# Remote IT support tools: the 10 essentials and how to secure them > The ten tools remote IT support runs on, by job: remote access, RMM, ticketing, MDM, MFA, passwords, docs, EDR, backup and monitoring, and how to secure each. - URL: https://computese.com/top-10-essential-tools-for-remote-it-support/ - Author: Duong Quan Nguyen, CEO, Computese - Published: 2024-08-21 - Updated: 2026-09-25 - Topics: IT support, Security ## In short - Remote IT support needs ten kinds of tools: remote access, RMM, ticketing or PSA, device management (MDM), identity with MFA, a password manager, documentation, EDR, backup and monitoring. Choose by job first, vendor second. - Windows already includes Quick Assist and Remote Desktop. For an organization, Intune Remote Help adds sign-in inside your own tenant, roles and session logs; RMM platforms add an always-on agent for monitoring, patching and scripts. - Attackers use the same software. CISA's January 2023 advisory describes phishing that ran portable ScreenConnect and AnyDesk, which need no installation or admin rights and generally do not trigger antivirus. - Secure the stack itself: one approved tool per job with everything else blocked, MFA on every technician account, least-privilege roles, logs the tools cannot delete, patched servers, and callers verified before any session or reset. Remote IT support runs on ten kinds of tools: remote access for live sessions, remote monitoring and management (RMM) for background work, a ticketing or PSA system, device management (MDM), identity with multi-factor authentication, a password manager, documentation, endpoint detection and response (EDR), backup, and monitoring. Choose them by job, then lock down every tool that grants access. This guide takes each category in turn: what it does, what to look for, and a few common examples named from the vendors' own documentation. It is not a ranking; no product is best for every team. The last sections cover what most tool lists leave out: attackers use the same remote access and RMM software, so the stack needs its own security. ## Remote IT support tools at a glance Whether support is one IT person or a managed service provider (MSP), the same ten jobs need covering. Some products cover several of them; the jobs stay the same. | # | Tool category | The job | Examples | Check first | | --- | -------------------------------- | ------------------------------------------------------- | --------------------------------------------------------------------------- | ---------------------------------------------- | | 1 | Remote access and screen sharing | See and control a user's screen, with their consent | Quick Assist, Intune Remote Help, Remote Desktop, TeamViewer, ScreenConnect | Named technician accounts, MFA, session logs | | 2 | RMM | Monitor, patch and script every device through an agent | NinjaOne, Datto RMM, N-able | MFA and roles on the console | | 3 | PSA and ticketing | One record per request; for MSPs, time and billing too | Jira Service Management, ConnectWise PSA, Halo | Intake by email and portal, RMM integration | | 4 | Device management (MDM) | Enrol, configure, update and wipe devices | Microsoft Intune, Jamf Pro | Zero-touch enrolment, compliance policies | | 5 | Identity and MFA | One account per person, strong sign-in | Microsoft Entra ID | Phishing-resistant MFA for technicians | | 6 | Password management | Share credentials safely, rotate local admin passwords | 1Password, Bitwarden, Windows LAPS | Shared vaults with audit logs | | 7 | Documentation | Systems, procedures and past fixes, written down | IT Glue, Hudu | Links between devices, tickets and documents | | 8 | Endpoint security (EDR) | Detect, investigate and contain attacks on devices | Microsoft Defender for Business, CrowdStrike Falcon | Alerts on unapproved remote tools | | 9 | Backup | Restore files, mailboxes and systems | Microsoft 365 Backup, Veeam | Copies an attacker cannot reach, restore tests | | 10 | Monitoring and status | Know about outages before users call | Uptime Kuma, Microsoft 365 Service health | Alerts that reach someone on duty | ## 1. Remote access and screen sharing: see what the user sees Remote access tools let a technician view a user's screen and, with permission, take control. **Attended** support needs the user present to accept the session; **unattended** access connects to a device with nobody at it, such as a server at night. Unattended access is the convenient mode and the one attackers most want, so enable it only on devices that need it. What ships with the operating system: - **Quick Assist** (Windows 11 and Windows 10) is for helping a person. The helper signs in with a Microsoft account or Microsoft Entra ID and reads [a time-limited security code](https://learn.microsoft.com/en-us/windows/client-management/client-tools/quick-assist) to the user, who enters it and allows screen sharing; the helper can then request control, which the user allows or denies. The user never signs in, and the helper works with the user's own permissions. - **Remote