Microsoft Intune Remote Help Unattended Support with Remote Sign-In - End-to-End Setup Guide
.png)
Microsoft recently introduced Remote Help Unattended Support with Remote Sign-In, allowing IT administrators and helpdesk staff to remotely access Intune-managed Windows devices without requiring an end user to be present.
This guide documents a complete lab-tested deployment, including setup, configuration, troubleshooting, and lessons learned during real-world testing.
Disclaimer
This guide is based on a manual proof-of-concept deployment. For production environments, Microsoft recommends deploying the required Azure Virtual Desktop components through Intune as Win32 applications.
What is Remote Help Unattended Support?
Traditional Remote Help requires a signed-in user to approve the support session.
With Unattended Support with Remote Sign-In, administrators can:
- Connect to a managed Windows device when no user is present
- Sign in using their own credentials
- Work in a separate Windows session
- Perform maintenance after business hours
- Support kiosk devices, public computers, library PCs, and shared devices
The user's existing session remains protected and isolated.
Prerequisites
Licensing
One of the following licenses is required:
- Microsoft 365 E3
- Microsoft 365 E5
- Intune Suite
- Remote Help Standalone Add-on
Device Requirements
The target device must be:
- Intune managed
- Corporate owned
- Microsoft Entra Joined or Hybrid Entra Joined
- Online and reachable
- Physical Windows device
Personal (BYOD) devices are currently not supported.
Step 1 - Enable Remote Help
Navigate to:
Enable:
Step 2 - Create a Custom RBAC Role
Microsoft introduced a dedicated permission specifically for unattended access.
Navigate to:
Configure the following permission:
Set the permission to:
Assign the Role
Admin Groups
Assign the role to the group containing your support staff.
Example:
Scope Groups
Assign the role scope to the device group containing your target devices.
Example:
A common mistake is using an administrator group as the scope group.
The scope group should contain the actual managed devices.
Step 3 - Deploy the Required Azure Virtual Desktop Components
Microsoft currently requires two Azure Virtual Desktop components.
Component 1
Azure Virtual Desktop Agent
Component 2
Azure Virtual Desktop Agent Boot Loader
Testing Approach
For testing purposes, both components were installed manually.
For production deployments, package both installers as:
and deploy them to the same device groups targeted for unattended support.
Verify Installation
Open:
Verify the following software is installed:
Verify Services
Run:
Expected result:
Step 4 - Enable Remote Desktop
Create a Settings Catalog profile.
Navigate to:
Add the following setting:
Configure it as:
Deploy the profile to the same device group used for unattended support.
Verify Deployment
Navigate to:
Verify the device reports:
Step 5 - Start an Unattended Session
Navigate to:
Choose:
A Remote Help session will be created and the Windows sign-in screen will appear.
What Happens If a User Is Already Signed In?
One of the key advantages of Remote Help Unattended Support is the ability to connect to a managed Windows device even when another user is currently signed in.
If an active user session is detected, the administrator receives a warning:
"Another user is signed in. If you continue, they'll be disconnected. Do you want to sign in anyway?"
Figure X - Existing User Session Detected
Remote Help warns the administrator that another user is currently signed in to the device. Selecting Yes allows the administrator to continue with the remote sign-in process while preserving the existing user's session.
User Experience
If a user is actively working on the device, Windows displays a notification informing them that a remote support professional is attempting to start an unattended support session.
Figure X - User Notification Before Remote Sign-In
Windows displays a notification to the signed-in user when a remote sign-in session is requested. The user can choose to allow or cancel the request. If no action is taken, the unattended session automatically proceeds after approximately 30 seconds.
Once the administrator successfully signs in, the user's desktop is locked and preserved while the administrator works within a separate Windows session. When the user returns, they can unlock and resume their original session without losing their work.
Common Issue: "Sign-in Failed"
One of the most confusing issues during testing occurred after the remote session was successfully established.
The Remote Help session connected correctly, but Windows rejected authentication with the following message:
Figure 1 - Windows Sign-In Failed
Caption:
Remote Help successfully launches the unattended session, but Windows rejects the supplied credentials. In many cases this does not indicate an incorrect password. The root cause may instead be the username format required by the organization's identity configuration.
Root Cause
Microsoft documentation states that administrators can authenticate using:
- Local Windows account
- Domain account
- UPN
- Microsoft Entra ID account
Examples:
During testing, authentication using:
failed repeatedly despite entering the correct password.
However, using:
worked immediately.
Important Note About Authentication
The required username format depends on how the target device is configured.
Possible working formats include:
If authentication fails despite a known-good password, test multiple formats before troubleshooting anything else.
Troubleshooting Checklist
Verify Device Ownership
Navigate to:
Confirm:
Verify Remote Desktop
Run:
Expected:
Verify AVD Components
Run:
Expected:
Verify Remote Help Configuration
Confirm the following permission is enabled inside the custom role:
Verify Scope Group Assignment
Confirm:
- Your administrator account is in the admin group
- The device is in the scope group
- The role assignment is active
Lessons Learned
During testing, the most common issues were:
- Incorrect RBAC scope assignments
- Missing AVD components
- Remote Desktop not enabled
- Using the wrong sign-in format
The final working configuration included:
✅ Remote Help enabled
✅ Custom Remote Help role created
✅ Windows unattended control remote sign-in permission assigned
✅ Azure Virtual Desktop Agent installed
✅ Azure Virtual Desktop Agent Boot Loader installed
✅ Remote Desktop enabled
✅ Corporate-owned Intune-managed device
✅ Correct authentication format (DOMAIN\UserName in this environment)
Final Thoughts
Remote Help Unattended Support with Remote Sign-In is one of the most significant Remote Help enhancements Microsoft has released in recent years.
For organizations managing:
- Library computers
- Kiosk devices
- Shared workstations
- Reception PCs
- Classroom computers
- Branch office devices
this feature eliminates the need for a user to be present before support can begin.
After completing the configuration and overcoming authentication challenges, the solution provided a seamless unattended remote support experience directly from the Intune Admin Center.
Kommentarer
Skicka en kommentar