Remote Help is Microsoft's built-in remote assistance tool for Intune-managed devices. It gives your helpdesk view-only access, full control, and UAC elevation on Windows, with the sharer's consent, and it authenticates both sides through Microsoft Entra ID so nobody outside your tenant can join.
Deploying it is not one task but five. You enable it at tenant level, decide who can use it through Intune RBAC, install the app on devices, allow it through the firewall where needed, and register a service principal so Conditional Access can see the service at all.
This guide covers the Windows path end to end. macOS and Android follow the same tenant setup but differ in how the app is installed.
Before you start
What you will learn
- How to take Remote Help from an unlicensed idea to a working helpdesk tool on Windows: the tenant switch, the RBAC permissions, two ways to deploy the app, the firewall rules, and the service principal that makes the service visible to Conditional Access.
- Remote Help is off by default and licensed separately from Intune. Miss either fact and your helpdesk stares at a session that never connects, with no obvious error to chase.
Requirements
- You need the Microsoft Intune admin center with permissions to change tenant administration settings and create app deployments, plus a workstation with Microsoft Graph PowerShell if you plan to use Conditional Access.
- Windows x86, x64 or ARM64 devices registered with Microsoft Entra ID. Windows 365 and Azure Virtual Desktop are supported for attended control. Remote Help is not supported on GCC High or DoD tenants.
- Intune Administrator
- Help Desk Operator or an equivalent custom Intune role for the helpers
- An account that can consent to the Application.ReadWrite.All Graph scope
Good to know
- Budget more than the clicking time. New or trial licenses can take up to 8 hours to activate.
- Steps and paths come from Microsoft Learn as of August 2026. Admin center menus shift over time, so check the labels against your own tenant.
Quick answer
Enable Remote Help under Tenant administration, assign helpers an Intune role that carries the Remote Help permissions, then deploy the Remote Help app to Windows device groups from the Enterprise App Catalog or as a Win32 app. If you use Conditional Access, register the Remote Assistance Service principal with Microsoft Graph PowerShell first, because the app does not appear in the policy picker until it exists in your tenant.
Microsoft Intune admin center > Tenant administration > Remote Help > SettingsStep-by-step tutorial
8 stepsEnable Remote Help for your tenant
Turn on the feature at tenant level and decide up front whether unenrolled devices and chat are in scope.
Microsoft Intune admin center > Tenant administration > Remote Help > SettingsSign in to the Microsoft Intune admin center and go to Tenant administration > Remote Help.
On the Settings tab, set the three options:
- Set Enable Remote Help to Enabled. This is disabled by default.
- Set Allow Remote Help to unenrolled devices to Enabled only if you intend to support Entra-registered devices that Intune does not manage. This is also disabled by default.
- Set Disable chat to Yes if you want to remove the in-app chat. Chat is enabled by default, with this setting at No.
Select Save.
Enabling unenrolled device support trades oversight for convenience. Microsoft notes you get no device compliance information and limited audit data for those sessions, so consider a separate role for helpers who support them.
If sessions still report that Remote Help is not enabled, give the licensing 30 minutes to 8 hours before troubleshooting anything else.
Grant Remote Help permissions through Intune RBAC
Decide which helpers can view, control, elevate, or connect unattended, and scope them to the right devices or users.
Microsoft Intune admin center > Tenant administration > RolesRemote Help uses Intune role-based access control. The built-in Help Desk Operator role already carries every permission Remote Help needs: view screen, take full control, elevation, Android unattended control, Remote Tasks - Offer remote assistance, and Remote Assistance Connector - Read.
Assign that role, or build a custom role if you want tighter separation. A helper needs three things together to work at all:
- Remote Tasks - Offer remote assistance
- Remote Assistance Connector - Read
- At least one Remote Help app permission, such as View screen or Take full control
Assign the role to a group of helpers and give it scope groups covering the users or devices they support.
Apply least privilege here rather than later. Microsoft's own guidance suggests view-only rights for tier-1 support and full control for tier-2.
The Windows unattended control remote sign-in permission deserves its own custom role scoped to specific device groups. Unattended control lets a helper connect with nobody present, so it should not travel with a general helpdesk role.
