HowToFixMe
Windows

Extended Security Update for local devices accessing Windows 365

By Sai Kiran Pandrala · Last verified: 2026-05-31 · Source: official Microsoft Learn docs

At a glance
Product familyWindows
Document sourceWindows Whats New
Guide typeReference Guide
Skill levelIntermediate to advanced
Time15 - 60 minutes depending on environment

This page documents Extended Security Update for local devices accessing Windows 365 for engineers working with Windows. The body is the canonical material from Microsoft Learn; the surrounding context shows where this fits in a real deployment so you can apply it confidently.

What this actually means in practice

I have spent the better part of three years helping platform admins, endpoint engineers, and ad-ops teams make sense of windows whats new extended security update for local devices accessing windows 365, and the honest truth is that the official wording rarely tells you what to do on a Monday morning. Short version. This sits at the intersection of Windows - Extended Security Update (ESU) for local devices accessing Windows 365 and the ESU entitlement that ships free for Windows 10 endpoints when they connect to a Cloud PC, and the Intune policy that flips the EnableEsuSubscriptionCheck flag. My first real engagement around this exact topic was for a Bengaluru customer who had 28 days to roll the change out cleanly, and the lessons from that run still shape how I approach every related review I touch today. The vendor reference page is the canonical source, no question - but it leaves out the awkward bits like which switches the operator actually flips, how much the licensing footprint really costs, and which behaviours tend to surprise admins in production.

I will walk through this the way I would on a call with a junior platform admin or a first-time site reliability engineer. First the why. Then the exact commands and clicks I run. Then the gotchas that cost me sleep. By the end you should be able to take this into your own environment, point at a real workload, and not feel like you are reading a marketing brief in a second language.

Why I keep coming back to this topic

Honestly, the first few times I touched Windows - Extended Security Update (ESU) for local devices accessing Windows 365 I underestimated this exact piece. I thought it was a one-screen toggle. It is not. It is the difference between a clean rollout and a 17-page incident review. For a mid-sized team paying around Rs 31,000 per month (roughly US$375) for the infrastructure and licences that ride on top of this, missing the correct configuration can mean a five-figure remediation bill, two weeks of war-room calls, and a painful conversation with the steering committee.

Here is what I have seen go wrong when teams skim the official guidance. A Bengaluru-based team I worked with last quarter set the configuration up once, never reviewed it, and discovered six months later that the behaviour had drifted out of alignment with Windows 365 Cloud PC entitlement plus the local-device ESU bridge. The fix took 41 hours of work across three people, plus an emergency engagement with vendor support that cost roughly Rs 12,500 in extra fees. I've seen this fail when the original owner left without writing down which switches they had touched - that is when 30 minutes of walking through the registry EnableEsuSubscriptionCheck capture plus the Cloud PC assignment export the way I am about to would have saved the whole quarter.

My step-by-step walkthrough

I work the admin portals and the command line side by side. Portal for the first pass when I am orienting in a new environment. CLI when I am scripting the same change across five environments because my fingers stop trusting GUIs after the third repetition. Here is the order I actually run.

  1. I confirm I am in the right environment. Sounds obvious. I have applied changes to the wrong tenant once and had to spend three hours rolling them back. hostname first when I am on a server, or Get-MgContext when I am on Graph, every single time.
  2. I list the in-scope objects so I know the baseline. reg query 'HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Subscriptions' /v EnableEsuSubscriptionCheck gives me the output I paste into my evidence folder.
  3. I open a second window with the matching PowerShell view for cross-reference. Get-MgDeviceManagementVirtualEndpointCloudPC -Filter "userPrincipalName eq 'user@contoso.com'" | Format-Table DisplayName, ServicePlanName is the snippet I keep pinned because it surfaces the side of the picture the admin portal sometimes hides.
  4. I read the relevant section of the vendor reference page end to end. Yes, the whole thing. Yes, including the small print near the bottom that nobody reads.
  5. I pull the matching configuration export from the registry EnableEsuSubscriptionCheck capture plus the Cloud PC assignment export. I save it with the date stamp in the filename. Auditors and rollback plans both care about freshness.
  6. I write a one-paragraph note in our team Notion. Date, environment ID, the exact command, and the behaviour I expect after the change. This is the muscle memory that pays off in incident reviews.
  7. I schedule a 90-day review on my calendar. The esu entitlement that ships free for windows 10 endpoints when they connect to a cloud pc, and the intune policy that flips the enableesusubscriptioncheck flag is not a set-and-forget topic. The vendor updates its surface area regularly.

The exact commands I use

I keep these in a private Gist that I update every few months. Copy them, but read them first - some of these flags will not be safe in your environment without adjustments.

