How to get Remote Help to successfully connect to a Samsung Knox enrolled device in Intune

John Wentz 25 Reputation points
2026-10-22T21:25:32.5266667+00:00

Hello! I have a Samsung tablet with me running the latest Android OS, and enrolled into Intune via Knox Mobile Enrollment. I have it applying to a group, every app I want on it is installing, and it's enrolled via user sign in. Specifically the Corporate-Owned, Fully Managed User Devices option.

I saw there was an option to put Remote Help on the device and use it to assist some of our users when they have issues. I turned it on, tested on a separate device enrolled with Corporate-Owned, Dedicated Devices and while I wasn't super thrilled with the console it does the job, and doesn't cost us anything else. To be clear I had no issues taking control of the device that way.

When I try to initiate a remote session on this user enrolled device though the option to connect is grayed out. I am not sure what is going on with this. Both of them are using the same Knox configuration with the exception of having 2 different enrollment tokens. They have the same groups assigning applications to them (I am using a default package for putting the compliance, config, and some basic apps), and I am using a licensed account to enroll it. I'm not really sure where to go from here. Hoping I can get some advice.

Microsoft Security | Intune | Microsoft Intune Android
0 comments
Answer accepted by question author

AI answer

2026-10-22T21:26:38.9533333+00:00

Remote Help cannot connect to this tablet while it is enrolled as an Android Enterprise corporate-owned, fully managed device; to use Remote Help, reprovision it with an Android Enterprise dedicated-device enrollment token.

Microsoft currently supports Remote Help on Samsung Knox Android devices only when they are enrolled in Dedicated (COSU) mode. The disabled connection action is therefore an enrollment-mode limitation, not an issue with the shared Knox configuration, app assignments, or the enrolling user's license.^1^ The Android troubleshooting guidance explicitly states that other Android enrollment types aren't supported.^2^

Supported path forward

  1. Back up any required local data.
  2. In Intune, prepare an Android Enterprise corporate-owned dedicated-device enrollment profile and use its token in the corresponding Knox Mobile Enrollment profile.
  3. Assign that Knox profile to the tablet.
  4. Wipe or factory-reset the tablet. This removes its data; Android enrollment mode cannot be changed in place.
  5. Allow Knox Mobile Enrollment to provision it again using the dedicated-device token. Knox Mobile Enrollment is supported for dedicated, fully managed, and corporate-owned work-profile provisioning, provided the device runs a supported Samsung Knox version.^3^
  6. After enrollment, verify that Intune reports the device as Android (dedicated) rather than Android (fully managed).
  7. Allow approximately 15 minutes after a new enrollment for the push-notification channel used to initiate Remote Help sessions to become active, then retry the connection.^2^

Dedicated enrollment is intended for corporate-owned, single-purpose or kiosk-style devices and does not associate the device with an individual user. Fully managed enrollment, by contrast, is intended for corporate-owned, work-only devices associated with one user.^4^ Confirm that losing user affinity will not interfere with user-targeted app assignments, policies, or authentication workflows before reprovisioning.

Requirements after dedicated enrollment

For the Samsung device:

  • It must be a supported Knox device.
  • Managed Google Play must be configured.
  • The Intune app must be later than version 5.0.5541.0.
  • Device policy must not block screen capture.
  • Full control or unattended control requires Samsung Knox; Samsung devices without Knox support screen sharing only.^1^

For the helper:

  • Only the helper requires a Remote Help license for a dedicated Android device because no user is signed in on the device.
  • The helper needs Remote Tasks - Offer remote assistance, Remote Assistance Connector - Read, and the applicable view, full-control, or Android unattended-control permission.
  • The RBAC role assignment must include the target device in its scope.^1^

Since the same helper can already control the separately enrolled dedicated device, these tenant, licensing, and helper-permission requirements are likely already satisfied. They do not make fully managed Android enrollment supported.

If dedicated enrollment is unsuitable

Keep the tablet fully managed and use a different remote-support product that explicitly supports Android Enterprise fully managed devices. Installing or reinstalling Remote Help, changing the Knox configuration, or modifying the existing app assignments will not enable Intune Remote Help for that enrollment mode. A matching Microsoft Q&A case confirms that fully managed Samsung tablets cannot currently expose the Remote Help action and must use dedicated enrollment for this capability.^5^

References

  1. Planning for Remote Help with Microsoft Intune
  2. Troubleshoot and Monitor Remote Help
  3. Enroll your Android Enterprise dedicated, fully managed, or corporate-owned with work profile devices
  4. Step 5 – Enroll devices in Microsoft Intune
  5. New remote assistance session is missing on already intuned Samsung Tablets. - Microsoft Q&A
AI-generated content may be incorrect. Read our transparency notes for more information.

Was this answer helpful?

1 person found this answer helpful.

0 additional answers

Sort by: Newest
Most helpful Newest Oldest

Your answer

Answers can be marked as 'Accepted' by the question author and 'Recommended' by moderators, which helps users know the answer solved the author's problem.