Check the helper's tenant before outsourcing Remote Help support

Source facts

Remote Help requires the sharer, helper, and their devices to belong to the same tenant. Microsoft highlights outsourced support as a case where the helper’s employer-issued device can violate that requirement. The helper must also have the sharer or device within the assigned RBAC scope; All Devices does not include unenrolled devices. Microsoft Learn.

Applicability

Use this review before promising Remote Help as part of a cross-organization support arrangement. Inventory the actual helper account, helper device, sharer, target device, enrollment state, and intended session mode.

DSE recommendation

Make tenant alignment an explicit service-onboarding decision rather than discovering it during an urgent call. Review the documented same-tenant workstation or virtual-desktop options with the support provider and the identity owner. Separately scope the minimum helper permissions to the agreed users or devices. Do not respond to a scope failure by granting tenant-wide access without a reviewed business requirement.

Verification

Rehearse a session using the exact account and workstation combination the provider will use. Confirm the intended target is eligible and that an out-of-scope test target cannot receive help from that role. Document any unenrolled-device requirements separately. Retain the tenant and scope evidence without user-session contents, and repeat the check when provider staffing or workstation ownership changes.

Official references

Microsoft Learn: Plan for Remote Help with Microsoft Intune.