Windows 10 has ended: Windows 11 is the minimum, not the plan

Windows 10 reached end of support on 14 October 2025. Version 22H2 was the last one, and the update that shipped that day was the last free security update it will ever receive. That date is behind us now, not ahead. A fleet still running Windows 10 today is in one of three places: already on Windows 11, paying for Extended Security Updates to buy time, or running unpatched and hoping. Only one of those is a plan.

We move organisations through this for a living, from global farms at the European Commission to Fortune 500 estates, and the mistake is almost always the same one: treating it as a PC refresh instead of the workplace decision it actually is. This article is the how, with the commands, including the part a device-by-device refresh tends to miss: the same Windows 10 that costs money to keep alive on a desk is free to keep alive in Azure.

The clock did not stop, it got a price

Windows 10 machines still boot. That is exactly the problem. Nothing breaks on 15 October; the risk is quiet, and it accrues. To keep receiving Critical and Important security updates, a physical device now has to be enrolled in the paid Extended Security Updates (ESU) programme, which Microsoft prices at 61 US dollars per device for year one, doubling every year after, to a maximum of three years, until October 2028. ESU is a bridge you pay to cross, not a place to live.

Microsoft 365 Apps blur the picture further. Word and Outlook keep receiving security updates on Windows 10 until 10 October 2028, but they freeze on version 2608: no new features, and if you open a support case for a problem that only happens on Windows 10, the answer is to move to Windows 11. You end up paying to stand still, on two separate meters.

Windows 11 is a hardware gate, not a download

The reason this is not a one-click upgrade is the hardware bar. Windows 11 requires TPM 2.0 and UEFI Secure Boot, on a processor from an approved list. Those two requirements are what disqualify a lot of the hardware bought before 2018, and no amount of RAM changes it. So the first real number in the project is not a licence count, it is how much of the estate is even eligible.

# Per device: the two gates that stop most pre-2018 hardware.
(Get-Tpm).TpmPresent -and (Get-Tpm).TpmReady   # TPM 2.0 present and ready
Confirm-SecureBootUEFI                          # True only on UEFI with Secure Boot on

First, know the fleet

You cannot plan what you have not counted. If the devices are already in Intune, one query with the Microsoft Graph PowerShell SDK gives the split between Windows 10 and Windows 11, and the exact builds, across the whole estate at once:

# Who is still on Windows 10, and on which build?
# 10.0.19045 = Windows 10 22H2; 10.0.22000 and above = Windows 11.
Connect-MgGraph -Scopes "DeviceManagementManagedDevices.Read.All"
Get-MgDeviceManagementManagedDevice -All -Filter "operatingSystem eq 'Windows'" |
  Group-Object osVersion | Sort-Object Count -Descending |
  Select-Object Count, Name

That single table decides the shape of the project: how many machines take Windows 11 in place, how many have to be replaced, and how many are candidates for a Cloud PC instead.

Autopilot: stop building machines by hand

The old way to deploy Windows was to build a golden image, and rebuild it every time something changed. Windows Autopilot ends that. The device is delivered, the user powers it on and signs in with their work account, and the device joins Entra ID, enrols in Intune, installs its applications, applies its configuration (BitLocker, Windows Hello) and is checked for compliance, all from the cloud. An Enrollment Status Page holds the desktop back until the machine is actually ready, in two phases: a device phase and a user phase.

There are two flavours. Classic Autopilot registers each device by its hardware hash first, so the service recognises it at first boot:

# Once per device (or done by the OEM): harvest the hardware hash and upload it to Intune.
Install-Script -Name Get-WindowsAutopilotInfo -Force
Get-WindowsAutopilotInfo -Online   # asks for an Intune Administrator sign-in, then uploads

The newer Autopilot device preparation drops the hardware-hash step: you assign a preparation policy to a user group, and any device that user signs into during setup joins Entra ID, enrols in Intune, gets its apps and scripts, and can even pull the user out of the local Administrators group automatically. For a Windows 10 estate being reinstalled anyway, it is the shortest path to a clean, managed Windows 11 machine.

The policies you set once

Autopilot puts the device under management. What keeps it secure is a handful of policies, defined once and assigned to groups, never clicked machine by machine:

• an Autopilot deployment profile, Entra join with an Enrollment Status Page, so the first boot lands configured;
• a compliance policy that requires BitLocker on, Microsoft Defender running and a minimum OS build, so a device that drifts out of shape is caught;
• a Conditional Access policy that only admits compliant devices and requires multifactor authentication, so identity and device posture are checked together, not separately;
• a Windows Update feature-update policy that moves eligible devices to Windows 11 in rings, on a schedule you control, not all at once.

Those four are the difference between a fleet that happens to run Windows 11 and one that is actually managed. The deadline is the reason to put them in now, while every machine is being opened anyway.

The Azure angle: the same Windows 10 is free to keep alive in the cloud

Here is the part that changes the economics, and it is the part a pure device refresh never sees. That 61 dollars per device, doubling each year, is for physical machines. For Windows 10 running as a virtual machine in Azure, Extended Security Updates are free, and automatic. No keys, no enrolment, no configuration: Azure recognises the machine from its own metadata. It applies to Azure virtual machines, Azure Virtual Desktop (single and multi-session), Azure Dedicated Host, Azure Local, the Azure Stack family, and Windows 365 Cloud PCs.

# Azure: list your Windows VMs to find the Windows 10 ones. ESU is already free here.
az vm list -d \
  --query "[?storageProfile.osDisk.osType=='Windows'].{name:name, rg:resourceGroup, image:storageProfile.imageReference.sku}" \
  -o table

That flips the decision for two groups of machines. The estate that runs Windows 10 on Azure Virtual Desktop does not have to be rescued from a cost, it has to be moved forward: swap the session hosts to Windows 11 multi-session at your own pace, knowing the security updates keep coming for free in the meantime. One caveat that is already in effect: the Windows 10 22H2 AVD image that shipped with Microsoft 365 Apps was pulled from the Azure Marketplace back in April 2026; only the image without Microsoft 365 Apps remains, through 2028, so any hosts built from the old one are first in line to move.

And the physical machines that failed the hardware check do not become waste. A Windows 365 Cloud PC gives their users a managed Windows 11 desktop, streamed to the old hardware, which runs it as a thin client. The old box even stays covered: a Windows 10 device connecting to a licensed Cloud PC is itself entitled to ESU, at no extra cost, for up to three years. The desk that looked like a bill becomes a way in.

The floor, not the destination

Windows 10 ending is not really a Windows story. It is the moment the industry stopped letting organisations defer the Modern Workplace. Windows 11 is not the destination, it is the floor you build identity, management and security on, whether that floor is a laptop joined to Entra with Autopilot or a Cloud PC in Azure. The only question the October 2025 deadline actually asked was whether you would lay that floor on purpose, or under pressure.