Quick wins for a faster PC:
Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Clear out junk files and repair common Windows errorsFree Scan →Deploy the Azure Virtual Desktop (AVD) agent and its bootloader as two separate Intune Win32 apps, then make the bootloader depend on the agent. For AVD, plan to use Remote Help’s attended security-code workflow: Microsoft documents attended support for AVD desktop and RemoteApp sessions, while its planning page explicitly excludes virtual devices from unattended control. The deployment guide contains an unattended Windows procedure, so treat that contradiction as a support boundary to verify rather than an invitation to promise unattended AVD access.
What this deployment actually enables
The AVD agent and bootloader register the session host components that Remote Help expects. Intune delivers them, controls assignment, and reports installation state. The resulting support model depends on the AVD session type:
As an Amazon Associate I earn from qualifying purchases.
| Session | What the helper can do | How to connect |
|---|---|---|
| Attended AVD desktop | View and control the user’s entire remote desktop. | Open Remote Help in the active AVD session and use a security code. An admin-center request for an AVD desktop can be broadcast to every active user on that host. |
| Attended AVD RemoteApp | View and interact only with the published application, not the complete desktop. | Open Remote Help inside the active RemoteApp session and use its security code. RemoteApp sessions cannot be directly targeted from the Intune admin center. |
| Unattended AVD control | Not an approved AVD option according to Microsoft’s planning guidance. | Do not design a rollout around unattended AVD access until Microsoft clarifies the conflicting documentation. |
Microsoft describes the attended workflow in Using Remote Help on Windows to Assist Authenticated Users. It also says it does not recommend remotely starting a session for users on Azure virtual desktops.
Check prerequisites before creating apps
Confirm AVD enrollment and tenant alignment
The reviewed Intune guidance covers single-session AVD virtual machines. Enroll the VM in the intended Intune tenant and confirm that the Azure subscription is associated with the same Microsoft Entra tenant used by Intune. Microsoft lists Windows Enterprise and supported Entra join and enrollment methods for this scenario; validate the exact method against Using Azure Virtual Desktop single-session with Microsoft Intune.
#1 Best Overall
- 256 GB SSD of storage.
- Multitasking is easy with 16GB of RAM
- Equipped with a blazing fast Core i5 2.00 GHz processor.
Multi-session hosts, sovereign clouds, and specialized government environments need separate confirmation. Do not assume that a single-session procedure applies unchanged to them. The Remote Help planning page states that AVD is unsupported in GCC and GCC High, and that Remote Help is not supported in DoD environments.
Prepare identities, licensing, and permissions
- Remote Help requires an additional subscription to Intune Plan 1 or Plan 2 for both helpers and sharers. The documentation reviewed here does not establish prices; check the current Microsoft terms for your region and agreement.
- Configure Remote Help tenant settings before assigning devices. Grant helpers the required Remote Help role-based access-control permissions, and confirm the current scoped-role requirements if you are evaluating any unattended-related permissions.
- Decide which device groups will receive the agent and bootloader. Start with a small test group containing representative AVD hosts and helper accounts.
Allow the required network traffic
Remote Help uses TCP port 443 and TLS 1.2. An AVD session host needs the Remote Help service endpoints in addition to the endpoints required by AVD itself. Maintain both allowlists from Microsoft’s Plan for Remote Help with Microsoft Intune and Required FQDNs and endpoints for Azure Virtual Desktop. A successful AVD connection does not prove that Remote Help traffic is permitted.
Rank #2
- 【Efficient Intel N150 Performance for Everyday Tasks】Powered by the Intel N150 processor with 4 cores and speeds up to 3.6GHz, this laptop delivers smooth performance for web browsing, office applications, online classes, and daily productivity with reliable efficiency.
- 【Fast DDR5 Memory and PCIe SSD Storage】Equipped with up to 32GB high-speed DDR5 RAM for responsive multitasking and a PCIe NVMe M.2 SSD (configurable up to 2TB) for fast boot times, quick file access, and improved overall system responsiveness.
- 【15.6" Full HD Anti-Glare Display】Enjoy clear visuals on a 15.6-inch Full HD (1920×1080) anti-glare display with 250 nits brightness and 45% NTSC color, designed for comfortable viewing during extended work, study, or streaming sessions.
- 【Modern Connectivity with USB-C and Wi-Fi 6】Stay connected with Wi-Fi 6 and Bluetooth 5.2, plus versatile ports including USB-C with Power Delivery and DisplayPort, USB-A 3.2, HDMI, and RJ-45 Gigabit Ethernet for flexible work and productivity setups.
- 【Business-Ready Design with Online Microsoft 365 Access】Designed for productivity, this laptop features a full-size keyboard with numeric keypad, firmware TPM 2.0 security, and an HD webcam with privacy shutter. Use Microsoft 365 online—no subscription needed—just sign in at Office.com to access Word, Excel, and PowerPoint in your browser.
