over HTTPS and one plain HTTP host for the revocation list, which someone will spend a morning on. If a device cannot get there at all, there is a phone activation route involving an installation ID read out and a confirmation ID typed back in. At volume there is a VAMT proxy activation scenario, which needs an updated PkeyConfig file before the tool will recognise an ESU key as a key.
Nothing about the second year is automatic. The only thing that renews itself is the invoice.
None of this is unreasonable. All of it is work, it lands on the same three people who did it last time, and it lands again in the autumn of 2027.
If you reimage, watch the activation limit on the MAK rather than your device count — the key runs out of activations, not seats. There is a documented process for requesting an increase, which means there is a queue for requesting an increase. Ask for it before you need it.
The machines you cannot move are the ones the programme excludes
Two eligibility facts, and between them they describe the awkward part of most estates.
The first is easy. Devices have to be running Windows 10 version 22H2, the last feature update and the one everything landed on anyway. A prerequisite pair of updates has to go on in the right order — the licensing preparation package after the servicing update, not before — and if you get that backwards you find out through a support ticket rather than an error message.
The second is the one to check before the meeting. Long Term Servicing releases are not covered by the ESU programme. Microsoft's page puts the word NOT in capitals, which for a documentation team is close to shouting. LTSC has its own lifecycle and its own end dates, which I have not looked up for this piece and which you should, because the LTSC boxes are precisely the ones you cannot move: the till, the machine controller, the instrument in the lab with a vendor driver signed in 2019 and a support contract that expired with the reseller. If your Windows 10 problem is mostly an LTSC problem, ESU is not the answer to it, and buying ESU will not make those machines feel any better about themselves.
The cheapest per-device price is zero, and it is a licensing decision
Near the bottom of the pricing question, in a bulleted list nobody reads to the end, sits the interesting commercial fact. ESU comes at no additional cost for Windows 10 virtual machines in Windows 365, Azure Virtual Desktop, Azure virtual machines, Azure Local and half a dozen other services. And then a sentence worth reading out loud: Windows 10 endpoints connecting to Windows 365 Cloud PCs are entitled to ESU for up to three years, so long as the subscription is live.
So the same security update is a metered product on a device you own and a free one on a device that has become a window onto a Cloud PC. That is a coherent commercial position and I am not going to perform outrage about it. But it does mean the ESU line in your budget is not a security number. It is the price of not having moved the workload, and it was set by a licensing team.
The end date is not on the page
I went looking for when year one actually stops and could not find it in the documentation I read. The programme FAQ says year one starts in November 2025. End of support for Windows 10 was 14 October 2025. Those are different months, and none of the three Microsoft pages I had open prints a coverage-period end date for any of the three years.
What they do print is this: "If you decide to purchase the program in Year Two, you have to pay for Year One too, as ESUs are cumulative." So the door does not close behind you. It only gets more expensive to walk through, and you cannot buy six months to bridge a migration that is nearly finished. The minimum unit is a year. The minimum quantity is one licence, which is generous in a way that helps nobody with four hundred machines.
Everything that decides the actual cost — the end dates, what a partner quotes in euros rather than dollars, whether your framework agreement moves the list price at all — lives in the volume licensing terms, which I have not opened and which you should before anyone signs.
Year three doubles again. That is the whole shape of the thing. If you cannot say today what you will do in the autumn of 2027, you have not made a decision this year; you have bought twelve months of not making one, at a price designed to make the next twelve months harder to justify. Which is exactly what the pricing was designed to do, and it is working.
Written from
Primary The document itself. Claims in this piece rest only on these.
- Extended Security Updates (ESU) program for Windows 10Opened for this piece, page dated 17 November 2025. Source for: $61 per device for year one through volume licensing; the sentence that the price doubles every consecutive year for a maximum of three; the three-year ceiling for commercial and educational organisations; the version 22H2 prerequisite; the quoted cumulative-purchase sentence; the statement that partial periods cannot be bought and that year one starts in November 2025; the minimum purchase of one licence; the limitations list and the narrow scope of technical support; and the no-additional-cost entitlement for Windows 10 virtual machines in Windows 365, Azure Virtual Desktop and the rest of the listed services, including the entitlement for Windows 10 endpoints connecting to Windows 365 Cloud PCs. The year-two and year-three dollar figures are arithmetic from the doubling rule, not quoted prices; the page prints only $61.
- Enable Windows 10 Extended Security Updates (ESU)Opened for this piece, page dated 21 April 2026. Source for the whole enrolment section: the Multiple Activation Key and where it lives in the Microsoft 365 admin center; the Product Key Reader and VL Administrator roles; the ordering requirement that KB5072653 be installed after KB5066791; the three per-year activation IDs and the table they sit in; the slmgr.vbs install and activate commands; the thirteen client activation endpoints; the phone activation path via installation ID and confirmation ID; the VAMT proxy activation scenario and the updated PkeyConfig requirement; MAK activation limit increases for reimaging; and the statement that Long Term Servicing releases are not covered by the programme.
- Lifecycle FAQ — WindowsOpened for this piece. Source for Windows 10 version 22H2 being the last feature update and being serviced with monthly updates through 14 October 2025. Cited here as much for what it does not contain: no coverage-period end date for any ESU year appears on it, which is why no such date is printed in the body.
- Placeholder: the Microsoft Product Terms and the volume licensing agreement covering Windows 10 ESUNot opened. This is where the coverage-period end dates, the retroactive year-one purchase mechanics and the actual contractual price almost certainly live, and all three are decision-relevant. The body says plainly that the end date is not in the documentation I read rather than guessing at one. Before publication, either open the Product Terms and replace that admission with the dates, or leave the admission standing — do not soften it into a vague month.
- Placeholder: Windows 11 requirementsNot opened for this draft, which is why no TPM version, processor generation or memory floor appears anywhere in the body. The piece only needs the fact that a hardware floor exists and that some machines sit below it. If an editor wants the specifics printed, read the page first.
- Placeholder: Microsoft Lifecycle entries for the Windows 10 LTSC and IoT Enterprise LTSC releasesThe LTSC exclusion is the sharpest thing in the piece for a mixed estate and I have deliberately not printed a single LTSC end date, because I have not looked one up. The body tells the reader to look them up. That is the honest version. Anyone filling this in should note which LTSC releases are still in support at time of publication and which are not.
Reporting Attributed, not relied on. Where the reporting is the fact, it says so.
- Placeholder: trade and community coverage of year-two ESU pricingThe doubled and quadrupled dollar figures circulate widely in trade coverage and community forums. Nothing here rests on that coverage: the figures in the body are derived from Microsoft's own doubling rule and are labelled as arithmetic. If a Microsoft price list is ever published for years two and three, cite it and drop the derivation.
Lead Pointed us at the story. Nothing here is cited as authority.
- Placeholder: reseller and Microsoft partner quotes in eurosWhat pointed me at the gap between the list price on the documentation page and the number a European buyer is quoted. Never cited, and no euro figure appears in the piece.