Microsoft Remote Help: Because ‘Read Me the Error’ Isn’t a Support Strategy

Microsoft Remote Help is what you reach for when “can you read me the error?” has failed three times and the user has started reading out the desktop wallpaper instead.

It is Microsoft’s own remote support tool for Intune-managed devices. Both people sign in with Microsoft Entra accounts, Intune decides who can help whom, and every session lands in a report. Think of it as Quick Assist after it got a job in compliance.

Two things changed in 2026. From July, Microsoft 365 E3 includes Remote Help, and Microsoft 365 E5 adds the Enterprise App Catalog, so you can deploy it without packaging a single .intunewin file.

This guide covers licensing, tenant setup, a least-privilege helper role, deployment with auto-update, your first session, elevation and logs. My lab uses two Microsoft Entra joined Windows 11 VMs: CADTB01 as the helper device and CADTB03 as the sharer.

Never miss a guide: subscribe here and check out my YouTube channel.

Prefer watching? I walk through the Microsoft Remote Help setup in my video:

What is Microsoft Remote Help?

Microsoft Remote Help is a cloud-based remote support service that works with Intune. The technician is the helper, and the person getting support is the sharer.

Both sign in with organisational Microsoft Entra accounts from the same tenant. That is the real difference from a basic screen-sharing tool: each session is tied to your identities, Intune roles and managed devices.

Capability	What it does on Windows
View screen	The helper sees the screen but cannot touch anything
Full control	The helper uses the keyboard and mouse after the sharer approves
Elevation	The helper can interact with User Account Control prompts
Chat	Text chat during the session, which you can disable tenant-wide
Remote launch	Start a session from the Intune device record
Compliance warnings	The helper is warned if the sharer’s device is non-compliant

There is no cross-tenant support. If your outsourced helpdesk lives in another tenant, Microsoft Remote Help won’t connect them to your users, however nicely they ask.

Microsoft Remote Help licensing after July 2026

Remote Help used to mean an add-on or the full Intune Suite. From July 2026, several Intune Suite capabilities moved into the Microsoft 365 enterprise plans, as the Intune licensing page sets out.

Plan	Microsoft Remote Help	Enterprise App Catalog
Microsoft 365 E3	Included, with Intune Plan 2 and Advanced Analytics	Not included
Microsoft 365 E5 and E7	Included	Included, with Endpoint Privilege Management and Cloud PKI
Office 365 E3 or E5	Not included (no Intune)	Not included
Other plans	Intune Suite or the Remote Help add-on	Intune Suite or standalone Enterprise App Management

An E3 tenant gets Remote Help but not the catalogue, so deploy the app as a Win32 package instead. My guide to deploying Windows apps with Microsoft Intune covers that route.

The change covers commercial E3 and E5 and is rolling out gradually, with a Microsoft 365 admin centre notice 30 days before it reaches your tenant.

My Microsoft 365 E5 developer tenant still showed a Remote Help trial banner, even though everything worked. Don’t treat one portal banner as your licensing check.

Before you start

What you need	Why
A Remote Help entitlement for helpers and sharers	Both sides of the session must be licensed
Microsoft Entra accounts in the same tenant	Cross-tenant sessions aren’t supported
Intune-enrolled Windows devices	You get compliance warnings and full auditing
Microsoft Edge WebView2 Runtime	Remote Help needs it and installs it if missing
Outbound TCP 443 to the Remote Help endpoints	Exclude them from SSL inspection on your proxy
Intune Management Extension on the sharer’s device	Remote launch notifications depend on it

How to set up Microsoft Remote Help in 7 steps

Step 1: Create your Remote Help groups

Start small. I created three Microsoft Entra security groups so I could test without handing the whole tenant to the helpdesk on day one.

Group	Members	Used for
Remote Help - Helpers	The helper account	Admin group in the role assignment
Remote Help - Test Users	The normal test user	Scope group for users
Remote Help - Test Devices	CADTB01 and CADTB03	Scope group and app assignment

Separate groups let you prove the role scoping works, and the rollout later becomes a membership change rather than a rebuild.

Step 2: Enable Microsoft Remote Help in Intune

A licence doesn’t switch anything on. Remote Help is disabled by default in every tenant.

1. Sign in to the Microsoft Intune admin centre.
2. Go to Tenant administration > Remote Help > Settings and select Configure.
3. Set the options below, then select Save.

