Qwalora

Qwalora

Qwalora

Research

One dollar, or sixty-one

Windows 10 Extended Security Updates Year One ends on October 13, 2026, seven days from now. The published commercial price is $61 per device. The published education price is $1. The updates are identical, the devices are identical, and in some towns the two buyers sit in buildings a quarter mile apart. What differs is the agreement each one bought under, and what it costs to have waited.

·

6 min

var(--variable-rpcX8dOAk)

The dates are fixed and they are close

Windows 10 reached end of support on October 14, 2025. The Extended Security Updates program runs for a maximum of three years from that date, and Microsoft’s lifecycle documentation publishes each year’s boundary. ESU Year One ends on October 13, 2026. Year Two ends on October 12, 2027. Year Three ends on October 10, 2028.

Year One closes next Tuesday. After that there is no further extension beyond October 10, 2028, which is the point at which Windows 10 stops receiving security updates by any route Microsoft currently publishes.

The price doubles, and that is the design

Microsoft’s commercial per-device pricing, from its own ESU documentation, last updated November 17, 2025, is $61 per device in Year One, $122 per device in Year Two, and $244 per device in Year Three.

The doubling is not an inflation adjustment. It is a migration incentive, and it works in the direction you would expect: each year of delay costs twice what the last one did, so the price of indecision rises faster than the price of acting.

The clause that catches organizations that waited

This is the finding underneath the finding, and it is stated plainly in Microsoft’s documentation: “ESU must be purchased by year; partial periods cannot be purchased. If purchasing in Year Two, you must also pay for Year One, as ESUs are cumulative.”

An organization that let Year One pass without enrolling does not now pay $122 per device. It pays $61 plus $122, or $183 per device, to be covered in Year Two.

Read that against how the decision usually gets made. A district or a municipality looks at $61 per device across eight hundred machines, decides it is not in this year’s budget, and defers. Twelve months later the same decision costs $183 per device for the same coverage period. Deferring did not save the money. It tripled it, and the organization spent the intervening year unpatched.

This is the shape of problem we have written about before in a different setting: the purchase gets scrutinized, the consequence of not purchasing does not.

$61

Commercial ESU, per device, Year One

$1

Education ESU, per device, Year One

$183

Per device to enroll in Year Two having skipped Year One

Oct 13

Date ESU Year One ends

Microsoft, ESU program documentation and education blog

Sixty-one to one

Microsoft publishes separate Extended Security Updates pricing for education customers: $1 per license in Year One, $2 in Year Two, and $4 in Year Three. The stated scope is “all education customers, including K-12 and Higher Education.”

A note on these figures, because they matter and we will not overstate them. They come from Microsoft’s education blog post dated April 2, 2024, which states the prices are “in US dollars and accurate as of April 2024” and that “regional prices will vary based on foreign exchange rates.” We have not found a more recent Microsoft publication restating them, and we have not independently confirmed they remain current as of October 2026. Treat them as the published education figures as of April 2024 and verify against a current quote before relying on them in a budget.

Taken at face value, the Year One differential is sixty-one to one.

The gap is procurement, not technology

Nothing about the software differs. The binaries a school district receives under ESU are the binaries a county government receives. The device does not know which agreement paid for it.

What differs is which licensing program the buyer qualifies under and purchased through. That is a commercial fact, decided before the technical work starts, and it is the single largest determinant of what this costs.

It is worth sitting with the practical version. A regional school district and the municipality it sits inside may run the same model of desktop, bought in the same year, on the same image, facing the same October 13 date. One organization’s cost of coverage is $1 per device. The other’s is $61, or $183 if it waited. Neither number is negotiable at the point of purchase, because the decision that set it was made upstream.

Two paths where the cost may be zero

Microsoft’s documentation states that ESU is included at no additional cost for Windows 10 virtual machines running on specified cloud services, naming Windows 365, Azure Virtual Desktop, and Azure virtual machines.

An organization already paying for Windows 365 or Azure Virtual Desktop may therefore have devices that are already covered and an ESU line item it does not need to buy. We raise this because it is the kind of entitlement that is easy to hold and easy not to notice, and because establishing what you already own is cheaper than buying it twice.

Eligibility on the device side is also narrower than many assume. The qualifying editions for Windows 10 ESU are Enterprise, Education, and Pro in Commercial use. A device outside those editions is not covered by purchasing ESU.

What ESU is actually for

Extended Security Updates are not a security product. They are time, sold by the year, at a price that doubles to discourage you from buying a third one.

The question that determines whether that purchase is sound is not whether $61 or $183 per device is affordable. It is whether a device refresh plan exists with dates attached. ESU bought against a funded plan that retires the last Windows 10 machine in, say, the second quarter of 2027 is a sensible bridge. ESU bought without that plan is a deferral, repeated annually, at twice the price each time, ending in October 2028 whether the organization is ready or not.

If nobody in the organization can name the quarter the last Windows 10 device leaves the estate, the ESU decision is not the one that needs making this week.

Five things to establish before October 13

How many Windows 10 devices remain, counted rather than estimated.

Which editions they run. Only Enterprise, Education, and Pro in Commercial use qualify.

Which agreement the organization buys under, and whether it qualifies for education pricing. This is the single largest cost variable.

Whether any devices are already covered through Windows 365, Azure Virtual Desktop, or Azure virtual machines.

The date the last Windows 10 device is retired. If there is no date, that is the finding.

The first four are a day of work. The fifth is the one that decides what the first four are worth.

Sources

  1. Microsoft. Extended Security Updates (ESU) program for Windows 10. Microsoft Learn. Page last updated November 17, 2025. Retrieved October 6, 2026. https://learn.microsoft.com/en-us/windows/whats-new/extended-security-updates

  2. Microsoft. Product Lifecycle FAQ, Extended Security Updates. Microsoft Learn. Retrieved October 6, 2026. https://learn.microsoft.com/en-us/lifecycle/faq/extended-security-updates

  3. Microsoft. Windows 10 end of support updates for education. Microsoft Education Blog. Published April 2, 2024. Retrieved October 6, 2026. Prices stated accurate as of April 2024. https://www.microsoft.com/en-us/education/blog/2024/04/windows-10-end-of-support-updates-for-education/

More from Qwalora.

Knowledge

Building a Copilot agent in Microsoft Teams for onboarding and offboarding

Onboarding and offboarding are not mirror images. The architecture that treats them as one agent is the architecture that fails, and it fails in the direction that costs you the most.

21 min

Research

What a federal agency can actually run: the AI authorization tables, read closely

Vendor announcements say a service is FedRAMP authorized. The published tables say something more specific, and in places the opposite of what the market assumes.

11 min

Research

Three days: what the KEV Catalog shows about the new federal patching clock

We analyzed all 1,709 entries in CISA's Known Exploited Vulnerabilities Catalog. The federal remediation deadline for the highest-risk vulnerabilities has fallen from 181 days to three, and most of that drop happened on a single day in June 2026.

10 min

Tell us what you are deciding.

CONTACT

→

CONTACT

SUBMIT AN RFP

BACK TO TOP