iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
To restrict Intune Remote Help with Conditional Access, complete two separate configurations: first enable Remote Help in Intune, then provision Microsoft’s Remote Assistance Service enterprise application so Conditional Access can target it. Enabling the tenant feature alone does not create a selectable Conditional Access resource.
The sequence below covers prerequisites, licensing, Intune RBAC, service-principal creation, policy design, validation, and network troubleshooting. Microsoft’s portal labels and supported platforms can change, so verify the current Remote Help and Conditional Access pages before production rollout.
What Conditional Access controls in Remote Help
Remote Help uses Microsoft Entra ID sign-in for both the helper (the support person) and the sharer (the person whose device is being assisted). Microsoft describes this shared organizational sign-in as the trust foundation for a Remote Help session. Conditional Access evaluates that sign-in against the RemoteAssistanceService enterprise application.
Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minutePC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11There are therefore two related but distinct objects:
#1 Best Overall
- Read Before You Buy — No Video Output: These adapters support charging and USB 2.0 data transfer, but cannot transmit video signals. Except for standard USB webcams (which use USB data only), they are not compatible with HDMI/DisplayPort cables, video-capable USB-C hubs, or docking stations with video output.
- Convert USB-A Ports to USB-C: Designed to connect USB-C earphones, cables, flash drives, card readers, and other USB-C accessories to standard USB-A ports. Plug-and-play with no drivers or software required.
- Aluminum Alloy Housing: Built with a sturdy aluminum alloy shell that aids in heat dissipation and protects against daily wear and scratches. Designed to maintain a stable and secure connection.
- Compact & Travel-Friendly: The ultra-compact design allows the adapter to stay plugged into your device without blocking adjacent ports or adding bulk, reducing wear and tear on your original USB ports.
- 12-Month Warranty: Backed by a 12-month manufacturer warranty for peace of mind. Designed to meet strict quality control standards for reliable everyday performance.
- Remote Help in Intune: the tenant feature that allows the service to be used and lets you configure enrollment and permissions.
- Remote Assistance Service: the enterprise application/service principal that must exist in your tenant before a Conditional Access policy can target Remote Help.
A policy can require a control such as multifactor authentication (MFA) or a compliant device for helper accounts, but Microsoft does not prescribe one universal grant control. Select a control that matches your risk, support workflow, and device-management maturity.
Prerequisites and support boundaries
Licensing
Remote Help generally requires a Remote Help license for both helpers and sharers. The feature is an additional subscription capability; Microsoft Intune Plan 1 or Plan 2 by itself is not sufficient. New licenses and trials can take approximately 30 minutes to 8 hours to activate. That is Microsoft’s troubleshooting estimate, not a guaranteed activation window.
Identity, tenant, and device requirements
- Helpers and sharers sign in with accounts from the same Microsoft Entra tenant.
- The devices and participants must belong to that same tenant; cross-tenant Remote Help sessions are not supported.
- Intune-enrolled devices must be registered with Microsoft Entra.
- Microsoft’s planning guidance limits Conditional Access support for Remote Help to Windows and macOS. Confirm the current platform and version table before applying a policy to production.
Remote Help has other workflows, including unattended control scenarios, but the Conditional Access support boundary still matters when you decide which devices and sign-in conditions to include.
Do these 3 things before closing this tab:
1Scan for outdated or missing drivers - takes under a minute2Clear out junk files and repair common Windows errors3Fix the driver behind crashes, sound loss and screen glitchesAdministrative access
You need permission to configure Remote Help in the Intune admin center, create or edit Conditional Access policies in the Microsoft Entra admin center, and grant administrator consent for Microsoft Graph application permissions. Use a controlled administrator account for the service-principal step and record who approved the change.
Phase 1: Enable Remote Help in Intune
- Sign in to the Intune admin center.
- Open Tenant administration > Remote Help.
- Set Enable Remote Help to Enabled.
- Configure support for unenrolled devices only if your operating model requires it.
- Select Save.
Tenant enablement is disabled by default. If the setting is enabled but users cannot launch Remote Help immediately after a new license assignment, allow the documented 30-minute-to-8-hour activation period before treating the delay as a configuration failure.
Rank #2
- 5-in-1 USB-C Hub: Experience comprehensive connectivity featuring a Power Delivery input, two USB-A 2.0 ports, a USB-A 3.0 port, and an HDMI port. (Note: The USB-C power delivery input port is only for connecting an external wall charger to power your laptop and cannot power peripheral devices.)
- 90W Pass-Through Charging: Achieve optimal charging with 90W pass-through power to your laptop, supported by a total input of 100W, with the hub reserving 10W for operational efficiency. (Note: Wall charger not included.)
