Remote vs Onsite IT Support: What Needs a Visit?

Remote IT support fixes a fault without anyone travelling, so work starts as soon as an engineer picks up the ticket. The engineer connects to the device, or to Microsoft 365 and the device management console, finds the cause and fixes it, often while the user watches. Sign-in problems, email, software, device settings, security alerts and network configuration are all handled this way. A visit is needed only when something physical has to happen: a failed part replaced, a loose lead reconnected, or a device that will not switch on. This guide sorts faults into those two groups and explains how secure remote sessions work. See how our remote IT support services work day to day.

Which IT problems can be fixed remotely?

Faults that live in software, in the cloud or in a device's settings can normally be fixed remotely, as long as the device is switched on and online. That condition matters: Microsoft's Intune documentation states that devices must be connected to the internet to receive remote commands.

• Sign-in, passwords and MFA: locked accounts, password resets and setting up an authenticator app on a new phone. With Microsoft Entra self-service password reset switched on, users can reset their own password with no administrator or help desk involvement.
• Email and Microsoft 365: new users, licences, mailboxes, and Teams and SharePoint permissions.
• Software: installs, updates, licence changes and applications that crash or will not open.
• Device settings and health: with Intune, an engineer can push the latest policies with a sync, restart a device or collect diagnostic logs without being on site, and lock or wipe a laptop that has been lost.
• Security: patching, antivirus scans and alerts. Intune lets a security team start a Microsoft Defender Antivirus scan remotely.
• Rebuilding a Windows PC: Windows Autopilot Reset brings a device back to a business-ready state, which Microsoft notes is useful in break and fix situations.
• Printers: drivers, print queues and fault-finding.
• Network: firewall and WiFi configuration, firmware, a VPN that fails for one user, and logging and chasing an internet outage with your ISP.

At GR, accounts, email, device settings, security, patching, backups and network configuration are all handled remotely, on every package.

Which problems need someone on site?

A visit is needed when the fix needs hands: something has to be touched, replaced, reconnected or switched on.

• A device that is dead or offline: a laptop that will not power on, or a device with no network connection at all, cannot receive remote commands.
• Failed hardware: a broken screen, keyboard, disk or power supply, or a firewall, switch or WiFi access point that has to be swapped.
• Physical connections: a network or power lead that has come loose, or a device moved to a new desk or room.
• Replacement equipment: fitting a new firewall, switch or access point in a rack or comms cupboard.
• Recovery at the device itself: a device that needs a reset button pressed or a direct connection to bring it back.

Even then, the first step is remote. The engineer diagnoses the fault and confirms what has failed before anyone travels, so a visit, if one is needed, has a clear job. Many of these tasks are simple enough for a member of your own staff to do while an engineer talks them through it.

How does secure remote support work?

Secure remote support means three things: the user agrees to each attended session, the engineer has only the access the job needs, and every session leaves a record.

The tool and the rules around it matter as much as the engineer. The US Cybersecurity and Infrastructure Security Agency (CISA) warns that cyber threat actors increasingly co-opt remote access tools for access to victim systems.

Intune Remote Help. Microsoft describes Remote Help as a cloud-based remote support solution that lets IT support teams connect securely to a user's device. The helper and the user both sign in with corporate Microsoft Entra ID accounts for each session, so it only works inside your organisation's tenant. Administrators set role-based rules for who can help and what they can do, including who can use elevated rights. The helper sees a warning before connecting if the device is not compliant with its policies, and reports show who helped whom, on which device and for how long. Conditional Access can require MFA for helpers. On corporate-owned, Intune-managed Windows devices, unattended remote sign-in lets an authorised helper troubleshoot without the user present, under role-based access control and auditing. See how we set up Intune Remote Help in the UAE.

Quick Assist. Quick Assist lets a person share their Windows device with another person over a remote connection. On a Mac, it is available only when working with Microsoft Support. The user selects Allow before the screen is shared, and is asked again before the helper can take control. It creates no logs on either device, and Microsoft suggests that organisations using it inside a single Entra tenant consider switching to Remote Help for enterprise-grade controls.

Whatever the tool, a safe set-up has the same parts:

• One approved remote tool, with unused ones disabled or removed.
• Named engineer accounts with MFA, never shared logins.
• The user's consent for every attended session.
• Access limited to what the task needs.
• A log of every session that you can review.
• Staff who accept a session only when they asked for help. Microsoft's own advice is to allow a helper to connect only if you started the conversation with your IT support staff.

Is remote support as fast as onsite support?

For a fault that can be fixed remotely, remote support starts sooner, because nobody has to travel before the work begins. At GR, response means an engineer is working on your issue remotely, not an automatic reply. The targets on our IT AMC and managed IT packages are:

• P1, business stopped: 5 minutes, 24/7, on every package, with a resolution target of 4 hours.
• P2, a user or team blocked: 10 minutes in support hours, resolved within 1 business day.
• P3, work continues: 30 minutes in support hours, resolved within 3 business days.
• P4, low priority or a planned request: next business day, resolved within 5 business days.

Support hours are Monday to Friday 9:00 to 18:00 and Saturday 9:00 to 14:00. P2 and P3 run 24/7 on GR IT AMC Scale and GR Managed IT Professional, and are set in the contract on GR Managed IT Enterprise. On our IT AMC packages, the service manager is notified of a P1 within 30 minutes and a director is briefed within 1 hour. Every missed target is listed in your monthly report.

Response here means remote work. A visit is booked and charged separately. When a part has to be replaced, the fix also depends on the part and the warranty.

How are onsite visits handled and charged?

Every GR package is delivered remotely, so a visit is always booked and charged separately, on its own line of your invoice. When a fault needs hands on site, there are three routes:

• An engineer from us, at our onsite rate.
• Your hardware vendor's warranty engineer. We raise and manage the warranty claim with the vendor, including their onsite engineer where the warranty provides one.
• Your own staff, talked through the fix by one of our engineers.

An engineer's visit is charged in one of two ways: a booked visit of up to 3 hours, or an urgent visit billed by the hour. Travel within Dubai is included. Outside Dubai, travel is quoted when you book.

The cost drivers are simple: how many visits you need, whether they are booked or urgent, how long the work takes, and where the site is. The package itself is one yearly fee per user, paid in advance, and it does not include onsite hours.

What should a remote-first support contract say about onsite work?

It should state how a visit is requested, how it is charged and who handles hardware, so nobody has to work it out in the middle of an outage. Check for these points:

• Requesting a visit: who on your side can ask for one, and how it is approved.
• Charging: booked or hourly, how travel is charged, and how a site outside the city is quoted.
• What the response targets cover: whether they apply to remote work only, and what the contract says about visits.
• Hardware and warranty: who raises warranty claims, who meets the vendor's engineer, and who orders replacements.
• Spare devices: who keeps a spare laptop and a spare network device, and where. For a spare Windows laptop registered with Windows Autopilot, the user only has to connect to a network and sign in, and the rest of the set-up is automated.
• Remote access rules: the approved tool, how consent works, and where session logs are kept.
• A hands-on contact: a named person in the office who can restart a device or reseat a lead while an engineer guides them.

If your day-to-day problems are sign-ins, email, devices and the network, a remote package covers them, and a visit can be booked when a fault needs hands. Compare our IT AMC packages and managed IT services, or tell us how your office works and we will suggest the package that fits.