Support Tip: Enabling kiosk mode on Android and iOS devices

Published Mar 29 2019 10:30 AM 34.1K Views

Hi everyone, today we have another post from Intune Support Engineer Saurabh Sarkar. In this article, Saurabh talks about kiosk mode and the different options available for the Android and iOS platforms, so if you’re thinking about implementing kiosk mode in your environment then you’ll definitely want to give this a quick read.




Recently I’ve had a few questions about setting up corporate-owned, kiosk-style devices so I thought this would be a good opportunity to go through some of the details of this scenario and show a couple examples of how to set this up on Android and on iOS.


Devices running in kiosk mode are used for a specific purpose, such as digital signage, ticket printing or inventory management, and are traditionally company owned and not associated with any user. These devices can be configured to run multiple applications in kiosk mode (available only for Android KNOX and Android Enterprise devices) or a single app which is available for Android as well as supervised iOS devices. Below is a brief example of each.


Android KNOX Devices

  1. From the Intune portal, go to Device Configuration and create a new Device Restriction profile.
  2. In your profile, make sure the platform is set to Android and the profile type is set to Device Restrictions.
  3. Under Kiosk settings, add the apps you want to run in kiosk mode. These can be by package name, by URL or by choosing a store app. You can choose a single app, or you can choose multiple apps in the profile thus rendering the experience of multi-app kiosk mode:



Android Enterprise Devices

  1. From the Intune portal, go to Device Configuration and create a new Device Restriction profile.
  2. In your profile, make sure the platform is set to Android enterprise and the profile type is set to Device Owner Only – Device Restrictions.
  3. Under Dedicated Devices, select Single App or Multi-app, then specify the apps you want to use as appropriate.


Note that for multi-app dedicated devices, the Managed Home Screen app from Google Play must be added as a client app in Intune, and it must be assigned to the device group created for your dedicated devices. The Managed Home Screen app isn't required to be in our Device Restriction profile enabling kiosk mode, it just needs to be added as a client app. When the Managed Home Screen app is added as a client app, any other apps are shown as icons on the Managed Home Screen app. For more information see the documentation on Device Restriction profiles here.


iOS Devices

Kiosk mode on iOS differs from the Android platform in that only single app kiosk mode is available and it requires that devices be supervised. Supervised mode can be enabled by Apple Configurator (which requires a reset of the device) or during Intune enrollment via DEP. More details on this can be found in our documentation here. The steps to create a kiosk mode profile are below.

  1. From the Intune portal, go to Device Configuration and create a new Device Restriction profile.
  2. In your profile, make sure the platform is set to iOS and the profile type is set to Device Restrictions.
  3. Under Kiosk settings, choose Managed App, Store App or Built-in App, then choose the app you want to use. Note that we can only choose one application in the profile.



Alternative Options for iOS Devices

If the requirement is to run multiple applications on a DEP iOS device in kiosk mode, pushing a kiosk profile would not suffice as it only provides the option of choosing one application. While only single app kiosk mode is currently supported for iOS devices, you can achieve similar functionality by implementing the following:

  1. Assign the desired apps to the device group from Intune the conventional way. (Client Apps -> Add App).
  2. Assign a Device Restriction profile and select "Show or Hide apps" as illustrated below. In the ‘Visible Apps’ section you can select multiple apps that will be visible to the user while everything else remains hidden.


In this scenario, the device would only have the two applications visible and others such as the built-in apps Contacts/Camera/Appstore will be hidden from the user, giving you an experience similar to that of multi-app kiosk mode. Just be aware that as with single app kiosk mode for iOS, this setting is only available for supervised devices enrolled in Intune using DEP.


