Download PDF (178 KB) PDF version, ready to print or share with your team.
Written by Mike Pearlstein, CISSP, CEO of Fusion Computing Limited. Helping Canadian businesses build and manage secure IT infrastructure since 2012 across Toronto, Hamilton, and Metro Vancouver.
Canadian businesses got a confusing gift in June 2026: Microsoft quietly extended free Windows 10 security updates to October 12, 2027. The catch sits in the fine print. The extension covers personal devices, and the clock on business fleets never moved.
For a company fleet, the real deadline is October 13, 2026. That’s the day commercial Extended Security Updates (ESU) Year 1 expires and the per-device price doubles to US$122. Meanwhile, 22.87% of Canadian desktop Windows machines were still on Windows 10 as of mid-2026, per StatCounter.
This guide lays out the dates, the real costs in US$, and a per-device decision path. It’s the same sequence Fusion Computing walks through with managed IT clients across Canada.
QUICK ANSWER
Free Windows 10 support ended October 14, 2025. The October 2027 extension applies to personal devices only. Business fleets need 1 of 4 paths before October 13, 2026: upgrade eligible devices to Windows 11 (US$0), buy ESU Year 2 (US$122 per device), replace ineligible hardware, or move to Windows 365 Cloud PCs with ESU included.
Key Takeaways
- Free Windows 10 support ended October 14, 2025; business ESU Year 1 expires October 13, 2026 (Microsoft, 2026).
- Microsoft’s consumer extension to October 12, 2027 covers personal devices only. Domain-joined and Entra-joined fleets are excluded.
- ESU pricing doubles every year: US$61, US$122, then US$244 per device, and late enrollment bills prior years retroactively (US$183 minimum in Year 2).
- At least 240 million Windows 10 PCs worldwide can’t meet the Windows 11 TPM 2.0 hardware floor (Canalys).
- Microsoft 365 Apps keep getting security updates on Windows 10 until October 10, 2028, but the OS underneath stays unpatched without ESU.
When did Windows 10 support actually end?
Microsoft ended free Windows 10 security updates on October 14, 2025, per the Microsoft Learn ESU program page (2026). Businesses can buy Extended Security Updates in 3 one-year blocks running to October 13, 2028, and the free upgrade to Windows 11 remains available for eligible devices. The October dates in 2026, 2027, and 2028 now drive every fleet decision.
The confusion traces to headlines. The recent “Windows 10 support extended” stories were accurate for home users and wrong for every domain-joined fleet in the country. The table below is the full picture.
| Date | What ends | Who it affects |
|---|---|---|
| October 14, 2025 | Free Windows 10 security updates | Every device, business and personal |
| October 13, 2026 | Business ESU Year 1 coverage | Commercial fleets enrolled at US$61 per device |
| October 12, 2027 | Consumer ESU coverage and business ESU Year 2 | Personal devices; fleets paying US$122 per device |
| October 13, 2028 | Business ESU Year 3, the final runway (Microsoft 365 Apps security updates end October 10, 2028) | Any Windows 10 device still in service |
Does the October 2027 extension apply to business devices?
According to Microsoft (2026), the consumer ESU program now runs through October 12, 2027 after a 1-year extension announced in June 2026. The extension covers personal Windows 10 22H2 devices only. Devices joined to a company domain or to Microsoft Entra ID are excluded, so a managed business fleet can’t enroll through the consumer program.
| Feature | Consumer ESU | Business ESU |
|---|---|---|
| Coverage ends | October 12, 2027 | October 13, 2026 (Year 1), renewable to October 13, 2028 |
| Price | Free with settings sync, 1,000 Rewards points, or US$30 one-time for up to 10 devices | US$61 Year 1, US$122 Year 2, US$244 Year 3, per device |
| Eligible devices | Personal Windows 10 22H2 with a Microsoft account | Windows 10 22H2 via volume licensing or a Microsoft partner |
| Domain or Entra-joined devices | Excluded | Covered |
The split isn’t an interpretation; Microsoft put it in writing when the extension shipped:
“Windows 10 Extended Security Updates (ESU) program for personal use devices is being provided for an additional year, with coverage now available through Oct. 12, 2027.”
What does Windows 10 ESU Year 2 cost?
Commercial Extended Security Updates cost US$61 per device for Year 1, US$122 for Year 2, and US$244 for Year 3, per Microsoft Learn (2026). Pricing is cumulative: a business that skipped Year 1 and enrolls in Year 2 pays US$183 per device. Canadian businesses buy through a Microsoft partner and are billed in CA$ at the prevailing rate.
Two rules shape the budget. Enrollment is cumulative, so waiting doesn’t defer the cost; it compounds it. And ESU delivers security fixes rated Critical and Important only, with no feature updates and no general technical support. The Year 2 window runs October 14, 2026 to October 12, 2027.
Should you pay for ESU or upgrade to Windows 11?
