# Check the helper's tenant before outsourcing Remote Help support

> Can an outsourced helper use a device from another tenant to support your Intune users?

- Canonical URL: https://update.dsesecurity.com/updates/dse-20260909-156-check-the-helper-s-tenant-before-outsourcing-remote-help-support/
- Publisher: Detection Systems & Engineering (DSE Security)
- Author: DSE Security Editorial Team
- Published: 2026-09-10T00:29:20+00:00
- Modified: 2026-09-10T00:55:35+00:00
- Last reviewed by DSE: 2026-09-09
- Resource type: Guide
- DSE priority: Information
- Topics: Business Continuity, IT
- Reading time: 1 minutes

## What you need to know

Can an outsourced helper use a device from another tenant to support your Intune users?

## Potentially affected

Use this review before promising Remote Help as part of a cross-organization support arrangement. Inventory the actual helper account, helper device, sharer, target device, enrollment state, and intended session mode.

## DSE recommendation

Make tenant alignment an explicit service-onboarding decision rather than discovering it during an urgent call.

## Article

## Source facts

Remote Help requires the sharer, helper, and their devices to belong to the same tenant. Microsoft highlights outsourced support as a case where the helper’s employer-issued device can violate that requirement. The helper must also have the sharer or device within the assigned RBAC scope; All Devices does not include unenrolled devices. [Microsoft Learn](https://learn.microsoft.com/en-us/intune/remote-help/plan).

## Applicability

Use this review before promising Remote Help as part of a cross-organization support arrangement. Inventory the actual helper account, helper device, sharer, target device, enrollment state, and intended session mode.

## DSE recommendation

Make tenant alignment an explicit service-onboarding decision rather than discovering it during an urgent call. Review the documented same-tenant workstation or virtual-desktop options with the support provider and the identity owner. Separately scope the minimum helper permissions to the agreed users or devices. Do not respond to a scope failure by granting tenant-wide access without a reviewed business requirement.

## Verification

Rehearse a session using the exact account and workstation combination the provider will use. Confirm the intended target is eligible and that an out-of-scope test target cannot receive help from that role. Document any unenrolled-device requirements separately. Retain the tenant and scope evidence without user-session contents, and repeat the check when provider staffing or workstation ownership changes.

## Official references

[Microsoft Learn: Plan for Remote Help with Microsoft Intune](https://learn.microsoft.com/en-us/intune/remote-help/plan).

## Primary reference

- Name: Plan for Remote Help with Microsoft Intune - Microsoft Intune | Microsoft Learn
- Authority: Microsoft Learn
- URL: https://learn.microsoft.com/en-us/intune/remote-help/plan
- Source publication date: Not stated by the source

## Citation and use

Preferred citation: “Check the helper's tenant before outsourcing Remote Help support,” DSE Security, https://update.dsesecurity.com/updates/dse-20260909-156-check-the-helper-s-tenant-before-outsourcing-remote-help-support/
Publishing principles: https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/
Usage and citation policy: https://update.dsesecurity.com/usage/
Copyright © 2026 Detection Systems & Engineering. All rights reserved.