Saurabh Sarkar

Intune Support Engineer

Occasional Contributor

Hi @J.C. Hornbeck 

I have been deploying kiosk devices (Samsung - various tablets and phones) very successfully. One "quirk" that has become a bit of an issue with some of the devices is the fact that after the Android devices upgrade to Android 9.0; the power button no longer works as far as bringing up the Power Dialogue UI. Power off and Restart are no longer possible. This means devices not in use have to be boxed and stored while powered on. The only way to power off the devices is to exit/pause Kiosk mode and then the dialogue appears and one is able to shut the devices down.

This is not an issue for the devices held at site but for those already deployed; revealing that escape passkey to users actually defeats the whole reason for having one in the first place. Could you shed any light on this, have you heard rumbles on this already?


Kind Regards




@MoZZa I can't say I've heard of that issue before but it definitely sounds like something we should take a look at. Your best bet would be to open a case with our support team so we can investigate further. You can find information on how to open a support case with us here: How to get support for Microsoft Intune.



Occasional Contributor

Hi @J.C. Hornbeck 

I have raised a ticket and the engineers were able to reproduce this issue in the lab. So they are working on it now. 

Senior Member

I've been unable to hide the "settings" app when in supervised mode using the show/hide option.  Is there a workaround to this? 

Occasional Contributor

Hi @anorwood 

Are you running Kiosk or Fully Managed?

Senior Member

Like @anorwood says, if you hide everything bar the app you want to make a kiosk app and one other (in my case, Camera), then Settings also remains visible... going to have a look at disabling as much as possible within Settings but this is hardly an elegant (or robust) solution. Also doesn't look like the would-be kiosk app will automatically launch. :(

FWIW - my ask is the same as the OP here: - I have an single app which requires access to the Camera, but there doesn't appear to be [an obvious] way to enable this whilst using Kiosk mode.

Occasional Contributor

Hi @Daniel Harrison ,


I was in a similar situation on a number of occasions.

Scenario 1 - 7 app, 5 weblink Kiosk build. Catering dept. who wanted to take pictures of the meals produced for the their web site menu, so they needed access to the camera as a standalone app. 

Solution 1 - Added a 3rd party camera app, I think it was called 'Open Camera'.


Scenario 2 - Single app Kiosk build. The app required access to the camera, but had a basic UI within the app.

Solution 2 - Created an App configuration policy for the app, granting access to the camera, local storage etc. One issue though, was that the users were not able to view the pictures taken; on the device. So were not available until they uploaded them. To circumvent this; I installed a 3rd party app called 'Simple Gallery'. This allowed them to view the pictures/videos taken. Shortly after the Vendor contacted the gallery app developer and added a simple gallery/media viewer to their app. 


Hope this assists in some way. Whether in Kiosk or Fully Managed mode; separating, enabling/disabling the system apps is an all or nothing game at the moment.

Senior Member

Thanks @MoZZa - that's really helpful.

I'm closer to your 2nd scenario in that I have a single 3rd-party-developed app which we want to run in Kiosk mode. It includes a "take picture/video" option (for uploading media)  - which is what triggers the permissions prompt. It did occur to me that there may be a way of creating an app configuration policy to grant permission, but I wasn't 100% clear whether the policy should be for the app I'm deploying, or for the built-in Camera app (?). Either way, it looks to me like I'd need a definition of what settings are possible and the XML syntax for them from the app's developer - or an example of the syntax from Apple (if the policy needs to be applied to Camera). Am I on the right track with either of those?


What I seem to have found with a test device, after posting yesterday, is that by taking the device out of Kiosk mode, but still targeting the app to it, I was able to open the app, agree permissions for Camera, then apply Kiosk mode. Looks to have stayed working, but I don't fancy doing that at scale if I can somehow push a config for it!

Occasional Contributor

Hi @Daniel Harrison ,

The app config policy should be for the 3rd party app. First of all, just to prove that it's actually possible, some apps are better than others, is to "Any-Any :lol:" equivalent settings, like below:-

App Config Policy.png

 If it works, then harden all the permissions until it breaks and then revert back one permission. Also, 'Auto Grant' is the best way to go as the Kiosk build by nature will not always allow an apps notification to appear on top. Most do, but not all.