Package the AVD agent and bootloader as Win32 apps
Use the installers and packaging approach in Microsoft’s Deploy Remote Help with Microsoft Intune. The critical design choice is to create two independent application objects and express their order with an Intune dependency.
- Download both MSI files. From the deployment guide, download the AVD agent MSI and the AVD agent bootloader MSI. During installation, the registration-token field is prefilled with
INVALID_TOKEN. Leave that value unchanged when completing the installation; do not substitute a token from another service. - Convert each MSI separately. Run Microsoft’s Win32 Content Prep Tool once for the agent source and once for the bootloader source. Produce one
.intunewinpackage per MSI. Keeping the packages separate lets Intune enforce installation order and report each component independently. - Create the agent app first. In the Intune admin center, add a Windows app and select the Win32 app type. Upload the agent
.intunewinfile. Follow the MSI metadata flow used in Microsoft’s example: choose the x64 agent installer, retain Microsoft as publisher, and accept the automatically populated install and uninstall commands unless your controlled packaging process requires an equivalent command. - Set detection and requirements. Use the MSI product-code detection rule generated from the installer. Set the minimum operating-system requirement to a version compatible with your AVD image and test ring. Do not select a lower version merely to make the app broadly assignable; an incompatible session host will produce a misleading deployment failure.
- Assign the agent. Target the pilot device group first. Review the assignment and wait for an installed state on a test host before deploying the second component broadly.
- Create the bootloader app. Add the bootloader MSI as another Win32 app, again using MSI metadata and an MSI detection rule. In its Dependencies section, add the AVD agent app and enable automatic installation of the dependency. Assign the bootloader to the same device groups. Intune will install the agent before it attempts the bootloader.
Do not combine both MSIs into one package or rely on assignment timing. A dependency is the documented mechanism that makes the required order explicit and gives you separate status for each component.
Rank #3
- [High Speed RAM And Enormous Space] 4GB high-bandwidth RAM to smoothly run multiple applications and browser tabs all at once; 128GB PCIe NVMe M.2 Solid State Drive allows to fast bootup and data transfer
- [Processor] Intel Core i5-13420H Processor (8 Cores, 12 Threads, 12MB Intel Smart Cache, Base at 1.5 GHz, Up to 4.6 GHz Max Turbo Frequency), with Intel UHD Graphics
- [Display] 15.6" FHD (1920 x 1080) Display
- [Tech Specs] 1 x USB 3.0 Type-A, 1 x USB 2.0 Type-A, 1 x USB Type-C, 1 x HDMI, 1 x RJ45, 1 x headphone/microphone combo, Webcam, Numeric Keypad, Wi-Fi and Bluetooth
- [Operating System] Windows 11 Pro - Organize open apps with pre-configured layouts to optimize productivity, Navigate with more intuitive experience to get things done, Collaborate with teams with more features
Remote Desktop configuration: use the documented step carefully
Microsoft’s deployment guide includes a Windows settings catalog profile that enables Remote Desktop and requires firewall rules permitting RDP traffic. To reproduce that documented procedure, create an Intune configuration profile with the Windows settings catalog, configure the Remote Desktop settings, and assign it to the same test devices. Verify the profile’s status and the device’s Remote Desktop state as described in the guide.
This profile is not evidence that unattended Remote Help works on AVD. It is a documented Windows configuration step appearing in an unattended deployment section that conflicts with the separate support statement for virtual devices. Apply it only when your security design calls for the underlying Windows Remote Desktop configuration, and keep the actual AVD support workflow attended.
Rank #4
- RELIABLE PERFORMANCE FOR EVERYDAY WORK: The Intel N150 processor works with 8GB LPDDR5 memory and 128GB UFS 2.2 storage to support web browsing, email, document editing, online classes, video streaming, and routine multitasking. Integrated Intel Graphics provides dependable visuals for business, education, and everyday home use.
- CLEAR 15.6-INCH FULL HD DISPLAY: The 1920x1080 anti-glare display offers a spacious view for documents, presentations, research, online learning, and entertainment. Its 250-nit brightness, 88% active-area ratio, and TÜV Rheinland Low Blue Light software solution support comfortable viewing during extended work or study sessions.
- LIGHTWEIGHT AND DURABLE DESIGN: Starting at only 3.42 lbs and measuring 0.70 inches thin, this Arctic Grey Lenovo laptop travels easily between home, school, and the office. MIL-STD-810H testing adds everyday durability, while the full-size keyboard includes a dedicated Copilot key for convenient access to AI assistance.
