Intune Remote Help: Setup, Licensing and Unattended Access for IT Teams

Updated: November 2026. Licensing and features checked against Microsoft Learn and Microsoft's Intune pricing page on 10 November 2026.

A user calls with a broken printer driver, and the fastest fix is to see their screen. Microsoft's own tool for that changed twice in 2026: it started rolling into Microsoft 365 E3 and E5 in July, and in August it learned to sign in to Windows devices with nobody at the desk. This guide covers Intune Remote Help after both changes, from whether your licenses already include it to setup with least privilege, unattended sign-in and where you still need another tool.

TL;DR

• What it is. Intune's remote support tool, with both sides on work accounts and every session logged.
• Licensing. Rolling into Microsoft 365 E3 and E5 since July 2026, and other plans need the $3.50 add-on.
• Unattended. Since August 2026, helpers can sign in to corporate Windows PCs with nobody at the desk.
• Least privilege. Use view-only, full-control and unattended roles, scoping the last to named device groups.
• Where it stops. One tenant only, with no Linux, iPhone or session recording.

What Is Intune Remote Help?

Intune Remote Help is Microsoft's remote support tool for devices managed in Intune. A helper connects to a user's device to view the screen or take control, and both sides sign in with their Entra ID work account, so every session is tied to a named person and logged.

There are two ways in. In an attended session, the user accepts a prompt or enters a code, then watches the helper work. In an unattended session, available on Windows since August 2026, the helper signs in to a separate Windows session on a device with nobody there.

Quick Assist, the free app built into Windows, does screen sharing too. Microsoft's own documentation tells single-tenant organizations using Quick Assist to consider switching to Remote Help, because Quick Assist has no roles, Conditional Access, session logging or tenant isolation. Its helper signs in with any Microsoft account, and the user on the other end doesn't sign in at all.

Is Remote Help Included in Your License?

This changed in July 2026, so older guides and price lists are out of date. Microsoft is adding Remote Help, Advanced Analytics and Intune Plan 2 to Microsoft 365 E3, and those plus Endpoint Privilege Management, Enterprise App Management and Cloud PKI to E5.

Prices are per user per month, paid yearly, from Microsoft's Intune pricing page on 10 November 2026. If your E3 tenant hasn't had the notice yet, check the admin center before you buy an add-on you're about to get anyway.

Both the helper and the user being helped need a license. The exception is Android dedicated devices from Samsung and Zebra, such as a shared scanner, where nobody signs in, so only the helper needs one. Microsoft also offers a 90-day trial for up to 250 users per tenant.

For the rest of Intune's plans and what they cost, our Intune review has the full comparison.

Supported Platforms and Session Modes

Remote Help runs on Windows, macOS and Android dedicated devices, plus a browser-based web app. What a helper can do depends on the device at the other end, and on which app the helper uses.

Chat works on Windows and macOS, and not on Android or in unattended sessions. Attended Windows sessions also work on Windows 365 Cloud PCs and Azure Virtual Desktop.

Remote Help is available in GCC and, since late September 2026, GCC High tenants, but not DoD. Microsoft keeps session metadata (who helped whom, on which device, when and in which mode) for 30 days. It doesn't record the screen or keystrokes, so export the sessions report if your audit trail needs longer.

How to Set Up Remote Help in Intune

The roles step takes the longest. Here's the order that avoids rework.

1. Turn it on for the tenant. In the Intune admin center, go to Tenant administration, then Remote Help, then Settings, and set Enable Remote Help. Leave "Allow Remote Help to unenrolled devices" off unless you need it.
2. License a group. Assign licenses to a group that holds both helpers and the users they support. New licenses can take from 30 minutes to 8 hours to activate.
3. Create roles. Build custom roles from the table below, or start with the built-in Help Desk Operator.
4. Deploy the app. Push Remote Help to Windows as a Win32 app with remotehelpinstaller.exe /quiet acceptTerms=1, or from the Enterprise App Catalog. The installer is at aka.ms/downloadremotehelp, and it needs Edge WebView2.
5. Open the network path. Remote Help connects over TCP 443. Microsoft says to exclude the Remote Help domains from SSL inspection on your proxy; our TLS inspection guide covers how bypass lists work.
6. Require MFA for helpers. Create the Remote Assistance Service service principal with Microsoft Graph PowerShell, then target it in a Conditional Access policy. This works for Windows and macOS helpers.
7. Pilot it. Run a week of sessions with two helpers before you open it to the whole help desk.

One trap before you start. The documented way to switch off Quick Assist is to block remoteassistance.support.services.microsoft.com, and that blocks Remote Help too.

The roles step is where least privilege happens. Every helper needs "Remote Tasks - Offer remote assistance" and "Remote Assistance Connector - Read", plus at least one Remote Help app permission. Microsoft's own guidance splits those permissions by tier, and it maps to three custom roles.

The built-in Help Desk Operator role has everything except Windows unattended sign-in, so L3 has to be a custom role. Scope groups have a catch too: the All Devices group leaves out unenrolled devices, so use a user group if you support those. Our RBAC guide covers how to keep roles from sprawling.

