Remote IT support tools: the 10 essentials and how to secure them

Remote IT support tools at a glance

Whether support is one IT person or a managed service provider (MSP), the same ten jobs need covering. Some products cover several of them; the jobs stay the same.

1. Remote access and screen sharing: see what the user sees

Remote access tools let a technician view a user's screen and, with permission, take control. Attended support needs the user present to accept the session; unattended access connects to a device with nobody at it, such as a server at night. Unattended access is the convenient mode and the one attackers most want, so enable it only on devices that need it.

What ships with the operating system:

• Quick Assist (Windows 11 and Windows 10) is for helping a person. The helper signs in with a Microsoft account or Microsoft Entra ID and reads a time-limited security code to the user, who enters it and allows screen sharing; the helper can then request control, which the user allows or denies. The user never signs in, and the helper works with the user's own permissions.
• Remote Desktop signs a technician into a Windows PC instead of sharing a session. Microsoft's instructions require the PC you connect to to run the Pro edition; you connect from Windows, from Windows App on macOS and iOS, or from the Remote Desktop app on Android.
• Screen Sharing on a Mac views and controls another Mac on your network.

For organizations on Microsoft 365, Intune Remote Help is the managed version. Helper and user both sign in with accounts from your Microsoft Entra tenant, so nobody outside your organization can use it on your users. Roles decide who may help whom and who may elevate, helpers are warned when a device is out of compliance, sessions appear in reports and audit logs, and corporate-owned Windows devices managed by Intune can be reached unattended. Microsoft's Quick Assist page recommends considering Remote Help for organizations that use Quick Assist within a single tenant. Check your licences: Remote Help is an Intune advanced capability, available through Intune Plan 2, the Intune Suite and selected Microsoft 365 bundles.

Commercial tools cover the same job. CISA's guide to securing remote access software names TeamViewer, AnyDesk, ConnectWise ScreenConnect, Splashtop, Zoho Assist, LogMeIn and Bomgar (now BeyondTrust) among the common ones.

Most of these tools, built-in or commercial, are what people call "zero-infrastructure": neither computer accepts an incoming connection. Both ends connect outward to the vendor's relay service, which joins them; Quick Assist, for example, carries the session over port 443 through Microsoft's RDP relay service. There is no firewall rule to open and no server to run. That is also why attackers like these tools: the CISA-led guide notes that they connect through cloud-hosted infrastructure and are rarely flagged as malicious.

What to look for: technicians sign in through your identity provider with MFA; named accounts with roles for unattended access and elevation; a consent prompt and an on-screen indicator the user cannot miss; session logs exported to a system the tool cannot change (Quick Assist creates no logs on either device); and a clear answer to who patches the server.

Never publish Remote Desktop to the internet. CISA's #StopRansomware guide notes that attackers often get in through exposed and poorly secured remote services. It recommends disabling RDP (TCP port 3389) where it is not needed and, where it is, closing unused RDP ports, locking accounts after repeated failed attempts, requiring MFA and logging sign-in attempts.

2. RMM: manage every device without opening a session

Remote monitoring and management (RMM) software puts an agent on each endpoint. CISA's guide defines it that way: an agent that continuously monitors a machine's health and status and enables administration. Datto describes the same model for its RMM: a lightweight agent collects data about the device and reports it to the RMM application, which technicians use through a web interface.

With the agent in place, most work needs no screen-sharing session:

• Alerts: disk space, stopped services, failed backups, devices gone offline.
• Patching: the operating system and third-party apps, on your schedule.
• Scripts: PowerShell or shell run on one device or a thousand, plus automatic fixes for known problems.
• Background tools: a remote terminal or file browser that does not interrupt the user. NinjaOne, for example, lists background terminal sessions next to direct remote control.
• Inventory: hardware and software details, collected automatically.

Common platforms include NinjaOne, Datto RMM and N-able. NinjaOne and Datto RMM also include remote control (Datto's is a browser-based tool called Web Remote), so for managed devices the RMM is often the remote access tool as well.

What to look for: agents for every operating system you run, third-party patching, a script library with an approval step, integration with ticketing and EDR, and fine-grained console roles. CISA recommends "reduced privilege" RMM configurations for routine uses such as read-only monitoring, and a safeguard on mass scripting: if one account pushes commands to 10 or more devices within an hour, require MFA again.

RMM and MDM overlap but reach the device differently: RMM through its own agent, MDM through the enrolment and management framework the operating system provides. Many teams run both: MDM for enrolment, configuration and compliance; RMM for monitoring, scripting and hands-on fixes. Setting up MDM for security, from enrolment to compliance checks, is covered in how to manage cybersecurity on your devices.

