Remote IT Support: What Can Be Fixed Remotely and What Needs a Visit

The short version: Most software, account and configuration problems can be fixed remotely. Anything physical needs someone on site: cabling, power, hardware swaps, racking, and devices that cannot reach the network at all. Remote support is only as safe as the tool behind it, so restrict who can start a session, require sign-in with your organisation's accounts, and keep an audit trail.

This is for small and mid-sized businesses deciding what to send to a remote team and what to keep for visits, and for whoever has to approve the remote support tool. After reading you will have a split list and a security checklist you can apply to the tool you use now.

What can usually be fixed remotely?

If the device is powered on and can reach the internet, most of these work remotely.

• Accounts: password resets, unlocks, MFA re-registration, group membership, licence assignment.
• Microsoft 365: mailbox rules and permissions, Outlook profile repair, Teams and OneDrive problems, shared mailbox set-up.
• Software: install, repair and uninstall approved apps, push updates, clear failed updates.
• Device settings and policy: Wi-Fi profiles, VPN client, printers, security settings, device management enrolment checks.
• Performance and crashes: startup items, disk space, driver updates, event log review.
• Monitoring-driven fixes: restarting a stopped service, clearing a full disk, re-running a failed backup job.
• Network and cloud changes: firewall rules, DNS records, cloud admin consoles, switch or access-point settings where management access exists.

What usually needs someone on site?

• Physical faults: broken screens, failed disks, fans, batteries, ports.
• Power and cabling: dead sockets, loose or faulty patch cables, UPS problems.
• Network gear that is offline: if a switch or router will not power up, nobody can reach it remotely.
• Device with no network or no boot: it cannot join a remote session.
• Installs: new office set-up, racking, moving equipment. See rack and stack work done by dispatched engineers.
• Hands-on checks: identifying a cable in a wiring cabinet, confirming a device is the right one, secure disposal.
• Anything needing a person's physical presence: handing over a laptop, collecting a leaver's equipment.

How do you decide: remote or visit?

Use these rules in order.

1. Is the device or service reachable now? If not, remote cannot start; send someone, or ask a colleague on site to do a basic step (restart, reseat a cable) with guidance.
2. Is the fault physical? Visit.
3. Is the fix a setting, account, software or policy? Remote.
4. Does the fix risk data loss or take the device down for a long time? Remote is fine, but get the user's OK and a backup first.
5. Has the remote attempt failed twice? As a rule of thumb, visit rather than run a third long remote session.

A reasonable pattern is "remote first, visit by exception". For a fuller comparison, read onsite vs remote IT support. For what each support level handles, see L1, L2 and L3 support levels.

What is the remote support tool security checklist?

Remote tools are powerful, so they are a target for attackers and for scammers pretending to be IT. Apply these to whichever tool you use. Microsoft's guidance on Quick Assist and Remote Help is used as a reference (checked against Microsoft Learn, 28 October 2026).

1. One approved tool. List the tools allowed (for example Intune Remote Help, or your provider's tool). Block or remove the others. Check the tenant limit first: Microsoft states Remote Help sessions cannot cross tenants, so helper, user and device must all be in the same tenant. If your provider uses its own tenant, ask how it will reach your devices; Microsoft's suggested workaround is to give the helpdesk devices joined to your tenant, or Windows 365 or Azure Virtual Desktop devices in your tenant. Microsoft advises disabling or removing Quick Assist if you use another remote support tool and do not use it yourself.
2. Sign-in with organisation accounts for the support person. Microsoft states that Remote Help requires both helper and sharer to sign in with Microsoft Entra accounts from your organisation, so helpers cannot assist users outside your tenant.
3. Support staff accounts have MFA. Conditional Access can require MFA for Remote Help helpers or limit access to specific locations or compliant devices (applies to sessions accepted by an end user).
4. Limit who can help, and how. Remote Help supports role-based access control, including who can only view a device and who can request full control or run elevated actions.
5. User consent for attended sessions. The user starts the session or approves it. With Quick Assist, the helper gets a time-limited security code and the user must allow screen sharing; control needs a second approval.
6. Staff rule: only accept sessions you started. Microsoft states you should never allow a connection from someone claiming to be IT support unless you initiated the contact. Put this in your staff guidance and repeat it.
7. Unattended access is separate and stricter. If your provider connects without the user present, ask who can do it, how it is logged, and whether it is limited to managed company devices.
8. Audit trail. In the Microsoft Intune admin center you can view Remote Help session reports, and audit logs under Tenant administration > Audit logs. Remote Help is not enabled by default; it must be turned on tenant-wide in Intune before use. Ask any other tool's vendor for the equivalent.
9. Network allow-list. Quick Assist uses port 443 and a defined set of Microsoft endpoints. Know what your tool needs before opening firewall rules.
10. Offboarding. When a support person or provider contract ends, remove their access the same day.

To disable Quick Assist across devices when you use a different tool, Microsoft documents two options: block traffic to https://remoteassistance.support.services.microsoft.com (this also affects Remote Help, which relies on the same endpoint), or uninstall the app.

# Run as Administrator. Source: Microsoft Learn, Quick Assist (checked 28 Oct 2026)
Get-AppxPackage -Name MicrosoftCorporationII.QuickAssist | Remove-AppxPackage -AllUsers

Microsoft's Remote Help planning page (checked 28 October 2026) states that everyone using the service, helpers and users, needs a Remote Help licence, and that it is a subscription in addition to Intune Plan 1 or Plan 2. Check the current licensing options before you rely on it. See also our notes on Microsoft Intune plans.

Common mistakes

• Leaving every consumer remote tool installed on staff laptops. Several tools mean several attack paths; keep one approved tool.
• Letting anyone with the code join. Codes should be time-limited and shared only after you verify the person.
• No record of sessions. If something goes wrong you cannot show who connected, when, to what.
• Remote-only plan with no on-site fallback. A dead switch or a failed disk then waits for a booking. Agree dispatch terms beforehand.
• Treating a visit as a failure. Some tasks are simply physical; plan for them.

How to check it worked

1. Ask a support person to start a session with a test device. Confirm the user was asked for consent and that control needed a separate approval.
2. Confirm the session appears in your tool's session report or audit log.
3. On a test device, confirm the unapproved tools are blocked or gone: run Get-AppxPackage -AllUsers -Name MicrosoftCorporationII.QuickAssist and check that nothing is returned if you removed it.
4. Test the MFA requirement with a non-admin helper account that has no MFA registered; your Conditional Access policy should challenge the sign-in. Note that Microsoft supports Conditional Access for Remote Help on Windows and macOS only.
5. Send staff a short test message: "IT will never ask for your password or a surprise remote session." Check they know who to call.

FAQ

Can you do IT support remotely?

Yes, for most software, account and configuration problems. It needs a device that is on and can reach the network. Physical faults still need a visit.

What does remote tech support do?

It connects to a user's device or to cloud and network consoles to diagnose and fix faults, install software, change settings and manage accounts, without travelling to the site.

What is remote IT support for a small business?

A provider fixes your staff's day-to-day IT issues by phone, chat, ticket and screen-sharing, and sends an engineer only when a problem is physical. It suits businesses without an in-house IT team.

Next step

When a problem needs hands on site, Brocent's field IT dispatch service sends an engineer; remote cases are covered under IT support.

Brocent publishes its managed IT support plans with per-user monthly prices for Hong Kong, Singapore, mainland China and the United States, so you can compare before you talk to anyone: see the plans and pricing.