Free tools Windows power users keep installed
One-click scans. No signup required.
Short answer: Enabling Remote Help in Intune is only half of the setup. To apply Conditional Access, you must also provision Microsoft’s RemoteAssistanceService enterprise application, then target that resource in a policy. The documented application ID is 1dee7b72-b80d-4e56-933d-8b6b04f9a3e2. This guide walks through prerequisites, tenant enablement, Intune permissions, service-principal creation, policy design, validation, and network troubleshooting for Windows and macOS.
What Conditional Access controls in Remote Help
Remote Help is an Intune service that lets an approved helper view or control another user’s device. Both people authenticate with Microsoft Entra ID. Microsoft describes that shared organizational sign-in as the trust foundation for a session: it establishes that the helper and sharer belong to the same organization before assistance begins.
As an Amazon Associate I earn from qualifying purchases.
Conditional Access is the identity control layer around that service. It can require conditions such as multifactor authentication (MFA) or a compliant device before a helper is allowed to sign in. It does not replace Intune’s Remote Help setting, licensing, or role-based permissions. Those are separate gates.
Do these 3 things before closing this tab:
1Repair Windows errors before they cause bigger problems2Fix the driver behind crashes, sound loss and screen glitches3Clear out junk files and repair common Windows errorsThere are therefore two related operations:
- Enable Remote Help in Intune. This turns on the tenant feature and determines whether unenrolled devices may be supported.
- Provision and target the Remote Assistance Service enterprise application. This makes the Remote Help backend available as a resource that a Conditional Access policy can evaluate.
Microsoft’s Conditional Access support for Remote Help is limited to Windows and macOS. A policy aimed at the Remote Assistance Service should be tested against those supported platforms and should not be assumed to govern every platform on which an Intune-related app might run.
#1 Best Overall
- Read Before You Buy — No Video Output: These adapters support charging and USB 2.0 data transfer, but cannot transmit video signals. Except for standard USB webcams (which use USB data only), they are not compatible with HDMI/DisplayPort cables, video-capable USB-C hubs, or docking stations with video output.
- Convert USB-A Ports to USB-C: Designed to connect USB-C earphones, cables, flash drives, card readers, and other USB-C accessories to standard USB-A ports. Plug-and-play with no drivers or software required.
- Aluminum Alloy Housing: Built with a sturdy aluminum alloy shell that aids in heat dissipation and protects against daily wear and scratches. Designed to maintain a stable and secure connection.
- Compact & Travel-Friendly: The ultra-compact design allows the adapter to stay plugged into your device without blocking adjacent ports or adding bulk, reducing wear and tear on your original USB ports.
- 12-Month Warranty: Backed by a 12-month manufacturer warranty for peace of mind. Designed to meet strict quality control standards for reliable everyday performance.
Check prerequisites before changing access
Licensing and tenant eligibility
Remote Help generally requires a Remote Help license for both the helper and the sharer. The feature is an additional subscription capability on top of Microsoft Intune Plan 1 or Plan 2; having an Intune plan alone does not automatically grant Remote Help rights. Microsoft’s offers and platform matrix can change, so verify the current entitlement for your tenant, region, and user types before rollout.
After a new license or trial is assigned, Microsoft’s deployment guidance says activation can take from 30 minutes to 8 hours. That is a troubleshooting estimate, not a guaranteed service-level commitment. If the feature remains unavailable after that window, check assignment, sign-in account, and tenant configuration rather than repeatedly changing the policy.
Identity, device, and tenant boundaries
- Helpers and sharers sign in with Microsoft Entra accounts from the same tenant.
- Cross-tenant Remote Help sessions are not supported.
- For enrolled-device scenarios, devices must be registered with Microsoft Entra and enrolled in Intune.
- Use a Microsoft-supported Windows or macOS platform and version. Confirm the live Remote Help platform table before deployment because support can change.