Desktop** signs a technician into a Windows PC instead of sharing a session. [Microsoft's instructions](https://support.microsoft.com/en-us/windows/experience/connectivity-networking/how-to-use-remote-desktop) require the PC you connect to to run the Pro edition; you connect from Windows, from Windows App on macOS and iOS, or from the Remote Desktop app on Android. - **Screen Sharing** on a Mac [views and controls another Mac](https://support.apple.com/guide/mac-help/mh14066/mac) on your network. For organizations on Microsoft 365, **Intune Remote Help** is the managed version. Helper and user both sign in with [accounts from your Microsoft Entra tenant](https://learn.microsoft.com/en-us/intune/remote-help/), so nobody outside your organization can use it on your users. Roles decide who may help whom and who may elevate, helpers are warned when a device is out of compliance, sessions appear in reports and audit logs, and corporate-owned Windows devices managed by Intune can be reached unattended. Microsoft's Quick Assist page recommends considering Remote Help for organizations that use Quick Assist within a single tenant. Check your licences: Remote Help is [an Intune advanced capability](https://learn.microsoft.com/en-us/intune/fundamentals/advanced-capabilities), available through Intune Plan 2, the Intune Suite and selected Microsoft 365 bundles. Commercial tools cover the same job. CISA's guide to securing remote access software names TeamViewer, AnyDesk, ConnectWise ScreenConnect, Splashtop, Zoho Assist, LogMeIn and Bomgar (now BeyondTrust) among the common ones. Most of these tools, built-in or commercial, are what people call "zero-infrastructure": neither computer accepts an incoming connection. Both ends connect outward to the vendor's relay service, which joins them; Quick Assist, for example, carries the session over port 443 through Microsoft's RDP relay service. There is no firewall rule to open and no server to run. That is also why attackers like these tools: the [CISA-led guide](https://www.cisa.gov/resources-tools/resources/guide-securing-remote-access-software) notes that they connect through cloud-hosted infrastructure and are rarely flagged as malicious. ![A technician's laptop and a user's desktop behind a firewall both connect outward to an orange relay cloud, which carries the screen image between them. No connection enters through the firewall.](https://computese.com/images/blog/top-10-essential-tools-for-remote-it-support/relay.cb1b131495-1536.webp) *No inbound port means nothing to open on the firewall, and nothing there to stop an unapproved tool either.* What to look for: technicians sign in through your identity provider with MFA; named accounts with roles for unattended access and elevation; a consent prompt and an on-screen indicator the user cannot miss; session logs exported to a system the tool cannot change (Quick Assist creates no logs on either device); and a clear answer to who patches the server. Never publish Remote Desktop to the internet. [CISA's #StopRansomware guide](https://www.cisa.gov/stopransomware/ransomware-guide) notes that attackers often get in through exposed and poorly secured remote services. It recommends disabling RDP (TCP port 3389) where it is not needed and, where it is, closing unused RDP ports, locking accounts after repeated failed attempts, requiring MFA and logging sign-in attempts. ## 2. RMM: manage every device without opening a session Remote monitoring and management (RMM) software puts an agent on each endpoint. CISA's guide defines it that way: an agent that continuously monitors a machine's health and status and enables administration. [Datto describes the same model](https://www.datto.com/products/rmm/) for its RMM: a lightweight agent collects data about the device and reports it to the RMM application, which technicians use through a web interface. With the agent in place, most work needs no screen-sharing session: - **Alerts:** disk space, stopped services, failed backups, devices gone offline. - **Patching:** the operating system and third-party apps, on your schedule. - **Scripts:** PowerShell or shell run on one device or a thousand, plus automatic fixes for known problems. - **Background tools:** a remote terminal or file browser that does not interrupt the user. NinjaOne, for example, [lists background terminal sessions](https://www.ninjaone.com/rmm/) next to direct remote control. - **Inventory:** hardware and software details, collected automatically. Common platforms include NinjaOne, Datto RMM and N-able. NinjaOne and Datto RMM also include remote control (Datto's is a browser-based tool called Web Remote), so for managed devices the RMM is often the remote access tool as well. ![A console screen on the left receives small pulse signals from six devices, each marked with a gear badge. One laptop shows an orange warning triangle while a script sheet travels out from the console.](https://computese.com/images/blog/top-10-essential-tools-for-remote-it-support/agents.1091119a5c-1536.webp) *The agent reports on its own, so the first sign of a failing disk can be an alert instead of a phone call.