In modern, geographically dispersed enterprise environments, the ability for an IT helpdesk to securely assume control of an end-user’s device is critical for resolving complex operating system issues. Historically, organizations relied on third-party tools (like TeamViewer or LogMeIn) or legacy on-premises solutions like SCCM Remote Control. These tools often suffer from massive security vulnerabilities, requiring persistent inbound firewall ports or utilizing shared administrative credentials that violate Zero Trust principles. To modernize this workflow, Microsoft introduced Intune Remote Help, a cloud-native, deeply integrated remote assistance solution that leverages Microsoft Entra ID for strict Role-Based Access Control (RBAC) and seamless unattended support.
The Architecture of Intune Remote Help
Unlike legacy remote desktop protocols (RDP) that open listening sockets on the local network, Intune Remote Help operates entirely via outbound TLS 1.2 connections to Microsoft’s cloud infrastructure.
The architecture fundamentally relies on Cryptographic Identity Verification. When a Helpdesk technician initiates a session, they are not connecting to an IP address or a hostname; they are connecting to a specific Entra ID device object. Before the session connects, both the technician and the end-user are mathematically verified against Entra ID. The end-user sees a highly visible prompt displaying the technician’s full name, corporate profile picture, and verified corporate domain, entirely eliminating social engineering attacks where malicious actors pose as “IT Support.”
Configuring Role-Based Access Control (RBAC)
Before deploying the client application, you must configure the strict permissions defining exactly who can assist whom, and what level of control they possess.
- Log in to the Microsoft Intune admin center.
- Navigate to Tenant administration > Roles.
- You can utilize the built-in Help Desk Operator role or create a custom role.
- Within the role’s properties, locate the Remote Help app permissions section. Here, you must grant specific privileges:
- Take full control: Allows the technician to interact with the keyboard and mouse.
- Elevation: This is a critical security boundary. If granted, the technician can interact with User Account Control (UAC) prompts on the user’s screen using the technician’s own administrative credentials, even if the end-user is a Standard User.
- View screen: Grants read-only observation rights.
By assigning these roles to specific Entra ID security groups (e.g., Tier 1 Support gets “View Screen”, Tier 3 gets “Full Control and Elevation”), you enforce the Principle of Least Privilege across your support organization.
Deploying the Remote Help Client
To utilize the service, the Remote Help executable must be deployed to your Windows 10/11 endpoints.
Download the official Remote Help installer (remotehelpinstaller.exe) from the Microsoft Download Center. Within the Intune admin center, navigate to Apps > Windows > Add and select Windows app (Win32).
Package the installer using the Intune Win32 Prep Tool and deploy it utilizing the following silent installation command:
remotehelpinstaller.exe /quiet acceptTerms=1Enabling Unattended Support
A recent, highly requested addition to the platform is Unattended Support. This allows administrators to connect to a device (e.g., a digital signage kiosk, an active directory joined server, or a laptop sitting idle on a desk) without requiring a human to explicitly click “Accept” on the screen.
To configure this highly sensitive feature, you must explicitly enable it at the tenant level:
- Navigate to Tenant administration > Connectors and tokens > Remote help.
- Under the Settings tab, toggle Allow unattended control to Enabled.
You must then assign specific RBAC permissions to your Tier 3 support group granting them the Unattended Control right. When a technician with this right attempts to connect to an idle Windows device, the Remote Help client will seamlessly establish the outbound tunnel, lock the physical screen (preventing physical bystanders from observing the administrative actions), and grant the technician full, elevated control of the remote operating system.