Start here
Extended Security Updates are a security bridge, not a support renewal
Windows 10 reached end of support on 14 October 2025. The machines did not stop working that day and they still have not. What stopped was the free flow of security patches. Microsoft's Extended Security Updates programme, ESU, is the paid route that puts those patches back on an eligible Windows 10 PC while you plan the move to Windows 11.
The distinction matters more than the price tag. ESU delivers the critical and important security updates defined by the Microsoft Security Response Center for devices running Windows 10, version 22H2. It does not reopen feature development, it does not bring back non-security fixes, and it does not restore general technical support. Microsoft confirms that ESU provides security updates but does not add new features or extend general technical support.
For a business in Dubai or anywhere else in the UAE, that means ESU is a line item with an expiry date attached, not a way to keep an ageing fleet indefinitely.
Eligibility
There are two ESU programmes, and your device only fits one
This is the single most common point of confusion, and it is where most people get their budget wrong. Microsoft runs a consumer programme for personal devices and a separate commercial programme sold through volume licensing. They differ in price, in length, and in who can use them. A domain-joined office PC cannot buy its way into the cheap consumer route, no matter who is sitting in front of it.
| Point of difference | Consumer ESU | Commercial ESU |
|---|---|---|
| Who it is for | Personal Windows 10 PCs | Organisations and schools |
| Required Windows version | 22H2 Home, Pro, Pro Education, Workstations | Windows 10, version 22H2 |
| Maximum coverage | Through 12 October 2027 | Three years, to October 2028 |
| How you buy it | In Windows Update on the device | Volume licensing or a partner |
| Domain-joined or MDM-managed devices | Not eligible | ✓ |
| Licence covers multiple devices | Up to 10 per Microsoft account | Per device, minimum one licence |
Watch for
What blocks a device from the consumer programme
If any of these apply, the device belongs in the commercial programme and the enrolment prompt will not appear in Windows Update.
- Domain or Entra joined. Devices joined to an Active Directory domain or to Microsoft Entra are excluded. Devices that are only Entra registered can still use the consumer route.
- Managed through MDM. Anything enrolled in a mobile device management solution falls outside the consumer programme.
- Kiosk mode. Devices running in kiosk mode are not offered enrolment.
- Already licensed. A device that already holds an ESU licence cannot enrol again.
- Account type. Enrolment requires an administrator Microsoft account. Local-account users are prompted to sign in, and child accounts do not qualify.
Pricing
Windows 10 ESU cost in 2026: the three published rates
Microsoft publishes ESU pricing in US dollars. Buyers in the UAE pay the local currency equivalent plus applicable VAT, and business licences are usually invoiced in dirhams by a local partner or cloud solution provider rather than bought directly from Microsoft.
Personal devices
- Or free if you sync PC settings via Windows Backup
- Or 1,000 Microsoft Rewards points
- One licence covers up to 10 devices
- Local currency equivalent plus tax
Commercial, Year 1
- Bought through Microsoft Volume Licensing
- Minimum purchase is one licence
- Sold by the year, no partial periods
- Roughly 25% less per device when managed through Intune or Windows Autopatch
Education, Year 1
- For qualifying schools and universities
- Rises to $2 in Year 2 and $4 in Year 3
- Same annual, cumulative structure
- Relevant to UAE education groups running large lab fleets
The commercial price ladder, and why late enrolment costs more
| Commercial ESU year | Price per device | Running total per device |
|---|---|---|
| Year 1 | $61 | $61 |
| Year 2 | $122 | $183 |
| Year 3 | $244 | $427 |
There is one route that carries no ESU charge at all. Windows 10 virtual machines running in Windows 365, Azure Virtual Desktop, Azure Virtual Machines and several other Azure services are entitled to ESU at no additional cost, and Windows 10 endpoints connecting to a Windows 365 Cloud PC are covered for up to three years with an active subscription. For UAE businesses already weighing a desktop-as-a-service model, that entitlement can change the arithmetic completely, which is worth raising with whoever handles your Microsoft Azure services before you buy a single ESU licence.
Calendar
Coverage periods and the dates that actually bind
-
14 October 2025
Windows 10 end of support
Free security updates, feature updates and technical support stop for Windows 10, version 22H2.
-
November 2025
Commercial ESU Year 1 begins
The first ESU updates ship to enrolled commercial devices.
-
13 October 2026
Commercial Year 1 closes
Organisations continuing on Windows 10 move to the Year 2 rate of $122 per device.
-
12 October 2027
Consumer ESU ends, commercial Year 2 closes
Microsoft extended the consumer programme by a year in June 2026. Enrolled personal devices roll into that extra year automatically.
-
10 October 2028
Commercial Year 3 closes
The end of the road. No further ESU is available for Windows 10 after this point.
What ESU covers, and what it quietly leaves out
- Critical and important security updates, as rated by the Microsoft Security Response Center.