3. PSA and ticketing: one record for every request

A ticketing system gives every request one record: who asked, what for, what was done and when it closed. Internal IT teams usually use an IT service management (ITSM) tool such as Jira Service Management, which gathers requests from email, chat tools and a self-service portal into queues and pairs them with a searchable knowledge base. MSPs use a professional services automation (PSA) platform, which adds the business side: ConnectWise PSA is built to run an MSP from ticket to invoice in one system, and Halo's managed services (PSA) edition lists tickets, contracts, SLAs, time tracking and billing.

For remote support, the value is in the links. An RMM alert should open a ticket by itself, the ticket should show the device's record, and a remote session should be logged against its ticket. That last link is also a security control: when every legitimate session starts from a ticket, a caller asking for a session with no ticket behind it stands out.

What to look for: intake by email, portal and chat; integration with your RMM and documentation; time recorded per ticket; and reports that show which problems keep coming back.

4. Device management (MDM): enrol, configure, wipe

Mobile device management (MDM) manages a whole device through the operating system's own enrolment: settings, apps, encryption, updates, compliance, and remote lock or wipe. Microsoft Intune, the usual choice with Microsoft 365, runs entirely in the cloud and manages Android, iOS/iPadOS, Linux, macOS, tvOS, visionOS and Windows. Devices enrol through the Company Portal app or automatically through Windows Autopilot, Apple Automated Device Enrollment or Android Enterprise. On personal phones, Intune's mobile application management (MAM) covers only work apps and their data, so company data can be wiped when someone leaves without touching their own.

Apple-heavy teams often use Jamf Pro, which offers zero-touch deployment, automatic inventory, and configuration and patching through Apple's native management features. Apple's own enrolment service has a new name: its documentation says Apple Business Manager is now Apple Business, combining Apple Business Manager, Apple Business Essentials and Apple Business Connect.

MDM makes devices fixable at a distance by design. A laptop that enrols itself, pulls its apps and policies, and reports its encryption and update status can be replaced by shipping a new one. Intune also passes each device's compliance to Microsoft Entra ID, where Conditional Access can refuse sign-ins from a device that falls out of line. Setting up a single PC by hand is covered in our guide to setting up Windows on a new computer; at company scale, enrolment replaces those steps.

What to look for: zero-touch enrolment for every platform you buy, compliance policies (encryption, operating system version, EDR running), app deployment, and remote lock and wipe.

5. Identity and MFA: one account per person

Every other tool here trusts an identity, so remote support security starts with it. Each person gets one account in an identity provider such as Microsoft Entra ID, every account has multi-factor authentication (MFA), and the remote access, RMM, ticketing and documentation tools sign in through it with single sign-on (SSO) instead of keeping their own passwords.

Not all MFA holds up against a determined caller. The joint FBI and CISA advisory on Scattered Spider, co-signed by Canada's RCMP and Canadian Centre for Cyber Security among others, describes attackers who talked employees into reading out one-time codes, flooded them with push prompts until one was accepted, and moved phone numbers to SIM cards they controlled. Microsoft Entra's built-in phishing-resistant MFA strength allows only Windows Hello for Business or a platform credential, FIDO2 security keys (passkeys) and certificate-based authentication. Require it at least for technicians and administrators through Conditional Access, the Entra rules that allow or block a sign-in based on the user, the app, the device's compliance, the location and risk signals.

Identity also gives the help desk a safe way to recover an account. When a user loses their phone or security key, a Microsoft Entra Temporary Access Pass (a time-limited passcode, single-use or valid for several sign-ins) lets them sign in and register a new method, instead of a technician switching MFA off. It is only as safe as the identity check before it is issued; see verify every caller below.

What to look for: SSO for every support tool, Conditional Access, phishing-resistant methods for privileged accounts, and sign-in logs that someone reviews.

6. Password management: share credentials without sharing passwords

Support work runs on credentials: admin accounts, Wi-Fi keys, vendor portals, router logins. A business password manager keeps them in shared vaults with access by group, records who used what, and removes access when someone leaves. 1Password's business offering lists granular vault permissions, multi-tenant support and audit-ready activity logs; Bitwarden's business plans offer least-privilege sharing, directory, SCIM and SSO integration, event logs and a self-hosted option.

Local administrator accounts need their own tool, because the same local admin password on every laptop means one leak opens them all. Windows LAPS (Local Administrator Password Solution) rotates each device's local administrator password, backs it up to Microsoft Entra ID or Active Directory, and lets authorized administrators retrieve it. It is part of Windows 11 23H2 and later and Windows Server 2025, and reached earlier Windows 10, Windows 11 and Windows Server versions with the April 11, 2023 update. Microsoft lists improved security for remote help desk scenarios among its benefits, along with protection against pass-the-hash attacks.

