Windows 10 has been the workhorse of Australian business computing for a decade. That ends on October 14, 2025 — the date Microsoft stops patching it. If your business still runs Windows 10 devices, the decisions you make in the coming months will determine your security posture, your compliance standing, and your cyber insurance position for years. This guide covers the deadline, what happens if you miss it, your three upgrade paths, and exactly how to migrate. If you want a managed path, contact Mycelium 365 for a Windows 11 migration assessment — Windows 11 migration is included in Secure Essentials from $95/user/month.
When does Windows 10 end of support happen?
Windows 10 end of support is October 14, 2025. After this date Microsoft will no longer issue security patches, bug fixes, or technical support for any Windows 10 edition — Home, Pro, or Enterprise. Every vulnerability discovered after October 14, 2025 will remain permanently unpatched on any Windows 10 device.
This is not a soft deadline — it is the same hard cutoff as Windows 7 (January 2020) and Windows XP (April 2014). Australian businesses that ignored those deadlines faced significant ransomware exposure in the years following, as attackers specifically targeted known, unpatched vulnerabilities in end-of-life operating systems.
Windows 10 end of life is more significant than either of those events — Windows 10 is the most widely deployed operating system in Australian businesses today. The scale of the exposure means attackers are already building exploitation capability in anticipation of the cutoff, in the same way they stockpiled Windows 7 exploits before its 2020 deadline.
What happens if your business keeps using Windows 10?
After October 14, 2025, the consequences compound quickly:
- Unpatched vulnerabilities. All Windows 10 devices accumulate permanent, unpatched security vulnerabilities. Every month, Patch Tuesday fixes for Windows 11 will effectively publish a map of the flaws that remain open in Windows 10.
- Essential Eight failure. Essential Eight Maturity Level 1 requires patching operating systems within defined timeframes. Windows 10 after end of life fails this automatically — an OS that cannot receive patches cannot meet patching requirements. Businesses working toward Essential Eight compliance lose that maturity level the day support ends.
- Cyber insurance exposure. Cyber insurers are already asking about Windows 10 exposure in renewal questionnaires, and several are excluding unpatched end-of-life systems from coverage. A claim arising from a Windows 10 compromise after October 2025 may be declined outright.
- Regulatory and contractual breaches. Any business subject to APRA CPS 234, Privacy Act obligations, or DISP requirements faces a material compliance failure by continuing to run Windows 10 without Extended Security Updates. "Reasonable steps" to secure information does not include running an operating system the vendor no longer patches.
In short: staying on Windows 10 past the deadline is not a neutral choice — it is an active degradation of your security, compliance, and insurability position.
Windows 10 Extended Security Updates — the bridge option
Microsoft offers Extended Security Updates (ESU) for businesses that cannot migrate before October 2025. ESU provides security patches only — no feature updates, no bug fixes beyond security, no support calls.
The cost is approximately $30 AUD per device per year in Year 1, doubling each subsequent year — roughly $60 per device in Year 2 and $120 in Year 3. That pricing structure is deliberate: Microsoft wants ESU to be a bridge, not a destination.
For most Australian SMBs, ESU is a sensible 6–12 month bridge while completing migration planning and hardware procurement — not a long-term strategy. The cost and complexity of managing ESU licensing alongside modern Microsoft Intune policies makes it unsuitable as a permanent solution for businesses of 10–300 users. If you are considering ESU, treat it as a deadline extension with a fixed end date, and build the migration project around that date.
Windows 11 compatibility — which devices can be upgraded?
Windows 11 requires TPM 2.0, Secure Boot capability, and a compatible 64-bit processor (Intel 8th generation or later, AMD Zen 2 or later). Most devices manufactured before 2018 will not meet these requirements.
In practice:
- Devices purchased in 2021 or later are almost universally compatible.
- Devices from 2018–2020 vary — approximately 60–70% meet the requirements.
- Devices from 2017 or earlier are largely incompatible and need hardware replacement.
The good news is the compatibility audit is straightforward. Microsoft Intune's device compliance reports show every enrolled device's TPM status and Windows version — making the audit a reporting exercise for businesses already using Microsoft 365 Business Premium. For unmanaged devices, Microsoft's PC Health Check app provides a per-device compatibility assessment. Either way, the first step of any migration project is knowing exactly which of your devices can be upgraded and which must be replaced.
The three upgrade paths for Australian businesses
Option 1 — In-place upgrade to Windows 11
For compatible devices, Intune Windows Update for Business deploys Windows 11 as a staged upgrade. This is the fastest path, the lowest cost, and involves no data loss — the upgrade preserves applications, files, and settings. It is best for businesses with modern hardware (2020 or later) already enrolled in Intune. Timeline: 4–8 weeks for a full business rollout, including a pilot group and staged deployment rings.
Option 2 — Hardware refresh with Autopilot
For incompatible devices, procure new Windows 11 hardware and enrol it via Microsoft Intune Autopilot. New devices arrive with company policies, applications, and security baselines pre-applied — no manual setup, no imaging. This is the best path for businesses with a significant proportion of pre-2018 hardware. Timeline: 8–16 weeks depending on hardware availability, so procurement decisions need to happen early.