I have used this for 90% of the apps that rely on system or built-in resources. WhatsApp, etc. all require app config policies.
Good luck, 

PS - Here are the icons for the apps I used to replace the camera and gallery system apps. I also ended up having to deploy

these to the departments Fully Manged build too; as they really liked them! 





Senior Member

Hi @MoZZa  - am I missing something? That's an Android app, and the same degree of configuration doesn't seem to be there for an iOS app:


Occasional Contributor

Hi @Daniel Harrison ,


The level of configuration does change, But using the Design Config Tool or use the xml method. The vendor should be able to let you know what the configurable items are, outside of the standard ones.

Occasional Contributor



Does anyone know how you can show the phone app on the managed home screen? I have managed to get contacts to show using google managed play and deploying the App but not the Phone App. Interestingly you can use the contacts to start a call but then cant hang up. 


I also have the issue with the power button no longer working. I am using Samsung xcover 4's but not through Know enrollment.

Occasional Contributor

Hi @AndyfF360 

The best way is to use the new-ish "Android Enterprise System App" type option when creating a new app. This allows you to add the built-in System apps that you either blocked by using KME or using a Kiosk build. What I did was to install the GET APK app. This allows you to see what the application names are for all the System and Installed apps on your device. for example the Phone app is called

You use this as the Package Name, when creating the new app. This method allows you to add system apps to your build. I previously used 3rd party apps for Phone, Camera, Calendar etc. Now, I only use the system apps for the standard apps.

The PowerUI issue has been causing me grief since June. I have had an escalated call open with MS since June. They are now (allegedly)  sorting this out with Google. Basically the PowerUI no longer has the permission to appear on top of the Managed Home Screen. When you exit Kiosk mode the PowerUI options appear. They thought they had resolved the issue a few weeks back, but, it only worked for the first time the device was switched on after building.

I am chasing them on a daily basis.

Occasional Contributor

hi @AndyfF360 ,


Just had an update from MSFT on the PowerUI issue.
Google should be fixing this in the November update. Extract from ticket notes:


Google have announced that the fix for this behaviour will be implemented in the November update for DPC, which should be around middle of the month. This update will also include other features provided by Google, and also more AM API's for future integrations with Intune or similar MDM solutions.

Occasional Contributor

Hi @AndyfF360 

If you need to restart you Android 9 Kiosk devices, you can use the old method of pressing the Power + Volume-Down buttons at the same time for approx 7 seconds. this will force a device restart. I hadn't used this since the early days of non-removable batteries and crashing devices :lol:
I have tested this on Samsung J5's, J6's and various tablets. However, it didn't work on One+6's.

Occasional Contributor

Hi All, @Intune Team @Intune Support Team 


Quick question about Android Enterprise Dedicated Devices (Kiosks) BUT, I noticed this morning (24/11/19) 11:00am UK time) for the first time that whilst working on 3 different builds, customising the App orders and locations etc. to my surprise the Microsoft Intune app started to install on all the devices. when you tap the icon, you get a screen saying that you have successfully installed the device or setup the device.
I am assuming this is connected with either the compliance or conditional access. I really don't know. Has anyone else spotted this?

Hi @MoZZa, starting with the 1911 update, The Microsoft Intune app must be present on the device for deployment to work.

As a result, we've updated the enrollment experience for Android Enterprise dedicated devices. New enrollments still start the same (with QR, NFC, Zero-touch, or device identifier) but now have a step that requires users to install the Intune app. Existing devices will start getting the app automatically installed on a rolling basis. (Which explains the behavior you've experienced).


If there are any issues with the Intune app, or deployments not working as expected, please let us know!


Cheers and Happy Holidays!

Occasional Contributor

Hi @Intune Support Team 


Thank you for the feedback. I have also noticed that compliance policies also deploy to dedicated devices now; without the issue of it blocking any device configuration policy changes being deployed.


Many Thanks!!!

