This browser is no longer supported.
Upgrade to Microsoft Edge to take advantage of the latest features, security updates, and technical support.
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(262.40000000000003, 82%, 35%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EVS%3C/text%3E%3C/svg%3E)
Which admin role should be added or provided to a user/admin account which would be used to provide admin privilege's while doing admin tasks on Autopilot and Entra ID joined devices on remote session by Helpdesk admin?
For Example:
User needs to install the app but he/she does not have admin on device and they reached out to helpdesk to get it done and Helpdesk is going to install the app with the admin privilege's with admin account on devices.
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(188.79999999999998, 35%, 28%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EZM%3C/text%3E%3C/svg%3E)
@Vinod Survase, Thanks for posting in Q&A.
From your description, I know that you want to know which admin role should be added to a user/admin account which would be used to provide admin privilege's while doing admin tasks on Autopilot devices on remote session by Helpdesk admin.
Based on my research, you can assign the Helpdesk admin role to the user/admin account. This role is designed to provide limited administrative access to helpdesk personnel who need to perform basic administrative tasks such as resetting passwords, managing service requests, and monitoring service health.
Hope this can be helpful.
If the answer is helpful, please click "Accept Answer" and kindly upvote it. If you have extra questions about this answer, please click "Comment".
Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.
Can you read my example again and tell me which role exactly we should assign to the user account and the role which you mentioned in above answer as Helpdesk admin wont help here see below attached description for helpdesk role.
@Vinod Survase, Thanks for your update.
If you want users to install apps, the Helpdesk admin cannot do this, and there are no related admin roles can achieve this it need corporation with the local admin rights.
However, there is another way to do this, you can deploy win32 app via Intune.
Here is a link about how to deploy win32 app via Intune.
https://video2.skills-academy.com/en-us/mem/intune/apps/apps-win32-add
Hope this can be helpful.
I know about how to deploy the app but there are scenarios where user needs to do some changes on device settings and for that reason we need to provide admin privilege's while performing that action on device.
@Vinod Survase, Hope you are doing well.
Based on my research, if you want to provide admin privileges to standard user while performing some action on the targeted device, not only you need to assign the Helpdesk admin role to the user account, but you also need to add the user to the administrator group. And here is one method you can refer.
https://www.prajwaldesai.com/add-user-or-groups-to-local-admin-in-intune/
Non-official, just for reference.
Hope this can be helpful.
I will check this and see if it works or not.
@Vinod Survase, Thanks for your time.
If there is any update, please feel free to let me know.
The link which shared above worked for us but it was showing as failure in the script view where we see whether the policy was applied successfully or not but by using that user by script it worked.
@Vinod Survase, Thanks for your update.
You can see whether the user is in admin group on targeted device to check if the script worked, and if the user was already in admin group or not exist on device, the script will fail in Intune portal.
Thanks for your kind understanding.