What to look for: vaults per team or per client, audit logs, SSO and automatic provisioning, emergency access, and a firm rule that passwords never go into tickets or chat. CISA adds one for anyone supporting several organizations: never reuse admin credentials across customers.

7. Documentation and knowledge base: fixes someone else can follow

A technician on a remote call cannot walk over and look. Documentation is how they know which router the office uses, who the internet provider is, where backups go and how the last person fixed the same error. IT Glue offers structured documentation, relationship mapping between assets and step-by-step procedures (SOPs); Hudu keeps knowledge base articles, passwords, assets and checklists in one platform, with access controls on stored credentials. An internal team can start with a wiki, as long as it is structured and searchable.

Documentation that works for remote support has four parts:

1. An asset record for every device, account, licence and vendor.
2. Runbooks for routine work: onboarding, offboarding, restoring a mailbox.
3. Known fixes, written when the ticket is closed, not later.
4. A network map: sites, internet links, firewalls and Wi-Fi.

What to look for: links from documents to devices and tickets, permissions per team or client, full-text search, and an export, so the knowledge belongs to the business rather than to the tool or to one person.

8. Endpoint security (EDR): detect what gets through

Endpoint detection and response (EDR) records what runs on each device (processes, network connections, file changes), flags attack behaviour, and lets a responder isolate a device while investigating. Traditional antivirus looks for known bad files; EDR looks at what a program does, which matters here because remote access tools are not bad files.

Microsoft Defender for Business brings Defender for Endpoint's capabilities, including EDR, to businesses of up to 300 users; it is included in Microsoft 365 Business Premium, and MSPs can connect it to RMM and PSA tools. CrowdStrike Falcon and SentinelOne's Singularity Endpoint are common alternatives.

One detail matters for remote support. CISA points out that RMM software is signed with valid code-signing certificates, so it does not look suspicious to antivirus or EDR, and that RMM install paths are often excluded from EDR inspection. Do not exclude your RMM's folders wholesale to quiet alerts, and use EDR to flag remote access software you did not approve, as CISA recommends.

What to look for: coverage for every operating system you run, device isolation, alerts on newly seen remote access tools, and someone (your team or a provider) who reads the alerts every day.

9. Backup: a copy you have actually restored

Remote support includes getting data back: a deleted folder, a corrupted mailbox, a laptop left on a train, a ransomware attack. Cloud services do not remove the need for backup. CISA's #StopRansomware guide tells organizations to review the cloud shared responsibility model so they know what remains their job, and to back up often, offline or cloud-to-cloud.

For Microsoft 365, Microsoft 365 Backup covers SharePoint sites, OneDrive accounts and Exchange mailboxes, and third-party services such as Veeam Backup for Microsoft 365 cover Exchange, SharePoint, OneDrive, Teams and Entra ID. For servers, CISA's baseline is offline, encrypted backups of critical data, tested regularly, because many ransomware variants look for backups they can reach and delete or encrypt them. The joint advisory on Gunra ransomware, published in August 2026, describes actors deleting backup data at a victim's primary data center and its disaster recovery center, and calls for offline, immutable backups in a physically separate, segmented location.

Keep the backup console out of reach of everyday tools. If the stolen RMM or admin account that reaches your devices can also delete your backups, you have one copy, not two.

What to look for: coverage of every SaaS app that holds business data, retention long enough to notice a problem, copies a compromised admin account cannot delete, and a restore test on the calendar.

10. Monitoring and status: know before the user calls

Monitoring answers two questions before the phone rings: is something of ours broken, and is it someone else's outage?

• Your own systems. The RMM watches devices. For websites, servers and internet links, add an external uptime check. Uptime Kuma, a self-hosted monitoring tool, checks HTTP(S), TCP, ping and DNS records, sends notifications through Slack, email and dozens of other services, shows certificate information and publishes status pages.
• Your providers. In the Microsoft 365 admin center, Service health lists current incidents and advisories; Microsoft suggests checking it before calling support or spending time troubleshooting, and keeps a separate status page for when you cannot sign in. Google publishes the Google Workspace Status Dashboard for Gmail, Drive, Meet and its other services.

Checking status first is the cheapest troubleshooting step in remote support: if Exchange Online has an active incident, no remote session to the user's laptop will fix Outlook.

What to look for: alerts that go to a channel someone watches, not a shared inbox; status pages bookmarked for every critical service; and at least one check that runs from outside your network.

