Microsoft shipped something this week that’s aimed squarely at IT helpdesks, not end users — which usually means it flies under the radar. This one shouldn’t, because it changes a default that’s been true of remote support tools for as long as they’ve existed: someone has to be sitting at the machine and click “allow.”
What actually shipped
On August 25, Microsoft announced Remote Help Windows Unattended Support with Remote Sign-In, a new capability inside Intune (Microsoft’s device management platform — the thing that lets an IT team manage laptops, security policies, and app installs across an entire organization from one console). It lets an authorized helpdesk staffer sign into a physical, corporate-owned Windows PC using their own credentials — with no end user present, no end user logged in, and no end user clicking “accept” first.
Before this, every Remote Help session on Windows required a live human at the keyboard to approve the connection. That’s the model everyone’s used to: IT calls, IT says “click this,” you click it, IT sees your screen. This release removes that requirement entirely for a specific class of session.
Why Microsoft built it: the stated use cases are the ones any IT director recognizes immediately — a shared kiosk in a warehouse that needs an after-hours patch, a branch office with no on-site IT staff, a machine sitting idle overnight that needs five minutes of work instead of a scheduled call with whoever’s usually at that desk. Genuinely useful. Also genuinely a new kind of access.
How it actually works
The helper doesn’t take over the existing user’s session — they get their own, separate one. Concretely:
- The IT admin starts the session from the Intune admin console, not from any app on the target machine.
- If someone happens to be signed in at the time, they get a 30-second notification: “Do you want to allow the helper to connect? Click OK to disconnect immediately, or Cancel to stay connected.” If nobody responds in those 30 seconds, the session starts automatically anyway — the “no response” outcome is access granted, not access denied.
- The user’s existing session gets locked and preserved (not logged off, not losing unsaved work) while the helper works in a completely separate Windows session, authenticated with their own account.
- When it’s done, the user can reclaim their session anytime just by signing back in at the lock screen — the helper gets notified and disconnects.
- Sessions auto-terminate after a 12-hour maximum, whether anyone remembers to end them or not.
Under the hood (per independent technical analysis from Patch My PC, who’d been tracking this in Microsoft’s device-management client code since March), the feature borrows infrastructure from Azure Virtual Desktop — the same plumbing Microsoft uses for cloud-hosted Windows sessions. The helper is temporarily added to the local “Remote Desktop Users” group on the target machine, granted a scoped, encrypted, time-limited credential, and then cleanly removed again when the session ends. That’s a reasonable way to build this — temporary, audited, reversible — which matters, because the alternative (a permanent standing account with remote-desktop rights) would be worse.
The access controls that actually matter
To Microsoft’s credit, this isn’t a checkbox anyone can flip on. A few guardrails are worth calling out specifically, because they’re the difference between a useful helpdesk tool and a wide-open door:
- It’s a dedicated permission, off by default. “Windows unattended control remote sign-in” is not included in any built-in Intune role — not even the standard Help Desk Operator role. An admin has to deliberately create a custom role, turn this on, and scope it to specific device groups. You can’t get this by accident.
- Corporate-owned devices only. Personal and BYOD machines are excluded entirely. So are virtual desktops. Only physical, Intune-managed, organization-owned PCs are eligible.
- Least privilege carries through. The helper’s session only has the permissions of whatever account they authenticate with — signing in doesn’t grant administrator rights that account doesn’t already have.
- Everything’s logged. Full audit trail — who connected, when, to which device, attended or unattended — sits in the same reporting Intune already uses for regular Remote Help sessions.
Those controls are real, and they’re the right shape. My read: this is what “we thought about the abuse case” looks like when a vendor takes it seriously.
The part worth sitting with
Here’s the governance question underneath the security controls, and it’s not really about Microsoft — it’s about how anyone deploying this configures it. The permission model answers “can this admin technically do this?” It doesn’t answer “should this specific person have this specific access to this specific machine, right now, for this specific reason?” That’s a scoping decision every organization has to make for itself, and it’s easy to get generous with role assignments under time pressure — “just give the whole helpdesk team unattended access, it’s faster” is exactly the kind of shortcut that turns a scoped tool into a standing risk.
The 30-second default-to-connect behavior is the detail I’d flag hardest in any rollout conversation. It’s the right call from a helpdesk-efficiency standpoint — you don’t want every unattended session blocked because nobody happened to be at the desk to click a button. But it does mean the “user consent” step in this flow isn’t really consent in the traditional sense; it’s a brief window to object before access happens by default. Worth being explicit with your own team and end users about that distinction, rather than letting people assume “unattended support” still means “someone approved this.”
None of this is a reason not to use the feature — after-hours maintenance without dragging someone back to their desk is a real efficiency win, and the audit trail plus the narrow default-off permission are exactly what should exist before a capability like this ships. It’s a reason to scope the role assignment carefully, document who gets it and why, and make sure “who can silently sign into a locked machine” is a question your access reviews actually ask — the same discipline I’d want applied to any tool with this kind of reach, not a knock on this one specifically.
Where to find it
Remote Help is included with Microsoft Intune Suite, the Remote Help standalone add-on, or Microsoft 365 E3/E5. The unattended sign-in capability needs three things configured before it works: the dedicated RBAC permission, the Azure Virtual Desktop agent components deployed to target devices, and a Remote Desktop configuration profile enabling remote connections. Microsoft’s full setup walkthrough is in their Remote Help documentation.
Sources: Microsoft’s own Intune Customer Success announcement (primary, read in full), Microsoft Learn’s Remote Help planning and session-start documentation (updated August 25, 2026), and independent technical analysis from Patch My PC, who had been tracking the feature’s device-side implementation in Microsoft’s management client since March and corroborated the architecture details against the official release.