Intune Remote Help has traditionally been useful when an employee is sitting in front of the affected computer. The support technician starts a session, the user accepts it, and the technician can then view or control the device.

That workflow is less useful for machines that nobody is actively using.

A shared workstation may be sitting at the Windows sign-in screen. A PC in a remote office may need maintenance after business hours. A corporate device can also require troubleshooting while no user is logged on.

Microsoft has addressed this scenario with Remote Help Windows Unattended Support with Remote Sign-In. An authorized administrator can start a remote session against a supported physical Windows device and authenticate with their own credentials without requiring an end user to approve the connection or already be signed in.

The feature is more restrictive than simply turning on unattended remote control. Microsoft limits it to specific device types and uses a dedicated Intune RBAC permission for the Windows remote sign-in workflow.

What Windows Unattended Remote Help Actually Does

There is an important difference between attended Remote Help and the new Windows unattended workflow.

In an attended session, Remote Help operates around the user’s existing session. The user participates in establishing the connection and can see that support is taking place.

With unattended remote sign-in, the target machine does not need an active user session. The helper authenticates to the Windows device with credentials they are authorized to use, creating a separate authenticated session rather than taking over an existing user’s desktop. Microsoft describes the session as being governed by user authentication, Intune RBAC, and auditing.

This makes the feature particularly useful for:

• Shared corporate workstations
• Devices located in remote offices
• After-hours maintenance
• Computers that are sitting at the Windows sign-in screen
• Operational or infrastructure endpoints where waiting for a user is impractical

The device still has to satisfy Microsoft’s requirements. Unattended Remote Help is not a general-purpose replacement for every remote-access product.

Device Requirements

The target device must be a physical, corporate-owned Windows device managed by Intune. Microsoft currently requires an x64-based Windows operating system, with the device joined to Microsoft Entra ID or Microsoft Entra hybrid joined. Virtual machines, Windows 365, Azure Virtual Desktop, personally owned devices, and unenrolled devices are not supported for Windows unattended control.

There are several other requirements that are easy to overlook.

The target computer must:

• Be powered on.
• Have an active Internet connection.
• Be able to reach the required Remote Help service endpoints.
• Have the Intune Management Extension installed.
• Have Remote Desktop enabled.
• Be enrolled in Intune and meet the ownership and join-state requirements.

The Intune Management Extension is used to orchestrate the unattended session. Remote Desktop also needs to be enabled on the target device.

That last point is particularly relevant during troubleshooting. If a device satisfies the Intune enrollment requirements but the necessary management components are missing, repeatedly reinstalling Remote Help is unlikely to solve the problem.

Start with the device state.

The RBAC Permission Is Deliberately Separate

Microsoft did not simply add Windows unattended access to every existing Remote Help role.

The required permission is:

Remote Help app → Windows unattended control remote sign-in

This permission allows a helper to start an unattended remote sign-in session against targeted physical corporate-owned Windows devices. Microsoft specifically recommends assigning it to the administrators who need the capability and scoping the assignment to the appropriate devices.

The distinction is important when designing the Intune role structure.

The standard Help Desk Operator role can provide normal Remote Help functionality, but the Windows unattended remote sign-in permission is not included in that built-in role. Microsoft requires a custom role assignment when unattended Windows access is needed.

A practical deployment therefore looks more like this:

Help desk users → custom Intune RBAC role → specific device scope

rather than:

All support users → unrestricted unattended access

That gives administrators a way to separate normal remote assistance from access to machines that can be entered without a user present.

How to Configure the Feature

The first step is enabling Remote Help in the Intune admin center.

Navigate to:

Intune admin center → Tenant administration → Remote Help

Under the Remote Help settings, enable Remote Help and save the configuration. Microsoft also provides an option controlling whether Remote Help can be used with unenrolled devices, but that setting is separate from Windows unattended support.

Next, create or modify an Intune custom role for the administrators who require unattended Windows access.

The role needs the appropriate Remote Help permissions, including:

Remote Help app → Windows unattended control remote sign-in

The role assignment should then be scoped to the device groups that are actually intended to receive unattended support.

For example, an organization could create a dedicated Entra ID group containing corporate support administrators and another device group containing approved shared workstations. The custom Intune role can then connect those two scopes.

This is preferable to giving the permission to a broad help-desk population.

Starting an Unattended Session

Once the tenant, device, and RBAC configuration are in place, the administrator can initiate a Remote Help session from the Intune admin center.

The exact options displayed depend on the helper’s permissions and the target device.

For a supported Windows device, the unattended workflow allows the helper to initiate remote sign-in without waiting for the person using the computer to accept a Remote Help request. The helper authenticates using their organizational credentials rather than relying on an already logged-on user.

The result is useful for machines that are sitting at the Windows logon screen.

It also changes how support teams should think about session security.

