Windows 10 ESU 60 Day MSA Sign In Rule: What to Know

Microsoft’s latest clarification about the Windows 10 Extended Security Updates (ESU) program makes one thing uncomfortably clear: if you use the free ESU path tied to a Microsoft account, you must sign into that account on the PC at least once every 60 days — or the ESU entitlement will lapse and security updates will stop.

Background / Overview​

Windows 10 reaches its official end of support on October 14, 2025. Microsoft created the consumer Extended Security Updates (ESU) program to provide one additional year of critical and important security patches for eligible Windows 10 devices through October 13, 2026. The ESU program is designed as a short-term safety net for users and organizations that cannot move to Windows 11 immediately.
There are three enrollment routes for consumer ESU:

• Free enrollment when a device is signed into a Microsoft account and PC Settings are synced (region-dependent rules apply).
• Redeem 1,000 Microsoft Rewards points to enroll.
• One-time purchase of $30 (USD) or local-currency equivalent (for users who prefer to remain on a local account).

Eligibility is limited to devices running Windows 10, version 22H2 with the prerequisite updates installed. After enrollment, Microsoft delivers ESU security updates through Windows Update just like normal monthly security patches.
Recent announcements and follow-up clarifications changed the terms for European Economic Area (EEA) consumers: Microsoft removed the OneDrive/Windows Backup requirement for free ESU in the EEA but retained the Microsoft account sign-in requirement and added a firm 60-day sign-in rule as a condition of the free enrollment path.

---

What Microsoft is requiring — the 60‑day sign‑in rule explained​

The rule in plain language​

• If a consumer enrolls in ESU using the free Microsoft‑account path, the Microsoft account used to enroll must be used to sign into the device at least once every 60 days.
• If the Microsoft account is not used to sign in for a period of up to 60 days, Microsoft says ESU updates will be discontinued for that device.
• To resume receiving ESU updates after discontinuation, the device must be re-enrolled by signing in with the same Microsoft account used originally to activate ESU.

How enrollment paths differ by region​

• In the EEA, Microsoft now allows free ESU enrollment without forcing users to enable Windows Backup or sync to OneDrive. The Microsoft account requirement remains, however, and the 60‑day sign‑in rule applies to the free EEA path.
• Outside the EEA, the free path still generally requires enabling Windows Backup (which involves OneDrive usage) or the user must pay $30 or redeem Rewards points to use a local account.

What Microsoft’s public documentation confirms​

Microsoft’s ESU documentation and consumer support pages list the three enrollment options, the end dates (October 14, 2025 end of support; ESU updates through October 13, 2026), the Windows 10 version requirement (22H2), and the ability to enroll up to 10 devices with the same Microsoft account. Microsoft’s guidance also clearly states the rule that continued signing into Windows with the Microsoft account used to enroll is required to maintain free ESU coverage, and that failure to sign in will require re-enrollment.

What remains less transparent​

Microsoft’s public documentation does not publish technical details about how the 60‑day check is implemented — for example, whether the check is a local countdown enforced by Windows Update, a periodic remote validation, or a mix of local and cloud checks. Some media outlets reported Microsoft saying it “periodically scans” to confirm enrollment compliance; however, that specific operational phrasing is not exposed in the FAQ pages and is therefore best treated as a media‑reported quote rather than a fully documented, auditable mechanism. This lack of detailed engineering documentation creates a grey area about the telemetry and mechanics used to enforce the rule.

---

How to enroll, verify, and recover ESU enrollment​

Step-by-step enrollment (consumer path)​

• Ensure the device is updated to Windows 10 version 22H2 and has the required cumulative updates installed.
• Open Settings > Update & Security > Windows Update.
• Under the "Windows 10 support ends in October 2025" message you'll see an Enroll now link when the rollout reaches your device.
• Follow the wizard. If using the free Microsoft‑account path and you’re signed in with a local account, you will be prompted to sign in to a Microsoft account.
• Choose the free path (sync settings) or opt to redeem Rewards or purchase the one‑time ESU offer if preferred.

How to check enrollment status​

• Open Settings > Update & Security > Windows Update. The page will show ESU enrollment status. If a one‑time purchase was made, the order should appear in your Microsoft account order history.