Frequent Visitor

Hi @Intune Support Team,


Once an iPad is in Kiosk Mode, is there a way of powering it off or getting out of kiosk mode for maintence?  

Occasional Visitor

Can I deploy over 100 supervised iOS devices in this manner using one single account? I've read information on using a device enrollment manager account for large scale deployments but one bullet point it mentions is that you can't enroll via Apple's DEP, meaning these devices wouldn't be supervised. Without having to manage 10+ accounts to accomplish this, what other option does Intune offer? 

@Kfinkbiner - The device can be placed out of Kiosk mode by un-assigning the assigned Device Configuration profile with the Kiosk settings, and preforming a sync and reboot of the device.


@nothinglasts1987 - The team is aware of DEM support for DEP, and there is an existing UserVoice item you may want to add your vote to: Support DEP, Apple Configurator and ASM for iOS Device Enrollment Manager (DEM) accountAs a workaround today, standard accounts would need to be leveraged to enroll within Intune.

Occasional Visitor

@Saurabh Sarkar if  Teams  on ipad is on Kiosk mode how come that there is no way to answer the call, it will only ring but it does not give an option  to answer it. Any idea about this? Thank you in advance

Hi @Lhea143, if you continue facing an issue with Teams not working as expected in Kiosk Mode for iOS devices, please open a support case via the Intune Admin console's Help and Support or any of the methods here, as this will help the team capture all the information needed to further investigate the issue. Also, please direct message us with your support case number for follow up.

Occasional Contributor

Hi All,

Just a quick tip that may come in useful for anyone who is deploying Android Corporate-Owned Dedicated Devices (Kiosks) and have noticed how hit and miss the System Software updates are on some devices. I have noticed this on Samsung phones and tablets and one or two other manufacturers.

Initially, the workaround was for once a month a few devices would be taken out of kiosk mode and updated that way. Now there are 1000's of device deployed; this is not feasible. So a solution was needed.

Please note, I have deployed this to a number of makes a models and works well with all so far.

Basically, I located the built-in system app that checks for updates but is also the UI for "Software Update" in the Settings menu.
Add this as an Android Enterprise System App, assign your kiosk dynamic group, add to the device configuration and also add it to you Managed Home Screen App Configuration Policy. Now even when in full kiosk mode, the user will be able to install updates when prompted and also check if there are any updates available for download & install.

Hope this helps.
For the full screen shot doc, give me a shout and I'll post on here. Just need to do a bit of editing.


Occasional Contributor

Hi All, Hi @Intune Support Team 


On Android Dedicated Devices, I used to be able to enable the devices to be used as a phone whilst in kiosk mode by assigning (For Samsung) the telephoneui Android Enterprise System App and away it would go. This has stopped working, does anyone know of any "tweaks or Fixes"?
If not I'll keep testing until I find a solution and will post my findings


Hi @MoZZa, thanks for the feedback. We'll be following up with you over direct message to learn more about the scenario. Thanks!

Occasional Contributor

Hi @Intune Support Team ,

I tried to access the link you sent but it error'd out.


Anyway, I have made progress, I looked over some of my old notes and found some other methods I had tried in the past.

So, here goes...

For anyone who is tasked to create a Multi-App Dedicated Device (Android), but the clients require the phone to still be able to make phone calls; here are the steps required. This was carried out on Samsung Android J6 and A20 mobile phones.

If you are using another make of device you can install an app called "Get APK". This will allow you to search for the system apps which provide the functions required. That's what I used to discover the Samsung System Apps I needed.


Add the following apps to Intune as Android Enterprise System Apps:-

Samsung Dialer  - - Remember to add this to your Managed Home Screen JSON script in order for the Phone App to be visible.

Call Management - - Allows the device to make calls. Even if this does not appear to be listed as a System App, add it anyway.

