If your service desk handles a large fleet of Windows 11 devices, you know the friction of standard remote support. An endpoint needs a quick registry fix or app re-install, but the user is away from their desk, stuck in a meeting, or unable to approve the elevation prompt. Standard Intune Remote Help typically requires an interactive session where the user actively accepts the prompt and shares their screen.
With Microsoft Intune’s Unattended Remote Help capabilities, helpdesk admins can connect directly to remote Windows 11 endpoints without requiring an end-user to be signed in or physically present at the device. When configured with proper Entra role-based access control (RBAC), this drastically cuts down desk-side visits for off-hours maintenance.
Here is how to set up Unattended Remote Help in Intune, lock down helper permissions, and handle the key elevation gotchas during session launch.
Prerequisites for Unattended Remote Help
Before turning on unattended access in your tenant, make sure your endpoints and helper accounts meet these baselines:
- Licensing: Devices requires an active Intune Remote Help add-on license (or Microsoft Intune Suite entitlement) assigned to the technician or device scope.
- OS Requirements: Target endpoints must run Windows 11 (22H2 or later) or Windows 10 (with latest quality updates).
- App Deployment: The latest version of the Remote Help app must be deployed as a Win32 app to all target client devices.
- Network Connectivity: Endpoints must be able to reach
*.remotehelp.microsoft.comover port 443 without SSL inspection blocking the traffic stream.
Step 1: Enable Unattended Access in Tenant Administration
Unattended access is toggled off by default across the tenant level to prevent unauthorized connections.
- Open the Microsoft Intune Admin Center.
- Go to Tenant administration → Remote Help.
- Under the Settings tab, locate Enable Remote Help and set it to Enabled.
- Set Enable unattended help to Enabled.
- Save your changes.
Step 2: Configure Intune RBAC Permissions for Technicians
You should never grant full remote control privileges to every tier 1 helpdesk account. Intune uses fine-grained Remote Help permissions under RBAC roles to split unattended access from standard screen sharing.
Create a custom Intune role or update an existing Help Desk Operator role with the following permissions under Remote Help app:
- View screen: Allows the helper to view the remote display.
- Take full control: Allows remote mouse and keyboard input.
- Elevation: Allows the helper to enter local admin credentials on UAC prompts during the session.
- Unattended control: (Critical) Grants the ability to initiate a session without waiting for an end-user to approve the connection prompt on the target device.
Step 3: Launching an Unattended Session on a Remote Windows 11 PC
Once policies and permissions propagate, launching a session takes just a few clicks inside the device record:
- In Intune, navigate to Devices → Windows → All Devices and select the target Windows 11 machine.
- In the top action bar, click the three dots (…) and choose New Remote Help session.
- Select Unattended access as the connection type.
- Click Connect to fire up the native Remote Help app on your management workstation.
- Once connected, the device display will show a notification banner letting local viewers know an authorized admin session is active, while giving you full administrative control.
Real-World Admin Gotchas to Avoid
- Watch Out for UAC Secure Desktop Blackouts: If your Windows 11 baseline policies enforce “User Account Control: Switch to the secure desktop when prompting for elevation”, your Remote Help screen may go black when a UAC prompt appears. To fix this, ensure your Remote Help app client is installed as a System-context Win32 app rather than a user-context app so it can interact with the Secure Desktop.
- Compliance State Checks: If the target device fails its Intune Compliance Policy (for example, missing a required BitLocker status or endpoint security baseline), Intune can be configured to block unattended connections entirely until the device is back in compliance.
- Audit Logs & Accountability: Every unattended session creates a detailed entry under Tenant administration → Remote Help → Monitor tab. Use these logs to correlate remote access events with your internal ticket numbers for security audits.