Windows 10, AVD, and the 2025 Deadline: What to Expect

Introduction

Support for Windows 10 officially ends on 14 October 2025. For organisations running Windows 10 in Azure Virtual Desktop or Windows 365, that creates risk. Without a plan, you may face higher costs, compliance issues and unsupported environments.

Microsoft's Extended Security Updates (ESU) program offers an option to stay protected. Some businesses can access it at no extra cost. Others will need to license it annually, with the cost increasing each year.

This blog breaks down how ESU works, who gets it for free, how to apply it in Windows and AVD, and why it is worth starting your Windows 11 migration strategy now.

Who This Applies To

• Organisations using Windows 10 in Azure Virtual Desktop or Windows 365.
• Businesses running Windows 10 on Azure-hosted virtual machines.
• Teams relying on legacy apps that block or delay Windows 11 upgrades.
• IT admins planning device lifecycle or cloud-hosted desktop strategies.
• Decision-makers unsure whether to upgrade now or extend support.

Let's get into it! 👇

Windows 10 End of Support: The Clock Is Ticking

Windows 10 will officially reach end of support on October 14, 2025. After that date, Microsoft will stop providing security updates, bug fixes and technical support for the operating system.

For personal devices, this might not seem urgent. But for businesses, especially those running Windows 10 in a virtual desktop environment, it is a serious deadline.

This isn't just another product lifecycle milestone. It's a final stop for Windows 10 support, unless you have a plan in place. Thankfully, Microsoft does offer a path for extended protection.

What Is The Extended Security Updates (ESU) Program?

The Extended Security Updates (ESU) program is Microsoft's paid offering that gives organisations continued access to critical and important security updates after Windows 10 reaches end of support in October 2025.

It is designed to help businesses buy extra time whilst they plan and complete their migration to Windows 11. Or, in virtual desktop scenarios, give organisations time to modernise legacy apps or retire their AVD environment entirely

The Essentials of Extended Security Updates

• ESU gives you up to three additional years of critical and important security updates, ending in October 2028.
• Each year of coverage must be purchased separately and applied annually with no multi-year discounts.
• Pricing increases each year:
  • Year 1: Baseline approx $61 per device per year.
  • Year 2: 2x the cost of Year 1 per device per year.
  • Year 3: 3x the cost of Year 1 per device per year.
• Devices must be running an eligible Windows 10 version e.g. Professional, Enterprise or Education (with more on multi-session later).
• Microsoft requires that devices are enrolled in Entra ID or at least connected to a management platform like Microsoft Intune.
• Costs apply per device unless you're eligible for ESU through AVD or Windows 365.

Limitations Of The ESU Offering

The ESU program is designed to buy time, not to provide a long-term solution. While it keeps your Windows 10 devices protected with security patches, there are several important limitations to be aware of before relying on it.

1. No Feature Updates or Quality Improvements

ESU covers security updates only. It does not include feature updates, UI improvements or any quality-of-life changes that are part of regular services.

2. No Assurances of Future Compatibility

Whilst not necessarily documented, devices running ESU may fall behind in compatibility with future Microsoft services, third-party apps and tooling updates. As the focus for software teams will be Windows 11 compatibility, there is an operational risk to continuing to use Windows 10 devices.

3. Annual Renewal and Deployment Overhead

Each year of Extended Security Updates must be purchased and applied manually. There is no automated multi-year enrolment or cost smoothing, which adds admin and planning overhead.

4. No Coverage for Unsupported Editions or Configurations

Devices running unsupported Windows 10 editions, unmanaged endpoints, or machines that can't meet the prerequisites will not be eligible for extended security updates; even if they are licensed!

5. Not a Compliance Guarantee

Using ESU may help reduce security risk, but it doesn't guarantee compliance with frameworks like Cyber Essentials, ISO 27001, or GDPR. Unsupported OSs, even with ESU, can be flagged during audits.

Check Before You Deploy: Device Readiness for ESU

Before Extended Security Updates to a Windows 10 device, the device must meet a few baseline requirements. These aren't optional. If a device doesn't meet them, it won't receive updates - even if you've paid for ESU!

