A method comprising: initiating, by a managed mobile device comprising at least one processor, a network interface, and a memory storing a remote assistance policy set comprising one or more remote assistance policies, a remote assistance connection with a remote support server via the network interface, wherein the managed mobile device is a personal device of a local user of the managed mobile device and is configured to access enterprise resources in a bring your own device, BYOD, environment; receiving, by the managed mobile device, via the remote assistance connection initiated with the remote support server, remote assistance input provided by a user of an administrator console device, the remote assistance input being received by the remote support server via an interface provided by the remote support server to the administrator console device; processing, by the managed mobile device, the remote assistance input based on the remote assistance policy set, wherein processing the remote assistance input based on the remote assistance policy set comprises: enforcing a first access policy of the remote assistance policy set that allows the user of the administrator console device to control one or more managed applications on the managed mobile device to which one or more enterprise policies are applied; and enforcing a second access policy of the remote assistance policy set that prevents the user of the administrator console device from controlling one or more unmanaged applications on the managed mobile device to which the one or more enterprise policies are not applied; and sending, by the managed mobile device, to the remote support server, one or more user interface updates based on processing the remote assistance input based on the remote assistance policy set. initiating, by a managed mobile device comprising at least one processor, a network interface, and a memory storing a remote assistance policy set comprising one or more remote assistance policies, a remote assistance connection with a remote support server via the network interface, wherein the managed mobile device is a personal device of a local user of the managed mobile device and is configured to access enterprise resources in a bring your own device, BYOD, environment; receiving, by the managed mobile device, via the remote assistance connection initiated with the remote support server, remote assistance input provided by a user of an administrator console device, the remote assistance input being received by the remote support server via an interface provided by the remote support server to the administrator console device; processing, by the managed mobile device, the remote assistance input based on the remote assistance policy set, wherein processing the remote assistance input based on the remote assistance policy set comprises: enforcing a first access policy of the remote assistance policy set that allows the user of the administrator console device to control one or more managed applications on the managed mobile device to which one or more enterprise policies are applied; and enforcing a second access policy of the remote assistance policy set that prevents the user of the administrator console device from controlling one or more unmanaged applications on the managed mobile device to which the one or more enterprise policies are not applied; and enforcing a first access policy of the remote assistance policy set that allows the user of the administrator console device to control one or more managed applications on the managed mobile device to which one or more enterprise policies are applied; and enforcing a second access policy of the remote assistance policy set that prevents the user of the administrator console device from controlling one or more unmanaged applications on the managed mobile device to which the one or more enterprise policies are not applied; and sending, by the managed mobile device, to the remote support server, one or more user interface updates based on processing the remote assistance input based on the remote assistance policy set.