Remote Help can be configured to support unenrolled devices, but that option changes the security and audit picture. An unenrolled endpoint may not provide compliance information or the same device inventory and audit detail as an Intune-enrolled endpoint. Enable that capability only for a documented use case and keep the helper scope as narrow as possible.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Plan the control you actually want
Write down the intended result before creating a policy. Common designs include requiring MFA for every helper, requiring a compliant helper device, or requiring both. Microsoft recommends considering MFA or compliant-device status for helper accounts because a helper can access another user’s device. The documentation does not prescribe one universal grant control; your choice should reflect your support tiers, risk tolerance, and existing identity policy.
Rank #2
- 5-in-1 USB-C Hub: Experience comprehensive connectivity featuring a Power Delivery input, two USB-A 2.0 ports, a USB-A 3.0 port, and an HDMI port. (Note: The USB-C power delivery input port is only for connecting an external wall charger to power your laptop and cannot power peripheral devices.)
- 90W Pass-Through Charging: Achieve optimal charging with 90W pass-through power to your laptop, supported by a total input of 100W, with the hub reserving 10W for operational efficiency. (Note: Wall charger not included.)
- Quick Data Transfers: Accelerate your productivity with rapid data transfers using a high-speed 5Gbps USB 3.0 port and two 480Mbps USB 2.0 ports.
- 4K HDMI Display: Enhance your visual experience with a hub capable of delivering 4K resolution at 30Hz in both mirror and extend modes. Please note that this hub is compatible with MacBook (macOS 12 and newer), Windows 10 and 11, ChromeOS, and laptops equipped with DP Alt Mode and Power Delivery. Note: This device is not compatible with Linux.
- What You Get: Anker USB-C Hub (5-in-1, 4K HDMI), welcome guide, 18-month warranty, and our friendly customer service.
Also decide whether the policy should cover all helpers or only a support group, and whether unattended support is allowed. A broad rule can block emergency support if it is not tested; a narrow rule can leave privileged support accounts unprotected.
Enable Remote Help in the Intune admin center
Tenant enablement is disabled by default. Use an account with permission to manage tenant settings, and complete this step before troubleshooting Conditional Access.
- Open the Microsoft Intune admin center.
- Go to Tenant administration > Remote Help.
- Set Enable Remote Help to Enabled.
- Configure support for unenrolled devices only if your operating model requires it. Leaving it disabled preserves the enrolled-device boundary.
- Select Save.
Allow time for a new license or trial to activate. If the setting is enabled but a licensed user still cannot start Remote Help, verify that the user is signing into the expected tenant and that the endpoint is on a supported platform and version.
Quick wins for a faster PC:
Clear out junk files and repair common Windows errorsFree Scan →Scan for outdated or missing drivers - takes under a minuteDriver Scan →Assign the minimum Intune RBAC permissions
Conditional Access does not grant Remote Help operations. Intune role-based access control (RBAC) determines what a helper can do after authentication. Microsoft’s required permission combination includes the following:
Rank #3
- Sleek 7-in-1 USB-C Hub: Features an HDMI port, two USB-A 3.0 ports, and a USB-C data port, each providing 5Gbps transfer speeds. It also includes a USB-C PD input port for charging up to 100W and dual SD and TF card slots, all in a compact design.
- Flawless 4K@60Hz Video with HDMI: Delivers exceptional clarity and smoothness with its 4K@60Hz HDMI port, making it ideal for high-definition presentations and entertainment. (Note: Only the HDMI port supports video projection; the USB-C port is for data transfer only.)
- Double Up on Efficiency: The two USB-A 3.0 ports and a USB-C port support a fast 5Gbps data rate, significantly boosting your transfer speeds and improving productivity.
- Fast and Reliable 85W Charging: Offers high-capacity, speedy charging for laptops up to 85W, so you spend less time tethered to an outlet and more time being productive.
- What You Get: Anker USB-C Hub (7-in-1), welcome guide, 18-month warranty, and our friendly customer service.