Securing the remote support stack itself

The tools that let you fix a laptop from anywhere let an attacker do the same. Three patterns keep recurring:

• Phishing that runs a legitimate tool. In January 2023, CISA, NSA and MS-ISAC warned about malicious use of RMM software: help-desk-themed phishing led US federal employees to download ScreenConnect and AnyDesk as portable executables set to connect to the criminals' own server. Portable versions run in the user's context without installation or administrator rights, so they get past controls on software installation, and RMM software generally does not trigger antivirus.
• Calls from "IT". From mid-April 2024, Microsoft tracked a group it calls Storm-1811 phoning users while posing as IT or help desk staff, and from late May using Microsoft Teams as well, to get them to open Quick Assist; the attacks went on to deliver ScreenConnect, NetSupport Manager and Black Basta ransomware. The Scattered Spider advisory, updated in July 2025, adds the reverse: attackers posing as employees to get help desks to reset passwords and move MFA to devices they control.
• Exploiting the tool itself. In February 2024, ConnectWise disclosed an authentication bypass in ScreenConnect 23.9.7 and earlier, scored 10, the CVSS maximum; servers in ConnectWise's cloud were fixed by the vendor, while self-hosted servers needed their owners to update. In June 2025, CISA reported ransomware actors using unpatched SimpleHelp RMM (version 5.5.7 and earlier, CVE-2024-57727) to reach customers of a utility billing software provider. The August 2026 Gunra advisory still lists AnyDesk among the legitimate tools its actors used.

The controls that matter

1. One approved tool per job, and nothing else. Keep an inventory of your remote access and RMM software, and use application control to block everything else, portable versions included, as CISA recommends. If you have standardized on Remote Help or another tool, Microsoft recommends blocking or removing Quick Assist, which is installed by default on Windows 11. If Remote Help is your tool, uninstall Quick Assist rather than blocking its network endpoint: Microsoft notes that Remote Help relies on the same endpoint, so blocking it breaks both.
2. MFA on every technician account. CISA asks providers to put MFA on every account with access to customer environments and to treat those accounts as privileged. Use phishing-resistant methods for any console that can reach every device.
3. Least privilege. Separate roles for viewing, controlling and scripting; unattended access only where needed; read-only accounts for monitoring; and a fresh MFA prompt on mass actions.
4. Logs the tools cannot delete. Send session and console audit logs to a separate system, keep the power to change or delete them out of reach of the RMM, as CISA advises, and review them for sessions nobody can explain.
5. Patch the tools, expose nothing extra. CISA puts internet-facing remote access and management servers and agents first in the patching queue; a vendor-hosted version moves that job to the vendor. Keep RDP off the internet. Where you can, apply CISA's stricter option: allow the authorized RMM only from inside your network over a VPN or virtual desktop, and block common RMM ports and protocols at the perimeter.

Verify every caller

Tell users that IT will never ask them to install a remote tool, open Quick Assist or read out a code on a call they did not expect. A genuine session starts from a ticket they raised or a call they placed to a number they already have.

Hold the help desk to the same rule. Before resetting a password, changing MFA or starting a session for someone who called in, confirm the person through a channel the caller does not control: call back on the number in your directory, check with their manager, or match the request to a ticket. Recover a lost sign-in method with a Temporary Access Pass after that check, never by turning MFA off.

If an outside provider supports you

CISA's guide gives customers of managed service providers three tasks: understand which security services the contract covers, require the provider to log its presence, activities and connections in your systems and to share those logs with you, and make sure the provider's accounts are monitored and audited. Also ask which remote access and RMM agents the provider installs, and whose tenant the admin accounts live in. Our IT support service works on those terms: tools only from an approved list and recorded in your documentation, remote sessions only with the user's consent and logged, and admin accounts that belong to your tenant. A forgotten RDP port or an unpatched remote access server is the kind of exposure our security scanning looks for from outside: exposed services, open ports and known CVEs in software versions.

How to put the stack together for a small team

Add the tools in the order that removes the most risk first:

1. Identity and MFA. Everything else signs in through it.
2. Device management and EDR. Every device enrolled, encrypted and watched.
3. One remote access tool and an RMM, often the same product, locked down as above.
4. Ticketing, documentation and a password manager, so work is recorded and repeatable.
5. Backup and monitoring, with a restore test and alerts someone receives.

Suites cover several jobs at once: NinjaOne's product line spans RMM, backup, patch management, MDM and documentation, and Microsoft's own tools (Entra ID, Intune, Remote Help, Defender for Business, Microsoft 365 Backup) cover several of the ten jobs under one identity. Fewer consoles mean fewer things to secure, but also one account that reaches everything; CISA warns that an attacker who compromises an MSP can reach a large number of its customers. Either way, the controls above apply to the platform as a whole.

A remote support call, tool by tool

With the stack in place, a typical call touches most of it, in this order:

1. Status pages: is it a provider outage?
2. The RMM: alerts, disk space, recent updates and installed software on the user's device.
3. The ticket: open or find it, and verify the user if they called in.
4. An attended session through the approved remote access tool, with the user's consent.
5. The fix, written down: a note on the ticket, and a documentation update if the problem could come back.