The absence of a user approval step means the RBAC assignment becomes one of the primary controls determining who can initiate this type of access.

What the User Sees

Unattended access does not simply expose the existing Windows desktop to the technician.

During an unattended control session, Microsoft blocks the target device’s screen for security and privacy reasons. The device can also notify an interactive user that a helper has connected. Microsoft documents additional behavior if someone interacts with the blocked screen while the unattended session is active.

That behavior is useful for shared environments because the technician is not silently taking control of an employee’s active desktop.

It also means administrators should test the workflow on representative devices before deploying it broadly. A support process that works perfectly on a dedicated workstation may behave differently on a shared device with active users, kiosk software, notification policies, or other endpoint restrictions.

Troubleshooting When Unattended Access Does Not Work

If the option is missing or the connection fails, start with the prerequisites rather than changing Windows configuration at random.

Check the device type first

Confirm that the computer is:

• Physical
• Corporate-owned
• Intune-managed
• x64
• Microsoft Entra joined or hybrid joined

A virtual machine or Windows 365 device will not become eligible for Windows unattended Remote Help simply because Remote Help is installed. Microsoft’s current documentation excludes virtual devices from this workflow.

Check the Intune Management Extension

The Intune Management Extension is required for unattended support.

If the device is enrolled but the extension is not present or functioning correctly, investigate the Intune management state before focusing on the Remote Help application itself.

Check Remote Desktop

Remote Desktop must be enabled on the target Windows device for the unattended workflow. This can be configured through Intune, including with a Settings Catalog policy.

Check RBAC scope

A helper can have the correct Intune role and still be unable to access a particular computer if the device is outside the role assignment’s scope.

This is one of the first things I would check when unattended Remote Help works against one group of devices but not another.

Verify both sides of the assignment:

Administrator scope → device scope

The permission alone is not enough.

Check network connectivity

Remote Help uses HTTPS over TCP 443 and communicates with Microsoft’s Remote Assistance service. The target and helper need access to the required Microsoft endpoints. Microsoft documents the Remote Help network requirements separately.

If the application launches but the session cannot be established, firewall and proxy configuration should therefore be part of the investigation.

Microsoft also lists incorrect Win32 application detection, blocked notifications, and related endpoint configuration as common Remote Help troubleshooting areas.

Keep Unattended Access Narrow

Unattended support is powerful precisely because it removes the user from the connection process.

That makes the RBAC design more important, not less.

I would avoid adding the Windows unattended permission to a general-purpose support role used by the entire help desk. A dedicated role with a tightly controlled device scope is easier to audit and easier to revoke if the operational requirement changes.

The same principle applies to the target device groups. Do not treat every Intune-managed Windows computer as an unattended-support endpoint unless there is a real reason to do so.

A technician who can perform attended Remote Help does not automatically need permission to initiate an unattended Windows sign-in.

That separation gives the organization a much cleaner access model.

Where Remote Help Fits

Windows unattended Remote Help is a useful addition to Intune for organizations already managing their endpoints through Microsoft Intune.

It is particularly attractive when the support workflow is closely tied to Intune device management and Entra ID authentication. There is no need to introduce another remote-management platform solely because a support technician occasionally needs to reach a powered-on workstation without a user present.

It does not, however, eliminate the need to evaluate other remote-management tools in environments with requirements outside Microsoft’s supported scenario.

The current Windows implementation is deliberately constrained: physical corporate-owned devices, Intune management, supported Windows architecture, required management components, and explicit RBAC authorization.

Those restrictions are useful guardrails.

Final Takeaway

The useful part of Microsoft’s new Remote Help capability is not simply that a technician can connect to a Windows PC without a user clicking Accept.

The bigger change is that Intune can now support an unattended Windows troubleshooting workflow while keeping the connection tied to the administrator’s identity and Intune’s RBAC model.

For deployment, start with the device requirements and build the RBAC assignment around a small, well-defined set of administrators and devices. If an unattended session fails, check enrollment, device ownership, Entra join state, Intune Management Extension, Remote Desktop, RBAC scope, and network access before changing the endpoint itself.

That approach keeps unattended support useful without turning it into unrestricted remote access.

Read more: An Incomprehensible M365 Case: “The Mailbox Has 50 GB of Free Space, But the User Gets a ‘Mailbox Full’ Error!”

FAQ

References

• Microsoft — Remote Help on Windows: Unattended Support with Remote Sign-In Is Here
  Microsoft Community Hub
• Microsoft — Plan for Remote Help with Microsoft Intune
  Microsoft Learn: Plan Remote Help
• Microsoft — Deploy Remote Help with Microsoft Intune
  Microsoft Learn: Deploy Remote Help
• Microsoft — Troubleshoot and monitor Remote Help for Microsoft Intune
  Microsoft Learn: Troubleshoot Remote Help