This Get Rubix walkthrough from July 2026 covers attended setup, the E3 and E5 change and a least-privilege role. It predates unattended sign-in, which has its own section below.

How to Start a Remote Help Session

There are three ways to start a session, and which one fits depends on whether the user is there and which device they're on.

From the admin center. Open the device in Devices, then All devices, choose New remote assistance session, then Remote Help, and pick attended or unattended control. For an attended session, the user gets a notification and accepts it. That needs the Intune Management Extension on Windows, and a newly enrolled device can take an hour before notifications arrive.

Security code. The helper generates a code in the app and reads it to the user, who enters it in their copy of Remote Help. Use this for Azure Virtual Desktop hosts, where an admin-center launch reaches every user on the host.

Web app. Helpers can work from a browser at aka.ms/rhh, and users without the app can share from aka.ms/rh, view only.

Before anything starts, the user sees the helper's name and company from Entra ID. A device that isn't compliant shows a warning banner, but the session still runs. Elevation is blocked on devices where the EnableSecureCredentialPrompting policy is on.

Unattended Remote Help on Windows

Unattended sign-in went generally available in the week of 25 August 2026 (Intune service release 2608). It lets a helper sign in to a Windows PC with nobody there, such as a kiosk, a meeting room PC or a laptop left on overnight.

The helper starts it from the admin center. A browser tab opens the Windows App, the helper signs in with the same account, then signs in to the device with a local, domain or Entra ID account. That's a separate Windows session, not the user's own. Signing in as a standard user gives no admin rights, and each device takes one unattended session at a time.

If someone is signed in, they get a prompt and can accept or decline. If they don't answer within 30 seconds, the session starts anyway: their own session locks with their work kept, and they see the lock screen rather than what the helper does. They can sign back in at any time and choose to end the helper's session.

The target PC has to meet these prerequisites:

• Physical and x64, corporate-owned and managed by Intune.
• Entra joined or hybrid joined.
• The Intune Management Extension installed.
• The Azure Virtual Desktop agent, then the agent bootloader, deployed as Win32 apps.
• Remote Desktop turned on through the settings catalog.
• Powered on and online. A PC that's asleep, hibernating or shut down can't take a session.

Unattended sessions skip what attended ones have. There's no chat, Conditional Access doesn't apply, and Windows 365, Azure Virtual Desktop, personal devices and unenrolled devices aren't supported. Tenants hosted in Switzerland North can't use it.

In r/Intune, an admin who tested it as a TeamViewer replacement found the separate session suits kiosks and shared machines better than troubleshooting inside a user's profile.

A field note from that subreddit, not from Microsoft: testers report the device sign-in needs the "Allow log on through Remote Desktop Services" user right. Security baselines that deny Remote Desktop logon to local accounts also block LAPS accounts.

Remote Device Actions in Intune

A remote support ticket often ends with a device action instead of a session: a sync, a restart or a wipe. Intune runs these from the device page in the admin center.

Remote lock isn't offered for Windows at all. Microsoft lists it for Android Enterprise corporate-owned devices, AOSP, iOS and iPadOS, macOS and visionOS. For a lost Windows laptop, wipe it, or rotate the BitLocker key and the local admin password. If the key was never backed up, our BitLocker recovery key guide covers where Intune stores it.

Intune caps the destructive actions. Each tenant can run up to 500 wipes, 1,000 retires and 1,000 deletes a day, counted across single, bulk and Graph requests, and a bulk action takes up to 100 devices at a time. When a device does need a wipe, our factory reset guide covers what happens on the device.

Where Remote Help Stops

Remote Help covers user devices in your own tenant. Outside that, plan for something else.

If you outsource first-line support, the tenant limit shapes the contract. Our guide to help desk outsourcing covers the access models that work.

In October 2026, an r/Intune thread asked whether teams dropped their old remote tool now that Remote Help comes with E3. Replies lean toward keeping it, for reasons that match the table above, while first-line teams report it covers their day-to-day sessions.

For teams that want remote access, patching and device management in one place, OpenFrame is open, AI-native infrastructure for IT and security. Fae resolves support requests and Mingo runs IT operations, for $1 per device per month with a 14-day free trial. Flamingo builds OpenFrame, which competes with Remote Help.

For a wider look at tools in this category, our remote access software roundup compares them.

Troubleshooting Remote Help

Failed sessions usually trace back to one of these causes.

When the table doesn't help, the logs do. Install logs land in the user's Temp folder, and session events are in Event Viewer under Applications and Services Logs, Microsoft, Windows, RemoteHelp. Keep the app current too: the newest Windows version listed in What's new in Intune is 5.2.1210.0, from the week of 12 October 2026.

Remote Help in One Page

Check your license first, because an E3 or E5 tenant may already have it. Then build three roles, push the app, keep its domains out of SSL inspection, and pilot with two helpers before you open it to the whole help desk. Plan the second tool now for servers, Linux and other tenants. Next, read our NinjaOne vs Intune comparison to see how an RMM covers what Intune leaves out.