- Remote Tasks – Offer remote assistance. This authorizes the helper to offer assistance.
- Remote Assistance Connector – Read. This permits the helper to read the connector information used by the service.
- At least one Remote Help permission. Select the Remote Help actions that match the support job.
Assign roles to specific users or device groups rather than the entire directory. Separate first-line, escalation, and administrator scopes where practical. A support operator should not automatically receive every remote-control action merely because the account can open the Intune portal.
Unattended Windows access needs special care
The built-in Help Desk Operator role does not include Windows unattended-control remote sign-in. If your process requires that capability, create a custom role containing the necessary permission, then scope it to the smallest support group and device collection that can perform the work. Document who is allowed to use unattended access and review that membership regularly.
Provision the Remote Assistance Service enterprise application
The Conditional Access target is not automatically created just because Remote Help is enabled. Microsoft identifies the backend service as RemoteAssistanceService and documents creating its service principal in Microsoft Graph PowerShell. Perform this step with an administrator account that can consent to application changes.
The Tool Desk
Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →- Open an administrator PowerShell session on a workstation where you can install PowerShell modules.
- Install the Microsoft Graph PowerShell module if it is not already present:
Install-Module Microsoft.Graph -Scope CurrentUser - Connect with the application-permission scope used by Microsoft’s procedure:
Connect-MgGraph -Scopes "Application.ReadWrite.All" - Complete administrator consent when prompted and sign in to the intended tenant.
- Create the service principal with the documented application ID:
New-MgServicePrincipal -AppId "1dee7b72-b80d-4e56-933d-8b6b04f9a3e2" - Confirm that the resulting enterprise application is named Remote Assistance Service and that its service-principal identifier is associated with
RemoteAssistanceService.
The application ID is a key, not a value to retype from memory. Compare it with Microsoft’s current Remote Help deployment page when you run the command, because Microsoft can change app registrations or portal labels. If the service principal already exists, do not create duplicates; locate the existing enterprise application and use it as the policy resource.
Rank #4
- Dual Converters, Infinite Potential：Includes 2× USB C male to USB A female adapters and 2× USB A male to USB C female adapters. Perfect for a wide range of uses—tablets with Bluetooth keyboards, expand USB ports on macbook, and more. Two different converters for all your daily needs
- Next-Level 10Gbps & 3A Charging: No more slow 480Mbps, this usb to usb c adapter has a transfer speed of up to 10Gbps, allowing you to do more transferring in less time. This usb adapter fits both USB A and USB C charger, supporting up to 3A fast charging
- Upgraded Exquisite Craftsmanship: With an aluminum alloy housing and metal connector, the usbc to usb adapter is extremely durable and sturdy. Rigorously tested to withstand more than 10,000 times of plugging and unplugging, ensuring long-lasting performance
- Broad Compatible: The usb c to usb adapter widely supports all USB C/ USB A devices like laptops, tablets, cellphones, car chargers, and phone chargers. Such as compatible with MacBook Pro/Air 2023/2022, Thunderbolt 4/3 Devices,Apple MagSafe Watch 9/8/7/SE/Ultra, iPad Pro 2022/2021, Samsung Galaxy S23/S20/S10, and iPhone 17/16/15 Pro. Plug and play
- Please Note: To reach 10Gbps speed, keep the cable under 3.3 ft. For USB A Male to USB C adapters, try flipping the USB C connector. USB C Male to USB A adapters support bidirectional 10Gbps transfer within 3.3 ft
Create a Conditional Access policy for Remote Help
Use a staged policy first. Start with a pilot group of helpers and report-only mode where your tenant supports it. This exposes sign-in results without immediately interrupting production support.
- In the Microsoft Entra admin center, open Protection > Conditional Access > Policies.
- Select New policy and give it a name that states the population and control, such as Remote Help helpers – MFA pilot.
- Under Assignments > Users, include the pilot helper group. Exclude emergency access accounts according to your organization’s break-glass standard, and protect those accounts with separate monitoring and controls.