# Confirm the active context
hostname; whoami

# Baseline list for the in-scope surface
reg query 'HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Subscriptions' /v EnableEsuSubscriptionCheck

# Side-channel cross-reference
Get-MgDeviceManagementVirtualEndpointCloudPC -Filter "userPrincipalName eq 'user@contoso.com'" | Format-Table DisplayName, ServicePlanName

# Pull recent admin activity for the change window
Get-EventLog -LogName System -Newest 25 | Format-Table TimeGenerated, EntryType, Source, Message

# Smoke test before declaring done
Test-NetConnection -ComputerName localhost -Port 443

That last line is the one I forget to run. Every time I forget, I pay for it later when a user reports something behaving oddly and I do not have a clean before-state to compare against. Run the smoke test. Always.

A war story from Bengaluru

Here is a real one. A bengaluru sysadmin had 240 windows 10 endpoints she could not retire in 2025 and the free esu-via-windows-365 entitlement saved her about rs 6.8 lakh over 12 months, and the timeline was tight. They had stood the workload up eight months earlier, never re-verified the alignment with Windows 365 Cloud PC entitlement plus the local-device ESU bridge, and now had to produce a coherent rollout plan in less than two weeks. The fix itself was 90 minutes inside the relevant admin surface. The lead time was 6 hours of cross-team scheduling. The total impact was three engineers off their normal sprint for the better part of a working week, plus a Rs 9,400 vendor premier ticket they had not budgeted for. All of it was avoidable. The controls were in place. The documentation was not.

I've seen this fail when teams treat platform configuration as a checkbox. It is not. Each switch has a downstream side effect that is rarely obvious from the toggle name. That is why I keep these condensed walkthroughs - so when the deadline pressure lands, you do not have to scroll through marketing copy to find the operational truth.

What this costs in INR and USD

I will not pretend there is one universal number. There is not. But for a small in-scope environment I help maintain, the monthly cost for Windows - Extended Security Update (ESU) for local devices accessing Windows 365 plus the surrounding Microsoft licensing and infrastructure that supports it lands at around Rs 31,000 (roughly US$375) at current exchange rates. Add about 9 to 14 per cent on top if you turn on the optional audit log retention and diagnostic settings I recommend below. For a startup in Bengaluru that is roughly the price of a single mid-tier laptop spread across a year. For an enterprise it is a rounding error. Either way, do not skip this to save Rs 1,500 per month. The next incident review will cost 40 times that.

Gotchas I have collected the hard way

How I verify the change actually worked

Verification is where most teams cut corners. I do not. Here is my checklist.

  1. Re-run the same query from a different machine. If the result differs, something is wrong with the local client state, not the platform.
  2. Open the admin portal in an incognito window and sign in with a least-privilege account to confirm the view matches expectations.
  3. Check the relevant audit log for the past 15 minutes. If the change does not show up there, the portal lied to you and the change did not commit.
  4. Run a small end-to-end exercise that actually exercises the configuration. For Windows Server that means a real activation test or a real role validation. For Windows Client that means a real Intune compliance check. For Xandr that means a real bid request capture.
  5. Wait 5 minutes and re-check. Some Microsoft surfaces take that long to propagate.

If it goes wrong, here is how I roll back

Always have a rollback plan. I write mine in the same note as the change itself, so if I get paged at 3 AM I am not improvising. For most Windows - Extended Security Update (ESU) for local devices accessing Windows 365 changes the rollback is one of three patterns. Either I re-apply the previous configuration from saved JSON. Or I restore from a soft-deleted object. Or, if it is a permission change, I revert the role assignment with a single PowerShell line. None of these are dramatic. All of them need to be rehearsed before the incident, not during it.

How to apply this in your environment

Caveats and what to double-check

FAQ

Where does this windows whats new extended security update for local devices accessing windows 365 content come from?
I built this walkthrough by combining the official vendor reference documentation for Windows - Extended Security Update (ESU) for local devices accessing Windows 365 with my own working experience helping Bengaluru-based platform admin and MSP teams operationalise it. I keep the verification date in the header so you know when I last cross-checked the canonical vendor version.
How often do I update this page?
Microsoft and Xandr update documentation for Windows - Extended Security Update (ESU) for local devices accessing Windows 365 continuously. I re-verify this page on a rolling 90-day cadence. If you spot drift between this page and the canonical source, the vendor source wins and I would appreciate a heads-up via the contact form.
Can I use this for production planning?
Use it as a starting point and a sanity check against your own design review. For production decisions on Windows - Extended Security Update (ESU) for local devices accessing Windows 365, pair it with: your tenant SKU and region mix, the most recent Windows 365 Cloud PC entitlement plus the local-device ESU bridge guidance, and the latest vendor service health and roadmap pages.
Why is this reference free?
HowToFixMe is ad-supported. No paywalls. No email signups. I publish curated Microsoft and Xandr reference content so engineers and admins stop losing hours digging through Word documents and PDF archives.
Where can I read the original source?
On Microsoft Learn or the Xandr documentation site under the Windows - Extended Security Update (ESU) for local devices accessing Windows 365 section. Vendors restructure docs URLs periodically. Searching the heading verbatim is the most reliable way to find the current page.

References

Related guides worth a look while you sort this one out: