Android device password not applying in Kiosk mode

[Noel Fairclough]

Hi everyone,

I'm not sure if I'm missing something here and please correct me if what I'm doing is not possible or by design.  

I'm setting up an Android tablet for single application use in Kiosk mode.  I'm using a QR code to enrol the device and get it configured.   Everything is working perfectly *except* no device password is being applied and I can specifically see the password policies failing to apply.  

I've configured the device password in the same policy that deploys the single use app.  So... Device Configuration -> Profiles -> Platform = Android Enterprise, Profile Type = Device Restrictions (Device Owner).  I've enforced to at least use a numeric pin, minimum lenght = 4,  Keyguard = Not configured.

My question ultimately is ..... is it possible to configure a device/screen lock password/pin on a kiosk device?  My use case here is the device is for single app use, by a trusted person.  The person will know the pin to unlock the device, but the device does not have any other purpose than running this one application, and the device should not be used for anything else other than running this one application.

I can see all the settings I've configured applying successfully, except the device password ones.  

Any advise on if this is possible and if so, where I can start troubleshooting?  

[#2 · Accepted solution]

This is by design in Android Enterprise - Dedicated Devices (Kiosk) mode.  You can configure the PIN/password via compliance or configuration policy but it doesn't get enforced as there is no Company Portal on the device in this scenario. The solution is to include in your documentation and processes that the owner/technician sets up a PIN after device is setup.

[#3]

Thank you very much for replying Shuchi.  This is good to know.  

[#4]

It's a real Kiosk mode device. 🙂

[#5]

Good morning,

I'm experiencing the same issue on fully managed corporate devices, can you confirm if it's possible to force a PIN on these devices?

[#6]

@Durrante I would expect it to work in that scenario. Forcing a PIN complexity is a very big deal for user assigned devices.

[#7]

@Noel Fairclough 

If you use a 3rd party app to set a PIN, the policies to indeed get enforced - you just need to get the initial PIN there.

We wrote our own little app to do this function and is pushed down to the clients as part of the profile.

[#8]

@Brett James , so there's no way of setting a pin requirement via Intune natively?

[#9]

@Noel FaircloughAnd @microsoft 

I am in a "worst case scenario" with passcode forcing:

• I have enrolled an android device in Kiosk mode using QR code (so 100% corporate with no user associated).
• After testing around the kiosk mode (which I'm very happy with by the way) I've tried around passlocking the device.
•  I've sent a "reset passcode" action from the intune portal . Quite happy this applied almost immediatly after showing a message around the lines of : "this will reset passcode on the device, it will appear here (I supposed the screen from where the passcode is reseted) for the next 7 days"
• I still haven't found the passcode from the screen. Have also tried looking into getting that from the company portal as indicated on some microsoft documentation, impossible to access (using tenant global admin or simple user) so stuck with not knowing temporary passcode
• Finally I had a (not at all) brilliant idea: wipe the device. Just to realise that the passcode that was enforced by intune is set before Android even launches, which prevent any "wiping" from happening, apparently needs android to have started first...

Quite a few lessons learned there, but no way to get my device back for know while I have global admin on our tenant.... Any help welcomed.

[#10]

@BrettJames with you app can you set the passcode via an application config? Also is it possible to change the pin like the native reset passcode command but specify it to what you want? You mentioned some third party apps any that you can recommend? Cheers

[#11]

@Shuchi Mehta  How does one set up PIN on device after device setup? (kiosk)

[#12]

@Eaglebeek76  In my use case, I have the policy configured to Exit Kiosk Mode with a PIN.  So, once you exit Kiosk Mode (by pressing back button on screen multiple times) you can get to the settings app on device and then Set the screen lock as PIN. 

[#13]

@Shuchi Mehta  Before I try this, how does one reenter kiosk mode? 

[#14]

@Eaglebeek76  you would swipe up (or go to apps) and search for Managed Home screen app. Once you click on that it takes you back to the Kiosk Mode/screen.