In-Call User Interface - - Allows the device to answer incoming calls

Ensure you add the contacts app -


You will now be able to make and receive calls; even on a Dedicated (Kiosk) device. :) 






Senior Member

Hey @MoZZa


can i ask what the id was of the app for the software updates, facing same issue so this would resolve it


i have tried a couple of the ones that seem responsible, but either do not show up on managed home screen

Occasional Contributor

Hi @Adrian Bishop 

Really sorry for not replying, I've been out of the loop, been on some crazy projects.

For Samsung devices, (I haven't seen a name change to the agent going back as far as J5's) is called com.wssyncmldm

Add its an an Android Enterprise System App.
I will also ping up the Motorola, One+ and HTC equivalents later this week.

Occasional Contributor



Phone call working fine in multi app kiosk but it seems when we are using another app then no option to answer call its samsung tab 

Occasional Contributor

Hi @Bharat Chand 


I have come across this with older Samsung (similar) devices. I think it was on Samsung A510's and A520's.

In the end for these older devices we had to get the users to use them in "unlocked" kiosk mode.
That was because the telephony apps were actually governed by the Contacts app.
In newer devices it was easier to add the apps individually as Android Enterprise apps.
Sorry I can't recall which app allowed it but one is the UI that appears ontop of other applications that are open when the phone or tablet rings.
I will dig through my notes and upload the name(s) here

Occasional Contributor

@MoZZa this is resolved google has default phone app so after deploying the phone app and added in multikiosk resolved the issue 



Phone – Apps on Google Play 

Occasional Contributor

Hi @Bharat Chand,


Good discovery. Have you tried this as yet.
I will try it later today in my Sandbox and see how it behaves.
The only devices I am still having issues with are some older Samsung A510's & A520's
I'll do some testing and get back to you.

Occasional Contributor

@MoZZa  yes i tried and its working seamlessly without any issue. 

Occasional Contributor

Hi @Bharat Chand 


I have tried on some of the older devices and it is working perfectly.
Excellent find :cool:

Occasional Contributor

@Intune Support Team 

I know this is pretty old. However I have a new item for Kiosk on an iOS device. We are using Edge in Kiosk Mode. With a App config setting Favorites Allowed sites and a home page. We use Conditional Access and require App Protection and a Compliant device. We are pushing out Authenticator, Edge (VPP Device License), and using User affinity. Every thing works well when I have Kiosk Mode turned off. However I run into issues if I try and deploy a new device with Kiosk Mode turned on. It looks like the Edge App is unprotected and I get CA errors. It looks like in Kiosk Mode the Edge App cannot shut down and re-start correctly in order to be protected. 

As it stands now, I have to turn off Kiosk Mode deploy the new device and then turn Kiosk mode back on. Any suggestions or is this expected behavior? 

Occasional Contributor

I have configured an Android device (Samsung) in Kiosk mode to run only Teams. It seems to work well EXCEPT when in a call you cannot tap the ellipse (...) to transfer the call to another user.  It works when you first start the phone from shutdown or after a restart, but stops working after an hour or so. 


Anyone come across this? Have I set to many restrictions on the device? 

Hi @Coopem16, thanks for the feedback! If you continue facing an issue with kiosk mode not working as expected for iOS devices, let's get you over to our support folks for further investigation as this does not sound expected. You can raise a new support request via the Microsoft Endpoint Manager admin center's Help and Support blade or any of the methods here, as this will help the team capture all the information needed to resolve the issue. Once created, feel free to follow-up and share your support case number with us over a message for us to follow up. Thanks!

Occasional Contributor

@Intune Support Team Thanks I will open a case. 

Occasional Visitor

Not sure what I'm doing incorrectly, but I've tried several times unsuccessfully to get my Fully Managed A20's with KME as Kiosk... I set them up with the dedicated device single app device restriction configuration profile as shown above and assigned my group.  My app is also set up as required, which does get installed correctly, just not in kiosk mode.  


Any advice?


Thanks, Chris

Version history
Last update:
‎Jun 27 2019 08:19 AM
Updated by: