Microsoft is retiring SMS and voice authentication in Entra ID, with passkeys the default sign in method from 1 September 2026 and a hard cut off on 1 February 2027 that applies to every tenant. Here is what changes, who it affects and what your business should do before the deadline.
Why your Windows 10 bill might be about to double
Nothing dramatic happened when Windows 10 went out of support in October 2025. The machines booted, Outlook opened, invoices printed. Which is exactly why so many businesses concluded there was nothing to do.
Year one of Extended Security Updates ends on 13 October 2026, and the price per device doubles the day after. If you are paying for ESU already, your renewal is twice what you budgeted. If you skipped year one, the bill is worse than you think, because the licensing is cumulative and you cannot buy year two without paying for year one as well.
We flagged this back when Windows 10 was five months from end of life. This is the part where it starts costing real money.
The numbers an owner manager can actually multiply
Microsoft’s commercial ESU pricing is per device, per year, and it doubles annually. Year one was 61 USD. Year two, covering 14 October 2026 to 12 October 2027, is 122 USD. Year three is 244 USD.
In sterling that is roughly £48, then £96, then £192 per machine, though the exact figure depends on your reseller, your agreement and VAT. Run a machine through all three years and you are looking at somewhere near £340 for security patches on hardware that was already old in 2025.
So the sum is simple. Twelve Windows 10 machines through year two is around £1,150. Twenty five machines is around £2,400. That is before anyone has upgraded anything.
Two things catch people out. The first is the cumulative rule. Enrol in year two having skipped year one and you owe both, so the entry price is closer to £145 per device than £96. There is no version of this where waiting is cheaper.
The second is the consumer programme. Microsoft quietly extended free consumer ESU through October 2027, and it was widely reported as a reprieve. It is not one for your business. That route excludes domain joined, Entra joined and MDM managed devices, which is almost every machine in a managed office. Microsoft sets out the ESU programme detail on its own lifecycle page if you want to check that yourself.
The Secure Boot wrinkle
There is a hardware complication sitting alongside the money.
The Secure Boot certificates issued back in 2011 began expiring in June 2026. Devices that have not picked up the replacement 2023 certificates keep booting and keep taking ordinary Windows updates, but they stop receiving protection for the earliest part of the boot process, including fixes for newly discovered boot level vulnerabilities.
Those replacement certificates reach Windows 10 machines through ESU. A Windows 10 device outside ESU is not covered by the rollout. Some older hardware also needs an OEM firmware update before it will accept the new certificates at all, which means checking manufacturer support pages rather than assuming Windows Update has handled it.
The practical upshot is that an unenrolled Windows 10 machine is now degrading in two directions at once, and one of them is invisible until something goes wrong.
Option one: renew
Buy year two and keep going.
This makes sense for a specific and usually small group of machines. Anything running line of business software that has not been certified for Windows 11, anything attached to a machine tool, a till or a piece of lab equipment, anything where the vendor has told you not to upgrade yet.
It is a bridge, not a destination. Budget it as such, and put a date on when the bridge ends.
Option two: migrate
Upgrade the machine in place to Windows 11.
The gate here is hardware. Windows 11 needs a 64 bit processor on Microsoft’s approved list, 4GB of RAM, 64GB of storage, UEFI firmware with Secure Boot and TPM 2.0. The full Windows 11 hardware requirements are published on Microsoft Learn.
In practice, plenty of machines that fail the check fail it on a TPM that is present but switched off in firmware. That is a five minute fix, not a new PC. It is worth auditing properly before anyone signs off a replacement order, because the gap between “fails the readiness check” and “genuinely needs replacing” is usually wider than expected.
If the machine passes, this is the cheapest option on the list. There is no per device licence to buy.
Option three: retire
Replace the hardware.
This is the option people resist and then, once the sums are on the table, tend to choose. A decent business laptop is a few hundred pounds. Three years of ESU on a machine already six or seven years old is around £340 and buys you nothing but patches. At that point you are spending most of the cost of a new device to keep an old one limping.
Retiring machines also solves the Secure Boot problem, the Cyber Essentials problem and the “this thing takes four minutes to open Excel” problem at the same time.
Do not skip the disposal side. Old machines need wiping properly and disposing of responsibly, and that needs to be someone’s job rather than a cupboard full of laptops nobody will touch.
Why doing nothing is the expensive option
Running an unsupported operating system is not a neutral choice.
Cyber Essentials fails outright on unsupported software. It is one of the most common reasons certifications get rejected, and we covered it alongside the other stumbling blocks in our piece on what is catching people out with Cyber Essentials. If you hold a certification because clients ask for it, an unpatched estate puts that at risk.
The NCSC’s position on obsolete products is blunt. Once technology is out of date it should not be used, and the only fully effective mitigation is to stop using it. Everything else is risk reduction.
Insurers and clients are asking about this too. A cyber insurance questionnaire that asks whether all operating systems are vendor supported does not have a comfortable middle answer.
Where to start
Start with an inventory, because most businesses genuinely do not know how many Windows 10 machines they have or which of them could take Windows 11 tomorrow. Once you have that list, sorting it into renew, migrate and retire takes an afternoon, and the budget stops being a guess.
Our business IT solutions team handles exactly this, from the audit through to procurement, migration and disposal. If you would rather the whole lifecycle sat with someone else, our IT service management service covers it as routine work.
October will arrive whether the inventory is done or not.
Get a quote or call the team, and we will tell you what you are actually running.