Intune – You can now use the new remote assistance tool (preview)

UPDATED to provide the download link to the new remote assistance tool

As you know, one of the challenge with Intune/Endpoint Configuration Manager is the ability to provide remote assistance.

Well, until know you had either to use the TeamViewer Connector (which in my opinion is not very good – better to simply use a standalone TeamViewer client rather than configuring the connector) or the Windows Remote Assistance (Quick Assist) tool from Windows.

Both of them do not provide RBAC and may have trouble when the remote session requires privileges elevation.

Good news, Microsoft is now finally providing a remote assistance tool which properly integrates with Intune to provide:

• Role-based access control (RBAC) and permissions: to define who is authorized to support which user or groups of users
• Elevation: to help Administrators determine if helpdesk associates can use local administrative privileges to troubleshoot an employees’ device, or if elevation of the task permissions is required
• Compliance warnings: to help protect the organization from security risks, alerts are displayed to the helpdesk associate if a device is out of compliance and may introduce a security risk to the organization
• Reporting: to identify recurring issues and potentially suspicious activity

NOTE the preview deployment is under going with a general availability expected by early 2022. It seems at this time, Microsoft is expecting to provide this feature with a premium on top of the Intune license

You can download the new remote assistance tool from https://aka.ms/downloadremotehelp

First thing first you need to enable the new remote assistance capability by connecting to your Intune portal (https://endpoint.microsoft.com/) to access the Tenant administration\Connectors and tokens\Remote Help blade

Then select the Enabled option for Enable remote help under the Settings, you can also choose to allow remote help for unmanaged devices

Then Intune administrators can adjust the Help Desk Operator role to define what support desk will be able to perform while assisting end-users through a remote help session by creating a custom role based on the Help Desk Operator role

Then the remote assistance session can be started either by the end-user using the Remote Help application or by the help desk operator from the Intune portal

You can deploy the new remote assistance tool by using SCCM or Intune using the below settings:

• Command line parameters to install: /install /passive acceptterms=Yes (you can replace /passive with /quiet – the “accepterms=Yes is mandatory for both)
• Command line parameters to uninstall: /uninstall /passive (you can replace /passive with /quiet)
• Detection rule: %programfiles%\remote help\remotehelp.exe exist or HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{76b52076-6120-4390-9746-0b246802893d}\DisplayVersion = 3.8.0.6 if you want to use the application version

The new remote assistance tool requires end-user to sign in with their corporate account before being able to use it – if the device is Azure AD joined (including hybrid) they just have to click on sign-in and accept the privacy options

From there they can either request or provide assistance