- Delivery through Windows Update in the normal monthly cadence.
- Support for ESU licence activation, installation, and regressions caused by ESU itself.
- Coverage for every user account on an enrolled PC, not just the account that enrolled it.
- New features or any further Windows 10 development.
- Customer-requested non-security updates and design change requests.
- General technical support, unless you hold a separate Microsoft support plan.
- Any guarantee that third-party software vendors will keep supporting Windows 10.
That last point catches people out. Browser makers, accounting packages and line-of-business vendors set their own support policies, and several have already drawn a line at Windows 10. An ESU licence patches the operating system, it does not oblige anyone else to keep testing against it. Pairing ESU with layered endpoint protection is a sensible interim posture, and it is one of the reasons a Windows 10 holdout fleet usually needs tighter security solutions around it rather than looser ones.
Enrolment
How to enrol a device
Personal Windows 10 PCs
Update first
Confirm the PC runs Windows 10, version 22H2, and install every pending Windows update.
Open Windows Update
Go to Settings, then Update and Security, then Windows Update. Eligible devices show an enrol link.
Pick your route
Sync your PC settings at no cost, redeem 1,000 Rewards points, or make the one-time purchase.
Add your other PCs
Sign in with the same Microsoft account on up to ten devices and select Add device.
Business fleets
Buy through volume licensing
ESU is ordered by the year through the Microsoft Volume Licensing Program, commonly via a local partner in the UAE.
Locate the activation key
Multiple Activation Keys appear in the Microsoft 365 admin center product details panel and become usable once the coverage period starts.
Deploy and verify
Apply the key across the fleet, then confirm each device is receiving the monthly cumulative update rather than assuming it is.
Track the expiry
Put the Year 1 close date in the same calendar as your licence renewals, because the price doubles the day after.
The decision
Renew, upgrade, replace, or run unpatched
Every organisation still holding Windows 10 devices in 2026 is choosing between four paths, whether or not the choice has been made explicitly. Doing nothing is one of them.
| Option | Cost per device | What it buys you | Main risk |
|---|---|---|---|
| Renew ESU | $61 in Year 1, doubling annually | Time, on a fixed and shortening clock | Rising spend on hardware you will still have to replace |
| Upgrade to Windows 11 | No licence cost on eligible hardware | A supported OS and the end of ESU spend | Application compatibility testing and user retraining |
| Replace the hardware | Full device cost, capital or leased | Modern security baseline and warranty cover | Budget timing, plus procurement and data migration effort |
| Continue without ESU | Nothing upfront | Nothing. The device works but stops being patched | Unpatched vulnerabilities, and compliance exposure |
Upgrading in place is the cheapest outcome when the hardware qualifies, because Windows 11 carries its own support lifecycle and no per-year fee. The trap is assuming eligibility. A device that runs Windows 10 comfortably can still fail the Windows 11 check on firmware alone.
Where the hardware genuinely cannot make the jump, replacement often beats a multi-year ESU commitment once you total the ladder. A device kept on ESU for the full three years absorbs $427 before you count the staff time spent maintaining it, which is frequently within touching distance of a new business desktop. If you are pricing that comparison, it is worth getting current UAE quotes on business hardware alongside the licensing numbers rather than after them.
Compatibility
Windows 11 hardware requirements
Every one of these has to pass. TPM 2.0 and Secure Boot are the two that most often turn a working office PC into an ESU candidate.
- 1 GHz or faster processor
- 2 or more cores
- Compatible 64-bit processor or SoC
- 4 GB of RAM minimum
- 64 GB of storage or more
- UEFI firmware
- Secure Boot capable
- TPM version 2.0
- DirectX 12 compatible graphics
- WDDM 2.0 driver
- Display larger than 9 inches
- 720p HD resolution or better
Before you buy anything
How to check whether a device qualifies
Run the PC Health Check app
Microsoft's own tool gives a pass or fail and names the specific requirement that failed.
Check TPM and Secure Boot in firmware
On plenty of machines from 2017 onward the hardware is present but switched off in BIOS or UEFI settings. Enabling it can convert a fail into a pass.
Inventory the whole fleet at once
Checking device by device is how organisations end up buying ESU for machines that never needed it. Pull a single report and sort by outcome.
Test the applications, not just the OS
A device passing the hardware check is only half the answer. The line-of-business application is what usually delays a migration.
For UAE businesses
What changes when you are covering thirty devices, not three
- The consumer route is off the table. Once devices are domain joined or managed through Intune, the $30 option disappears and commercial licensing applies to every one of them.
- Prices are quoted in dollars, invoiced in dirhams. Budget for the local currency equivalent plus applicable VAT, and confirm the exchange basis your partner uses before approving the purchase order.
- Management tooling earns a discount. Devices managed through Microsoft Intune or Windows Autopatch attract a reduced ESU rate, which is worth confirming if you already own the licences.