- Under Target resources > Resources, select the RemoteAssistanceService resource. Verify that the displayed application ID is
1dee7b72-b80d-4e56-933d-8b6b04f9a3e2. - Microsoft’s current procedure describes selecting Exclude before selecting the resource. Treat that instruction as a portal-specific workflow detail: inspect the policy summary afterward and confirm whether the resource is included or excluded. Do not enable a policy until the summary says exactly what you intend.
- Under Access controls > Grant, choose the control approved by your security design, such as Require multifactor authentication, Require device to be marked as compliant, or both. Select whether one or all selected controls are required.
- Set Enable policy to Report-only for the pilot, save, and review sign-in logs and What If results.
- After successful pilot sessions, change the policy to On during a planned support window. Keep a tested recovery path for administrators who cannot satisfy the new requirement.
Do not infer that an exclusion is harmless. Excluding the Remote Assistance Service means that this policy will not enforce its grant condition for that resource, which can create the opposite of the intended protection. Conversely, accidentally including a broader resource set can block unrelated sign-ins. The portal’s final policy summary and a real test session are the authority for the effective scope.
Validate an attended and an unattended workflow
Attended session test
- Use a pilot helper and a test sharer in the same tenant.
- Confirm both accounts have the required Remote Help licenses and that the helper has the intended RBAC scope.
- Start a Remote Help request on a supported Windows or macOS device.
- Verify that the helper is challenged for the selected Conditional Access control, such as MFA or device compliance.
- Confirm that the sharer sees the consent prompt before assistance begins.
- Check Entra sign-in logs, Conditional Access results, and Intune audit records for the expected application and user.
Attended support requires the user’s participation and consent. This is the normal workflow for troubleshooting because the sharer can see and approve the connection.
Unattended Windows or Android session test
Unattended control has reduced user visibility compared with an attended session. Microsoft states that users are notified when an unattended session is active, and that the service stores no session recordings. Test the notification, helper authorization, and stop-session behavior on a nonproduction device before granting the capability broadly. Windows unattended remote sign-in also requires the custom RBAC role noted earlier.
Best Value
- 5-in-1 Connectivity: Equipped with a 4K HDMI port, a 5 Gbps USB-C data port, two 5 Gbps USB-A ports, and a USB C 100W PD-IN port. Note: The USB C 100W PD-IN port supports only charging and does not support data transfer devices such as headphones or speakers.
- Powerful Pass-Through Charging: Supports up to 85W pass-through charging so you can power up your laptop while you use the hub. Note: Pass-through charging requires a charger (not included). Note: To achieve full power for iPad, we recommend using a 45W wall charger.
- Transfer Files in Seconds: Move files to and from your laptop at speeds of up to 5 Gbps via the USB-C and USB-A data ports. Note: The USB C 5Gbps Data port does not support video output.
- HD Display: Connect to the HDMI port to stream or mirror content to an external monitor in resolutions of up to 4K@30Hz. Note: The USB-C ports do not support video output.
- What You Get: Anker 332 USB-C Hub (5-in-1), welcome guide, our worry-free 18-month warranty, and friendly customer service.
Build the network allowlist from Microsoft’s live endpoint data
Remote Help uses TCP port 443, but opening 443 alone is not a complete firewall rule. Microsoft documents Remote Help service destinations, web-pubsub dependencies, and additional Azure Communication Services requirements. Use the current endpoint list for your cloud and region, including every required host and service category.
- Check outbound proxy and firewall rules for the Remote Help destinations listed by Microsoft.
- Account for Azure Communication Services dependencies rather than allowing only the main Intune URL.
- Review SSL inspection. Proxy interception or certificate substitution can disrupt authentication and real-time connection establishment.
- Test from the same network segments used by helpers and sharers; a successful test from an administrator laptop does not prove that a restricted branch network is ready.
