This browser is no longer supported.
Upgrade to Microsoft Edge to take advantage of the latest features, security updates, and technical support.
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(44.800000000000004, 39%, 14%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EE%3C/text%3E%3C/svg%3E)
Hello,
Recently we started configuration of Remote Help App via Intune.
Created application and deployed to test VM. Everything works fine. We are using internal proxy.
A the moment when I what to launch RemoteHelp.exe it starts and closes immediately.
After investigation we see that traffic from RemoteHelp.exe is going to not trough our proxy.
https://learn.microsoft.com/en-us/mem/intune/remote-actions/remote-help#network-considerations
What could we do? We dont want to open all Azure ip adress range just for remote help app to work.
Maybe there is some option to force traffic from remotehelp.exe go through our proxy? Some registry entry or something?
Have you reviewed the requirements in the official docs at https://learn.microsoft.com/en-us/mem/intune/remote-actions/remote-help#network-considerations that call out a short list of URLs that must be reachable by the endpoints?
Yes a saw the requirements. We have sophos firewall. I don't exactly know, could we input *.xxxx.com address and will sophos understand it.
We asked this question for sophos also.
Hello. Some updates
Sophos support mentioned that they are not sure that adding hosts that starts with "*." to exclusions will actually work.
We tested and it's not working as it supposed :) We can't resolve endpoints.
I'm not sure what to tell you on this. We provide a service that requires connectivity to these endpoints. You have "something" in place that prevents connectivity to these endpoints. Thus, you need to configure that "something" to allow this connectivity to use the service. How you configure that "something" is not anything we can help with.
How are your clients being managed by Intune though as some of these endpoints are the same (or similar)?
Hello @Jason Sandys
Maybe there are some direct endpoint addresses that we could add in our firewall as exception that doesn't contains asterisks (*)?
Hello @Jason Sandys
After some testing we discovered that after I un-join workstation from domain. Remote Help App starts working.
Also when remote help app is installed in Event Viewer (System) shows this error :
Update : Also for testing i moved workstation to OU and disabled inheritance, after that forced gpupdate, but no result.
Based on this, it looks like the firewall is not blocking any functionality but instead, you have a group policy applied that is impacting its functionality. Thus, you need to find the policy setting for this and change it to enable the functionality.
Hello @Jason Sandys
I tested all GPo an find out that this is not the problem.
Installed remote help app on just joined domain that is managed by SCCM (if I write dsregcmd /status -> it shoes azure ad joined:No. After that remote help is working.
After I put workstation into pilot collection, after that it's becomes hybrid azure ad joined. If Device state is AzureADJoined:YES, Remote help app stops working
Is remote help app is supported with co-management? I didn't fine any related resources to this.
Sorry, not completely following here. Management by ConfigMgr and Co-management are not the same as AAD registration and AAD join. Also, Remote Help isn't applicable to a ConfigMgr only managed system (as it's an Intune feature) so not sure how (or why) you are testing that.
From your description though, it sounds like you may have a policy deployed by Intune that may be interfering here -- the device join state should have zero impact here.
We are moving to co-management. As we will switch workloads to intune, and manage workstation via intune.
As we are moving to co-management we want to use remote help app feature for this devices.
Is this path supported?
Yes. By definition co-management is the coordinated management of a Windows Endpoint by Intune and ConfigMgr. Remote Help is a feature of Intune and is thus usable for co-managed devices (or Windows endpoints managed by Intune alone).
As noted though, this has nothing to do with the domain join state of the device specifically. Thus, the most likely cause here of any failures, given what you've said, is that a policy that you have configured in Intune is deployed to the devices and preventing Remote Help from working.
Also as noted, running Remote Help on a ConfigMgr only device is not supported so not exactly sure how you are even testing that (or why).
@Jason Sandys I’m testing remote help app on co-managed device, which has workloads from intune.
The only policy that i applied from intune to this device is compliance policy, and device is compliant in intune.
The are no intune policies deployes that are blocking something.
But i will check this later. Thank you
Hello @Jason Sandys
I did investigation in our Intune and Azure AD. Couldn't find any clues that something could block RemoteHelpApp.exe.
Our Azure AD and Intune is quite new and fresh.
What could be causing this app blocking?
RemoteHelpApp is deployed via Intune to co-managed device. Other Win32 Apps and LOB apps deployed are working just fine.
There's no way for anyone to know what's going on in your environment without direct investigation. I suggest that you open a support case to provide this type of help.