Document what a Remote Help session report cannot prove

Source facts

Intune’s Remote Help session report records participants, assisted device, start and end times, and control-session type. It does not report use of Windows elevation.

Microsoft retains these session logs for 30 days and stores metadata rather than screen images or keystrokes. Reporting for unenrolled devices is limited. Dedicated Android devices have no user affinity, so their recipient identity fields display dashes. Microsoft Learn.

Applicability

Identify the supported platform, enrollment state, and evidence question before interpreting a row. Distinguish who participated and when from what occurred on the screen. Check whether the investigation requires an action record that this report does not contain.

DSE recommendation

DSE recommends writing an evidence plan for the support workflow before sensitive assistance occurs. Assign an owner to retrieve the available session metadata within its documented window and preserve the associated support ticket under approved handling rules. Make missing content or elevation evidence explicit; do not describe a session listing as a recording.

Verification

For an authorized test session, compare the report with the known participants, device, timing, and control type. Check how userless or unenrolled cases appear. Verify the planned metadata retrieval and retention process, and confirm reviewers can distinguish an absent field from proof that an action never happened.

Official references

Microsoft Learn: Troubleshoot and monitor Remote Help for Microsoft Intune.. Source retrieved September 9, 2026.