Minimum Requirements for Extended Updates:

• Must be running a supported Windows 10 edition: Pro, Enterprise or Education.
• Must be patched to Windows 10 22H2, the final supported feature update.
• Must be joined to Entra ID, or managed through Intune or Configuration Manager.
• Must be licensed correctly through volume licensing or CSP.
• Must have the ESU product key applied and verified successfully.

Typically, Azure-based VMs (including AVD) meet these requirements. More on how ESU is included below.

AVD & Windows 365: Where ESU Is Included

If you're running Windows 10 in Azure Virtual Desktop or Windows 365, you may be in luck. Microsoft is offering Extended Security Updates at no additional cost for many cloud-hosted scenarios; depending on configuration and licensing.

Included in Azure at No Extra Cost

Requires Additional ESU Purchase

Applying Extended Security Updates in Windows and AVD

Once you've confirmed that your Windows 10 devices are eligible for ESU, the next step is deployment. Depending on where the device is hosted and how it's licensed, the application process will differ.

For Azure Virtual Desktop, Windows 365 and Azure VMs

If your environment runs in Azure using supported Windows 10 images, ESU is included at no extra cost and is automatically applied.

There is no need to enter a product key or activate anything manually, as long as:

• The device is hosted in Azure.
• A supported Windows 10 image is used e.g. Enterprise or Multi-Session on 22H2 or later.
• Licensed for Azure Virtual Desktop or Windows 365.

Updates are delivered through Windows Update as normal to your Azure-based devices.

On-Premises or Third-Party Hosted Devices

If your organisation or customer is running Windows 10 outside of Azure, or on unmanaged infrastructure, ESU must be purchased and applied manually, per device.

To apply ESU:

1. Confirm device(s) eligibility including version, patch level and supported edition.
2. Purchase ESU via a volume licensing agreement or from your partner CSP.
3. Install the ESU license key either manually via Windows Settings, or through Intune.
4. Activate the ESU key.
5. Restart the device.

Planning Your Windows 11 Migration

Extended Security Updates give organisations time but they don't remove the need to upgrade eventually. Every year organisations remain on Windows 10, the cost increases, and so does the risk of compatibility issues with certain apps, security tools and Microsoft services.

That's why it's important to start your Windows 11 planning now, and not later. If anything, organisations should have been planning for this already!

Some Key Focus Areas - Your Windows 11 Migration

• Hardware and Lifecycle - are your devices compatible with Windows 11?
• Application Compatibility - are your line of business apps ready?
• Image Strategy - If your organisation or customers are using AVD, plan your move to Windows 11 multi-session images.
• User Experience - Will the user interface or layout change cause disruption for your users?

Obviously, migrating and transitioning from Windows 10 to Windows 11 has more facets than the 4 I've listed - so make sure you've covered all key areas before beginning the transition.

Final Thoughts

Windows 10's end of support is a hard deadline, not a guideline. Extended Security Updates provide a safety net, but it comes with cost, complexity and limitations. For some, especially AVD and Windows 365 users, Microsoft has made this migration more manageable by including ESU at no additional cost.

ESU is not a strategy, it's a buffer and the cost will increase each year. However, the cost of using ESU might outweigh the cost of migrating to a Windows 11 AVD environment, or replacing a significant amount of machines.

If your customers, or organisation is still relying on Windows 10, then now is a good time to start planning! Whether that's an AVD image review, a full endpoint migration strategy, or just understanding the licensing impact; the sooner you act, the smoother it'll be.

Need Help Navigating ESU or Migrating to Windows 11?

Whether you're unsure if your AVD environment qualifies for free ESU, or you're planning a broader Windows 11 migration, I can help.

Providing insight on:

• Technical guidance on ESU eligibility and deployment.
• Migration planning for AVD, Windows 365 and on-premises Windows 10 deployments.
• Best practices with your cloud desktops.

Get in touch via LinkedIn!

Or, sign-up below to have blog posts delivered directly to your inbox!