Option 3 — Extended Security Updates (bridge)
For businesses that cannot complete migration before October 2025, ESU buys 1–3 years of security patching. This is only viable for businesses with a clear migration timeline and budget attached to it. It is not recommended as a permanent solution — the doubling cost and the operational overhead of maintaining ESU licensing make it the most expensive path over anything beyond a short bridge.
Most businesses end up with a blend: in-place upgrades for compatible devices, Autopilot-refreshed hardware for the rest, and ESU only for any stragglers that cannot be touched before the deadline.
Microsoft 365 Business Premium and Windows 11 migration
The most cost-effective Windows 11 migration path for Australian SMBs is Microsoft 365 Business Premium plus Intune. Business Premium ($32/user/month) includes:
- Microsoft Intune for device management and Windows 11 upgrade deployment
- Windows Autopilot for zero-touch new device setup
- Windows Update for Business for ongoing patch management after migration
- Defender for Business for endpoint security on the migrated fleet
For businesses already on Microsoft 365 Business Basic or Standard, upgrading to Business Premium provides the Intune tooling needed to manage the Windows 11 migration centrally — covering the full lifecycle from compatibility assessment through ongoing patch compliance. It also strengthens your broader cyber security for Windows devices posture, which matters for both Essential Eight compliance and insurance renewals.
Mycelium 365 manages the entire migration as part of its managed IT service — see Secure Essentials from $95/user/month, which includes Intune management, Windows 11 deployment, and ongoing patch compliance reporting.
How to migrate from Windows 10 to Windows 11 in Australia — step by step
Step 1 — Audit all Windows 10 devices. Run a device inventory to identify every device still running Windows 10. In Microsoft 365 environments, Microsoft Intune device compliance reports show all enrolled devices and OS versions. For unmanaged devices, use the Microsoft PC Health Check app. The audit output is your project scope: total device count, OS versions, and ownership.
Step 2 — Check Windows 11 hardware compatibility. Windows 11 requires TPM 2.0, Secure Boot, and a compatible 64-bit processor. Most devices manufactured before 2018 will not meet these requirements. Use Intune hardware inventory or the PC Health Check app to identify incompatible devices that need replacement.
Step 3 — Plan hardware replacement for incompatible devices. Budget for device replacement for hardware that cannot run Windows 11. New devices can be enrolled in Intune Autopilot — out-of-box setup with company policies applied automatically, with no manual configuration required. Order early: hardware lead times are the most common cause of migration projects missing the deadline.
Step 4 — Deploy Windows 11 via Intune for compatible devices. Use Microsoft Intune Windows Update for Business policies to push Windows 11 to compatible enrolled devices. Set upgrade rings: a pilot group first, then a staged rollout across the business. Schedule upgrades outside business hours to minimise disruption, and communicate the change to users before their devices upgrade.
Step 5 — Validate and close out. After migration, run an Intune compliance report to confirm all devices are on Windows 11 and meeting compliance policies. Update your Essential Eight maturity assessment to reflect the patched OS status, and keep the compliance evidence on file for your next cyber insurance renewal.
Frequently Asked Questions
When does Windows 10 end of support happen?
Windows 10 end of support is October 14, 2025. After this date Microsoft will no longer issue security patches, bug fixes, or technical support for Windows 10. Every vulnerability discovered after October 14, 2025 will remain permanently unpatched on any Windows 10 device.
What happens if my business keeps using Windows 10 after end of support?
After October 14, 2025, Windows 10 devices will have unpatched security vulnerabilities. This means failure of Essential Eight Maturity Level 1 (patch operating systems), likely exclusion from cyber insurance coverage, and non-compliance with APRA CPS 234 and similar frameworks for regulated businesses.
Can my business stay on Windows 10 with Extended Security Updates?
Microsoft offers Extended Security Updates (ESU) for Windows 10 at approximately $30 per device in Year 1, doubling each year. ESU provides security patches only — no feature updates or support. For most Australian SMBs it is a 6–12 month bridge, not a long-term solution.
What should Australian businesses do before Windows 10 end of support?
Audit all Windows 10 devices, check Windows 11 compatibility (TPM 2.0 required — most pre-2018 hardware fails), plan hardware replacement for incompatible devices, and migrate compatible devices to Windows 11 via Intune. Mycelium 365 manages Windows 11 migration as part of its managed IT service from $95/user/month.
Does Mycelium 365 help Australian businesses migrate from Windows 10 to Windows 11?
Yes — Mycelium 365 manages Windows 10 to Windows 11 migration using Microsoft Intune — including device compatibility assessment, staged upgrade deployment, hardware replacement planning, and Autopilot setup for new devices. Windows 11 migration is included in the Secure Essentials managed package from $95/user/month. Contact Mycelium 365 for a Windows 11 migration assessment and we will scope your device fleet, timeline, and cost.