Key takeaways

  • Windows 10 Home and Pro, version 22H2, reached end of support on October 14, 2025. After that date Microsoft no longer provides technical support, feature updates or quality updates, including security fixes, unless a device is enrolled in Extended Security Updates.
  • Commercial ESU is a paid, per-device subscription for up to three years after end of support. Microsoft's page lists $61 USD per device for Year One and says the price doubles each year.
  • Microsoft 365 Apps keep receiving security updates on Windows 10 until October 10, 2028, but Microsoft says devices should move to Windows 11, and support for issues that only occur on Windows 10 is limited.
  • Windows 11 needs a compatible 64-bit processor, 4 GB of memory, 64 GB of storage, UEFI with Secure Boot and TPM 2.0. Many older PCs will fail the check and need replacing.
  • CISA's SCuBA project publishes free secure configuration baselines and the ScubaGear tool for Microsoft 365. Start with identity: MFA, legacy authentication, privileged roles and logging.

The date has passed

Microsoft's lifecycle page for Windows 10 Home and Pro states that Windows 10 reached end of support on October 14, 2025, and that version 22H2 was the final version of Windows 10. From that date, Microsoft's support article on the Extended Security Updates program says, the company no longer provides technical support, feature updates or quality updates, including security and reliability fixes, for versions of Windows 10 that reached end of support on that date. Existing LTSC releases follow their own lifecycles. Check the specific edition you run on the Microsoft lifecycle site.

Windows 10 PCs keep working. That is the trap. A machine that boots and runs your applications looks fine while it collects unpatched vulnerabilities. Attackers study each month's patches for the bugs they fix, so an unsupported system becomes easier to attack over time, not harder. If you are one of the firms still running Windows 10 more than a year after the deadline, the first job is to find out how many devices that is.

Step 1: inventory what you have

List every Windows device with its edition, version, age, owner and role. Include the machines people forget: a reception PC, a conference room system, a CAD workstation, a lab PC that runs a vendor application, a kiosk. Your device-management tool or a network scan can build the list in a day. Mark each machine as one of four things: eligible for an in-place upgrade to Windows 11, replace, retire, or keep on Windows 10 with ESU for a defined time.

Step 2: check Windows 11 eligibility

Microsoft's Windows 11 requirements page lists the minimum hardware. The processor must be 1 GHz or faster with two or more cores on a compatible 64‑bit processor or system on a chip. Memory is 4 GB or more and storage is 64 GB or more of available space. Graphics must support DirectX 12 or later with a WDDM 2.0 driver. System firmware must be UEFI and Secure Boot capable, and the device needs a Trusted Platform Module (TPM) version 2.0. To upgrade directly, a device must run Windows 10 version 2004 or later with the September 14, 2021 security update or later.

The TPM and processor rules are where older fleets fail. Do not work around them with unsupported tweaks. A machine installed outside the stated requirements is outside what Microsoft documents, and a work PC that holds client data should not be in that position. Replacement is usually the better answer for a machine that fails the check, and it is a good moment to standardize on devices that can be managed and encrypted properly.

Step 3: use Extended Security Updates as a bridge, not a plan

Microsoft describes ESU as a paid program that lets individuals and organizations extend the use of Windows 10 devices past the end of support date in a more secure manner. Facts from Microsoft's page for organizations:

  • Eligible devices must run Windows 10 version 22H2.
  • ESU is sold per device, with a minimum purchase of one license. For organizations, Microsoft lists $61 USD per device for Year One through volume licensing, and says the price doubles every consecutive year for a maximum of three years.
  • ESU must be purchased by year, and the years are cumulative: if you buy in Year Two, you must pay for Year One too.
  • Enrolled commercial and education PCs can receive security updates for a maximum of three years after end of support.
  • ESU does not include new features, customer-requested non-security updates or design change requests, and it does not include technical support beyond license activation, installation and possible regressions of the ESU itself.
  • ESU is available at no additional cost for Windows 10 virtual machines in certain Microsoft services, including Windows 365, Azure Virtual Desktop and Azure virtual machines. Check the page for the full list.

Confirm current prices and terms with your licensing partner before you budget, since the page notes the price schedule. The arithmetic is simple. Each year of ESU costs more than the one before, so the longer a PC stays on Windows 10, the closer its cost gets to the price of replacing it. Use ESU for machines that must stay on Windows 10 for a clear reason, such as a vendor application that is being replaced, and put an end date on each one.

Microsoft 365 Apps on Windows 10

Microsoft 365 is governed by the Modern Lifecycle Policy, which requires customers to stay current with servicing and system requirements, including using Microsoft 365 Apps on a supported Windows operating system. Microsoft's guidance says apps such as Word may continue to work after Windows 10 reaches end of support, but an unsupported operating system can cause performance and reliability issues, and devices should move to Windows 11.

Microsoft says it will continue to provide security updates for Microsoft 365 Apps on Windows 10 for three years after end of support, delivered through the standard update channels and ending on October 10, 2028. Devices will receive feature updates and Copilot support, where eligible, until Version 2608 is released, then stay on Version 2608 with security updates only. The OneDrive desktop app on Windows 10 22H2 keeps receiving updates through October 10, 2028.

Support is limited. If an issue occurs only with Microsoft 365 Apps on Windows 10 and not on Windows 11, Microsoft says support will ask the customer to move to Windows 11. If the customer cannot, support provides troubleshooting only, and workarounds may be limited or unavailable. Those incidents do not include the option to log a bug. Note that app security updates do not patch the operating system underneath them.

Why this is also a Microsoft 365 hardening moment

A Windows migration touches every user, so it is an efficient time to review the Microsoft 365 tenant. Most small and mid-size tenants run on defaults plus whatever someone changed years ago. CISA's Secure Cloud Business Applications (SCuBA) project exists for this. CISA established it in 2022 to address visibility and cybersecurity gaps exposed by software-as-a-service intrusions. It publishes secure configuration baselines for Microsoft 365 and Google Workspace and a no-cost assessment tool, ScubaGear, that compares a Microsoft 365 tenant's configuration with those baselines and produces a report.

CISA's page says the primary goal is to help secure federal civilian agencies, but all organizations can use SCuBA to strengthen SaaS security. The baseline documents add that non-federal users get the content for informational purposes, that some controls depend on license level, and that every organization has its own risk tolerance. Treat the baselines as a reference, not as a rule that must be met setting by setting.

Ten settings to review first

The Entra ID and Exchange Online baselines contain many policies. These are the ones we would check first in a mid-size firm, with the baseline policy language where it is short.

  • Block legacy authentication (MS.AAD.1.1). The baseline says legacy authentication SHALL be blocked, because those protocols do not support MFA.
  • Require MFA for all users (MS.AAD.3.2), and phishing-resistant MFA for everyone where possible (MS.AAD.3.1). The baseline lists certificate-based authentication, FIDO2 security keys, Windows Hello for Business and device-bound passkeys as recommended.
  • Block users detected as high risk (MS.AAD.2.1).
  • Keep Global Administrators between two and eight people (MS.AAD.7.1).
  • No permanent active assignments for highly privileged roles (MS.AAD.7.4), and phishing-resistant MFA for those roles (MS.AAD.3.6).
  • Send security logs to a monitoring system (MS.AAD.4.1).
  • Let only administrators register applications (MS.AAD.5.1).
  • Disable automatic forwarding to external domains in Exchange Online (MS.EXO.1.1).
  • Enforce DMARC with a reject policy (MS.EXO.4.2), after SPF and DKIM are in place. Our email authentication article explains the sequence.
  • Disable SMTP AUTH (MS.EXO.5.1) and enable mailbox auditing (MS.EXO.13.1) unless a documented device needs an exception.

The policy numbers and wording are quoted from the baselines as published on CISA's GitHub repository when we reviewed them, and CISA revises them, so check the current text. Several of the identity items also appear in insurer application forms, which is another reason to do them. See our article on cyber insurance readiness.

Run ScubaGear

ScubaGear is a PowerShell tool that CISA maintains as open source. It is read-only: it assesses the tenant and produces a report, and it does not change settings. Run it from an administrator workstation with the right read permissions, review the failures, and decide per item whether to fix, accept or document an exception. Re-run it after each change window and keep the report with your records. That report is also a useful exhibit for auditors and insurers.

A 90‑day plan

  • Days 1 to 15: inventory devices, mark each as upgrade, replace, retire or ESU; run ScubaGear and rank the failures.
  • Days 16 to 45: fix identity items (legacy authentication, MFA, admin roles, logging); upgrade the eligible machines in waves, starting with IT and a pilot group.
  • Days 46 to 75: replace machines that fail the Windows 11 check; buy ESU only for exceptions with end dates; fix the Exchange Online items.
  • Days 76 to 90: retest, document exceptions, update the asset inventory and report to leadership.

Common mistakes

  • Treating ESU as a policy. It is a bridge with a price that rises each year.
  • Forgetting servers and embedded systems. Windows Server and specialized devices have their own lifecycle dates.
  • Upgrading hardware but leaving tenant defaults alone.
  • Enforcing MFA for staff but not for service accounts, shared mailboxes or contractors.
  • Skipping a pilot. Conditional access and legacy-protocol blocks can break old scanners and line-of-business apps, so find them first.

How Clayton Cybernetics can help

Our team manages Windows and Microsoft 365 environments with device management, Defender, identity and backup in the same operating model. We can inventory your devices, plan the Windows 11 move, and assess your tenant against the CISA baselines, then fix the findings and keep them fixed. Call (305) 404-9404 to start.

Sources

This article is general information, not licensing or legal advice. Microsoft changes prices, dates and terms; confirm them with Microsoft or your licensing partner. CISA's baselines are written for federal agencies and offered to others for information only. Last reviewed .

Keep reading

Need help with this?

We run your IT day to day so it stays secure: help desk, devices, Microsoft 365, Exchange, Active Directory, backups, networks and monitoring.

Managed IT Services