Intune Remote Help Unattended Access: Setup Guide (Remote Sign-In)

The August 2026 Intune update added unattended support with remote sign-in to Remote Help on Windows. A technician can connect to a device with no user present, authenticate with their own Microsoft Entra ID credentials, and work in a separate Windows session while the user’s session stays locked.

With the July 2026 licensing changes, Remote Help is included in Microsoft 365 E3 and E5 — no add-on required.

• Microsoft 365 E3/E5 (Remote Help now included) or the Intune Suite / Remote Help add-on
• Corporate-owned, physical x64 Windows devices that are Entra joined or hybrid joined (BYOD, VMs and ARM are not supported at GA)
• Devices Intune-enrolled and compliant
• The Remote Help app deployed to target devices

1. Go to Tenant administration > Remote Help.
2. On the Settings tab select Configure.
3. Set Enable Remote Help = Enabled.
4. Optionally set Allow Remote Help to unenrolled devices and Disable chat.

Unattended control uses a dedicated permission that is not in the built-in roles by default:

1. Go to Tenant administration > Roles.
2. Create a new custom role (or edit an existing one).
3. Under Permissions > Remote Help app, enable Windows unattended control remote sign-in.
4. Assign the role to your helpdesk group, scoped to the device groups that may receive unattended support.

1. Go to Devices > Windows > Configuration profiles > Create profile.
2. Platform: Windows 10 and later — Profile type: Settings catalog.
3. Add Administrative Templates > Remote Desktop Session Host > Connections > Allow users to connect remotely by using Remote Desktop Services = Enabled.
4. Assign the profile to the same device groups as the RBAC scope.

Deploy Remote Help as a Win32 app:

• Install: remotehelpinstaller.exe /quiet acceptTerms=1 enableAutoUpdates=1
• Uninstall: remotehelpinstaller.exe /uninstall /quiet acceptTerms=1
• Detection: C:\Program Files\Remote Help\RemoteHelp.exe, version ≥ 5.2.1037.0

The acceptTerms and enableAutoUpdates options are case-sensitive. Remote Help requires the Microsoft Edge WebView2 Runtime.

• Allow Remote Desktop inbound on the required network profiles (domain/private/public).
• Allow *.trouter.communications.svc.cloud.microsoft so Remote Help session starts aren’t delayed (the Teams-based notification endpoint).

1. Open the target device page in the Intune admin center.
2. Select Initiate unattended control (unattended sessions start from the device page, not the Remote Help app).
3. Sign in to the remote device with a local account (ComputerName\UserName), a domain account, or an Entra ID account (UPN).

• Least privilege — a standard account doesn’t gain admin rights in the session.
• User awareness — if a user is signed in they get a 30-second accept/reject prompt.
• Session isolation — support runs in a separate session; the user’s session stays locked.
• 12-hour maximum — unattended sessions auto-terminate.
• Full audit trail — all sessions are logged.

1. Start an unattended session on a test device with no user signed in.
2. Confirm you reach the Windows sign-in screen and can authenticate.
3. Check the session appears in the Remote Help reports/audit logs.

The helper’s role lacks the Windows unattended control remote sign-in permission, or the device group isn’t in scope.

Verify the Remote Desktop profile applied, firewall rules allow RDP, and the device is compliant.

If the role is activated via Privileged Identity Management, a device restart may be required after activation.

• Remote Help on Windows: Unattended Support with Remote Sign-In — Microsoft Tech Community
• Deploy Remote Help — Microsoft Learn