- Quick Data Transfers: Accelerate your productivity with rapid data transfers using a high-speed 5Gbps USB 3.0 port and two 480Mbps USB 2.0 ports.
- 4K HDMI Display: Enhance your visual experience with a hub capable of delivering 4K resolution at 30Hz in both mirror and extend modes. Please note that this hub is compatible with MacBook (macOS 12 and newer), Windows 10 and 11, ChromeOS, and laptops equipped with DP Alt Mode and Power Delivery. Note: This device is not compatible with Linux.
- What You Get: Anker USB-C Hub (5-in-1, 4K HDMI), welcome guide, 18-month warranty, and our friendly customer service.
Phase 1A: Configure Intune RBAC before granting support access
Conditional Access does not replace Intune role-based access control (RBAC). A user can satisfy an MFA or compliant-device requirement and still be unable to offer assistance if the required Intune permissions are missing.
A helper needs all of the following permission areas:
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
- Remote Tasks – Offer remote assistance
- Remote Assistance Connector – Read
- At least one permission from the Remote Help permission set
Assign these permissions through built-in or custom Intune roles and scope them to the users or device groups that each support tier is responsible for. A first-line help desk may need only attended assistance, while an endpoint engineering team may need additional actions.
Important built-in-role limitation
The built-in Help Desk Operator role does not include Windows unattended-control remote sign-in. If unattended Windows control is required, create a custom role containing that capability and assign it narrowly. Do not broaden every help-desk account simply to avoid designing a separate role.
Unenrolled-device trade-off
Supporting unenrolled devices can be useful for break-fix scenarios, but those devices may lack compliance information and provide less audit context. Enable the option only when there is a defined business need, and scope the corresponding roles to the smallest practical group.
Rank #3
- Sleek 7-in-1 USB-C Hub: Features an HDMI port, two USB-A 3.0 ports, and a USB-C data port, each providing 5Gbps transfer speeds. It also includes a USB-C PD input port for charging up to 100W and dual SD and TF card slots, all in a compact design.
- Flawless 4K@60Hz Video with HDMI: Delivers exceptional clarity and smoothness with its 4K@60Hz HDMI port, making it ideal for high-definition presentations and entertainment. (Note: Only the HDMI port supports video projection; the USB-C port is for data transfer only.)
- Double Up on Efficiency: The two USB-A 3.0 ports and a USB-C port support a fast 5Gbps data rate, significantly boosting your transfer speeds and improving productivity.
- Fast and Reliable 85W Charging: Offers high-capacity, speedy charging for laptops up to 85W, so you spend less time tethered to an outlet and more time being productive.
- What You Get: Anker USB-C Hub (7-in-1), welcome guide, 18-month warranty, and our friendly customer service.
Phase 2: Provision the Remote Assistance Service application
The Conditional Access resource is represented by a service principal in your tenant. Microsoft’s documented app ID is 1dee7b72-b80d-4e56-933d-8b6b04f9a3e2. Verify the current Microsoft Learn deployment page and the identifier shown in your tenant before automating this step, because application identifiers and portal behavior can change.
Run the Microsoft Graph PowerShell commands
- On an administrator workstation, install the Microsoft Graph PowerShell module using your organization’s approved PowerShell installation process.
- Connect to Microsoft Graph with application-write permission:
Connect-MgGraph -Scopes 'Application.ReadWrite.All'. - Sign in with an administrator account and grant the requested consent when prompted.
- Create the service principal:
New-MgServicePrincipal -AppId '1dee7b72-b80d-4e56-933d-8b6b04f9a3e2'. - After the command succeeds, open the tenant’s enterprise applications list and confirm that the application appears as Remote Assistance Service (also shown as RemoteAssistanceService).
Application.ReadWrite.All is a powerful directory permission. Use a change-controlled session, avoid embedding credentials in scripts, and remove standing privileges or administrative access that was granted only for provisioning.
If the service principal already exists
Do not create duplicate objects. Search the enterprise applications list for Remote Assistance Service and verify its app ID. If the object exists, use it as the Conditional Access target and continue with policy design.
Phase 3: Create a Conditional Access policy for Remote Help
In the Microsoft Entra admin center, open Protection > Conditional Access > Policies and create a policy for a pilot group first. Portal wording can differ by tenant experience, so use the current labels displayed in your environment.
1. Select users and workload scope
Start with a dedicated helper pilot group. Include only the support accounts that should be governed. Exclude emergency access (break-glass) accounts according to your organization’s standard Conditional Access design, and monitor those exclusions separately.