Recovering from a lapse (re‑enrollment)​

• If ESU updates stop because the enroling Microsoft Account has not signed in within 60 days, re‑enroll by signing back into the same Microsoft account on the device and using the Windows Update > Enroll now flow.
• Re‑enrollment is permitted until ESU program end date (October 13, 2026), but devices will be vulnerable during the lapse period.

---

Why Microsoft introduced the rule — motives and drivers​

Regulatory pressure and a compliance pivot​

Regulatory scrutiny in Europe — fueled by consumer advocacy groups and legislation such as the Digital Markets Act — pushed Microsoft to modify the free ESU terms for EEA users. Microsoft’s EEA concession removed the explicit backup/OneDrive requirement for free ESU, but the company retained the Microsoft account tie. The 60‑day sign‑in constraint appears to be a compromise: it keeps an account-based entitlement model while addressing complaints that the company was forcing cloud backup as a condition of free patches.

Product strategy and upgrade funnel​

Microsoft has an obvious product objective: encourage migration to Windows 11 and drive account-based services. The Microsoft account tie serves multiple strategic functions:

• It provides a persistent identity that can be used to link entitlements across devices.
• It supports Microsoft’s ecosystem goals (OneDrive, Microsoft 365, Edge, Defender integrations).
• It reduces the complexity of one-off paid transactions by offering a free, account‑based option which is easier to manage than per‑device purchases.

Balancing fraud prevention and customer convenience​

Entitlement checks (such as requiring periodic sign-ins) are a common anti‑abuse mechanism. A 60‑day sign‑in window is short enough to make automated abuse or churn more difficult, while still tolerable for many consumer usage patterns. That said, it imposes an operational burden on users who prefer local accounts or intermittent device use.

---

Critical analysis — strengths, weaknesses, and real risks​

Strengths and legitimate reasons for the rule​

• Security continuity: ESU provides a vital stopgap for devices that cannot be upgraded to Windows 11 for hardware, software compatibility, or organizational reasons.
• Account-linked entitlement simplifies distribution: Using Microsoft accounts makes it straightforward to tie ESU licenses to users who may manage multiple devices.
• Regulatory accommodation: Microsoft responded to European pressure by removing the backup requirement in the EEA, which is a meaningful concession.

Weaknesses and friction points​

• Two‑tier user experience: EEA users receive a softer experience; users elsewhere face either the OneDrive backup requirement or a monetary fee. This geographic disparity creates confusion and fairness complaints.
• Privacy and data concerns: Many users resisted the earlier OneDrive requirement for privacy reasons. Although the EEA carve‑out removes that requirement, the Microsoft account tie still raises unease for privacy‑conscious users who prefer local accounts.
• Operational fragility for intermittent users: The 60‑day rule can catch users who rarely sign into a Microsoft account on a device (e.g., secondary PCs, test boxes, or machines used primarily offline), creating an unexpected lapse in security updates.
• Opaque enforcement mechanics: Lack of public technical detail about how Microsoft enforces the 60‑day rule fuels suspicion and complicates compliance for administrators.

Concrete risks for users and organizations​

• Security gap risk: If automatic updates stop because of a lapsed ESU entitlement, the device becomes vulnerable to new exploits. Attackers often scan unpatched systems, and a gap of even a few weeks can be exploited.
• Upgrade bottleneck: Many devices fail Windows 11’s hardware requirements (TPM 2.0, CPU family lists). Users who cannot upgrade are forced into ESU or face unsupported systems; the sign‑in requirement adds another obstacle.
• Administrative overhead: Home users and small businesses without centralized account management may need to track sign‑in windows for multiple devices.
• Potential for accidental de‑enrollment: System changes that remove the Microsoft account from a device — migrating to a local account, user cleanup, or a device reset — can unintentionally trigger ESU lapsed status.

---

Practical mitigation steps and recommendations​

Short-term actions to avoid losing ESU updates​

• Stay signed in with the Microsoft account used for enrollment on any device enrolled via the free path. The simplest route is to keep the device configured to sign in automatically with that Microsoft account for regular use.
• Set recurring calendar reminders: Schedule a reminder every 50 days to sign in, particularly for secondary devices or those rarely used.
• Use the paid one‑time purchase if avoiding an account tie is a priority. The paid $30 path allows continued use of a local account after a one‑time sign‑in to purchase.
• Verify enrollment immediately after activating ESU: Settings > Update & Security > Windows Update will indicate enrollment status.