Scope traps to watch: if a sharer or their device falls outside a helper's scope, that helper simply cannot assist. And the All Devices scope group excludes unenrolled devices, so use a user scope group when unenrolled support matters.
Download the Remote Help installer
Get the current Windows installer from Microsoft and record its version for the detection rule later.
Download the latest Windows build directly from Microsoft at aka.ms/downloadremotehelp.
As of the August 2026 documentation, the current version is 5.2.1037.0.
If you plan to deploy as a Win32 app, rename the downloaded file to remotehelpinstaller.exe. Microsoft's documented install and uninstall command lines assume that exact filename.
Remote Help needs the Microsoft Edge WebView2 Runtime. The installer adds it automatically when it is missing. Uninstalling Remote Help does not remove WebView2, which is worth knowing if you audit installed components.
Remote Help opts users into automatic updates by default and prompts them when a new version is required. There is no need to uninstall the old version first.
Deploy through the Enterprise App Catalog
Take the low-effort route: let Microsoft's prepackaged catalog entry handle packaging and detection for you.
Microsoft Intune admin center > Apps > All apps > Add > Enterprise App Catalog appRemote Help is available in the Enterprise App Catalog, a set of Win32 apps prepackaged by Microsoft for Intune. Adding it from the catalog means you skip repackaging and skip writing a detection rule by hand.
Add it as a Windows catalog app from the Intune apps blade, then assign it to your Windows device groups.
This is the recommended path if the Enterprise App Catalog is available to you. If it is not, use the Win32 route in the next step instead. The two are alternatives, not a sequence.
Assign to device groups, not user groups. Microsoft states Remote Help is applicable when targeting groups of devices.
The Enterprise App Catalog is part of the Intune Suite. Check what your licensing covers before planning around it.
Deploy as a Win32 app instead
Package and deploy Remote Help yourself when the Enterprise App Catalog is not an option.
Microsoft Intune admin center > Apps > All apps > Add > Windows app (Win32)Repackage remotehelpinstaller.exe into a .intunewin file using the Microsoft Win32 Content Prep Tool, then add it in Intune as a Windows app (Win32).
Work through the wizard as follows:
App information: select the .intunewin package, add a Publisher, then Next. The remaining fields are optional.
Program: set the install and uninstall command lines shown below.
Requirements: set Operating system architecture and Minimum operating system to match your estate.
Detection rules: choose Manually configure detection rules, then Add, and configure a File rule with these values:
- Path:
C:\Program Files\Remote Help - File or folder:
RemoteHelp.exe - Detection method: String (version)
- Operator: Greater than or equal to
- Value: the version you are deploying
- Associated with a 32-bit app on 64-bit clients: No
Assignments: select the Windows device groups that should receive the app, then finish the wizard.
remotehelpinstaller.exe /quiet acceptTerms=1
remotehelpinstaller.exe /uninstall /quiet acceptTerms=1
remotehelpinstaller.exe /quiet acceptTerms=1 enableAutoUpdates=0The third command is optional. Add enableAutoUpdates=0 only if you want to manage updates yourself rather than letting the app update itself.
Both `acceptTerms` and `enableAutoUpdates` are case sensitive. Getting the casing wrong is a silent failure.
For the detection rule value, use the version you are actually deploying, not the example in Microsoft's documentation. To read it from a machine where you installed Remote Help manually, run this in PowerShell and take the FileVersion from the output:
(Get-Item "$env:ProgramFiles\Remote Help\RemoteHelp.exe").VersionInfoAllow Remote Help through Windows Firewall
Clear the path for Remote Help traffic in environments where the firewall blocks it by default.
Microsoft Intune admin center > Devices > ConfigurationThis step is conditional. Depending on your firewall posture, you may need rules allowing three Remote Help executables:
C:\Program Files\Remote Help\RemoteHelp.exeC:\Program Files\Remote Help\RHService.exeC:\Program Files\Remote Help\RemoteHelpRDP.exe
Create the rules through an Intune configuration profile so they land alongside the app rather than being applied by hand.
