Microsoft has introduced a significant enhancement to its Intune Remote Help feature, streamlining the process for IT teams managing unattended Windows devices. With this update, administrators can now access devices without requiring user approval, effectively minimizing delays associated with locked, shared, or after-hours devices.
Historically, the Remote Help functionality necessitated the presence of an end user to authorize support sessions, which often resulted in frustrating delays when devices were not actively in use. This change addresses those challenges, allowing IT technicians to initiate troubleshooting even when users are unavailable.
How Microsoft Intune Remote Help handles unattended sessions
The newly implemented unattended support feature eliminates the need for user participation, granting authorized help desk personnel secure access to devices for maintenance and repairs. This capability is designed with security in mind, offering session isolation, user awareness, and comprehensive session functionalities. Additionally, it includes controls that ensure visibility and accountability during unattended sessions.
According to Microsoft, “This feature uses a dedicated permission: Remote Help app > Windows unattended control remote sign-in. It must be explicitly assigned to helpdesk roles targeting specific device groups. To maintain a higher security boundary, this permission isn’t included in any Intune built-in role, including existing roles such as Help Desk Operator or School Administrator, and must be granted through a custom role assignment.”
What does the change mean for IT admins?
This update enhances the utility of Microsoft Intune Remote Help for organizations that frequently manage unattended Windows PCs. Help desk teams can now perform various support and maintenance tasks independently, without the need to coordinate with users or wait for session approvals.
However, with the added capability of unattended access comes an expanded scope of what support personnel can accomplish without direct user involvement. Microsoft’s choice to keep this feature outside its built-in Intune roles underscores the importance of maintaining a secure environment.
Organizations looking to implement this feature should take care to define appropriate custom roles, restrict access to relevant device groups, and regularly review Remote Help logs to ensure that unattended sessions are conducted with accountability.
