Intune Remote Help 2608: support Windows devices without a user present

IT administrators know the scenario. An employee reports in the evening that their workstation has frozen, but they have already left. A kiosk in a warehouse or reception area shows an error message, but nobody is present to approve a remote session request. Until recently, this meant waiting until the next morning or sending a technician on-site. With the Intune service release of August 2026 — version number 2608 — Microsoft delivers a direct solution: unattended Remote Help sessions that allow a helpdesk employee to connect independently to a Windows device, even without a user being present.

What is Remote Help in Intune

Remote Help is Microsoft Intune's built-in support solution. It enables helpdesk staff to remotely connect to Windows devices, view or take over screens, and resolve problems directly. Unlike traditional remote desktop tools, Remote Help is fully integrated with Microsoft Entra ID: every session requires authentication on both sides, is recorded in the Intune audit log, and is bound to the RBAC roles the administrator has assigned.

Remote Help is part of the Microsoft Intune Suite, which is included with Microsoft 365 E5 and available as an add-on with Business Premium and comparable plans. For organisations already using Intune for device management, Remote Help is typically available without additional licensing costs.

What changed in Intune 2608 — unattended sessions

Up to version 2608, Remote Help worked exclusively in interactive mode. The user received a session request on their screen and had to actively click to accept the connection. That required someone to be present at the device, or at least have access to it to confirm the notification.

Intune 2608 introduces a fundamentally different approach. In the new unattended mode, the helpdesk employee connects to the Windows login screen of the device and then signs in using their own authorised credentials. The session runs completely separate from the user's session. If an employee is already signed in, that session remains locked and intact. When the repair work is done and the helpdesk employee disconnects, the device returns to the locked sign-in screen. The end user's open work is not lost.

Technical requirements — what works and what does not (yet)

The unattended Remote Help mode works exclusively on physical, corporate-owned Windows devices that are enrolled in Intune and joined to Microsoft Entra ID — via full Entra join or via hybrid join with an on-premises Active Directory. Personal devices are out of scope, regardless of whether they are enrolled under a BYOD policy.

Noteworthy are the exceptions. Windows 365 Cloud PC, Azure Virtual Desktop, and other virtualised workstations are not supported for unattended access in the current release. For devices that do not yet reach the Windows login screen — for example because a failed update leaves the device in a recovery screen — direct Remote Help is also out of reach. For such situations, out-of-band management via hardware-based technology remains the appropriate route.

A dedicated permission for unattended access

Microsoft has introduced a separate RBAC permission in Intune specifically for the unattended mode, distinct from the existing Remote Help roles. That choice is deliberate. Unattended access is of a different order than a session where the user is watching and can intervene at any moment. Without end-user oversight, a strict permission structure is essential.

In practice, this means IT teams can choose: the broader helpdesk retains access for interactive sessions, while only a selected group of senior staff receives the permission for unattended connections. Every unattended session is recorded in the Intune audit log with the administrator's account, the device involved, and the timestamp. That makes the feature usable in environments where demonstrable remote access is a compliance requirement.

Which situations does this resolve

The addition of unattended Remote Help sessions addresses a range of situations that regularly cost IT teams hours. After-hours repair is the most obvious benefit. When a device freezes after office hours or a software installation fails, the helpdesk can act immediately without waiting until the next morning.

Kiosk and shared devices form a second category. Screens in warehouses, reception areas, meeting rooms, or stores are often not linked to a fixed employee. Until now, remote support for such devices was difficult to organise. With unattended Remote Help, that is directly resolved, provided the device is enrolled and Entra-joined.

Furthermore, the feature helps in situations where an employee has left their device while a problem requires immediate action. A blocking security warning, an outdated certificate configuration disrupting connections, or a failed policy application the user cannot resolve themselves — in all these cases, the helpdesk can now act without delay and without requiring the employee to sign in.

How to configure the unattended mode

Activation takes three steps in the Microsoft Intune portal. First, ensure that Remote Help is enabled in the tenant settings, found under Tenant administration, then Remote help. If Remote Help was already active for interactive sessions, this step is likely already done.

Next, create an Intune RBAC role with the new permission for unattended remote sign-in, or add that permission to an existing custom role you want to extend specifically. Finally, assign that role to the user group that may initiate unattended sessions. On the devices themselves, no additional configuration is needed if they are already enrolled and Entra-joined.

Do verify that the Remote Help client on the devices has been updated to the version released with Intune 2608. Older clients do not support the unattended mode yet. The client is typically deployed as an Intune-managed app and updated automatically through the standard app update process.

What you can do now

Three steps you can take immediately. First, inventory which devices in your environment qualify: physical, corporate-owned, Entra-joined, and enrolled in Intune. That is your scope for unattended Remote Help. Second, determine who receives the permission for unattended sessions and configure a matching RBAC role. Deliberately limit this to a small group with a clear area of responsibility. Third, ensure the Remote Help client is updated on the devices in scope.

Unattended Remote Help in Intune 2608 closes a longstanding gap in Microsoft Intune's management capabilities. For IT teams managing Windows devices at scale, including outside office hours and at locations without a fixed user, this is a concrete improvement to daily operations. The combination of Entra authentication, separate user sessions, a dedicated permission, and full audit logging makes the feature suitable for both practical and regulated environments. Want to activate Remote Help, configure the right roles, or determine which devices are in scope? Contact Zarioh for a practical intake.