Intune Remote Help Now Supports AVD RemoteApp Sessions

Microsoft has added a significant capability to Intune Remote Help: the ability to provide remote assistance within Azure Virtual Desktop RemoteApp sessions. This update, announced in the July 2026 AVD What’s New, changes the support paradigm for organizations using RemoteApp to publish individual applications to users without providing full desktop access.

Alongside this feature announcement, Microsoft has confirmed that Remote Help is now included at no additional cost with Microsoft 365 E3 and E5 licenses — part of a broader move to fold Intune Suite capabilities into the core Microsoft 365 SKUs starting July 1, 2026.

What’s New: Remote Help for RemoteApp Sessions

Until now, Intune Remote Help could attach to full AVD desktop sessions — both Windows 365 Cloud PCs and Azure Virtual Desktop multi-session hosts. But for organizations that publish only RemoteApps (individual applications like SAP, Excel, or custom line-of-business apps delivered via AVD without a full desktop), help desk staff had no way to see or control what was happening inside those published app sessions.

That gap is now closed. Remote Help can attach to a RemoteApp session, and the helper can see and interact with the published application windows — without gaining access to the rest of the user’s desktop.

Why This Matters

RemoteApp is widely used in scenarios where organizations want to deliver specific applications to users without exposing a full desktop environment. Common use cases include:

• Contractor and partner access: Publishing a single app (like an ERP or CRM client) to external users without giving them a full desktop
• BYOD scenarios: Delivering corporate apps to personal devices without full desktop virtualization
• Line-of-business app delivery: Running legacy or resource-intensive apps on Azure infrastructure while presenting them as if locally installed

In all these scenarios, when users encounter issues, support staff previously had to rely on phone-based troubleshooting or screen descriptions. Now they can see the app, interact with it, and resolve the issue directly — scoped to just the published application.

How It Works

The Session Attachment Model

Remote Help attaches to the user’s underlying AVD session and renders control over the remote app UI. The helper sees the RemoteApp window(s) integrated into the user’s local desktop, and can click, type, and interact inside that app like any other Remote Help session.

For AVD multi-session hosts — where multiple users share the same virtual machine — Microsoft uses a code-based flow to ensure Remote Help binds to the correct user session:

1. Helper (support staff) opens the Remote Help app on their device, signs in with their Entra ID account, and generates an 8-digit security code
2. Sharer (end user) opens the Remote Help app within their RemoteApp session, enters the code, and accepts the share request
3. Remote Help binds to that specific user’s session on the shared host
4. The helper can now view and control the published apps in that session

This code-based flow is critical for multi-session environments — it prevents support staff from accidentally connecting to the wrong user’s session on a shared VM.

RemoteApp vs Full Desktop Support

The key difference: in a RemoteApp session, the helper sees only the published apps — not the taskbar, start menu, or desktop wallpaper. This is a deliberate scoping that matches the RemoteApp experience itself, where the user sees the published app as if it were a local window on their device.

Licensing: Remote Help Now Included with E3 and E5

This is where the July 2026 update gets particularly interesting for cost-conscious IT departments.

The Old Model

Remote Help was part of the Intune Suite add-on SKU — a premium feature that required licensing beyond base Intune Plan 1 or Plan 2. Organizations needed to purchase the Intune Suite for both helpers (IT support staff) and sharers (end users receiving support).

The New Model

As of July 1, 2026, Intune Suite capabilities — including Remote Help — are being rolled into Microsoft 365 E3 and E5 subscriptions. The Microsoft 365 E3 price adjusted from $23 to $26 per user per month, but this now includes:

• Remote Help (RBAC-scoped help desk sessions for Cloud PC and AVD)
• Advanced Analytics (device query, anomaly detection, deeper endpoint analytics)
• Endpoint Privilege Management
• Enterprise Application Management
• Cloud PKI

For organizations already on E3 or E5, Remote Help is now effectively a no-additional-cost capability. This removes a significant licensing barrier that previously limited Remote Help adoption.

What This Means for AVD Environments

Many AVD deployments run on Microsoft 365 E3 or E5 licenses (which include the Windows license entitlement for multi-session). With Remote Help now bundled into those same licenses, the full support stack — from endpoint management via Intune to remote assistance — is covered without additional SKU purchases.

Security Architecture

Remote Help is designed as a secure, tenant-bound remote support tool. The security model is particularly important for AVD environments where multiple users share infrastructure.

Authentication and Identity

• Both helpers and sharers must sign in using Microsoft Entra ID organizational accounts
• Remote Help functions only within your organization’s tenant — support personnel cannot assist users from other tenants or external organizations
• This tenant isolation is critical for AVD where multiple organizations might use shared Azure infrastructure

Access Control

• Remote Help access is controlled via Intune role-based access control (RBAC)
• You can restrict who can start Remote Help sessions and what actions they can perform (view-only, full control, elevation)
• RBAC can be scoped to specific device groups, including AVD host pools

Session Privacy

• The sharer must explicitly consent to the session — they accept the share request before the helper can see anything
• Sessions are auditable via Intune, including who connected to which device and when
• Conditional Access policies can be applied to restrict Remote Help usage (e.g., requiring compliant devices or MFA for helpers)