* What to look for: agents for every operating system you run, third-party patching, a script library with an approval step, integration with ticketing and EDR, and fine-grained console roles. CISA recommends "reduced privilege" RMM configurations for routine uses such as read-only monitoring, and a safeguard on mass scripting: if one account pushes commands to 10 or more devices within an hour, require MFA again. RMM and MDM overlap but reach the device differently: RMM through its own agent, MDM through the enrolment and management framework the operating system provides. Many teams run both: MDM for enrolment, configuration and compliance; RMM for monitoring, scripting and hands-on fixes. Setting up MDM for security, from enrolment to compliance checks, is covered in [how to manage cybersecurity on your devices](https://computese.com/how-to-manage-cybersecurity-on-your-devices/). ## 3. PSA and ticketing: one record for every request A ticketing system gives every request one record: who asked, what for, what was done and when it closed. Internal IT teams usually use an IT service management (ITSM) tool such as [Jira Service Management](https://www.atlassian.com/software/jira/service-management/features/itsm), which gathers requests from email, chat tools and a self-service portal into queues and pairs them with a searchable knowledge base. MSPs use a professional services automation (PSA) platform, which adds the business side: [ConnectWise PSA](https://www.connectwise.com/platform/psa) is built to run an MSP from ticket to invoice in one system, and [Halo's managed services (PSA) edition](https://www.usehalo.com/managed-services) lists tickets, contracts, SLAs, time tracking and billing. For remote support, the value is in the links. An RMM alert should open a ticket by itself, the ticket should show the device's record, and a remote session should be logged against its ticket. That last link is also a security control: when every legitimate session starts from a ticket, a caller asking for a session with no ticket behind it stands out. What to look for: intake by email, portal and chat; integration with your RMM and documentation; time recorded per ticket; and reports that show which problems keep coming back. ## 4. Device management (MDM): enrol, configure, wipe Mobile device management (MDM) manages a whole device through the operating system's own enrolment: settings, apps, encryption, updates, compliance, and remote lock or wipe. Microsoft Intune, the usual choice with Microsoft 365, [runs entirely in the cloud](https://learn.microsoft.com/en-us/intune/fundamentals/what-is-intune) and manages Android, iOS/iPadOS, Linux, macOS, tvOS, visionOS and Windows. Devices enrol through the Company Portal app or automatically through Windows Autopilot, Apple Automated Device Enrollment or Android Enterprise. On personal phones, Intune's mobile application management (MAM) covers only work apps and their data, so company data can be wiped when someone leaves without touching their own. Apple-heavy teams often use [Jamf Pro](https://www.jamf.com/products/jamf-pro/), which offers zero-touch deployment, automatic inventory, and configuration and patching through Apple's native management features. Apple's own enrolment service has a new name: its documentation says [Apple Business Manager is now Apple Business](https://support.apple.com/guide/apple-business-manager/welcome/web), combining Apple Business Manager, Apple Business Essentials and Apple Business Connect. MDM makes devices fixable at a distance by design. A laptop that enrols itself, pulls its apps and policies, and reports its encryption and update status can be replaced by shipping a new one. Intune also passes each device's compliance to Microsoft Entra ID, where Conditional Access can refuse sign-ins from a device that falls out of line. Setting up a single PC by hand is covered in our guide to [setting up Windows on a new computer](https://computese.com/how-to-set-up-windows-for-a-new-computer/); at company scale, enrolment replaces those steps. What to look for: zero-touch enrolment for every platform you buy, compliance policies (encryption, operating system version, EDR running), app deployment, and remote lock and wipe. ## 5. Identity and MFA: one account per person Every other tool here trusts an identity, so remote support security starts with it. Each person gets one account in an identity provider such as Microsoft Entra ID, every account has multi-factor authentication (MFA), and the remote access, RMM, ticketing and documentation tools sign in through it with single sign-on (SSO) instead of keeping their own passwords. Not all MFA holds up against a determined caller. The joint FBI and CISA [advisory on Scattered Spider](https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-320a), co-signed by Canada's RCMP and Canadian Centre for Cyber Security among others, describes attackers who talked employees into