For power users and administrators​

• Audit device inventory to identify Windows 10 devices and version (22H2 requirement).
• Prioritize upgrades to Windows 11 where possible, especially for internet‑facing or business‑critical systems.
• Where upgrade is not possible, standardize on a single Microsoft account for cross‑device ESU enrollment and document the account usage and recovery options for continuity.
• Consider purchasing ESU for machines where maintaining a Microsoft account is operationally difficult or where compliance requires no cloud identity tie.

Long-term planning​

• Plan hardware refresh cycles for devices that will never meet Windows 11 minimums.
• Assess alternate OS strategies (lightweight Linux, managed virtual desktops, or new hardware) for legacy workloads that cannot migrate to Windows 11.
• Stay informed: Microsoft’s rollout of ESU enrollment is phased; keep a monitoring process in place for alerts, policy changes, and regional adjustments.

---

Workarounds, myths, and things to avoid​

Common misconceptions​

• Myth: Changing region to Europe permanently makes ESU free without an account. Reality: The EEA carve‑out removed the OneDrive Backup requirement for free ESU in those markets, but a Microsoft account is still required to enroll. Attempts to exploit regional settings are brittle, often transient, and can cause activation or update issues.
• Myth: Once enrolled, ESU will never lapse. Reality: Enrollment via the free account path requires periodic sign‑ins; failure to meet the 60‑day rule will cause the entitlement to be discontinued.

Risky or discouraged tactics​

• Using throwaway or shared Microsoft accounts to “game” free enrollment can create recovery problems and security vulnerabilities.
• Attempting to spoof location or repeatedly change region settings to manipulate eligibility can break device configurations and lead to update failures.
• Automating sign‑ins with scripts or exposing credentials to circumvent the spirit of the entitlement check risks credential compromise and is not advised.

---

Policy and market implications — a two‑tier Windows ecosystem?​

Microsoft’s EEA concession and the retained account requirement illustrate an emerging pattern: regulatory pressure can force product changes that create divergent experiences across regions. The practical effect is a two‑tier Windows world:

• Consumers in the EEA get free ESU without forced OneDrive backups but still must use a Microsoft account and comply with the 60‑day rule.
• Consumers elsewhere must either enable cloud backup, pay $30 (or redeem Rewards points), or upgrade to Windows 11.

This two‑tier dynamic raises several concerns:

• Consumers with older devices in non‑EEA markets may feel unfairly penalized.
• Privacy advocates will continue to press Microsoft on account and telemetry practices.
• The disparity increases churn risk: some users may migrate away from Windows entirely, to other operating systems or devices that promise longer support lifecycles without extra entitlements.

---

What is verifiable and what should be treated cautiously​

• Verifiable facts:
• Windows 10 end of support date: October 14, 2025.
• ESU consumer program extends updates through October 13, 2026.
• Enrollment options: free (account + sync), redeem 1,000 Rewards, or a $30 one‑time purchase.
• Devices must be on Windows 10, version 22H2 to be eligible.
• Microsoft’s public documentation and its enrollment wizard indicate the need to sign into Windows with the Microsoft account used to enroll in order to retain the free ESU entitlement.
• Claims to treat with caution:
• The exact technical mechanism Microsoft uses to enforce the 60‑day rule — e.g., whether there is an active “periodic scan” conducted by Microsoft servers or purely local logic within Windows Update — is not fully documented in public engineering guidance. Media outlets have quoted Microsoft and security researchers on operational details; however, those operational specifics are not exhaustively explained in the consumer FAQ and should therefore be treated as plausible journalistic reporting rather than definitive technical specifications.
• Reports of large-scale abuse techniques or reliable “region toggle” hacks to permanently circumvent fees are transient; exploits that work today often close within hours or days as Microsoft adjusts backend checks.