- Partial fleets are normal. Most UAE SMEs find a mix: some devices upgrade cleanly, a few need firmware changes, and a small group is genuinely stuck behind an application or a piece of connected equipment.
- Healthcare, education and government carry extra weight. In regulated environments an unpatched endpoint is not only a technical risk, it is a documentation problem at the next audit.
The practical answer for most SMEs is to stop treating this as a one-off purchase. Enrolment, key deployment, patch verification and the eventual migration are recurring operational tasks with hard dates attached, which is exactly the kind of work that sits naturally inside an IT annual maintenance contract rather than being handled ad hoc each October.
Decision guide
Which option is right for you?
Your devices pass the Windows 11 check
Upgrade in place and skip ESU entirely. Test your critical applications on one machine first, then roll out in waves. Paying for ESU on eligible hardware is money spent twice.
The hardware fails, and the devices are near end of life anyway
Replace rather than renew. One year of ESU on a five-year-old desktop buys twelve months on a machine that will still need replacing, and Year 2 doubles the bill.
A specific application or machine ties you to Windows 10
This is the case ESU was designed for. Buy Year 1 for the affected devices only, isolate them on the network, and set a firm date to resolve the dependency.
You are considering doing nothing
Understand what you are accepting. The device keeps working, but every vulnerability disclosed from now on stays open on it permanently. For a shared office PC handling client data, that is not a saving.
Before year end
Your 2026 action checklist
Work through these in order. Most of it is discovery, and discovery is what stops the budget from being a guess.
- Count every Windows 10 device you own
- Confirm each one is on version 22H2
- Run PC Health Check across the fleet
- Split the list into upgrade, replace, and ESU
- Check TPM and Secure Boot on the near-misses
- Identify which devices are domain or MDM managed
- Test line-of-business apps on Windows 11
- Price ESU against replacement per device
- Check whether Windows 365 or AVD already covers you
- Order Year 1 licences before 13 October 2026
- Deploy keys and verify patches are landing
- Diarise the Year 2 renewal decision
Help
Frequently asked questions
Is Windows 10 ESU worth it for a small business in Dubai?
It depends entirely on why the devices are still on Windows 10. If they cannot meet the Windows 11 hardware requirements and still have useful life, Year 1 at $61 per device is cheap insurance while you plan. If they are already eligible for Windows 11, or are old enough that you would replace them within the year anyway, ESU is a delay rather than a saving. The test is whether the money buys you a migration you have actually scheduled.
Can my company use the $30 consumer ESU option instead?
No, if the devices are joined to an Active Directory domain or Microsoft Entra, or managed through an MDM solution such as Intune. Those devices are excluded from the consumer programme and the enrolment option will not appear in Windows Update. Devices that are only Entra registered can still qualify. Anything managed commercially has to go through volume licensing at the commercial rate.
What happens if I skip Year 1 and buy ESU later?
You pay for both years. Commercial ESU is cumulative and sold by the year with no partial periods, so an organisation enrolling for the first time in Year 2 owes the Year 1 fee as well. That takes the entry cost from $122 to $183 per device before a single patch is delivered.
How long can Windows 10 stay on ESU?
Personal devices are covered through 12 October 2027, after Microsoft extended the consumer programme by an extra year in June 2026. Commercial and education customers can buy up to three years of coverage, taking them to October 2028. After that there is no further ESU for Windows 10 in either programme.
Does ESU include technical support if something breaks?
Not in the general sense. Microsoft supports ESU licence activation, installation, and regressions caused by the ESU updates themselves. Ordinary Windows 10 troubleshooting is not covered, and organisations that want it need a separate Microsoft support plan. Day to day support for the device typically falls to your internal team or your managed services provider.
Will my Windows 10 PC stop working when ESU ends?
No. The device keeps booting and your software keeps running. What ends is the flow of security updates, so any vulnerability disclosed after that date stays permanently open on the machine. For a personal PC used lightly that may be an acceptable risk. For a shared office device handling client or patient data in a regulated UAE sector, it usually is not.
Is there any way to get ESU without paying per device?
Yes, through the cloud. Windows 10 virtual machines running in Windows 365, Azure Virtual Desktop and several other Azure services are entitled to ESU at no additional cost, and physical Windows 10 endpoints connecting to a Windows 365 Cloud PC are covered for up to three years with an active subscription. If a virtual desktop project is already on your roadmap, it may cover the ESU question as a side effect.
Do I have to upgrade to Windows 11, or can I move to something else?
Windows 11 is the direct upgrade path and it carries no licence fee on eligible hardware. Some organisations move specific workloads to a cloud desktop instead, and a small number move non-standard machines to a different operating system entirely. The right answer usually depends on the applications rather than the hardware, which is why application testing should come before any procurement decision.
Keep reading
If the ESU decision is part of a wider hardware refresh, our guide on upgrading IT infrastructure without destroying your budget covers how UAE SMEs phase this kind of work across a financial year.