The break-even is stark. Two years of ESU costs US$366 per device and buys no new capability, while the Windows 11 upgrade is US$0 on eligible hardware, according to Microsoft (2026) pricing. For most Canadian fleets the answer is per device: upgrade what qualifies, bridge what retires within 12 months, and replace the rest.
| Path | Per-device cost | Best fit | Watch out for |
|---|---|---|---|
| Upgrade in place to Windows 11 | US$0 license | Devices with TPM 2.0 and a supported CPU | Test line-of-business apps first; pilot for 2 to 4 weeks |
| Buy ESU Year 2 | US$122 (US$183 if Year 1 was skipped) | Devices already scheduled to retire within 12 months | Doubles again to US$244 in Year 3; security patches only |
| Replace the hardware | Varies by device class | Machines older than 5 years or failing the TPM 2.0 floor | Order lead times ahead of the October 13, 2026 rush |
| Windows 365 Cloud PC | Subscription per user; ESU included at US$0 | Fleets already moving to cloud desktops | Endpoints must be Entra joined and sign in every 22 days |
The affordability objection cuts the other way here. Two years of ESU on a 6-year-old desktop is US$366 spent standing still: nothing new at the end, and the Year 3 renewal doubles again. The same US$366 put toward a replacement produces an asset on a fresh 4-to-5-year lifecycle. And the cost of 1 incident on an unpatched machine makes both numbers look small.
Unsure which path fits your fleet? Book a 30-minute consultation with a CISSP-led team →
What if your hardware can’t run Windows 11?
Canalys (2023) estimated at least 240 million Windows 10 PCs worldwide can’t meet the Windows 11 hardware floor, and Microsoft has confirmed the TPM 2.0 requirement won’t be relaxed. For those devices the realistic choices are replacement or a Windows 365 Cloud PC subscription that includes ESU coverage for the endpoint.
The floor a device has to clear, per Microsoft’s Windows 11 specifications (2026):
- TPM 2.0, enabled in firmware (Microsoft calls it non-negotiable)
- A supported 64-bit CPU, roughly Intel 8th generation (2017) or AMD Zen 2 (2019) and newer
- UEFI with Secure Boot, plus 4 GB RAM and 64 GB storage minimum
The cloud path changes the math for ineligible hardware. A Windows 10 endpoint that connects to a Windows 365 Cloud PC is entitled to ESU at no additional cost for up to 3 years, per Microsoft Learn (2026). The conditions: the device must be Entra joined or hybrid joined, and each user signs in with their Entra ID at least once every 22 days.
What about Microsoft 365 apps on Windows 10?
Microsoft will keep shipping security updates for Microsoft 365 Apps on Windows 10 through October 10, 2028, according to Microsoft Learn (2026). Feature updates stop earlier: devices freeze at Version 2608 and then receive security fixes only. The app runway protects Word and Excel; the operating system underneath still stops getting patches the moment ESU coverage lapses.
The 2028 date reads like breathing room and behaves like a trap. A plan built around Office patches while the OS underneath goes unpatched inverts the risk model, because the exposed layer is the one attackers reach first. Fold the fleet decision into the IT budget cycle now instead of absorbing an unplanned refresh in 2027.
“Fusion rebuilt our access controls before bonding renewal. They handed us a single PDF with our last restore test date, our MFA coverage report, our subcontractor offboarding log, and our incident response runbook. Our bonding underwriter accepted it without follow-up questions.”
Your 90-day plan before October 13, 2026
StatCounter (June 2026) puts 22.87% of Canadian desktop Windows devices on Windows 10, roughly 1 machine in 4. With business ESU Year 1 ending October 13, 2026, a 90-day plan is enough to inventory a fleet, move the eligible devices, and order replacements before the autumn procurement rush.
| Weeks | Action | Output |
|---|---|---|
| Weeks 1 to 2 | Pull the RMM hardware inventory: TPM version, CPU generation, device age, Windows build | Per-device eligibility list |
| Weeks 3 to 6 | Upgrade eligible Windows 10 22H2 devices to Windows 11, piloting with 5 to 10 users first | Eligible fleet moved at US$0 license cost |
| Weeks 7 to 10 | Price replacements for ineligible devices and order before September | Purchase orders placed ahead of the rush |
| Weeks 11 to 12 | Enroll any remaining Windows 10 devices in ESU Year 2 through your Microsoft partner | Zero devices unpatched on October 14, 2026 |
TRUSTED BY CANADIAN BUSINESSES SINCE 2012
CISSP-Led • Microsoft Solutions Partner • CompTIA Managed Services Trustmark • 50 Best Managed IT Companies (2024)
Serving Toronto and the GTA • Hamilton • Metro Vancouver • Windows 11 transitions, managed IT, and cybersecurity for 25 to 200 seat fleets
The bottom line for Canadian fleets
Windows 10 keeps working after every one of these dates; it just stops being defensible. The decision is per device, the pricing is published, and the deadline for business fleets is October 13, 2026. Run the inventory early, then spend the ESU budget only where it buys time deliberately. Fusion Computing manages this transition for Canadian businesses, and the earlier the inventory runs, the cheaper the outcome.