---

Final assessment and what to do now​

Microsoft’s ESU program is an essential, short‑term safety valve for Windows 10 users who cannot move to Windows 11. The newly emphasized 60‑day Microsoft account sign‑in requirement for the free enrollment path introduces a real operational requirement that consumers and small organizations cannot ignore.
Actions that maximize safety and minimize friction:

• If staying on Windows 10 is unavoidable, enroll in ESU now and ensure the Microsoft account used to enroll remains signed into the device or plan for a paid one‑time purchase to preserve a local account workflow.
• For secondary or rarely used machines, set a 50‑day calendar reminder to sign in with the enrolling Microsoft account to avoid accidental de‑enrollment.
• Prioritize upgrading business‑critical and internet‑facing machines to Windows 11 where hardware permits.
• For privacy‑sensitive users who refuse to tie devices to a Microsoft account, consider the $30 paid ESU route for a one‑time purchase, or accelerate hardware replacement or alternate OS migration planning.

Microsoft’s changes reflect a balancing act: regulatory compliance, product economics, and platform security. The 60‑day rule is not merely a nuisance; it is a gating control that can produce real security gaps if ignored. Treat the sign‑in requirement as a security maintenance task: set reminders, check enrollment status, and include ESU monitoring in any device‑management lifecycle checklist. The cost of inaction is simple and stark — stopped updates and a widened exposure window for attacks on machines assumed to be secure.

---

Source: Forbes Microsoft Warns Windows Users—All Updates Stop If You Do This

Microsoft’s last-minute accommodation for Windows 10 users in the European Economic Area (EEA) has softened one of the most controversial aspects of its consumer Extended Security Updates (ESU) plan — but the relief comes with a notable caveat: you still need a Microsoft Account (MSA) and you must use it on the enrolled PC at least once every 60 days to keep receiving free ESU patches. This detail, now visible in Microsoft’s own ESU guidance and confirmed by independent reporting, closes the local‑account “loophole” some users hoped would let them grab a free year of updates and then revert to a privacy‑focused local login.

Background / Overview​

Windows 10’s mainstream support ended on October 14, 2025. To avoid an abrupt security cliff for consumers who cannot or will not move to Windows 11, Microsoft offered a one‑year consumer ESU: security‑only updates through October 13, 2026 for eligible Windows 10, version 22H2 devices. Enrollment options initially published included:

• Enable Windows Backup (sync settings to OneDrive) while signed in with an MSA (the “free” path in many markets).
• Redeem 1,000 Microsoft Rewards points (free if available).
• Make a one‑time paid purchase (roughly $30 USD or local equivalent), which Microsoft says can cover up to 10 devices tied to the same MSA.

European regulators and consumer groups objected to the original flow because the “free” option effectively nudged users into OneDrive and Microsoft account sign‑ins to receive essential security updates. Microsoft adjusted the flow for the EEA so the free path no longer requires enabling Windows Backup/OneDrive — but Microsoft’s enrollment rules still hinge on an MSA and on periodic re‑authentication.

---

What Microsoft now requires — the confirmed details​

The hard facts​

• You must enroll using a Microsoft Account. Enrollment in the consumer ESU wizard requires an MSA. Microsoft’s ESU pages and statements make this explicit.
• You must sign into the enrolled PC with that same MSA at least once every 60 days. Microsoft has stated that if the MSA “is not used to sign in for a period of up to 60 days, ESU updates will be discontinued” and re‑enrollment with the same MSA will be required to resume updates. This was confirmed to multiple press outlets.
• Paid option lets you continue with a local account — but only after MSA enrollment. If you prefer to use a local account and avoid ongoing MSA sign‑ins, Microsoft documents a one‑time purchase route that allows the device to remain on a local account after the initial enrollment step. That purchase still requires signing in with an MSA to complete enrollment.
• EEA carve‑out drops the forced OneDrive backup requirement, but not the MSA check‑ins. Microsoft removed the forced Windows Backup/OneDrive prerequisite for the EEA free route in response to regulatory scrutiny, but it did not remove the MSA‑sign‑in requirement or the 60‑day re‑authentication rule.

What’s unchanged about ESU​

• ESU delivers security‑only updates (Critical and Important) for enrolled consumer devices — no new features, non‑security bug fixes, or routine support. The consumer ESU window is one year.
• Eligible devices must be Windows 10, version 22H2 with the necessary cumulative updates installed (users were directed to ensure KB5063709 and related servicing updates were applied to surface the Enroll experience).

