Intune Remote Help Licensing

Five layers that admins often collapse into one

Remote Help is off by

• default. Turning it on
• makes the service available across
• the tenant’s configuration boundary.
• the tenant’s configuration boundary.

1. Tenant enablement

Remote Help is off by default. Turning it on makes the service available across the tenant’s configuration boundary. It does not automatically license the population. 2. Entitlement Microsoft’s planning guidance requires Remote Help licensing for both helpers and sharers. Historically this was purchased as Remote Help or Intune Suite on top of Intune Plan 1 or Plan 2. From July 2026, eligible Microsoft 365 E3, E5, and related enterprise packages gained selected advanced Intune capabilities, so the base suite must be checked against the current packaging matrix. Microsoft 365 F3 should not be assumed to include Remote Help merely because it includes an Intune foundation or the app accepts a sign-in. Verify whether a separate Remote Help Frontline Worker or another qualifying entitlement is assigned. 3. RBAC and scope Helpers need the correct Intune RBAC permissions: the connector-read permission, permission to offer remote assistance, and the relevant view, control, elevation, or unattended permission. Scope groups determine whom they can assist. An entitled helper can still fail because the sharer or device is outside the helper’s scope. Conversely, a technically over-broad role does not grant licensing rights. 4. Platform and enrollment Windows supports view-only, full-control, and elevation from the supported native helper app. Microsoft’s current matrix lists unattended access for supported Samsung and Zebra Android Enterprise dedicated devices—not for Windows. Remote Help can support certain unenrolled Windows and macOS scenarios when the tenant allows them, but that does not remove the user-licensing requirement. Cross-tenant Remote Help sessions are not supported. 5. Operational policy Decide who may elevate, whether unenrolled devices are allowed, how consent is handled, and how session records are reviewed. Microsoft records session metadata such as participants, device, times, and features used for 30 days; it does not store a recording of the session.

What changed in July 2026

Microsoft added advanced Intune capabilities to eligible enterprise suites. Its public packaging guidance says the rollout was due to complete by 1 August 2026. The additions are tiered. Microsoft 365 E3 received a selection that includes Remote Help, Advanced Analytics, and Intune Plan 2 capabilities. Microsoft 365 E5 received the E3 additions plus Endpoint Privilege Management, Enterprise Application Management, and Microsoft Cloud PKI. The standalone Intune Suite and add-ons remain available for customers or users outside those qualifying packages.

• This means a tenant can legitimately contain several Remote Help populations:
• E3 or E5 users with included entitlement;
• users licensed through the standalone add-on or Intune Suite;
• frontline users with a suitable frontline add-on;

Practical checks

users with only core Intune who are not entitled to Remote Help.

A clean deployment method

1. Export assigned licences and service plans for helpers and target users. 2. Map each population to the current Microsoft packaging documentation.

• 3. Create entitlement-based groups that can be reconciled, not hand-maintained forever.
• 4. Scope Remote Help roles separately from licence groups; least privilege and entitlement are related but different controls.
• 5. Pilot each platform and mode actually required.
• 6. Test a deliberately unlicensed account and document what the service does. Treat any successful session as an enforcement observation, not permission.

Practical checks

7. Review session reports and licence assignments monthly.

Two edge cases

If the endpoint is Windows, Remote Help currently requires a person

• at the device for the supported
• session flow; Windows unattended access
• is not listed. A device-only kiosk also requires careful analysis of
• who the sharer is and how that user is entitled.

Helpdesk assists a kiosk

If the endpoint is Windows, Remote Help currently requires a person at the device for the supported session flow; Windows unattended access is not listed. A device-only kiosk also requires careful analysis of who the sharer is and how that user is entitled. External contractor provides support Remote Help does not establish sessions across tenants. If the contractor needs an account in the customer tenant, identity governance, RBAC, entitlement, and contractual controls must all be designed explicitly.

The compliance principle

Microsoft cloud services frequently provision capabilities at the tenant or service-plan

• level. Enforcement is not the licence model. The defensible question
• is not “Did it work?” but “Which assigned subscription gives
• this helper and this sharer the right to use it?”
• Axeti can help reconcile that answer across E3, E5, F3,

Practical checks

Intune Suite, and standalone add-ons after the 2026 packaging change.

Practical checks

Sources and scope: Microsoft Learn, Plan for Remote Help with Microsoft Intune: helper and sharer licensing, RBAC, supported modes, platforms, and limitations. Microsoft Learn, Remote Help for users authenticated by your organisation: tenant enablement, identity, session features, and unenrolled devices. Microsoft Licensing Resources, Microsoft 365 packaging and pricing updates FAQ: 2026 rollout and suite additions. Microsoft Learn, Microsoft Intune planning guide: E3 and E5 capability distribution. Validate the tenant’s cloud, SKU, service plans, and current Microsoft documentation. Feature provisioning and licensing packaging can change independently.