- MODERN CONNECTIVITY AND PRIVACY: Wi-Fi 6 and Bluetooth 5.2 provide reliable connections for networks and accessories. Two USB-A ports, USB-C with Power Delivery and DisplayPort, HDMI 1.4, an SD card reader, and a 3.5mm audio jack support displays and peripherals, while the 720p camera includes a physical privacy shutter.
- READY FOR BUSINESS AND EDUCATION: Windows 11 Home and Microsoft 365 Personal provide familiar tools for documents, communication, coursework, and daily productivity. A 47Wh battery supports mobile workflows, while the included 65W power adapter enables efficient charging. Dolby Audio stereo speakers and dual-array microphones enhance online meetings and classes.
Start the supported attended AVD session
AVD desktop session
- Have the user sign in to the AVD desktop and open Remote Help in that active session.
- Have the helper open Remote Help and enter the security code shown by the user, following the authenticated-user flow.
- Confirm the user and host before accepting control. An Intune admin-center request can notify all active users on the host, so it is not a precise substitute for the security-code process.
- Once connected, the helper can view and control the full remote desktop within the permissions granted by the Remote Help session.
AVD RemoteApp session
- Launch the published RemoteApp and open Remote Help from inside that active session.
- Share the displayed security code with the helper through your approved support channel.
- Enter the code in the helper’s Remote Help client and authenticate both participants.
- Expect scope to remain limited to the published application. The helper cannot use this workflow to control the user’s complete AVD desktop, and the session cannot be selected directly from the Intune admin center.
Why unattended AVD control should not be promised
Microsoft’s planning page states: “Virtual devices, including Windows 365 and Azure Virtual Desktop, as well as unenrolled and personally owned (BYOD) devices, aren’t supported for unattended control.” The same page describes unattended control as requiring an enrolled, corporate-owned, physical x64 Windows device.
At the same time, the deployment guide lists the AVD agent and bootloader in an unattended-support procedure and explains how to package them. Those instructions do not override the explicit planning-page exclusion. Until Microsoft publishes a clarification, document AVD as attended-only for Remote Help, use the security-code workflow, and avoid granting or advertising unattended access as a supported capability.
Quick Recap
Verify installation and session readiness
- In Intune, open each Win32 app and review the device-installation status. Confirm that the agent reports installed before the bootloader reports installed.
- Inspect the dependency state on the bootloader app. A failed or pending agent should leave the bootloader waiting rather than installing out of order.
- Review the settings-catalog profile status if you assigned the Remote Desktop configuration. Resolve per-device errors before expanding the assignment.
- On the session host, verify that Windows Remote Desktop reflects the intended configuration and that local firewall policy permits the required traffic.
- Test one attended AVD desktop session and one attended RemoteApp session. Record which user opened Remote Help, which security code was used, and whether the helper’s access scope matched the session type.
- Check outbound connectivity to both AVD and Remote Help endpoints over TCP 443 with TLS 1.2. Endpoint lists change, so use Microsoft’s maintained pages rather than a copied historical list.
Troubleshoot common deployment failures
| Symptom | Likely cause | Action |
|---|---|---|
| Bootloader is pending while the agent is failed or absent. | The dependency cannot complete. | Open the agent’s installation details, correct its MSI, requirement, or detection error, and let Intune retry before changing the bootloader assignment. |
| Both apps show installed but Remote Help cannot connect. | Missing Remote Help endpoints, blocked TCP 443, TLS inspection issues, or an unsupported cloud. | Compare the host’s egress policy with the current Remote Help and AVD endpoint lists, then retest from the actual session host. |
| The app is not applicable to a host. | The OS requirement does not match the AVD image or the wrong architecture was selected. | Check the host edition and architecture, then align the Win32 requirement with the supported x64 agent and your approved image baseline. |
| A helper cannot control an AVD RemoteApp desktop. | RemoteApp scope is limited by design. | Use an AVD desktop session when full-desktop control is required; do not treat the RemoteApp limitation as an installation fault. |
| An admin-center request reaches unintended users. | Requests for an AVD desktop are broadcast to all active users on the host. | Use the security-code workflow in the correct active session instead of initiating a broad admin-center request. |
| Unattended permissions appear configured but AVD remains unsupported. | The planning documentation excludes virtual devices. | Keep AVD in the attended workflow and seek current Microsoft clarification before changing the support model. |
Roll out in controlled stages
- Begin with a pilot device group containing a single-session AVD host, a representative network path, and named helper accounts.
- Validate agent-before-bootloader ordering, detection, profile status, endpoint access, and both attended session types.
- Expand assignments by host group only after the pilot has clean status and a documented rollback plan.
- For multi-session hosts, GCC, GCC High, or DoD environments, pause and verify current support documentation instead of extrapolating from the single-session procedure.
- Recheck Microsoft’s live planning, deployment, licensing, and endpoint pages whenever you change AVD images or Remote Help policies; support boundaries and service endpoints can change.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
