Remote Help provides cloud-based support sessions controlled through Intune licensing and RBAC. A secure deployment needs more than enabling the tenant switch: it needs helper roles, device scope, client deployment, Conditional Access, privacy controls and an auditable support process.
Plan the service
- Confirm licensing for both helpers and users receiving help.
- Define supported platforms and whether unenrolled devices are allowed.
- Decide attended, view-only and full-control scenarios.
- Map support tiers to Intune RBAC permissions and scope groups.
- Require helper access from managed, compliant and strongly authenticated devices.
- Document session recording or audit requirements, privacy notices and user consent.
Enable Remote Help
- In the Intune admin centre, go to Tenant administration > Remote Help.
- Set Enable Remote Help to Enabled.
- Leave Allow Remote Help to unenrolled devices disabled unless there is an approved business need and a documented risk treatment.
- Decide whether chat should be available.
- Save and allow time for service activation.
Create least-privilege RBAC
Use a custom role rather than broad Intune Administrator access. Helpers need the relevant Remote Help permissions plus device visibility and the remote-assistance connector read permission. Assign the role to support groups and scope it to the users or devices they are permitted to assist.
| Support persona | Suggested capability | Control |
|---|---|---|
| Service desk | View and basic full-control sessions | Limited device scope; no tenant configuration |
| Endpoint engineering | Advanced troubleshooting and elevation where approved | PIM activation and broader scope |
| Remote Help administrators | Service configuration and role maintenance | Small privileged group with change control |
Deploy the client
Package or use the supported deployment method for the Remote Help client, then assign it to helpers and supported user devices. Validate installation under WDAC/App Control, secure web gateway inspection and application-control policies.
Example detection check
$paths = @(
"$env:ProgramFiles\Remote Help\RemoteHelp.exe",
"$env:ProgramFiles\Microsoft\Remote Help\RemoteHelp.exe"
)
$found = $paths | Where-Object { Test-Path $_ }
if ($found) { exit 0 } else { exit 1 }Confirm the installed path and version in your environment before using a custom detection script.
Protect helper access
Use Conditional Access to require phishing-resistant or strong multifactor authentication and a compliant helper device. Exclude emergency accounts only where the organisation’s break-glass standard requires it. Validate that session launch and sign-in endpoints are not blocked by proxy controls.
Run a structured pilot
- Test helper and user sign-in.
- Test view-only and full-control modes.
- Confirm the user can see the helper identity and session warnings.
- Validate UAC and elevation behaviour.
- Test disconnected, proxy-restricted and non-compliant-device scenarios.
- Review audit records and service-desk evidence after each session.
Operationalise the service
- Require a ticket or incident reference for every session.
- Define when a helper may request full control.
- Review helper membership and role assignments regularly.
- Monitor failed sessions, client versions and network dependencies.
- Publish a user-facing guide explaining consent and how to verify a legitimate helper.
Microsoft references
- Use Remote Help with Microsoft Intune
- Plan for Remote Help
- Deploy Remote Help
- Start a Remote Help session
- Troubleshoot and monitor Remote Help
- Intune built-in role permissions
Review note: Microsoft cloud licensing, rollout dates and portal labels can change. Validate your tenant, Message Centre notices and current documentation before production implementation.