Network Security

• Communications run over HTTPS (port 443) using RDP over TLS 1.2
• No inbound firewall rules are required on the device — all traffic is outbound to Microsoft services
• Microsoft has added a new endpoint: *.trouter.communications.svc.cloud.microsoft for improved connectivity when launching Remote Help sessions from the Intune admin center

Prerequisites and Limitations

What You Need

• Remote Help app installed on the AVD session host (deploy via Intune or download from aka.ms/downloadremotehelp)
• Intune enrollment — devices must be Intune-enrolled and Entra-registered
• Licensing — Microsoft 365 E3 or E5 (now includes Remote Help), or Intune Suite add-on for other plans
• Network access — outbound HTTPS to remotehelp.microsoft.com and *.trouter.communications.svc.cloud.microsoft
• Intune tenant configuration — Remote Help must be enabled in Tenant Administration → Remote Help → Configure

Current Limitations

• Not supported on GCC High or DoD tenants — Government Community Cloud environments don’t support Remote Help in AVD
• Unattended Remote Help for AVD — while unattended Remote Help for Windows is coming (targeted August 2026 GA), its applicability to AVD multi-session or RemoteApp sessions isn’t yet documented. Plan for attended flows in AVD until official guidance confirms unattended support
• Standard remote actions still limited on multi-session VMs — several Intune remote actions (Autopilot reset, BitLocker key rotation, Fresh Start) remain unavailable on Windows Enterprise multi-session VMs
• Tenant-scoped only — MSPs supporting external AVD tenants must operate within that tenant’s identity and Intune environment

Configuration Steps

1. Enable Remote Help in Intune

1. Sign in to the Microsoft Intune admin center
2. Navigate to Tenant administration → Remote Help → Configure
3. Set Enable Remote Help to Enabled
4. Choose whether to allow Remote Help for enrolled devices only or also unenrolled devices
5. Optionally enable or disable chat functionality

2. Configure RBAC

Assign Intune roles that include Remote Help permissions to your help desk groups (e.g., Help Desk Operator). Scope roles to the relevant device groups, including AVD host pools.

3. Deploy the Remote Help App

Deploy the Remote Help client to AVD session hosts via Intune (as a Win32 app or line-of-business app). The app must be available to users within their RemoteApp sessions.

4. Update Network Endpoints

Ensure outbound access to:

• remotehelp.microsoft.com over port 443
• *.trouter.communications.svc.cloud.microsoft for improved Launch Remote Help reliability

5. Configure Conditional Access (Optional)

Apply Conditional Access policies to restrict who can use Remote Help — for example, requiring compliant devices or MFA for support staff.

The Bigger Picture: Intune and AVD Convergence

This update is part of a broader trend: the convergence of Intune management and AVD operations. Consider what’s happened over the past year:

• Windows Enterprise multi-session management via Intune is GA — admins can manage AVD multi-session VMs from the Intune admin center
• Intune Suite capabilities are now included in E3/E5 — removing the licensing barrier for premium management features
• Remote Help for RemoteApp — closing the support gap for app-only delivery scenarios
• Unattended Remote Help for Windows — coming August 2026, enabling IT to initiate support sessions without end-user involvement

Together, these changes position Intune as the unified management plane for both physical endpoints and AVD virtual desktops/applications. For organizations already invested in the Microsoft 365 ecosystem, the management story is becoming increasingly coherent — one admin center, one set of policies, one licensing model.

Recommendations

1. Enable Remote Help now if you have E3/E5 — it’s included in your license, and the RemoteApp support makes it immediately useful for AVD environments
2. Deploy the Remote Help app to your AVD session hosts — it needs to be available within user sessions for the code-based flow to work
3. Update firewall rules — add *.trouter.communications.svc.cloud.microsoft to your allowlist for reliable session launching
4. Train your help desk on the RemoteApp-specific flow — the code-based session binding is different from standard device-based Remote Help
5. Pilot with a test host pool — validate the experience with your specific RemoteApp configurations before rolling out broadly
6. Plan for unattended support — with unattended Remote Help for Windows targeting August 2026 GA, start planning how you’d use it for AVD scenarios

What’s Still Missing

• Unattended Remote Help for AVD RemoteApp is not yet documented — the August 2026 unattended capability is focused on Windows desktop devices
• No macOS Remote Help for AVD — Remote Help is available on macOS, but the AVD RemoteApp scenario is Windows-focused
• Intune configuration of RemoteApp itself remains limited — Remote Help supports RemoteApp sessions, but Intune doesn’t yet fully manage RemoteApp publishing configuration

Summary

The addition of RemoteApp session support to Intune Remote Help closes a real gap in the AVD support story. Organizations publishing apps via RemoteApp can now offer the same level of remote assistance that was previously only available for full desktop sessions. Combined with the inclusion of Remote Help in Microsoft 365 E3 and E5, there’s very little reason not to enable this for any AVD deployment running on those licenses.

For IT departments managing AVD environments, this update reduces support costs, improves resolution times for RemoteApp users, and further consolidates the management stack under Intune — all without additional licensing spend.

Follow Kevin Kaminski on X at https://x.com/kkaminsk for more AVD and Azure updates.