Gerry Hampson Device Management: June 2026

You may remember the surprise announcement late last year when Microsoft announced that they would unify the key capabilities of endpoint management by adding the components of the Intune Suite to Microsoft 365 E3 and Microsoft 365 E5 SKUs. These advanced Intune capabilities include Remote Help, which will be included in Microsoft Enterprise Mobility and Security E3 (EMS E3) and therefore Microsoft 365 E3. We believe that this change will be rolled out starting in July 2026.

I have already implemented Remote Help for a number of enterprise and SMB customers and I’m confident that this licensing change will prompt many other customers to move from third party solutions with a view to reducing costs.

What does Remote Help give to your organization?

Deliver simple, cloud-connected, and secure assistance to workers anywhere, anytime.
Secure screen sharing and full control of Windows, macOS and Android (Zebra and Samsung) so that helpers (administrators) can support sharers (end users).
Role Based Access Control (RBAC); helpers do not need to have excessive permissions on Intune or the devices.
Ability to monitor Remote Help sessions; every session is logged with details like helper name, sharer name, device name and length of session.
Allows helpers to enter UAC credentials when prompted on the sharer's device for elevated permissions.
Enhanced chat in multiple languages.

What are the advantages of Remote Help over other third-party tools?

Remote sessions can be launched natively from the Intune admin center by selecting a device.
Intune can be integrated with ServiceNow to show a real time list of ServiceNow incidents for a user from the Troubleshooting pane. Remote sessions can be launched from there.
Zero Trust enforcement; uses Microsoft Entra authentication and can be protected with Conditional access. For example, you can require multifactor authentication (MFA) for helpers or restrict access to specific locations or compliant devices.
Compliance checks and warnings; helpers can see a noncompliance warning before connecting to a non-compliant device.
You can choose to limit remote sessions to Intune enrolled devices only (although you can allow unenrolled devices also).
Remote sessions are restricted to your tenant only. This is useful for privacy reasons, especially in Europe, where there are GDPR restrictions.
The data from Remote Help sessions can be combined with Endpoint Analytics to identify common issues.

It won’t hurt to try it out in advance of the licensing changes.

From the Microsoft Intune admin center, navigate to Tenant administration > Intune add-ons. Click View details for Remote Help and this will connect you to the Microsoft 365 admin center where you can request a trial.

Click Start free trial for 250 Remote Help licenses to be added to your tenant for 90 days. You can then assign the licenses to users. Remember that both the helper and sharer need a Remote Help license.

Enable Remote Help

This operation is carried out at the tenant level. In the Microsoft Intune admin center, navigate to Tenant administration > Remote Help. On the Settings tab, click Configure.

Set Enable Remote Help to Enabled to allow the use of Remote Help. By default, this setting is disabled.
Set Allow Remote Help to unenrolled devices to Enabled if you want to allow this option. By default, this setting is disabled.
Set Disable chat to Yes to remove the chat functionality in the Remote Help app. By default, chat is enabled and this setting is set to No.

RBAC and permissions

It is recommended to enforce least privilege and grant the minimum Remote Help permissions for each support role. The Help Desk Operator role already contains the necessary permissions to use Remote Help. However, consider using a custom role to be more granular with the permissions. In the Microsoft Intune admin center, navigate to Tenant administration > Roles. Click Create and choose Intune role.

Select the permissions for the Remote Help app only.

View screen allows the helper to view the sharer’s device when Remote Help is enabled.
For Android devices, Unattended control will start Remote Help as soon as the helper selects a new session, without a sharer having to grant access. At the time of writing, Unattended control is not yet supported for Windows, this would be useful for managing kiosks.
Take full control allows the helper to control the sharer’s device when Remote Help is enabled.
Elevation allows the helper to enter UAC credentials when prompted on the sharer’s Windows device.

The custom role can be assigned to Admin Groups (Entra groups containing the helpers) and targeted at Scope Groups (Entra groups containing the sharers; this can also be All Users or All devices).

Remote Help app

Windows

Download the Remote Help app for Windows. At under 8MB, it’s very lightweight. It must be installed on the helpers device and any device where support is to be offered. There are a few ways to deploy this app.

Install manually; requires local administrator permissions and is not sustainable.
Add Remote Help to Intune as an Enterprise App Catalog app and assign to your users or devices. There is a cost associated with this method.
Deploy Remote Help as a Win32 app. The following parameters can be used.

Install command line, specify remotehelpinstaller.exe /quiet acceptTerms=1
Uninstall command line, specify remotehelpinstaller.exe /uninstall /quiet acceptTerms=1
Detection Path, specify C:\Program Files\Remote Help
Detection File or folder, specify RemoteHelp.exe

macOS

Download the Remote Help app for macOS. It can be automatically deployed to your estate of Intune enrolled macOS device.

Web App

In situations where the sharer needs assistance but is unable to install the full client application for Windows or macOS, the sharer can use the Web App to share their screen to a helper. This web app provides view only capabilities to the helper.

Android

Remote Help app for Android is available on the Google Play store for installation on Zebra and Samsung devices.

The Remote Help experience on Windows

I have two users in my lab. Fred is the helper and Joe is the sharer. Both have Windows 11 devices with the Remote Help app installed.

Fred’s device is on the left in the screenshot. He navigates to Joe’s device in the Intune admin center and chooses New remote assistance session.

The New remote assistance session blade opens, and Fred selects Remote Help > Continue.

Joe receives a Remote Help notification that Fred is available to help him. He is invited to Open Remote Help.

Fred is also invited to Open Remote Help.

The Remote Help app launches on Fred’s device, and he can see that Joe is ready for support. Fred can choose to Take full control or View screen. For now, he chooses View Screen.

Joe gets a notification to Allow the remote help session.

The remote help session is established and Fred can see Joe’s screen.

Fred and Joe can chat during the session.

Fred can Request control. Joe gets a notification to Allow.

Now Fred can control Joe’s device. Joe can Cancel control at any time.

Fred can elevate his permissions on Joe’s device by entering administrator credentials at the UAC prompt.

Note that I had to create and deploy an Intune configuration policy so that Fred could see the UAC prompt on Joe’s device.

Settings catalog > Local Policies Security Options > User Account Control Allow UI Access Applications To Prompt For Elevation > enabled (allow UIAccess applications to prompt for elevation without using the secure desktop).

The Remote Help experience on macOS

Fred is still the helper and Joe is the sharer. Fred is using his Windows 11 device and Joe wants to share his MacBook with Fred for assistance, although the MacBook is not enrolled in Intune. This time we will use the web app, which supports screen sharing but not full control. If full control is needed, then you have to use the full macOS client application.