reading out one-time codes, flooded them with push prompts until one was accepted, and moved phone numbers to SIM cards they controlled. Microsoft Entra's [built-in phishing-resistant MFA strength](https://learn.microsoft.com/en-us/entra/identity/authentication/concept-authentication-strengths) allows only Windows Hello for Business or a platform credential, FIDO2 security keys (passkeys) and certificate-based authentication. Require it at least for technicians and administrators through Conditional Access, the Entra rules that allow or block a sign-in based on the user, the app, the device's compliance, the location and risk signals. Identity also gives the help desk a safe way to recover an account. When a user loses their phone or security key, a [Microsoft Entra Temporary Access Pass](https://learn.microsoft.com/en-us/entra/identity/authentication/howto-authentication-temporary-access-pass) (a time-limited passcode, single-use or valid for several sign-ins) lets them sign in and register a new method, instead of a technician switching MFA off. It is only as safe as the identity check before it is issued; see [verify every caller](#verify-every-caller) below. What to look for: SSO for every support tool, Conditional Access, phishing-resistant methods for privileged accounts, and sign-in logs that someone reviews. ## 6. Password management: share credentials without sharing passwords Support work runs on credentials: admin accounts, Wi-Fi keys, vendor portals, router logins. A business password manager keeps them in shared vaults with access by group, records who used what, and removes access when someone leaves. [1Password's business offering](https://1password.com/business-security) lists granular vault permissions, multi-tenant support and audit-ready activity logs; [Bitwarden's business plans](https://bitwarden.com/products/business/) offer least-privilege sharing, directory, SCIM and SSO integration, event logs and a self-hosted option. Local administrator accounts need their own tool, because the same local admin password on every laptop means one leak opens them all. [Windows LAPS](https://learn.microsoft.com/en-us/windows-server/identity/laps/laps-overview) (Local Administrator Password Solution) rotates each device's local administrator password, backs it up to Microsoft Entra ID or Active Directory, and lets authorized administrators retrieve it. It is part of Windows 11 23H2 and later and Windows Server 2025, and reached earlier Windows 10, Windows 11 and Windows Server versions with the April 11, 2023 update. Microsoft lists improved security for remote help desk scenarios among its benefits, along with protection against pass-the-hash attacks. What to look for: vaults per team or per client, audit logs, SSO and automatic provisioning, emergency access, and a firm rule that passwords never go into tickets or chat. CISA adds one for anyone supporting several organizations: never reuse admin credentials across customers. ## 7. Documentation and knowledge base: fixes someone else can follow A technician on a remote call cannot walk over and look. Documentation is how they know which router the office uses, who the internet provider is, where backups go and how the last person fixed the same error. [IT Glue offers structured documentation](https://www.itglue.com/), relationship mapping between assets and step-by-step procedures (SOPs); [Hudu keeps knowledge base articles](https://www.hudu.com/), passwords, assets and checklists in one platform, with access controls on stored credentials. An internal team can start with a wiki, as long as it is structured and searchable. Documentation that works for remote support has four parts: 1. **An asset record** for every device, account, licence and vendor. 2. **Runbooks** for routine work: onboarding, offboarding, restoring a mailbox. 3. **Known fixes**, written when the ticket is closed, not later. 4. **A network map**: sites, internet links, firewalls and Wi-Fi. What to look for: links from documents to devices and tickets, permissions per team or client, full-text search, and an export, so the knowledge belongs to the business rather than to the tool or to one person. ## 8. Endpoint security (EDR): detect what gets through Endpoint detection and response (EDR) records what runs on each device (processes, network connections, file changes), flags attack behaviour, and lets a responder isolate a device while investigating. Traditional antivirus looks for known bad files; EDR looks at what a program does, which matters here because remote access tools are not bad files. [Microsoft Defender for Business](https://learn.microsoft.com/en-us/defender-business/mdb-overview) brings Defender for Endpoint's capabilities, including EDR, to businesses of up to 300 users; it is included in Microsoft 365 Business Premium, and MSPs can connect it to RMM and PSA tools. [CrowdStrike Falcon](https://www.crowdstrike.com/en-us/platform/endpoint-security/) and [SentinelOne's Singularity Endpoint](https://www.sentinelone.com/platform/endpoint-security/) are