Windows 10 End of Support (Oct 2025): Unpatched Endpoints in Your Microsoft 365 Estate

Retrospective: this article looks back at events from October 2025, written in 2026 with the benefit of hindsight.

On October 14, 2025, Microsoft ended support for Windows 10. After that date, Windows 10 devices stopped receiving free security updates, unless enrolled in the paid Extended Security Updates (ESU) program.

What end of support means

• No more free security patches for newly discovered vulnerabilities.
• ESU offered security updates for a fee (with consumer options and commercial pricing increasing each year, for up to three years for organizations).
• Microsoft 365 apps continued to run on Windows 10 for a limited period but with reduced support commitments.

Why it mattered for security

Unpatched operating systems are prime targets. After end of support, every newly disclosed Windows 10 vulnerability becomes a permanent opening on unprotected devices. Attackers know organizations lag in upgrades.

Many organizations still had significant Windows 10 populations, often because of:

• Hardware that doesn't meet Windows 11 requirements (TPM 2.0, supported CPUs).
• Application compatibility concerns.
• Budget and project timing.

Windows 11 security improvements

Windows 11 brought stronger default security: hardware-backed protections (TPM 2.0, virtualization-based security, Secure Boot), credential protection, and features such as Smart App Control and improved phishing protection. Microsoft's later resiliency work, including Quick Machine Recovery, also targets Windows 11.

In hindsight

Windows 10 end of support was a predictable event — announced years in advance — that still left many organizations scrambling. The practical choices were upgrade, replace hardware, pay for ESU, or isolate and accept risk. Conditional Access and Intune compliance policies can enforce whichever choice an organization made.