Setting	My value	Why
Enable Remote Help	Enabled	Turns the service on tenant-wide
Allow Remote Help to unenrolled devices	Not allowed	Keeps compliance data and full auditing
Disable chat	No	Keeps chat available during sessions

Step 3: Create a least-privilege helper role

Installing the app doesn’t make anyone a helper. Intune role-based access control decides who can help, who they can help and what they can do.

The built-in Help Desk Operator role includes everything, elevation too. That suits a quick test, but it is more than first-line staff need, so I built a custom role.

1. Go to Tenant administration > Roles > All roles > Create.
2. Name the role Remote Help - Elevated Helper and add the permissions below.
3. Assign it with Remote Help - Helpers as the admin group, and Remote Help - Test Users and Remote Help - Test Devices as scope groups.

Category	Permission	Required?
Remote tasks	Offer remote assistance	Yes
Remote assistance connectors	Read	Yes
Remote Help app	View screen	At least one Remote Help permission is required
Remote Help app	Take full control	Optional
Remote Help app	Elevation	Optional, for senior staff only

The admin group decides who gets the permissions, and the scope groups decide who they can support. If the sharer or their device is out of scope, the helper can’t connect.

Support tier	Suggested permissions
First line	View screen
Second line	View screen and Take full control
Senior technicians	View screen, Take full control and Elevation

Step 4: Add Microsoft Remote Help from the Enterprise App Catalog

This is where the July licensing change pays off. The Enterprise App Catalog holds prepackaged Win32 apps hosted by Microsoft, complete with install commands, requirements and detection rules.

1. Go to Apps > All apps > Create.
2. Under Windows, choose Enterprise App Catalog app and select Select.
3. Select Search the Enterprise App Catalog, search for Remote Help, pick Microsoft Remote Help and select Next.
4. On Configuration, choose the package that matches your devices.

Configuration	My lab value
Package name	Remote Help
Language	en-US
Architecture	x64
Version	5.2.1037.0

Version 5.2.1037.0 is still the latest listed on Microsoft Learn as I write this. Pick whatever your tenant offers, because the catalogue moves when Microsoft ships a release.

Step 5: Choose the Remote Help update method

The Updates tab gives you two options, and you only choose once. Changing your mind later means creating a new app.

Option	What it does	Good for
Automatically update	Intune deploys newer catalogue versions to Required assignments. Custom settings and scripts are reset and blocked.	Most tenants
Update with supersedence	Keeps custom settings, but you create a superseding app for each update	Strict change control

I chose Automatically update. Remote Help is a support tool, not a line-of-business app with its own change board, and Microsoft might enforce upgrades for older versions anyway.

Step 6: Review the settings and assign as Required

Intune fills in the name, publisher, version, requirements and detection rules. Publisher stays as Microsoft, and the app installs in the System context, so users don’t need local admin rights.

Leave the install and uninstall commands, requirements and detection rules alone. Changing them can break installation.

1. Continue through Program, Requirements, Detection rules and Supersedence without changes.
2. On Assignments, under Required, select Add group and choose Remote Help - Test Devices.
3. Select Review + create, check the summary, then create the app.

Assign it to devices, not users. The Intune Management Extension installs it on the next check-in, and nobody has to open Company Portal.

Step 7: Start your first Microsoft Remote Help session

Open Start and search for Remote Help. Not Quick Assist, which sits right next to it looking helpful.

On CADTB01 I signed in with the helper account, and on CADTB03 with the test user. A personal Microsoft account gets the organisational account screen and no further.

Once you’re signed in, the home screen shows Get Help for entering a code and Give help for generating one.

Option A is launching from the Intune device record:

1. On CADTB01, sign in to the Intune admin centre as the helper and open Devices > All devices > CADTB03.
2. Select New remote assistance session > Remote Help > Continue, then Initiate attended control.
3. Select Open Remote Help and sign in with the same account you used in the portal.
4. On CADTB03, the sharer selects the Windows notification, or finds it in the notification centre.

Option B is a security code:

1. On CADTB01, select Get a security code under Give help.
2. Give the code to the sharer over the phone or in Teams.
3. On CADTB03, enter it under Get Help and select Submit.

Both people then see the other’s name, job title, company, photo and verified domain. The helper requests screen sharing or full control, and the sharer decides.

Screen sharing, full control and elevation

Start with screen sharing. It covers most “where do I click?” calls, and you can’t accidentally drag Dave’s budget spreadsheet into the Recycle Bin.

Full control hands you the keyboard and mouse once the sharer approves, and you can step up from view-only mid-session. Elevation is separate again: the helper needs the Elevation permission to get through UAC prompts.

Use a dedicated endpoint admin account for elevation, never the user’s password or a Global Administrator. If elevated actions happened and the sharer ends the session, they are signed out, so warn them to save their work.