common alternatives. One detail matters for remote support. CISA points out that RMM software is signed with valid code-signing certificates, so it does not look suspicious to antivirus or EDR, and that RMM install paths are often excluded from EDR inspection. Do not exclude your RMM's folders wholesale to quiet alerts, and use EDR to flag remote access software you did not approve, as CISA recommends. What to look for: coverage for every operating system you run, device isolation, alerts on newly seen remote access tools, and someone (your team or a provider) who reads the alerts every day. ## 9. Backup: a copy you have actually restored Remote support includes getting data back: a deleted folder, a corrupted mailbox, a laptop left on a train, a ransomware attack. Cloud services do not remove the need for backup. [CISA's #StopRansomware guide](https://www.cisa.gov/stopransomware/ransomware-guide) tells organizations to review the cloud shared responsibility model so they know what remains their job, and to back up often, offline or cloud-to-cloud. For Microsoft 365, [Microsoft 365 Backup](https://learn.microsoft.com/en-us/microsoft-365/backup/backup-overview) covers SharePoint sites, OneDrive accounts and Exchange mailboxes, and third-party services such as [Veeam Backup for Microsoft 365](https://www.veeam.com/products/saas/backup-microsoft-office-365.html) cover Exchange, SharePoint, OneDrive, Teams and Entra ID. For servers, CISA's baseline is offline, encrypted backups of critical data, tested regularly, because many ransomware variants look for backups they can reach and delete or encrypt them. The [joint advisory on Gunra ransomware](https://www.cisa.gov/news-events/cybersecurity-advisories/aa26-222a), published in August 2026, describes actors deleting backup data at a victim's primary data center and its disaster recovery center, and calls for offline, immutable backups in a physically separate, segmented location. Keep the backup console out of reach of everyday tools. If the stolen RMM or admin account that reaches your devices can also delete your backups, you have one copy, not two. What to look for: coverage of every SaaS app that holds business data, retention long enough to notice a problem, copies a compromised admin account cannot delete, and a restore test on the calendar. ## 10. Monitoring and status: know before the user calls Monitoring answers two questions before the phone rings: is something of ours broken, and is it someone else's outage? - **Your own systems.** The RMM watches devices. For websites, servers and internet links, add an external uptime check. [Uptime Kuma](https://github.com/louislam/uptime-kuma), a self-hosted monitoring tool, checks HTTP(S), TCP, ping and DNS records, sends notifications through Slack, email and dozens of other services, shows certificate information and publishes status pages. - **Your providers.** In the Microsoft 365 admin center, Service health lists current incidents and advisories; [Microsoft suggests checking it](https://learn.microsoft.com/en-us/microsoft-365/enterprise/view-service-health) before calling support or spending time troubleshooting, and keeps a separate status page for when you cannot sign in. Google publishes the [Google Workspace Status Dashboard](https://www.google.com/appsstatus/dashboard/) for Gmail, Drive, Meet and its other services. Checking status first is the cheapest troubleshooting step in remote support: if Exchange Online has an active incident, no remote session to the user's laptop will fix Outlook. What to look for: alerts that go to a channel someone watches, not a shared inbox; status pages bookmarked for every critical service; and at least one check that runs from outside your network. ## Securing the remote support stack itself The tools that let you fix a laptop from anywhere let an attacker do the same. Three patterns keep recurring: - **Phishing that runs a legitimate tool.** In January 2023, CISA, NSA and MS-ISAC [warned about malicious use of RMM software](https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-025a): help-desk-themed phishing led US federal employees to download ScreenConnect and AnyDesk as portable executables set to connect to the criminals' own server. Portable versions run in the user's context without installation or administrator rights, so they get past controls on software installation, and RMM software generally does not trigger antivirus. - **Calls from "IT".** From mid-April 2024, [Microsoft tracked a group it calls Storm-1811](https://www.microsoft.com/en-us/security/blog/2024/05/15/threat-actors-misusing-quick-assist-in-social-engineering-attacks-leading-to-ransomware/) phoning users while posing as IT or help desk staff, and from late May using Microsoft Teams as well, to get them to open Quick Assist; the attacks went on to deliver ScreenConnect, NetSupport Manager and Black Basta ransomware. The Scattered Spider advisory, updated in July 2025, adds the reverse: attackers posing as employees to get help desks to reset passwords and move MFA to devices they control. - **Exploiting the tool itself.