Skip to main content

167: Remote Help (Attended & Unattended)

Implementation Effort: Low – Cloud-based remote assistance deployed via Intune with built-in Microsoft Entra ID authentication and Intune RBAC controls.

User Impact: Low – Improves helpdesk resolution times while enforcing explicit role-based permissions and session auditing.

Overview​

Remote Help in Microsoft Intune is a cloud-based remote assistance solution that enables IT support staff to securely view and control managed Windows, macOS, and Android devices using Microsoft Entra ID authentication and granular Intune RBAC controls.

Major 2025–2026 updates include:

  • Included in Microsoft 365 E3 and E5 (June 2026): Remote Help is now included directly in Microsoft 365 E3 (EMS E3) and Microsoft 365 E5 (as well as Intune Plan 2 / Intune Suite) without requiring a separate standalone add-on purchase.
  • Unattended Remote Help Sessions on Windows (August 2026 / 2608): Authorized helpdesk agents can now initiate unattended Remote Help sessions on physical Windows devices, signing in with their own credentials to view, control, and troubleshoot devices without requiring an end user to be present.
  • Azure Virtual Desktop (AVD) RemoteApp Support (June 2026 / 2606): Helpdesk agents can securely view and control applications running inside AVD RemoteApp and desktop sessions.
  • US Government GCC High Support (September 2026 / 2609): Extends Remote Help across Windows, macOS, and Android to GCC High environments.
  • macOS 26 & Microsoft AutoUpdate (MAU) Integration (March 2026): Remote Help on macOS registers with MAU for automatic client updates and full inventory version reporting.
  • Real-Time Notification Infrastructure: Uses *.trouter.communications.svc.cloud.microsoft (logged in NotificationInfra.log) for faster session initiation.

Implementation Guidance​

Establish the support control model​

  • Define who can provide remote assistance, whether elevation is allowed, and which device platforms are in scope.
  • Use Microsoft Entra groups and Intune role-based access control to separate first-line support from higher-privilege administrators.
  • Review Conditional Access requirements for support staff accounts, especially MFA and compliant device requirements.

Deploy the service​

  • Enable Remote Help in Intune, assign the required roles, and deploy the Remote Help application or prerequisites to support staff and end-user devices as needed.
  • Pilot with helpdesk staff using real support scenarios such as enrollment troubleshooting, policy refresh issues, and app installation failures.
  • Confirm user prompts, consent flows, and session logging behavior before announcing the capability broadly.

Operate securely​

  • Require support sessions to originate from managed, compliant admin devices rather than personal endpoints.
  • Train support teams on when to use Remote Help versus device actions such as sync, collect diagnostics, or wipe.
  • Review session usage and any elevation events as part of periodic privileged access governance.

Reference​