Separate from the local firewall, both helper and sharer need to reach Microsoft endpoints over port 443. Remote Help connects to the Remote Assistance Service at https://remotehelp.microsoft.com using RDP, encrypted with TLS 1.2.
If your proxy performs SSL inspection, exclude the Remote Help domains. Inspection breaks the connection, and the failure looks like a network problem rather than a policy one.
Register the Remote Assistance Service principal
Make the Remote Help backend service visible to Conditional Access, which it is not until the service principal exists in your tenant.
Only do this if you intend to reference Remote Help in a Conditional Access policy.
Open PowerShell as administrator. The Microsoft Graph PowerShell module must be installed. Run the commands in order.
The New-MgServicePrincipal call uses the fixed Remote Assistance Service application ID 1dee7b72-b80d-4e56-933d-8b6b04f9a3e2. That value is the same in every tenant, so use it verbatim.
Install-Module Microsoft.Graph -Scope CurrentUser
Connect-MgGraph -Scopes "Application.ReadWrite.All"
New-MgServicePrincipal -AppId "1dee7b72-b80d-4e56-933d-8b6b04f9a3e2"
Disconnect-MgGraphYou must sign in with an account able to consent to the Application.ReadWrite.All scope, which is a high-privilege grant. Use an admin account, and disconnect when you are finished.
The display name Remote Assistance Service is the backend service behind Remote Help. That naming difference trips people up when they go looking for Remote Help in the Entra portal and find nothing.
Reference RemoteAssistanceService in Conditional Access
Bring Remote Help under your Conditional Access design, whichever direction that design points.
Microsoft Entra admin center > Protection > Conditional Access > PoliciesOpen the Conditional Access policy you want to adjust, then select Target resources.
Select Resources (formerly cloud apps), then choose either Include or Exclude depending on your intent, then Select resources, and check RemoteAssistanceService with app ID 1dee7b72-b80d-4e56-933d-8b6b04f9a3e2.
Microsoft's deployment walkthrough demonstrates the Exclude path. Its planning guidance separately recommends requiring MFA or a compliant device for helper accounts, which means including the resource in a policy that enforces those controls. Decide which you are doing before you touch the policy.
Set the policy to report-only first and review sign-in logs before enforcing it. Conditional Access mistakes are fast to make and slow to undo.
Conditional Access policies for Remote Help are supported on Windows and macOS only.
If RemoteAssistanceService does not appear in the picker, the service principal from the previous step was not created in this tenant.
How to Confirm Your Remote Help Rollout Is Working
Verification runs on three fronts, and they fail independently.
Check the tenant first: Tenant administration > Remote Help should still show Enabled, and your unenrolled-device and chat choices should have stuck.
Check the app: in Apps > All apps, open Remote Help and read the device install status. Installs land when the Intune Management Extension next checks in, so give it time before treating pending as broken.
Check the session: have a helper inside the correct RBAC scope start a session against a test device. That single test exercises licensing, tenant setting, RBAC scope, app install, and network path at once, which makes it the fastest way to find which one is wrong.
For ongoing monitoring, Intune audit logs and Entra ID sign-in logs both show who signed in to Remote Help. Unusual hours or unfamiliar helper accounts are worth investigating.
- Remote Help shows Enabled, the app reports installed on targeted devices, and a helper can open a session with a sharer who accepts the prompt.
- Sessions report that Remote Help is not enabled for the tenant despite the setting being on, helpers cannot see the Remote Help action, or the app sits at pending install indefinitely. Each points at a different layer: licensing, RBAC scope, or the Intune Management Extension.
- Usually license activation lag rather than a wrong setting. Microsoft allows 30 minutes to 8 hours.
- The helper needs Remote Tasks - Offer remote assistance, Remote Assistance Connector - Read, and at least one Remote Help app permission, with the target inside their scope group.
- The IME orchestrates Win32 installs. Confirm it is installed and healthy on the target device.
Troubleshooting
Sessions report that Remote Help is not enabled for the tenant, even though the setting shows Enabled
Cause: License activation lag. New licenses and trial licenses take time to propagate, and sessions keep reporting the old state during that window.