** In February 2024, [ConnectWise disclosed an authentication bypass](https://www.connectwise.com/company/trust/security-bulletins/connectwise-screenconnect-23.9.8) in ScreenConnect 23.9.7 and earlier, scored 10, the CVSS maximum; servers in ConnectWise's cloud were fixed by the vendor, while self-hosted servers needed their owners to update. In June 2025, CISA reported [ransomware actors using unpatched SimpleHelp RMM](https://www.cisa.gov/news-events/cybersecurity-advisories/aa25-163a) (version 5.5.7 and earlier, CVE-2024-57727) to reach customers of a utility billing software provider. The August 2026 Gunra advisory still lists AnyDesk among the legitimate tools its actors used. ![A laptop inside an office network runs two remote tools: a grey approved agent linked to the company console, and an orange unapproved program that connects out through the firewall to an unknown console.](https://computese.com/images/blog/top-10-essential-tools-for-remote-it-support/rogue.c8653985bf-1536.webp) *To the firewall, a portable remote tool calling home looks like any other outbound session, so the control has to sit on the device.* ### The controls that matter 1. **One approved tool per job, and nothing else.** Keep an inventory of your remote access and RMM software, and use application control to block everything else, portable versions included, as CISA recommends. If you have standardized on Remote Help or another tool, Microsoft recommends blocking or removing Quick Assist, which is installed by default on Windows 11. If Remote Help is your tool, uninstall Quick Assist rather than blocking its network endpoint: Microsoft notes that Remote Help relies on the same endpoint, so blocking it breaks both. 2. **MFA on every technician account.** CISA asks providers to put MFA on every account with access to customer environments and to treat those accounts as privileged. Use phishing-resistant methods for any console that can reach every device. 3. **Least privilege.** Separate roles for viewing, controlling and scripting; unattended access only where needed; read-only accounts for monitoring; and a fresh MFA prompt on mass actions. 4. **Logs the tools cannot delete.** Send session and console audit logs to a separate system, keep the power to change or delete them out of reach of the RMM, as CISA advises, and review them for sessions nobody can explain. 5. **Patch the tools, expose nothing extra.** CISA puts internet-facing remote access and management servers and agents first in the patching queue; a vendor-hosted version moves that job to the vendor. Keep RDP off the internet. Where you can, apply CISA's stricter option: allow the authorized RMM only from inside your network over a VPN or virtual desktop, and block common RMM ports and protocols at the perimeter. ### Verify every caller Tell users that IT will never ask them to install a remote tool, open Quick Assist or read out a code on a call they did not expect. A genuine session starts from a ticket they raised or a call they placed to a number they already have. Hold the help desk to the same rule. Before resetting a password, changing MFA or starting a session for someone who called in, confirm the person through a channel the caller does not control: call back on the number in your directory, check with their manager, or match the request to a ticket. Recover a lost sign-in method with a Temporary Access Pass after that check, never by turning MFA off. > [!WARNING] > If someone calls or messages on Teams claiming to be IT and asks you to open Quick Assist, install a remote tool or read out a code, stop and call your IT contact on the number you already have. Attackers have used exactly this approach to deliver ransomware. ### If an outside provider supports you CISA's guide gives customers of [managed service providers](https://computese.com/optimizing-remote-work-through-outsourced-it-help-desk-support/) three tasks: understand which security services the contract covers, require the provider to log its presence, activities and connections in your systems and to share those logs with you, and make sure the provider's accounts are monitored and audited. Also ask which remote access and RMM agents the provider installs, and whose tenant the admin accounts live in. Our [IT support service](https://computese.com/services/it-support/) works on those terms: tools only from an approved list and recorded in your documentation, remote sessions only with the user's consent and logged, and admin accounts that belong to your tenant. A forgotten RDP port or an unpatched remote access server is the kind of exposure our [security scanning](https://computese.com/services/security-testing/) looks for from outside: exposed services, open ports and known CVEs in software versions. ## How to put the stack together for a small team Add the tools in the order that removes the most risk first: 1. **Identity and MFA.** Everything else signs in through it. 2. **Device management and EDR.