Skip to main content

185: Remote Assist

Implementation Effort: Medium User Impact: Medium — users must consent to support sessions and may need approved support software.

Overview​

Remote support for managed devices should be identity-aware, audited, and limited to approved admins. For Microsoft Intune environments, the preferred model is to standardize on Microsoft Intune Remote Help where supported, apply least-privilege RBAC, and make support sessions contingent on verified users and trusted devices.

Implementation Guidance​

  1. Confirm which remote support workflow is in scope: Microsoft Intune Remote Help, Quick Assist for break-glass scenarios, or an approved third-party tool with identity and logging controls.
  2. In the Microsoft Intune admin center, enable the support feature and assign only the RBAC permissions required for helpers. Separate helper groups from supported-user groups.
  3. Require Microsoft Entra authentication for helpers and users, and pair privileged helper access with MFA and Conditional Access for compliant admin workstations.
  4. Pilot the workflow with a small support group. Validate screen sharing, user consent, full-control approval, session logging, and escalation paths for unmanaged devices.
  5. Review support reports, Intune audit logs, and Entra sign-in activity on a recurring basis to verify remote support is being used as intended.

Reference​