---

Why the 60‑day sign‑in rule matters (and how it’s enforced)​

Microsoft’s stated rationale is simple: prevent users from enrolling with an MSA just once and then switching to a local account to avoid account‑based policy controls for the remainder of the free year. The 60‑day check acts as a periodic “heartbeat” that demonstrates the MSA remains in active use on the device that benefits from ESU.
From an operational standpoint, Microsoft likely implements this via telemetry that records the account used to sign into the device and then verifies the frequency of that sign‑in. Microsoft’s public guidance confirms the outcome (updates will be discontinued if the account isn’t used within 60 days) but does not publish technical specifics about the detection mechanism. That part — exactly how the check is implemented and which login events count — remains opaque in public documentation and should be treated as an implementation detail users cannot control directly. This is a material, unverifiable gap that matters for privacy‑minded or offline users.

---

The practical impact: scenarios and edge cases​

Scenario A — Home user who wants to stay on a local account​

If you insist on a pure local account experience with no ongoing Microsoft Account sign‑ins, your options are:

• Purchase the one‑time ESU license: sign in once with an MSA to buy/enroll, then switch back to a local account. Microsoft documents this route explicitly.
• Decline ESU and accept no further security updates after October 14, 2025 (risky for internet‑connected devices).

Scenario B — Sign up with MSA, then switch to local account (the attempted loophole)​

Attempting to enroll with an MSA and then switch to a local account and never sign in again will fail: Microsoft will terminate ESU updates after up to 60 days without MSA sign‑in. You can re‑enroll later by signing back in with the same MSA, but that creates potential security gaps and friction.

Scenario C — EEA resident who didn’t want OneDrive but will sign in with MSA​

EEA residents can enroll for free without enabling Windows Backup/OneDrive, but they still must sign in with an MSA and comply with the 60‑day check. This addresses the regulatory complaint about forced OneDrive usage, but it does not remove the account dependency.

Scenario D — Devices that are offline or rarely connected​

Devices that are rarely connected or offline for extended periods face the highest risk of losing ESU coverage if the device cannot perform an MSA sign‑in within the 60‑day window. These machines could be forced into periodic manual sign‑ins, or they could require the paid purchase route. Microsoft’s guidance does not present special accommodations for intermittent connectivity.

---

Strengths of Microsoft’s approach​

• Predictability and simplicity for consumers. The ESU program gives a clear, time‑boxed runway (October 15, 2025 — October 13, 2026) to receive critical and important security fixes, and Microsoft surfaced enrollment inside Settings → Update & Security → Windows Update for eligible devices. That reduces confusion compared with enterprise licensing flows.
• Multiple enrollment paths. Microsoft provides at least three routes (free via backup, rewards points, or paid purchase), which helps households with varying budgets. The EEA carve‑out reduces friction for European users specifically.
• A one‑year safety valve. For users on hardware that cannot meet Windows 11’s requirements, ESU is a pragmatic short‑term mitigation to avoid an immediate security cliff.

---

Risks, trade‑offs and privacy considerations​

• Account dependency and cloud nudging. Even when the OneDrive backup requirement is removed for EEA residents, the MSA requirement still incentivizes account‑centered interactions with Microsoft services. That’s a meaningful shift away from local‑first account models for people who prefer privacy or limited cloud integration.
• Periodic re‑authentication as a form of control. The 60‑day sign‑in check enforces ongoing account usage. For privacy‑minded users this is effectively a persistent condition for receiving security updates. It also introduces a failure mode (missed sign‑in) that can leave devices unpatched until re‑enrollment.
• OneDrive storage and hidden costs outside the EEA. The free OneDrive tier is small; heavy backups may push users to buy storage, making the “free” path less free in practice. The EEA carve‑out mitigates this for European users only.
• Regional fragmentation. Different rules for EEA vs. the rest of the world create a two‑tier experience that can confuse users and complicate support. Regulatory pressure drove Microsoft’s EEA concession; similar pressure elsewhere may or may not follow.
• Unclear enforcement nuance. Microsoft’s public statements don’t describe which account actions satisfy the 60‑day check (full interactive login, background token refresh, network authentication), so there is uncertainty about borderline cases. That ambiguity increases the operational risk for users relying on ESU.

