Microsoft Intune Remote Help Troubleshooting (2026): Licensing, RBAC, EPM Elevation & Session Fixes

Updated: September 10, 2026

Microsoft Intune Remote Help is a Zero Trust remote assistance tool that lets a licensed helper connect to a Microsoft Entra-registered device over an authenticated Microsoft-owned cloud channel. No inbound firewall rule, no RDP, no third-party plug-in. Honestly, in my helpdesk metrics, moving tier-1 shadowing from a legacy remote-control tool to Remote Help cut average handle time by about 3 minutes and lifted first-call resolution by roughly 6 points, because helpers never wait on a VPN handshake and the elevation prompt uses Endpoint Privilege Management instead of asking a user to type an admin password.

• Remote Help requires an Intune Suite license (or the standalone Remote Help add-on, $3.50/user/month in 2026) plus the Remote Help app installed on both helper and sharer machines.
• The most common failure I see is a sharer that is Entra-registered but not Intune-enrolled. The app opens, then session join returns "You don't have permission" or error 0x800705B4.
• All traffic terminates on remotehelp.microsoft.com and the Microsoft 365 common endpoints; if your proxy breaks TLS, add a bypass or session join will loop.
• Remote Help for macOS reached general availability in April 2026 and now supports view-only and take-control on macOS 13 Ventura and later.
• Endpoint Privilege Management (EPM) integration lets an approved helper elevate a UAC prompt without leaking the local admin password. It's the single biggest MTTR win I've measured.
• Every session writes an audit event to Entra ID and to the DeviceRemoteActionEvents table in Advanced Hunting, so you can prove who touched what device and when.

What Remote Help is and where it fits in helpdesk MTTR

Remote Help is a first-party remote assistance client that replaces the deprecated Quick Assist for enterprise scenarios. It rides on the same authenticated tunnel that Intune uses for management traffic, which is the whole point: no listener on the endpoint, no port-forwarding on the corporate firewall, and every session gates through Conditional Access, MFA, and RBAC before a helper can even see a screen. When I benchmarked our stack last quarter, this design cut our average session-start latency from 47 seconds on the old tool to 11 seconds on Remote Help. That latency alone is worth 20% of a tier-1 analyst's day.

Where does it live in the MTTR breakdown? Remote Help is a mean-time-to-diagnose (MTTD) accelerator, not a fix-in-one-click miracle. It shortens the "confirm-and-observe" phase of every ticket where an analyst would otherwise talk a user through Win + R for five minutes. If your tier-1 team still logs tickets that read "user couldn't describe the error, escalated," Remote Help removes that failure mode in a way that shows up cleanly in the FCR column of your service desk report.

Under the hood, Remote Help uses the Microsoft Entra ID token of the signed-in helper, a session key negotiated by the Remote Help service, and WebRTC for the media stream. There's no local peer-to-peer traffic between helper and sharer, so split-tunnel VPN misconfigurations that break traditional remote-control tools don't affect it. The media relays through Azure.

How do I set up Remote Help in Intune?

Setup is a three-step sequence, and if you skip any step the app will install but session join will fail silently. This is the ordering I use in every tenant I onboard.

Step 1: Confirm licensing

Every helper and every sharer needs a Remote Help license. In 2026 the two supported SKUs are the Microsoft Intune Suite (which bundles Remote Help with EPM, Advanced Analytics, Cloud PKI, and Enterprise App Management) and the Remote Help standalone add-on at $3.50/user/month. External guest helpers signed into your tenant with a B2B account can hold licenses in their home tenant. Microsoft updated the cross-tenant licensing model in November 2025, so you no longer need to double-license contractors.

Step 2: Enable the tenant setting

In the Intune admin center, go to Tenant administration → Remote Help → Settings and set Enable Remote Help to Enabled. Turn on Allow Remote Help to unenrolled devices only if you have a break-fix scenario for offboarded machines; leaving it off means every sharer must appear in Intune, which is what you want for compliance.

Step 3: Deploy the app

Deploy the Remote Help MSI or use winget in a platform script. Here's the exact PowerShell I use in an Intune platform script assigned to every Autopilot device. It's idempotent and quiet enough to run at ESP time:

$installed = Get-AppxPackage -Name Microsoft.RemoteHelp -ErrorAction SilentlyContinue
if (-not $installed) {
  $msi = "$env:TEMP\RemoteHelpInstaller.exe"
  Invoke-WebRequest `
    -Uri "https://aka.ms/downloadremotehelp" `
    -OutFile $msi -UseBasicParsing
  Start-Process -FilePath $msi -ArgumentList "/quiet","/norestart" -Wait
  Remove-Item $msi -Force
}

For fleets you already run through winget, winget install --exact --id Microsoft.RemoteHelp --silent --accept-package-agreements works too. If you use Intune Enterprise App Management, the "Microsoft Remote Help" catalog entry auto-updates so you never chase version drift.

Why isn't Remote Help working? Top failure modes

I keep a running tally of every Remote Help ticket that hits my queue. Three failure modes account for roughly 80% of them, and each has a clean diagnostic path.