When Microsoft updates endpoint guidance, treat the list as a configuration dependency and schedule a firewall review. Keep the transport qualification—TCP 443—next to the destination list in your change record so an administrator does not mistake the port for a sufficient allowlist.
Troubleshoot failures in the order they occur
The Remote Help option is missing or disabled
- Confirm Tenant administration > Remote Help > Enable Remote Help is set to Enabled.
- Check that the signed-in users have the Remote Help subscription and that activation time has elapsed. Microsoft’s estimate for a new license or trial is 30 minutes to 8 hours.
- Verify the device platform and version are supported for the scenario.
The helper can sign in but cannot offer assistance
- Review Intune RBAC for Remote Tasks – Offer remote assistance, Remote Assistance Connector – Read, and a Remote Help permission.
- Check role scope tags, assigned user groups, and device groups. A correctly named role with no matching scope still produces an authorization failure.
- For unattended Windows control, verify that a custom role—not only Help Desk Operator—contains the required remote sign-in permission.
Conditional Access never appears in the sign-in result
- Confirm that the Remote Assistance Service service principal exists in the tenant.
- Verify the policy targets
RemoteAssistanceServiceand the documented app ID, rather than a similarly named Microsoft application. - Read the policy summary for accidental inclusion or exclusion, then check the sign-in log’s resource and Conditional Access details.
- Ensure the test account is in the policy’s included group and is not excluded by another assignment.
The connection starts and then fails
- Confirm both participants are signed in to the same tenant; cross-tenant sessions are unsupported.
- Check outbound TCP 443 access to every current Remote Help, web-pubsub, and Azure Communication Services destination required for your cloud and region.
- Temporarily compare behavior from a network without SSL inspection, following your organization’s change controls. If the session works there, review proxy interception and certificate handling.
- Look for platform, version, consent, and RBAC errors before changing Conditional Access. A network symptom is not proof that the policy is wrong.
Security decisions to document
Record the policy resource, included and excluded groups, grant controls, RBAC roles, device scopes, and exception process. A future administrator should be able to tell whether a blocked session is caused by identity, device compliance, Intune authorization, licensing, or the network.
- Helper assurance: MFA and compliant-device requirements reduce the chance that a stolen helper credential becomes a remote-control path.
- Consent model: Attended sessions require sharer participation; unattended sessions need explicit governance because user visibility is reduced.
- Data handling: Microsoft states that Remote Help stores no session recordings. Your own screen-capture, ticketing, or endpoint-monitoring practices may still create records and should be governed separately.
- Unenrolled devices: Allow them only when necessary, because compliance and audit information can be limited.
- Scope: Keep Conditional Access assignments and Intune RBAC assignments aligned. A strict identity policy with an overbroad helper role, or a narrow identity policy with an overbroad role, leaves an avoidable gap.
Administrator go-live checklist
- Remote Help licenses assigned to helpers and sharers.
- Intune Plan 1 or Plan 2 subscription plus the required Remote Help entitlement.
- Supported Windows or macOS devices registered with Microsoft Entra and enrolled where required.
- Remote Help enabled in Tenant administration > Remote Help.
- Unenrolled-device support disabled unless a documented exception requires it.
- Intune RBAC permissions and scope tags reviewed, including the custom unattended-control role if applicable.
- Remote Assistance Service service principal created or verified with app ID
1dee7b72-b80d-4e56-933d-8b6b04f9a3e2. - Conditional Access policy tested in report-only mode with the intended resource inclusion or exclusion visible in the summary.
- MFA or compliant-device grant control verified with a pilot helper.
- Attended consent, unattended notification, and session termination tested.
- Current Microsoft endpoint list and Azure Communication Services dependencies allowed over TCP 443.
- Sign-in, Conditional Access, Intune audit, and support-ticket evidence retained according to your organization’s policy.
Once these checks pass, Conditional Access is enforcing an identity condition on the Remote Assistance Service rather than merely turning on Remote Help. That distinction is the key to a predictable and auditable deployment.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