Free tools Windows power users keep installed
One-click scans. No signup required.
Rank #4
- Dual Converters, Infinite Potential：Includes 2× USB C male to USB A female adapters and 2× USB A male to USB C female adapters. Perfect for a wide range of uses—tablets with Bluetooth keyboards, expand USB ports on macbook, and more. Two different converters for all your daily needs
- Next-Level 10Gbps & 3A Charging: No more slow 480Mbps, this usb to usb c adapter has a transfer speed of up to 10Gbps, allowing you to do more transferring in less time. This usb adapter fits both USB A and USB C charger, supporting up to 3A fast charging
- Upgraded Exquisite Craftsmanship: With an aluminum alloy housing and metal connector, the usbc to usb adapter is extremely durable and sturdy. Rigorously tested to withstand more than 10,000 times of plugging and unplugging, ensuring long-lasting performance
- Broad Compatible: The usb c to usb adapter widely supports all USB C/ USB A devices like laptops, tablets, cellphones, car chargers, and phone chargers. Such as compatible with MacBook Pro/Air 2023/2022, Thunderbolt 4/3 Devices,Apple MagSafe Watch 9/8/7/SE/Ultra, iPad Pro 2022/2021, Samsung Galaxy S23/S20/S10, and iPhone 17/16/15 Pro. Plug and play
- Please Note: To reach 10Gbps speed, keep the cable under 3.3 ft. For USB A Male to USB C adapters, try flipping the USB C connector. USB C Male to USB A adapters support bidirectional 10Gbps transfer within 3.3 ft
2. Select the Remote Help resource
Under Target resources, open Resources and locate RemoteAssistanceService. Confirm the displayed app ID is 1dee7b72-b80d-4e56-933d-8b6b04f9a3e2.
Microsoft’s procedure describes selecting Exclude before selecting the resource. Because inclusion and exclusion have opposite security effects, do not assume that instruction matches your intended outcome or current portal layout. Read the policy summary after configuring the resource and verify whether the resulting policy includes or excludes RemoteAssistanceService. Test with a pilot account before enabling it broadly.
3. Choose conditions deliberately
Use conditions only when they answer a defined risk. For example, you might apply the policy to Windows and macOS sign-ins, or limit it to selected locations or client app types. Avoid adding conditions that unintentionally block legitimate support sessions without a tested recovery path.
4. Select a grant control
| Grant approach | What it does | Operational effect |
|---|---|---|
| MFA required | Requires the helper to complete multifactor authentication before access. | Strong identity assurance, with an interactive challenge that can delay urgent support if enrollment or authentication methods are unavailable. |
| Compliant device required | Allows access only from a device reported compliant by Intune. | Links support access to endpoint posture; unavailable or stale compliance data can prevent assistance. |
| MFA and compliant device | Requires both controls. | Highest assurance of these examples, but also the greatest chance of blocking support during an outage or enrollment problem. |
Microsoft recommends considering MFA or compliant-device status for helpers. The appropriate choice depends on your threat model; there is no single Microsoft-mandated grant control for every tenant.
5. Start in report-only mode
Use report-only mode when available, review sign-in logs and Conditional Access evaluation details, and test an attended session with a pilot helper and sharer. Confirm that the expected resource is evaluated, the grant control is satisfied, and unrelated applications are not affected. Move to On only after the observed result matches the policy summary.
Best Value
- 5-in-1 Connectivity: Equipped with a 4K HDMI port, a 5 Gbps USB-C data port, two 5 Gbps USB-A ports, and a USB C 100W PD-IN port. Note: The USB C 100W PD-IN port supports only charging and does not support data transfer devices such as headphones or speakers.
- Powerful Pass-Through Charging: Supports up to 85W pass-through charging so you can power up your laptop while you use the hub. Note: Pass-through charging requires a charger (not included). Note: To achieve full power for iPad, we recommend using a 45W wall charger.
- Transfer Files in Seconds: Move files to and from your laptop at speeds of up to 5 Gbps via the USB-C and USB-A data ports. Note: The USB C 5Gbps Data port does not support video output.
- HD Display: Connect to the HDMI port to stream or mirror content to an external monitor in resolutions of up to 4K@30Hz. Note: The USB-C ports do not support video output.
- What You Get: Anker 332 USB-C Hub (5-in-1), welcome guide, our worry-free 18-month warranty, and friendly customer service.
Attended and unattended sessions: different user-impact profiles
Attended assistance
Attended support requires the user to participate and provide consent. This is the clearest workflow for service-desk incidents because the sharer knows when the helper is connected and can end the session.
