Introduction

From July 1, Microsoft is rolling out Remote Help as part of Microsoft 365 E3 and E5 – no separate add-on required. That means a lot of organizations need to set up the RBAC properly, rather than leaning on broad built-in roles like Help Desk Operator or School Administrator that grant far more than remote assistance.

Microsoft recommends custom RBAC roles to implement least-privilege access.

Back in December I published a PowerShell script that creates four custom Remote Help RBAC roles and matching Entra ID security groups in under 10 seconds. I have updated it with two additions:

• -AssignRoles switch that binds each role to its paired group automatically, with scope set to All devices and All users. No more clicking through the Intune portal to assign four roles by hand
• Multi Admin Approval (MAA) awareness for both role and assignment operations, so the script behaves correctly on tenants where RBAC changes are gated by an approval policy

PowerShell

The script is available on GitHub: Create-Remote-Help-RBAC-Roles-Groups-Automation

Prerequisites

Before running the script, you need:

• PowerShell modules:
  • Microsoft.Graph.DeviceManagement.Administration
  • Microsoft.Graph.Groups
  • Microsoft.Graph.Authentication
• Microsoft Graph API permissions:
  • DeviceManagementRBAC.ReadWrite.All
  • Group.ReadWrite.All

The script connects to Microsoft Graph automatically and will prompt for authentication and consent on first run.

Basic Usage

Create roles and groups:

.\Create-Intune-Remote-Help-RBAC-Roles-Groups.ps1

Create roles, groups, and bind each role to its paired group:

.\Create-Intune-Remote-Help-RBAC-Roles-Groups.ps1 -AssignRoles

Preview what would be created without making changes:

.\Create-Intune-Remote-Help-RBAC-Roles-Groups.ps1 -AssignRoles -WhatIf

Remove all roles and groups created by the script:

.\Create-Intune-Remote-Help-RBAC-Roles-Groups.ps1 -Remove

What Gets Created

The script creates four custom RBAC roles and a paired Entra ID security group for each:

1. Remote Help – View Screen Only
   • Security group: Intune-RemoteHelp-ViewScreenOnly
   • Permissions: View screen without taking control
2. Remote Help – Full Control
   • Security group: Intune-RemoteHelp-FullControl
   • Permissions: Take full control of devices
3. Remote Help – Elevation
   • Security group: Intune-RemoteHelp-Elevation
   • Permissions: Interact with UAC prompts on Windows
4. Remote Help – Unattended (Android)
   • Security group: Intune-RemoteHelp-Unattended
   • Permissions: Connect to Android dedicated devices without user acceptance

All roles include the required base permissions:

• Remote Tasks – Offer remote assistance
• Remote Assistance Connector – Read

Each role contains only the Remote Help permissions required for its tier and no additional device management permissions.

Role Assignments with -AssignRoles

When -AssignRoles is specified, the script creates an Intune role assignment for each role, binding it to its paired Entra ID group with scope set to All devices and All users. This means support staff added to the group immediately receive the role permissions without any additional steps in the portal.

The assignment step is idempotent – if an assignment already exists for the same role and group, it is skipped.

Multi Admin Approval (MAA)

Some tenants have a Multi Admin Approval policy enabled for the Role-based access control profile type in Intune. When this is the case, role definitions and role assignments cannot be created or deleted by a single admin – they require a second admin to approve the request before it takes effect.

The script handles this automatically. When MAA intercepts an operation, the script detects the pending approval response, reports it in the output, and moves on rather than failing. At the end of the run, any pending items are listed with instructions on where to approve them.

Intune admin center > Tenant administration > Multi Admin Approval > All requests

After an approver approves the request, return to My requests and select Complete to finalize.

Running on an MAA tenant with -AssignRoles

Because role assignments must reference an existing role ID, and that ID does not exist until MAA approval completes, the script must be run twice on MAA-protected tenants to fully provision roles and assignments:

1. First run – creates roles (queued in MAA) and Entra groups
2. Approve the role creation requests in MAA, then Complete them under My requests
3. Second run with -AssignRoles – roles are now found, assignments are created (these may also queue in MAA if the tenant policy covers role assignments)

First run:

Second run:

Result