Wait it out before changing anything. Microsoft states activation can take between 30 minutes and 8 hours. If the message persists well past 8 hours, confirm the Remote Help subscription is assigned to the specific users involved, not just present in the tenant.
A helper cannot start a Remote Help session, or the option is missing entirely
Cause: Incomplete permission combination, or the sharer sits outside the helper's scope groups.
Confirm the helper's role carries all three requirements together: Remote Tasks - Offer remote assistance, Remote Assistance Connector - Read, and at least one Remote Help app permission. Then confirm the target user or device is inside a scope group on that role assignment. Missing any one produces the same silent failure.
Helpers cannot assist users on unenrolled devices
Cause: The All Devices scope group does not include unenrolled devices.
Replace or supplement the device scope with a user scope group on the RBAC assignment. Also confirm Allow Remote Help to unenrolled devices is set to Enabled on the tenant Settings tab, since it is off by default.
The Win32 app reports installed on devices that do not have Remote Help, or reinstalls in a loop
Cause: The detection rule version does not match reality, often because the example version from the documentation was copied verbatim.
Install Remote Help manually on one machine, read the FileVersion from PowerShell, and use that value as your detection value. Confirm the path and filename in the rule match exactly.
(Get-Item "$env:ProgramFiles\Remote Help\RemoteHelp.exe").VersionInfoThe Win32 install fails silently with no useful error
Cause: The installer was not renamed to remotehelpinstaller.exe, or the command line arguments were typed with the wrong casing.
Confirm the packaged file is named remotehelpinstaller.exe, then check the casing of acceptTerms and enableAutoUpdates in both the install and uninstall command lines. Both are case sensitive. Re-upload the package after correcting either.
RemoteAssistanceService does not appear in the Conditional Access resource picker
Cause: The service principal has not been created in this tenant.
Run New-MgServicePrincipal -AppId "1dee7b72-b80d-4e56-933d-8b6b04f9a3e2" after connecting with the Application.ReadWrite.All scope. Search the picker for RemoteAssistanceService, not Remote Help, since the backend service uses the different name.
Sessions fail to connect from the corporate network but work from home
Cause: Proxy SSL inspection is breaking the connection, or port 443 access to the Remote Help endpoints is blocked.
Exclude the Remote Help domains from SSL inspection on your proxy, and confirm both helper and sharer can reach the documented endpoints over port 443. Remote Help connects to https://remotehelp.microsoft.com over RDP with TLS 1.2, so inspection that terminates TLS will break it.
Frequently asked questions
Is Remote Help included with Microsoft Intune?
No. Microsoft states that Remote Help requires a subscription in addition to Microsoft Intune Plan 1 or Plan 2. The license is needed for everyone targeted to use the service, meaning both the helpdesk staff providing help and the users receiving it.
Can I use Remote Help to support users in another tenant?
No. Remote Help's integration with compliance policies and role-based access control requires helpers, sharers, and devices to all be in the same tenant. For outsourced helpdesk scenarios, Microsoft suggests supplying the helpdesk with devices joined to your tenant, or giving them access to Windows 365 or Azure Virtual Desktop devices in it.
What is the difference between Remote Help and Quick Assist?
Remote Help authenticates both parties through your Microsoft Entra ID, enforces Intune RBAC so you control who can view, control, or elevate, and logs session data for auditing. Quick Assist has none of that tenant-level control, which is why Remote Help is the supported option for managed environments.
Do I need to uninstall the old version before deploying an update?
No. Microsoft states there is no need to uninstall the previous version before installing an updated one. Remote Help also opts users into automatic updates by default and prompts them when a new version is required.
Does Remote Help record sessions?
No session recordings are stored by the service. Microsoft logs limited session metadata for 30 days, covering start and end times, who helped whom on which device, and which features were used. Session details are also written to the Windows Event Logs on both the helper's and the sharer's device.
Why does Remote Help appear as RemoteAssistanceService in Entra ID?
Remote Assistance Service is the name of the backend service that Remote Help runs on. When you create the service principal for Conditional Access, it registers under that display name with app ID 1dee7b72-b80d-4e56-933d-8b6b04f9a3e2, so search for RemoteAssistanceService rather than Remote Help.
