Remote Help for Windows

Remote Help is Microsoft’s secure, cloud-based tool for remote assistance in Intune. It was recently included in Microsoft 365 E3 and E5 and no longer requires a separate Intune Suite (or standalone Remote Help) licence.

This guide covers enabling Remote Help for the tenant and assigning the RBAC permissions that let help desk staff use it.

Prerequisites

• An Intune administrator account.
• Users on both ends have the Remote Help app installed (deployable via Intune/Winget: Microsoft.RemoteHelp).
• Microsoft 365 E3/E5 (or Intune Suite) licences assigned to the staff using Remote Help.
• Permissions assigned in Intune.

Note: since admin accounts are generally not licensed or logged into Ps, it should be set up by an admin, but then you should launch from the Intune portal as a normal user, with Intune license, remote help installed, and the helpdesk operator role.

1. Enable Remote Help for the tenant

1. Sign in to the Microsoft Intune admin center as an Intune administrator.
2. Go to Tenant admin > Remote Help.
3. Select Configure, set Remote Help to Enabled, and save.

Optional settings worth reviewing on the same page:

• Allow Remote Help to unenrolled devices — leave off unless you specifically need it.
• Disable chat — controls the in-session chat window.

2. Assign permissions (RBAC)

Remote Help capabilities are controlled by the Help Desk Operator Intune role. Permissions are granted to the users in a role assignment’s admin group for the devices/users in its scope groups.

1. Create an Entra ID security group for the operators, e.g. SG-HelpDeskOperator-Admins, and add your help desk staff to it.

2. In the Intune admin center go to Tenant admin > Roles > Help Desk Operator > Assignments > Assign.

3. Configure the assignment:

   • Admin Groups — SG-HelpDeskOperator-Admins (who gets the permissions).
   • Scope Groups — the users/devices the operators may help (e.g. All users, or a dedicated group).

4. Review and create the assignment.

Role capabilities

The Help Desk Operator role grants two Remote Help permissions:

Permission	Effect
View screen	Operator can view the user’s screen.
Take full control	Operator can take control of the session (still requires the user to consent at connect time).

You can create a custom role if you want to grant view only without full control.

3. Launching remote help

1. Logon to a computer using the user account which has both the Intune license, help desk operator role, and remote help app installed.
2. Open https://intune.microsoft.com/ > Devices > Windows > New remote assistance session
3. Click Open remote help link, and sign into the Remote Help app using the same account.

4. Using remote help

Whilst somewhat basic compared to other remote control software, it’s certainly an improvement over Teams screen sharing, features include:

• Elevation: Allows helpers to enter UAC credentials when prompted on the sharer’s device.
• Chat feature
• Remote restart
• Task manager

This image shows how to enable UAC:

References

• Use Remote Help
• Role-based access control (RBAC) with Intune

Microsoft Intune admin center