** Every device enrolled, encrypted and watched. 3. **One remote access tool and an RMM**, often the same product, locked down as above. 4. **Ticketing, documentation and a password manager**, so work is recorded and repeatable. 5. **Backup and monitoring**, with a restore test and alerts someone receives. Suites cover several jobs at once: NinjaOne's product line spans RMM, backup, patch management, MDM and documentation, and Microsoft's own tools (Entra ID, Intune, Remote Help, Defender for Business, Microsoft 365 Backup) cover several of the ten jobs under one identity. Fewer consoles mean fewer things to secure, but also one account that reaches everything; CISA warns that an attacker who compromises an MSP can reach a large number of its customers. Either way, the controls above apply to the platform as a whole. ### A remote support call, tool by tool With the stack in place, a typical call touches most of it, in this order: 1. **Status pages:** is it a provider outage? 2. **The RMM:** alerts, disk space, recent updates and installed software on the user's device. 3. **The ticket:** open or find it, and verify the user if they called in. 4. **An attended session** through the approved remote access tool, with the user's consent. 5. **The fix, written down:** a note on the ticket, and a documentation update if the problem could come back. ## Key terms - **Remote monitoring and management (RMM)**: Software that installs an agent on each device to report its health continuously and let technicians patch, script, inventory and control it from one console. - **Attended and unattended access**: Attended support needs the user present to accept the session. Unattended access connects to a device with nobody at it, such as a server at night: convenient, and the access attackers most want. - **PSA (professional services automation)**: The platform a managed service provider runs on: tickets, contracts, time tracking and billing in one system, often linked to the RMM. - **Mobile device management (MDM)**: Management of a whole device through the operating system's own enrolment: settings, apps, encryption, updates, compliance, and remote lock or wipe. - **Endpoint detection and response (EDR)**: Security software that records activity on each device, detects attack behaviour rather than only known bad files, and lets a responder isolate the device. - **Phishing-resistant MFA**: Sign-in methods that a fake page or a persuasive caller cannot relay, such as passkeys and FIDO2 security keys, Windows Hello for Business and certificate-based authentication. - **Conditional Access**: Microsoft Entra rules that allow or block a sign-in based on the user, the app, the device's compliance, the location and risk signals. - **Windows LAPS**: Windows Local Administrator Password Solution: a Windows feature that rotates each device's local administrator password and backs it up to Microsoft Entra ID or Active Directory. - **Portable executable**: In CISA's usage, a self-contained copy of a program that runs in the user's context without installation or administrator rights, which lets it slip past software installation controls. ## Common questions ### What tools do you need for remote IT support? Ten kinds, each for a different job: remote access, RMM, ticketing or PSA, device management (MDM), identity with MFA, a password manager, documentation, EDR, backup and monitoring. A small team can start with identity, device management, EDR and one remote access tool, then add the rest as devices and requests grow. ### What is the difference between RMM and remote desktop software? Remote desktop and screen-sharing tools open a live session to one device when someone needs help. RMM installs an agent that runs all the time, reporting health and letting technicians patch, script and inventory every device without a session. RMM platforms such as NinjaOne and Datto RMM include remote control as well. ### What are zero-infrastructure remote control tools? Tools that need no VPN, port forwarding or server of your own, because both computers connect outward to the vendor's relay service. Quick Assist works this way over port 443. The convenience cuts both ways: an attacker's copy connects just as easily, so pair these tools with application control that blocks unapproved ones. ### Is Quick Assist safe for business IT support? It is safe when the user asked for help and knows the helper, but it was built for ad hoc help: no roles or policies, and no logs on either device. Microsoft suggests Intune Remote Help for organizations supporting users in their own tenant, and blocking Quick Assist where another tool is standard, because attackers have used it in phone scams that led to ransomware. ### What endpoint tools are best for remote IT support? No single product is best; the endpoint layer is a set of jobs. You need device management (MDM, RMM or both), EDR and a remote access tool, all signing in through your identity provider with MFA. In a Microsoft 365 organization, Intune, Defender for Business (designed for