Unattended control
Unattended Windows or Android control gives the helper reduced user visibility compared with an attended session. Microsoft states that users are notified when an unattended session is active, and that Remote Help stores no session recordings. Treat unattended access as a higher-risk permission: use a custom RBAC role, narrow its scope, require strong helper authentication, and log the business justification.
Network and endpoint requirements
Remote Help uses TCP 443, but opening that port alone is not a complete firewall rule. Microsoft publishes a current list of Remote Help service destinations, web-pubsub dependencies, and additional Azure Communication Services requirements. Use the endpoint list for your cloud and region rather than copying an old static allowlist.
- Permit the complete Microsoft-documented destination set over TCP 443.
- Check proxy authentication and SSL inspection policies; interception or certificate substitution can disrupt Remote Help connections.
- Ensure endpoints can resolve the required Microsoft hostnames and reach the services from both helper and sharer networks.
- Recheck the endpoint guidance after Microsoft service or region changes.
A network path that allows ordinary Microsoft 365 sign-in can still fail Remote Help if web-pubsub or Azure Communication Services dependencies are blocked.
Validation checklist before production
- Confirm the Remote Help subscription is assigned to both the helper and sharer, and allow the activation window for new assignments.
- Verify Remote Help is enabled under Tenant administration > Remote Help.
- Confirm the pilot helper has the required Intune RBAC permissions and the correct user/device scope.
- Verify the Remote Assistance Service enterprise application exists and has the documented app ID.
- Review the Conditional Access policy summary to ensure the intended include/exclude behavior.
- Test an attended Windows or macOS session with a same-tenant sharer.
- Test the selected grant control: complete MFA, prove compliant-device status, or both, as applicable.
- Review Entra sign-in logs and Conditional Access details for the pilot account.
- Test from each network type used by support staff, including VPN and proxy paths.
- Document an emergency support procedure that does not depend on disabling broad security controls.
Troubleshooting by symptom
Remote Help is missing or unavailable
- Check that the tenant feature is enabled.
- Verify both participants have the required licenses and that the 30-minute-to-8-hour activation period has elapsed for new or trial licenses.
- Confirm the device platform and version are supported.
- Check that both identities and devices belong to the same tenant.
The helper can sign in but cannot offer assistance
- Review Intune RBAC assignments for Remote Tasks – Offer remote assistance, Remote Assistance Connector – Read, and a Remote Help permission.
- Check role scope: the helper may have permission, but not for the affected user or device group.
- For unattended Windows control, verify that a custom role includes the required remote sign-in capability.
The Conditional Access policy never appears to evaluate
- Confirm the Remote Assistance Service service principal was created.
- Verify the policy targets RemoteAssistanceService, not a similarly named Microsoft application.
- Check the app ID in the enterprise application and policy resource picker.
- Inspect include and exclude assignments; an exclusion can intentionally prevent evaluation for the account or resource you are testing.
- Review sign-in logs after a fresh test rather than relying on an old session token.
The session fails to connect or drops
- Test TCP 443 reachability to every current Remote Help, web-pubsub, and Azure Communication Services destination required for your cloud and region.
- Temporarily test a path without SSL inspection, subject to your security change process.
- Check proxy authentication, DNS resolution, firewall logs, and endpoint security controls on both devices.
- Confirm that the failure is not caused by an unsupported platform or cross-tenant attempt.
Operational decisions to document
| Decision | Questions to answer |
|---|---|
| Who can help? | Which support tiers receive Remote Help RBAC permissions, and which user or device groups are in scope? |
| Which sessions are allowed? | Is support attended only, or is unattended Windows/Android control justified? |
| Which sign-in control applies? | Will helpers use MFA, compliant-device status, or both? What is the outage fallback? |
| Which devices are eligible? | Are unenrolled devices required, and what audit or compliance visibility is accepted if they are enabled? |
| How is the policy changed? | Who reviews report-only results, approves production activation, and monitors sign-in failures? |
Keep the Conditional Access policy, Intune RBAC assignments, service-principal creation, and network allowlist under separate change records. This makes it possible to identify whether a failure comes from identity policy, Intune authorization, licensing, or connectivity.
Quick Recap
Key points to retain
- Enabling Remote Help in Intune does not provision the Conditional Access target.
- Create or verify the Remote Assistance Service service principal with app ID
1dee7b72-b80d-4e56-933d-8b6b04f9a3e2. - Conditional Access support for Remote Help is limited to Windows and macOS in Microsoft’s planning guidance.
- Remote Help licensing, Intune RBAC, Conditional Access, and network access are separate prerequisites.
- Use Microsoft’s complete, current endpoint list over TCP 443; a port-only firewall rule is insufficient.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