---

What Microsoft’s messaging doesn’t fully answer (flagged as cautionary)​

• Does a background token refresh (e.g., the Microsoft account credential cache renewing when online) count as “signing in,” or must the user perform an interactive sign‑in? Microsoft’s guidance is silent on this nuance. Treat this as unverifiable until Microsoft clarifies.
• Will Microsoft ever relax the 60‑day rule or extend the free global offering beyond the EEA? Those are policy questions outside the current documentation and should be treated as speculative.
• Will Microsoft check OneDrive sync state separately from MSA sign‑in (especially outside the EEA)? The company has not published a precise list of telemetry signals used for ESU entitlement checks; this remains an implementation detail users cannot audit.

---

Practical guidance — step‑by‑step checklist​

• Confirm your Windows 10 edition and version: Settings → System → About. The device must be on Windows 10, version 22H2.
• Install all available Windows Updates including the August 2025 cumulative (the KB referenced in Microsoft and media guidance) so the ESU enrollment wizard can appear in Settings → Update & Security → Windows Update.
• Decide how you’ll enroll:
• If you want zero ongoing MSA sign‑ins: plan to purchase the one‑time ESU license (sign in once with an MSA to buy, then you may switch to a local account).
• If you’re happy to use an MSA: sign in with the account you’ll use for ESU and enroll via the wizard. In the EEA you will not be forced to enable Windows Backup, but you still must sign in with the MSA.
• If you enroll with an MSA, sign into Windows with that same MSA at least once every 60 days to avoid automatic discontinuation of ESU. Add a calendar reminder or automation to prevent accidental lapses.
• Maintain independent backups (external disk image + file backups) irrespective of ESU enrollment. ESU is security‑only and not a substitute for disaster recovery.

---

Alternatives and long‑term choices​

• Upgrade to Windows 11 where hardware and software compatibility permit. This is the recommended long‑term solution for consumer safety and feature parity.
• Paid enterprise ESU (volume licensing): organizations that need multi‑year coverage should pursue the commercial ESU channels rather than the consumer path.
• Switch to a different OS (some Linux distributions or ChromeOS Flex) for older hardware that cannot meet Windows 11 requirements.
• Cloud/virtual desktops: use Windows 365 or other cloud PC services to preserve a supported Windows environment without local OS lifecycle concerns.

---

Final analysis — what to make of this change​

Microsoft’s adjustment for the EEA was a meaningful regulatory‑driven correction: it responds to concerns that conditioning free security updates on cloud backup and forced OneDrive usage would be problematic under regional rules. Yet the company preserved an account‑centric entitlement model and introduced a periodic re‑authentication requirement that prevents simple “sign up and go local” workarounds. That combination achieves Microsoft’s operational goals — easier entitlement control and fraud prevention — while still giving users a short, one‑year bridge to migrate.
For privacy‑conscious users the result is unsatisfying: you either accept an ongoing Microsoft Account presence on your device, pay for the one‑time license to remain local, or plan a migration away from Windows 10 within a year. For households and small offices on older hardware, ESU provides useful time to plan upgrades and reduce immediate exposure — but it’s precisely that: a tactical pause, not a long‑term fix.
Microsoft has published the basic rules; independent reporting and vendor pages confirm the 60‑day check and the EEA carve‑out. Where the record is thin is in the technical enforcement details (what counts as a sign‑in, how the telemetry works) and in future policy changes. Those are the parts users should watch closely and treat as potential friction points.

---

Conclusion​

The headline is accurate but incomplete: the free, EEA‑only pathway to an extra year of Windows 10 security updates removes the forced OneDrive backup requirement — but it does not allow you to avoid a Microsoft Account entirely. You still must enroll with an MSA and continue to sign in using that account at least once every 60 days, or your ESU entitlement will be stopped and you’ll need to re‑enroll. Microsoft’s approach balances regulatory concessions with operational controls, but it leaves privacy‑focused users with three unpalatable choices: accept ongoing MSA usage, pay the one‑time fee, or migrate off Windows 10 within the ESU year. Act now: verify prerequisites, decide your enrollment path, and treat the ESU year as a finite window to migrate rather than a permanent extension.

---

Source: TechRadar Think you figured out how to avoid having a Microsoft account to get Windows 10's free year of updates? Think again...