Frequently asked questions
Frequently asked questions. Our team helps Canadian SMBs approach windows 10 end of support canada in a practical, compliant way, focusing on the decisions and trade-offs that matter for a regulated business.
When does Windows 10 support end?
Free support ended October 14, 2025. Paid Extended Security Updates extend protection in 1-year blocks: business Year 1 ends October 13, 2026, Year 2 ends October 12, 2027, and Year 3 ends October 13, 2028. Consumer ESU coverage ends October 12, 2027. After the applicable date, devices keep working without security patches.
Can a business use the free consumer ESU extension to October 2027?
No. The consumer program is licensed for personal-use devices and requires enrollment with a Microsoft account through the Settings app. Devices joined to a company domain or to Microsoft Entra ID are excluded, which rules out nearly 100% of managed business fleets. Businesses buy commercial ESU through volume licensing or a Microsoft partner instead.
How much does Windows 10 ESU cost for a business?
Year 1 runs to October 13, 2026 at US$61 per device. Year 2 costs US$122 (to October 12, 2027) and Year 3 costs US$244 (to October 13, 2028). Canadian businesses are billed in CA$ equivalent through their Microsoft partner. ESU covers security updates rated Critical and Important, with no feature updates and no general support.
Do we pay for Year 1 if we enroll late?
Yes. ESU pricing is cumulative because each year’s updates build on the last. A business enrolling for the first time in Year 2 pays for Year 1 retroactively: US$61 plus US$122, a minimum of US$183 per device. Enrolling before October 13, 2026 avoids the stacked charge.
Is the Windows 11 upgrade free?
Yes. Windows 10 22H2 devices that meet the hardware requirements (TPM 2.0, a supported CPU, UEFI Secure Boot, 4 GB RAM, 64 GB storage) upgrade to Windows 11 at US$0 license cost through Windows Update. The real project cost is testing and deployment time, typically 2 to 4 weeks for a small fleet pilot.
What happens if we keep running Windows 10 without ESU?
The device keeps working and stops receiving security patches, so every vulnerability disclosed after October 14, 2025 (or after your ESU coverage lapses) stays open permanently. Attackers target unsupported systems first, and insurers ask about unsupported software on applications. For any device that touches business data, running unpatched past October 13, 2026 is an avoidable risk.
Will Microsoft 365 apps keep working on Windows 10?
Yes. Microsoft will ship security updates for Microsoft 365 Apps on Windows 10 through October 10, 2028. Feature updates stop when Version 2608 arrives, after which the apps freeze functionally. App-level patches don’t protect the operating system underneath, so the 2028 runway doesn’t replace an OS decision.
Why can’t some PCs upgrade to Windows 11?
Windows 11 requires TPM 2.0 and a CPU on Microsoft’s supported list, roughly Intel 8th generation (2017) and newer or AMD Zen 2 (2019) and newer. Canalys estimates at least 240 million Windows 10 PCs worldwide fail that floor. Some 2017 to 2019 machines have TPM 2.0 disabled in firmware, so check the BIOS before ruling a device out.
How does Windows 365 remove the ESU charge?
Windows 10 endpoints that connect to a Windows 365 Cloud PC are entitled to ESU at no additional cost for up to 3 years. The endpoint must be Microsoft Entra joined or hybrid joined, the user must sign in with their Entra ID at least once every 22 days, and a verification policy must be enabled on the device.
Is Windows 10 ESU available through a Canadian Microsoft partner?
Yes. Commercial ESU is sold through Microsoft volume licensing and the Cloud Solution Provider (CSP) channel, which is how most Canadian SMBs buy it. The list prices are US$61, US$122, and US$244 per device for Years 1 to 3, invoiced in Canadian dollars at the exchange rate applied by your partner at billing time.
Does ESU require a specific Windows 10 version?
Yes. Devices must run Windows 10 version 22H2, the final feature release from 2022, to receive Extended Security Updates. A machine stuck on 21H2 or older gets nothing from ESU enrollment until it moves to 22H2, so version compliance belongs in the week 1 to 2 inventory step of the 90-day plan.
What should a Canadian business do first?
Pull a hardware inventory from your RMM or endpoint manager covering TPM version, CPU generation, device age, and Windows build. That single report splits the fleet into 3 groups: upgrade now at US$0, bridge on ESU Year 2 at US$122, or replace. Start before September 2026 to beat procurement lead times.
Related Resources
Related Resources. Our team helps Canadian SMBs approach windows 10 end of support canada in a practical, compliant way, focusing on the decisions and trade-offs that matter for a regulated business.