Prove Microsoft Remote Help worked

Under Apps > Windows, open Microsoft Remote Help. The update method should say Auto-update, and device status should show your test devices as installed.

On a device, check the installed version and that the Intune Management Extension is running:

# Installed Remote Help version
(Get-Item "$env:ProgramFiles\Remote Help\RemoteHelp.exe").VersionInfo.FileVersion

# Remote launch needs the Intune Management Extension running
Get-Service -Name IntuneManagementExtension | Select-Object Name, Status, StartType

Next, go to Tenant administration > Remote Help. Monitor shows active sessions, and Remote Help sessions lists the helper, sharer, device, start and end times and session type.

Microsoft Remote Help keeps that metadata for 30 days and never records the screen, actions or keystrokes. Worth telling users who think the helpdesk is filming them.

Elevation isn’t shown in the sessions report, so check the device. Remote Help writes operational events on both helper and sharer devices to:

Event Viewer > Applications and Services Logs > Microsoft > Windows > RemoteHelp

These two PowerShell snippets list the Remote Help logs and pull the latest events:

Get-WinEvent -ListLog '*RemoteHelp*' -ErrorAction SilentlyContinue |
    Select-Object LogName, RecordCount, IsEnabled

$RemoteHelpLogs = Get-WinEvent -ListLog '*RemoteHelp*' -ErrorAction SilentlyContinue

foreach ($Log in $RemoteHelpLogs) {
    Get-WinEvent -LogName $Log.LogName -MaxEvents 10 -ErrorAction SilentlyContinue |
        Select-Object TimeCreated, Id, LevelDisplayName, Message
}

Lock down Microsoft Remote Help helpers

Helpers can control other people’s devices, so require MFA or a compliant device for them through Conditional Access. First, create the Remote Assistance Service principal with Microsoft Graph PowerShell:

Install-Module Microsoft.Graph.Applications -Scope CurrentUser
Connect-MgGraph -Scopes "Application.ReadWrite.All"

# Remote Assistance Service, the back end for Remote Help
New-MgServicePrincipal -AppId "1dee7b72-b80d-4e56-933d-8b6b04f9a3e2"

Disconnect-MgGraph

It then appears as RemoteAssistanceService under target resources. Test the policy with the Conditional Access What If tool first, unless you enjoy locking out your own helpdesk.

If helpers also hold Entra admin roles, put those behind Microsoft Entra PIM. On E5, Endpoint Privilege Management can approve elevations by policy, covered in my Intune Endpoint security guide.

Microsoft Remote Help gotchas

Licence lag. Sessions can claim Remote Help isn’t enabled for up to 8 hours after licensing.

New devices. Newly enrolled devices take about an hour to receive remote launch notifications. Use a security code meanwhile.

Missing notifications. Do not disturb, blocked cloud notifications or a stopped Intune Management Extension service all stop the launch request appearing.

SSL inspection. Proxies inspecting TCP 443 can break sessions, so exclude the Remote Help domains listed on Microsoft Learn.

WebView2 errors. Error codes 1001 to 1003 point at WebView2. Update Edge or install the WebView2 Runtime.

Unattended control. Windows unattended remote sign-in needs its own permission and the Azure Virtual Desktop agent, and Help Desk Operator doesn’t include it. This guide doesn’t cover it.

Should you use Microsoft Remote Help?

If you’re on Microsoft 365 E3 or E5, yes. You’re already paying for it, and it replaces “Quick Assist and hope” with identity checks, scoped roles and a 30-day session history.

With E5, the Enterprise App Catalog makes deployment the easy bit. The part that needs thought is the support model: who can view, who can take control and who gets elevation.

Pilot with a small group, keep elevation for a few senior staff and require MFA for helpers. Then tell the helpdesk they can stop asking users to spell out error codes.

Microsoft Remote Help FAQs

Further reading

• Use Remote Help with Microsoft Intune (Microsoft Learn)
• Planning for Remote Help with Microsoft Intune (Microsoft Learn)
• Deploying Remote Help with Microsoft Intune (Microsoft Learn)
• Microsoft Intune Enterprise Application Management (Microsoft Learn)
• Troubleshoot and monitor Remote Help (Microsoft Learn)
• How to deploy Windows apps with Microsoft Intune
• Intune Endpoint security explained
• Microsoft Entra PIM for secure admin access

Found this useful? Buy me a coffee, and if you handle subject access requests, have a look at Redact Ninja for redacting PDFs without sending files to a server.