Windows 10 ESU Year 2 Has Started — Decide This Week, Then Check What Intune Enforces

Microsoft’s lifecycle table for Windows 10 Extended Security Updates (ESU) shows Year 1 ending on 13 October 2026. Year 2 now runs through 12 October 2027, and a third and final year ends in October 2028. Commercial ESU covers Windows 10 Pro, Enterprise and Education in business use, on version 22H2. It delivers Critical and Important security updates only — no new features and no general technical support.

Two details matter this week. First, ESU is cumulative. Microsoft only sells a Year 2 licence to organisations that have also bought Year 1, so a device that skipped Year 1 has to be licensed for both to get back into coverage. Second, each year is licensed separately and has its own activation ID. Being activated for Year 1 does not make a device ready for Year 2 — check that the Year 2 licence is activated on every device you keep.

If your organisation still runs Windows 10 on managed devices, you have a decision to make before November’s security updates: enrol the remaining devices in Year 2, or finish moving them to Windows 11. Either way, this is a good week to check what your Intune baseline actually enforces — starting with one tenant-wide setting that many tenants have never changed.

Why NZ organisations should care

Plenty of New Zealand mid-market and public-sector estates carried a Windows 10 tail past October 2025: shared PCs, lab and kiosk devices, specialist hardware, and laptops that did not meet Windows 11 requirements. ESU Year 1 bought time. That year is now used up, and Microsoft prices ESU so that it doubles each year.

Under the Privacy Act 2020, organisations that hold personal information need reasonable security safeguards. A Windows 10 device that is neither on ESU nor upgraded gets no security updates at all. That is hard to explain as reasonable.

There is a second, quieter risk. Intune’s tenant-wide compliance policy settings include Mark devices with no compliance policy assigned as, and Microsoft documents the default as Compliant. If you rely on a Conditional Access policy that requires a compliant device, a device with no compliance policy assigned — a forgotten Windows 10 group, a platform you never wrote a policy for, a device outside your assignment scope — can pass that check. Microsoft’s guidance is to change the setting to Not compliant when you use compliance with Conditional Access.

What to do this week

Count the Windows 10 devices you still have. Use Intune device inventory or Microsoft Defender for Endpoint and split the list three ways: can upgrade to Windows 11, needs replacing, must stay on Windows 10 for now. Intune’s Windows feature update device readiness report flags devices that can’t upgrade as “Replace device”.
Decide per group, not per estate. Upgrade eligible devices with an Intune feature update policy or Windows Autopatch. Keep ESU Year 2 for devices that genuinely cannot move yet, and give each one a named owner and an exit date.
If you enrol in Year 2, activate it properly. Commercial ESU keys (MAKs) are in the Microsoft 365 admin center under Billing > Your products > Volume licensing, visible to the Product Key Reader or VL Administrator role. Install the Year 2 key, activate it with the Year 2 activation ID, then run slmgr.vbs /dlv and confirm the Year 2 programme shows as Licensed.
Check the Windows 365 and licensing routes. Windows 10 devices used to reach Windows 365 Enterprise Cloud PCs can be entitled to ESU at no extra cost — but only if they are Microsoft Entra joined or hybrid joined, the user signs in at least every 22 days, and you deploy the EnableESUSubscriptionCheck policy through Intune. Microsoft has also described a discounted ESU offer, sold through Volume Licensing, for organisations that manage updates with Intune or Windows Autopatch. Confirm what applies to your agreement, and New Zealand pricing, with your licensing partner.
Flip the compliance default — carefully. Open the Devices without compliance policy report in Intune first. Once every platform you allow (Windows, iOS/iPadOS, Android, macOS) has a compliance policy assigned, go to Endpoint security > Device compliance > Compliance policy settings and set Mark devices with no compliance policy assigned as to Not compliant.
Make compliance mean something. Most Windows compliance settings default to Not configured, which means they are not evaluated. Require BitLocker, Secure Boot, firewall, antivirus and a minimum OS build at least. If Windows 10 ESU devices stay, use valid operating system build ranges so a device that stops taking ESU updates becomes noncompliant.
Work through the rest of the baseline. Our new Intune device baseline checklist covers per-platform compliance, encryption, Windows LAPS, Defender for Endpoint, updates, security baselines, enrolment restrictions, app protection for BYOD and reporting.

What this is not

It is not a new vulnerability and not an Intune outage. Year 2 of ESU starting is a published lifecycle step, and the compliance default is documented. Tenants that have finished Windows 11 and already set the compliance default to Not compliant have little to do. Tenants with a Windows 10 tail, or a “require compliant device” policy resting on the default, should act before November’s security updates.