up to 300 users) and Remote Help cover those jobs under one identity; add an RMM when you need continuous monitoring and scripting across many devices or clients. ### How do attackers misuse remote support tools? Three ways: they trick users into running a legitimate tool that connects to the attacker, they phone users while posing as IT to start a session, and they exploit unpatched remote access servers. The defences are an allowlist of approved tools, MFA, least-privilege roles, independent logs, prompt patching and verifying every caller. ## Sources 1. [Use Quick Assist to help users](https://learn.microsoft.com/en-us/windows/client-management/client-tools/quick-assist), Microsoft Learn 2. [How to use Remote Desktop](https://support.microsoft.com/en-us/windows/experience/connectivity-networking/how-to-use-remote-desktop), Microsoft Support 3. [Share the screen of another Mac](https://support.apple.com/guide/mac-help/mh14066/mac), Apple Support 4. [Use Remote Help with Microsoft Intune](https://learn.microsoft.com/en-us/intune/remote-help/), Microsoft Learn 5. [Microsoft Intune advanced capabilities](https://learn.microsoft.com/en-us/intune/fundamentals/advanced-capabilities), Microsoft Learn 6. [Guide to Securing Remote Access Software](https://www.cisa.gov/resources-tools/resources/guide-securing-remote-access-software), CISA, NSA, FBI, MS-ISAC and INCD 7. [#StopRansomware Guide](https://www.cisa.gov/stopransomware/ransomware-guide), CISA 8. [Datto RMM: Remote Monitoring and Management](https://www.datto.com/products/rmm/), Datto 9. [NinjaOne RMM](https://www.ninjaone.com/rmm/), NinjaOne 10. [ITSM software features](https://www.atlassian.com/software/jira/service-management/features/itsm), Atlassian (Jira Service Management) 11. [ConnectWise PSA](https://www.connectwise.com/platform/psa), ConnectWise 12. [Halo for managed services](https://www.usehalo.com/managed-services), Halo 13. [What is Microsoft Intune?](https://learn.microsoft.com/en-us/intune/fundamentals/what-is-intune), Microsoft Learn 14. [Jamf Pro](https://www.jamf.com/products/jamf-pro/), Jamf 15. [Apple Business Manager User Guide](https://support.apple.com/guide/apple-business-manager/welcome/web), Apple Support 16. [Scattered Spider (AA23-320A)](https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-320a), FBI, CISA and partner agencies 17. [Conditional Access authentication strengths](https://learn.microsoft.com/en-us/entra/identity/authentication/concept-authentication-strengths), Microsoft Learn 18. [Configure Temporary Access Pass to register passwordless authentication methods](https://learn.microsoft.com/en-us/entra/identity/authentication/howto-authentication-temporary-access-pass), Microsoft Learn 19. [1Password for business](https://1password.com/business-security), 1Password 20. [Bitwarden business password manager](https://bitwarden.com/products/business/), Bitwarden 21. [What is Windows LAPS?](https://learn.microsoft.com/en-us/windows-server/identity/laps/laps-overview), Microsoft Learn 22. [IT Glue IT documentation software](https://www.itglue.com/), IT Glue 23. [Hudu IT documentation](https://www.hudu.com/), Hudu 24. [Microsoft Defender for Business overview](https://learn.microsoft.com/en-us/defender-business/mdb-overview), Microsoft Learn 25. [CrowdStrike Endpoint Security](https://www.crowdstrike.com/en-us/platform/endpoint-security/), CrowdStrike 26. [Singularity Endpoint](https://www.sentinelone.com/platform/endpoint-security/), SentinelOne 27. [Overview of Microsoft 365 Backup](https://learn.microsoft.com/en-us/microsoft-365/backup/backup-overview), Microsoft Learn 28. [Veeam Backup for Microsoft 365](https://www.veeam.com/products/saas/backup-microsoft-office-365.html), Veeam 29. [#StopRansomware: Gunra Ransomware (AA26-222A)](https://www.cisa.gov/news-events/cybersecurity-advisories/aa26-222a), FBI, CISA, DC3, NSA, USSS and KNPA 30. [Uptime Kuma](https://github.com/louislam/uptime-kuma), Uptime Kuma project (GitHub) 31. [How to check Microsoft 365 service health](https://learn.microsoft.com/en-us/microsoft-365/enterprise/view-service-health), Microsoft Learn 32. [Google Workspace Status Dashboard](https://www.google.com/appsstatus/dashboard/), Google 33. [Protecting Against Malicious Use of Remote Monitoring and Management Software (AA23-025A)](https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-025a), CISA, NSA and MS-ISAC 34. [Threat actors misusing Quick Assist in social engineering attacks leading to ransomware](https://www.microsoft.com/en-us/security/blog/2024/05/15/threat-actors-misusing-quick-assist-in-social-engineering-attacks-leading-to-ransomware/), Microsoft Threat Intelligence 35. [ConnectWise ScreenConnect 23.9.8 security fix](https://www.connectwise.com/company/trust/security-bulletins/connectwise-screenconnect-23.9.8), ConnectWise Trust Center 36. [Ransomware Actors Exploit Unpatched SimpleHelp Remote Monitoring and Management to Compromise Utility Billing Software Provider (AA25-163A)](https://www.cisa.gov/news-events/cybersecurity-advisories/aa25-163a), CISA