MC1183612 – Action Required to Enable Extended Security Update for local devices accessing Windows 365

Product:

Entra, Intune, Windows, Windows 365

Platform:

Online, Windows Desktop, World tenant

Status:

Change type:

Admin impact

Links:

Details:

Windows 10 devices accessing Windows 365 Enterprise Cloud PCs and Windows 365 Frontline (Dedicated) Cloud PCs are automatically entitled to Windows 10 Extended Security Updates (ESU) under certain conditions. IT administrators must use Microsoft Intune or another MDM provider to deploy a custom policy that helps verify whether a device is enrolled in the Windows 10 ESU subscription program.


Action is required in order for these devices to install the upcoming November 2025 Windows security update, which will be available on November 11, 2025. Learn more about this change at Enable Windows 10 Extended Security Updates (ESU) for clients accessing cloud and virtual machines.


When will this happen:
The upcoming November 2025 Windows security update will be available on November 11, 2025. It's necessary to take action prior to this date, in order for devices to be eligible for this update.

Entitlement to ESU is available for qualifying devices any time, however, we advise taking action prior to November 11 in order to receive this month's update and remain protected.

Change Category:
XXXXXXX ... free basic plan only

Scope:
XXXXXXX ... free basic plan only

Release Phase:

Created:
2025-11-07

updated:
2025-11-08

Task Type

XXXXXXX ... free basic plan only

Docu to Check

XXXXXXX ... free basic plan only

MS How does it affect me

XXXXXXX ... free basic plan only

MS Preperations

XXXXXXX ... free basic plan only

MS Urgency

XXXXXXX ... free basic plan only

MS workload name

XXXXXXX ... free basic plan only

summary for non-techies**

XXXXXXX ... free basic plan only

Direct effects for Operations**

Inability to receive security updates
If the custom policy is not deployed, devices will not be eligible for the November 2025 security update, leaving them vulnerable to security threats.
   - roles: IT Administrators, End Users
   - references: https://learn.microsoft.com/windows/whats-new/enable-extended-security-updates-virtual

Increased security risks
Without the necessary updates, devices may face increased risks of malware and cyber attacks, impacting organizational security.
   - roles: IT Administrators, Security Officers
   - references: https://www.microsoft.com/windows/extended-security-updates

User experience degradation
Users may experience issues accessing Windows 365 services if their devices are not updated, leading to potential productivity loss.
   - roles: End Users, Support Staff
   - references: https://learn.microsoft.com/windows-365/overview

Compliance issues
Failure to implement the ESU may lead to non-compliance with security policies or regulations, resulting in potential legal ramifications.
   - roles: Compliance Officers, IT Administrators
   - references: https://learn.microsoft.com/windows/whats-new/extended-security-updates

Increased support workload
IT support may face a surge in requests from users experiencing issues due to outdated systems, straining resources.
   - roles: Support Staff, IT Administrators
   - references: https://learn.microsoft.com/windows/whats-new/enable-extended-security-updates-virtual

Configutation Options**

XXXXXXX ... paid membership only

Opportunities**

Implement Custom Policy Deployment via Intune
By deploying a custom policy that enables the EnableESUSubscriptionCheck flag through Microsoft Intune, IT administrators can ensure that devices are correctly enrolled in the Windows 10 ESU subscription program. This proactive approach will enhance security and compliance across the organization.
   - next-steps: 1. Review the current device enrollment status and identify devices that require the custom policy. 2. Develop the custom policy using the provided documentation. 3. Deploy the policy via Intune and monitor compliance.
   - roles: IT Administrators, Security Officers, Compliance Managers
   - references: https://learn.microsoft.com/windows/whats-new/enable-extended-security-updates-virtual, https://learn.microsoft.com/windows/whats-new/enable-extended-security-updates-virtual#to-configure-enableesusubscriptioncheck-flag-with-intune " target="_blank" rel="nofollow noopener noreferrer">https://learn.microsoft.com/windows/whats-new/enable-extended-security-updates-virtual#to-configure-enableesusubscriptioncheck-flag-with-intune

Enhance Device Enrollment Strategy
Improving the strategy for enrolling devices into Microsoft Entra will ensure that more devices meet the eligibility criteria for ESU updates. This can include training sessions for staff on the importance of device enrollment and compliance with organizational policies.
   - next-steps: 1. Assess the current enrollment status of devices within the organization. 2. Create training materials to educate users on the enrollment process and its importance. 3. Schedule training sessions and follow up on enrollment progress.
   - roles: IT Administrators, HR Managers, Training Coordinators
   - references: https://learn.microsoft.com/entra/identity/devices/concept-directory-join, https://learn.microsoft.com/entra/identity/devices/concept-hybrid-join

Regular Compliance Audits
Conducting regular audits to ensure that devices are compliant with the ESU eligibility requirements will help maintain security and prevent potential vulnerabilities. This can also improve overall IT governance.
   - next-steps: 1. Develop a compliance audit checklist based on ESU requirements. 2. Schedule regular audits to review device compliance. 3. Implement corrective actions for any non-compliant devices.
   - roles: IT Administrators, Compliance Managers, Security Officers
   - references: https://learn.microsoft.com/windows-365/enterprise/introduction-windows-365-frontline, https://www.microsoft.com/windows/extended-security-updates

Potentional Risks**

XXXXXXX ... paid membership only

IT Security**

XXXXXXX ... paid membership only

explanation for non-techies**

XXXXXXX ... free basic plan only