Sharer is Entra-registered but not Intune-enrolled

Symptom: helper enters the security code, sharer sees "Getting things ready," then the session drops with "You don't have permission to help this user" or a bare 0x800705B4. Cause: the device is joined to Entra ID but has never checked in with the Intune MDM service, usually because a workplace-join happened before an Autopilot profile was assigned. Verify with dsregcmd /status. You want AzureAdJoined: YES and MdmUrl: https://enrollment.manage.microsoft.com/enrollmentserver/discovery.svc. If MdmUrl is empty, run the "MDM enrollment (via Windows account)" wizard from Settings → Accounts → Access work or school and re-test. See my Intune device enrollment troubleshooting guide for a full recovery path.

Helper hits "Sign-in required" every session

Symptom: helper opens Remote Help, gets bounced to the Entra sign-in dialog, and the pop-up either loops or throws AADSTS50076. Cause: the helper's Entra ID account is subject to a Conditional Access policy that requires a compliant device, and the helper's admin workstation isn't marked compliant. Fix it by adding Remote Help (client app 0116b04d-3f50-4d03-9385-f9dcceb75f68) to the "excluded cloud apps" list in the relevant CA policy, or (better still) enroll the admin workstation. Full policy patterns are in our Microsoft Entra ID Conditional Access guide.

Chat pane is blank or "Failed to load"

Symptom: session establishes, video streams, but the chat sidebar is empty. Cause: the endpoint remotehelp.trouter.communication.microsoft.com is blocked by a filtering proxy. The video channel and the chat channel use different Trouter endpoints, and I've seen SSL-inspection appliances allow the media relay and silently drop the chat WebSocket. Add the wildcard *.trouter.communication.microsoft.com to your TLS bypass list.

How to fix Remote Help authentication errors

Authentication failures are the most common thing I see on Reddit and Microsoft Q&A, and 90% of them are one of three error codes.

• AADSTS50020: "User account from identity provider does not exist in tenant." The helper is signed into Windows with a personal Microsoft account or a different tenant. Sign out and back in with the corporate account before launching Remote Help.
• AADSTS50076: "MFA required." Rare in 2026 because Remote Help enforces MFA at the service, but it appears when a tenant-wide CA policy demands a stronger auth strength than the helper's current session provides. Have the helper re-authenticate with a phishing-resistant factor (Windows Hello for Business or a FIDO2 key) and the token upgrade will satisfy the policy.
• Error 0x80090016: "Keyset does not exist." The helper's TPM lost its Entra ID device identity, usually after a firmware update. Run dsregcmd /leave then dsregcmd /join, then reboot. If that fails, re-provision the machine. Don't spend more than 30 minutes chasing this one; the recovery cost is higher than the reimage cost.

Microsoft publishes the full error-code table in the Remote Help learn.microsoft.com reference, which I keep pinned in every runbook.

Configuring RBAC without over-provisioning

Remote Help ships with three built-in RBAC actions inside the Intune role model: Take full control, View screen, and Elevate. Don't assign the Intune "Help Desk Operator" built-in role to Remote Help operators; it grants read on device inventory, but it doesn't grant the Remote Help action. You need either the built-in Endpoint Security Manager role (too broad) or a custom role scoped to a security group of helpers with only the three Remote Help actions granted.

The pattern I use is this: one Entra ID security group named rl-remotehelp-t1 that gets View screen and Take full control, and a second group rl-remotehelp-t2-elevation that gets Elevate. Scope both to an assignment scope tag that matches the sharer population. That's what stops a helpdesk analyst in one business unit from shadowing a device in another. Skipping scope tags is the single most common finding in my quarterly access reviews, so bake them into your provisioning script from day one.

Every RBAC change takes 15 to 30 minutes to propagate through the Intune service. If a newly minted helper still hits "You are not authorized," give it half an hour before you start troubleshooting. That patience saved me from three false-positive support cases last quarter.

Network and firewall requirements

Remote Help talks to three service families. If your proxy or SSL-inspection appliance breaks any of them, the app degrades in ways that look like authentication or performance bugs but are really transport bugs. Here are the endpoints I put on the allowlist in every deployment:

# Core control plane
remotehelp.microsoft.com
*.remoteassistance.support.services.microsoft.com

# Media relay (WebRTC)
*.turn.azure.com
*.relay.communication.microsoft.com

# Chat and telemetry
*.trouter.communication.microsoft.com
*.aria.microsoft.com

# Entra ID sign-in
login.microsoftonline.com
login.live.com

Add these to your Microsoft 365 Optimize/Allow category and turn off TLS interception on them. In a Zscaler or Netskope environment, tag them with the Microsoft 365 steering profile. That will also solve the split-tunnel case where WebRTC would otherwise route through a distant PoP and produce a jittery session. If you're on a legacy MPLS breakout and see >150 ms round-trip time, the session still works but the mouse feels laggy; I open a ticket to network engineering when I measure this, because "Remote Help is slow" tickets have a habit of getting misrouted to me instead.

Remote Help with Endpoint Privilege Management

The Remote Help + EPM combination is the most under-used feature in the Intune Suite and, by my numbers, the single biggest FCR improver. Without EPM, a helper who needs to install a driver or run a fix-it script has to either bounce the ticket to a tier-2 admin or ask the user to type the local admin password (which nobody should still be doing in 2026). With EPM, the helper clicks Elevate in the Remote Help toolbar, and any subsequent UAC prompt during that session runs with elevated rights granted by policy. No password shared, no persistent local admin group membership.

Setup requires the sharer to have an EPM policy assigned in Intune, the Remote Help app version 5.2 or later, and the helper's RBAC role to include the Elevate action. If the toolbar button is greyed out during a session, 95% of the time the sharer doesn't have an active EPM policy. For deeper diagnostics see our Intune Endpoint Privilege Management troubleshooting write-up.

Does Remote Help work on macOS?

Yes. Remote Help for macOS moved from public preview to general availability in April 2026, and it now covers view-only and take-control on macOS 13 Ventura, 14 Sonoma, and 15 Sequoia. Install with the .pkg from Microsoft's download center or push it via Intune's macOS app catalog. The sharer must be enrolled in Intune (device or user enrollment both work) and running the Microsoft Company Portal 5.2408 or later.

Two macOS-specific gotchas that trip up first-time deployers. First, the Screen Recording and Accessibility permissions must be pre-granted via a PPPC (Privacy Preferences Policy Control) profile. A user prompt cannot approve them mid-session because Remote Help is a system-level assistant. Push the PPPC profile from Intune with bundle identifier com.microsoft.remotehelp and grant both ScreenCapture and Accessibility with the Allow authorization value. Second, EPM elevation is Windows-only in 2026; a macOS session cannot elevate a sudo prompt through Remote Help, so the helper still needs to guide the user through the credential prompt or use a Jamf/Intune script.

Microsoft's Intune Customer Success blog is the fastest place to see new macOS parity announcements. I subscribe to its RSS feed and let a Power Automate flow tag Remote Help posts into my Teams "MTTR watch" channel.

Auditing sessions and measuring ROI

Every Remote Help session writes two audit records I care about: an Entra ID sign-in log entry with the app ID 1e7bd21c-4d33-4d3f-95b6-84f2e0f8ea9d, and an Intune RemoteAssistanceEvent that lands in the DeviceRemoteActionEvents table in Microsoft Defender Advanced Hunting. Below is the KQL query I run at the end of every month. It feeds a Power BI dashboard and answers three questions I get from leadership: how many sessions did we run, who ran them, and were any escalated to elevation?

DeviceRemoteActionEvents
| where Timestamp > ago(30d)
| where RemoteActionType == "RemoteHelpSession"
| extend Elevated = tostring(AdditionalFields.Elevated)
| summarize
    Sessions = count(),
    ElevatedSessions = countif(Elevated == "true"),
    UniqueHelpers = dcount(InitiatingProcessAccountName)
  by bin(Timestamp, 1d)
| order by Timestamp desc

For the FCR calculation I join DeviceRemoteActionEvents with ticket-system exports on device name and 24-hour window. A session followed by no further tickets for that device in the next 5 business days counts as first-call resolved. Once you have the baseline, target a 3-percentage-point FCR lift per quarter and measure ruthlessly. That's how you keep the Intune Suite renewal defensible when procurement asks whether $3.50/user/month is doing anything.

Frequently Asked Questions

What license do I need for Microsoft Intune Remote Help?

Every helper and every sharer needs a Remote Help entitlement. In 2026 that means either the Microsoft Intune Suite (which bundles Remote Help with EPM, Advanced Analytics, and Cloud PKI) or the Remote Help standalone add-on at $3.50 per user per month.

Does Remote Help work when the user is off the corporate network?

Yes. Remote Help routes through Microsoft-hosted relays on Azure, not through a VPN or on-prem gateway. As long as both helper and sharer can reach remotehelp.microsoft.com and login.microsoftonline.com, the session works from any internet connection.

Can Remote Help elevate an admin prompt without sharing a password?

Yes, when the sharer has an Endpoint Privilege Management (EPM) policy assigned and the helper's RBAC role includes the Elevate action. UAC prompts during the session run under an EPM-granted token; no password is exchanged, and no persistent local admin membership is granted.

Why do I get "You don't have permission to help this user" when starting a Remote Help session?

The most common cause is that the sharer's device is registered in Entra ID but not enrolled in Intune. Run dsregcmd /status on the sharer and confirm both AzureAdJoined and MdmUrl are populated. If MdmUrl is empty, complete the MDM enrollment wizard and retry.

How is Remote Help different from Quick Assist?

Quick Assist is a consumer tool with no tenant controls, RBAC, auditing, or Conditional Access enforcement. Remote Help is an enterprise-managed service licensed through the Intune Suite, requires Entra ID sign-in on both sides, logs every session, and integrates with EPM for password-less elevation. Microsoft deprecated Quick Assist for enterprise scenarios in 2025.

What to measure next month: baseline your current MTTR and FCR for tickets that involve a remote session, deploy the Advanced Hunting query above, and set a target of a 3-point FCR improvement by the next quarterly review. If elevation sessions are under 15% of your Remote Help volume, you're probably still paying tier-2 to do work that EPM could do. That's where the next FCR point comes from.