Unattended access is a contentious subject. That’s even more true now that compliance and governance rules, such as GDPR, shape how IT teams support their users. For a long time, Remote Help offered no unattended option at all. Some would argue that’s exactly how it should be.
Still, there’s a scenario IT teams face all the time. A manager has an important meeting, and the only window you get to access their device is while they’re away from their desk. They respond to a support ticket, ‘Log into my computer at 11am and add the printer.’
I take privacy seriously, and so should you, but there are edge cases where you need access to a device without waiting for approval. That’s a crude example, but you get the point I’m trying to make.
Other tools provide this unattended access, and Microsoft has finally caught up because not having unattended access can be a deal breaker for MSP’s when the SLA metrics matter (Wait time, first response, etc.).
Microsoft added unattended Remote Help to Intune in service release 2608, which landed in late August 2026. An authorised helper can now sign in to a managed Windows device with their own credentials. Nobody at the other end needs to be at the keyboard or click accept.
Unattended access is not available to all endpoints. Only physical, corporate-owned Windows devices qualify. They must be x64, Intune-managed and joined to Microsoft Entra, either directly or hybrid. Cloud PCs, Azure Virtual Desktop hosts, personal devices and unenrolled machines are not supported. These devices can still get attended support though. What are the prerequisites? The Intune Management Extension must be present (it’s most likely present if you use Intune to install apps), Remote Desktop must be enabled, and the Azure Virtual Desktop agent and bootloader need to be deployed as Win32 apps or manually if you have a smaller estate.
NOTE: Microsoft doesn’t specifically state the Intune Management Extension is required for remote help, not at the time of writing this blog anyway. This is my prerequisites from troubleshooting issues with deploying remote help in my lab environment
Access is controlled by one permission, ‘Remote Help app > Windows unattended control remote sign-in’. The built-in Help Desk Operator role doesn’t include it, so you’ll need a custom role. Scope that role to a small, named set of user/device groups, not everyone!
Two details matter for your compliance conversation. First, the session is a separate authenticated Windows session, kind of like the multi-window feature that no one really uses, it’s not a silent takeover of the user’s desktop which exposes all their files etc. Second, Remote Help’s Conditional Access policies apply only to attended sessions. Unattended access sits outside them, so you need to plan its controls separately. Sessions are audited, so you can review who connected, when and for how long, which matters for them dreaded audit sessions. OK, so now let’s see how we deploy remote help with unattended access from my test tenant.
1. Confirm licensing. Remote Help comes with the Intune Suite (This is what I have) or the standalone Remote Help add-on. Unattended Windows support also needs eligible Microsoft 365 E3 or E5 licensing.
2. Check the target devices. They must be physical, corporate-owned, x64 Windows PCs, enrolled in Intune and Entra joined or hybrid joined. Exclude personal devices, Cloud PCs, Azure Virtual Desktop hosts and other VMs. Also exclude ARM64 hardware.
3. Enable Remote Help. In the Intune admin centre, go to Tenant administration > Remote Help. On the Settings tab, set Enable Remote Help to Enabled and select Save. Activation can take 30 minutes to 8 hours.
4. Create a custom RBAC role. The built-in Help Desk Operator role doesn’t include the unattended permission. Create a custom role with “Remote Help app – Windows unattended control remote sign-in” plus the other Remote Help permissions you need. Assign it to your helpers, and scope it to the device groups that should receive unattended support. Use a dedicated role rather than adding this to your standard helpdesk role.
- Set up Conditional Access for Remote Help (optional but recommended). Install the Microsoft Graph PowerShell module, run Connect-MgGraph -Scopes “Application.ReadWrite.All”, then create the service principal with New-MgServicePrincipal -AppId “1dee7b72-b80d-4e56-933d-8b6b04f9a3e2”.
Then create a CA like below for an extra layer of security. You can use ‘Require device to be marked as compliant’ too, I used phishing resistant MFA as my grant control.
6. Download the two Azure Virtual Desktop installers. Get the Azure Virtual Desktop Agent and the Azure Virtual Desktop Agent Bootloader from the Microsoft link below.
7. Package each MSI as an .intunewin file. Use the Microsoft Win32 Content Prep Tool.
I manually installed them for my lab environment as I’m just one person, but if you have multiple helpers than it’s best to package and deploy from Intune.
- Create the agent app in Intune. Go to Apps > Windows > Add > Windows app (Win32). Upload the agent package, set the publisher to Microsoft, and populate the install\uninstall commands. Microsoft states the commands are as follows:
Install: msiexec /i “.msi” /qn
Uninstall: msiexec /x “{Product-Code-GUID}” /qn
Set the minimum OS to Windows 10 1607 or later. Use an MSI detection rule. Add no dependency. Assign it to your target device group.
9. Create the bootloader app with a dependency. Repeat step 8 with the bootloader package. On the Dependencies page, add the agent app. Keep Automatically install set to Yes. Assign it to the same device group. Intune then installs the agent first and the bootloader second.
10. Check the Intune Management Extension. The doc doesn’t list it for unattended support, but other sources say the target device needs it.
11. Deploy the Remote Help app to the targets. You’ve most likely already have this installed if you’re now trying to deploy unattended access. If you paid for the Intune suite like I have, then you can simply deploy from the Enterprise app catalog which is super easy to deploy with zero management overheads.
12. Enable Remote Desktop with a Settings catalog profile. Go to Devices > Manage devices > Configuration > Create > New policy. Choose Windows 10 and later, then Settings catalog. Add ‘Allow users to connect remotely by using Remote Desktop Services’ and set it to Enabled. Assign it to the target group. Make sure the firewall allows RDP. On a target device, confirm it under Settings > System > Remote Desktop.
13. Test on a pilot device. Wait for the apps and profile to check in. On the device’s page in the Intune admin centre, select remote actions, then begin a remote assistance session. You should now see the unattended option.
What it looks like from a users perspective. The user still receives a message on screen similar to attended access. However, this time they’re given 30 seconds to either approve or access the connection, otherwise the help gains acess.
That’s it, if the helper has the remote helper app installed, then the session can be run through that, otherwise it’s ran via the web client which in my opinion isn’t as clean as the remote help app.
Leave a Reply