Intune

How to Configure Kiosk Mode in Intune

Published 18 March 2026 · 8 min read

Kiosk mode locks a Windows device to one or more apps, preventing users from accessing the broader OS. It is used for digital signage, self-service terminals, shared reception devices, and staff workstations where only specific apps are needed. Intune deploys kiosk configuration using Assigned Access, configured via a Device Restrictions profile or a custom XML profile for complex setups.

Contents
  1. Single-app vs multi-app kiosk
  2. Prerequisites
  3. Configure single-app kiosk
  4. Configure multi-app kiosk
  5. Custom Assigned Access XML
  6. Auto-login for kiosk accounts

Single-app vs multi-app kiosk

📊
Kiosk type comparison
Single-app kioskDigital signage, kiosk terminals, interactive displays
Runs one UWP or browser app full screen
Multi-app kioskShared reception PCs, call centre workstations, shared tablets
Locked Start menu with approved apps only

Prerequisites

Configure single-app kiosk

Devices → Configuration → + Create → Windows 10 and later → Templates → Device Restrictions

Go to Kiosk section:

⚙️
Single-app kiosk settings
Kiosk mode
Single app, full-screen kiosk
User logon type
Auto logon (no credentials required) or Local user account
Application typeFor Edge in kiosk mode, select Microsoft Edge and set the kiosk URL
Store app
App User Model ID (AUMID)Find with: Get-AppxPackage | Select Name,PackageFamilyName
Your app AUMID from the Store
💡
Microsoft Edge kiosk mode
For browser-based kiosks, select Microsoft Edge as the app and configure the kiosk URL. Edge kiosk mode hides the address bar, navigation buttons, and all browser UI, showing only the web content.

Configure multi-app kiosk

Devices → Configuration → + Create → Windows 10 and later → Templates → Device Restrictions → Kiosk → Multi app kiosk

Multi-app kiosk requires you to specify:

For complex multi-app setups, use a custom Assigned Access XML profile.

Custom Assigned Access XML

For full control over the kiosk layout, deploy a custom XML via a Settings Catalog profile or OMA-URI:

<?xml version="1.0" encoding="utf-8"?>
<AssignedAccessConfiguration xmlns="http://schemas.microsoft.com/AssignedAccess/2017/config">
  <Profiles>
    <Profile Id="{kiosk-profile-id}">
      <AllAppsList>
        <AllowedApps>
          <App AppUserModelId="Microsoft.MicrosoftEdge_8wekyb3d8bbwe!MicrosoftEdge"/>
          <App AppUserModelId="Microsoft.WindowsCalculator_8wekyb3d8bbwe!App"/>
        </AllowedApps>
      </AllAppsList>
      <StartLayout>
        <![CDATA[<LayoutModificationTemplate>...</LayoutModificationTemplate>]]>
      </StartLayout>
      <Taskbar ShowTaskbar="false"/>
    </Profile>
  </Profiles>
  <Configs>
    <Config>
      <Account>kioskuser</Account>
      <DefaultProfile Id="{kiosk-profile-id}"/>
    </Config>
  </Configs>
</AssignedAccessConfiguration>

Auto-login for kiosk accounts

For unattended kiosk devices, configure auto-login via a Settings Catalog profile:

⚙️
Auto-login settings (Settings Catalog)
Setting
Windows Autologon
Username
kioskuser (local account name)
PasswordStore securely - this is in the Intune config
kiosk account password
Domain name
Leave blank for local accounts

Frequently Asked Questions

Q: What is Kiosk mode in Intune?

Kiosk mode locks a Windows device to run one app (single-app kiosk) or a limited set of apps (multi-app kiosk) for a specific user account. The user cannot access the desktop, settings, or any app outside the configured list. Intune deploys kiosk configuration via a Device Restrictions or Assigned Access profile.

Q: What is the difference between single-app and multi-app kiosk in Intune?

Single-app kiosk runs one app in full screen - typically a browser for digital signage or a POS terminal. Multi-app kiosk shows a locked-down Start menu with only the apps you specify. Multi-app kiosk is used for shared devices like reception terminals or staff workstations with limited roles.

Q: Can I set up a kiosk for a specific user account only?

Yes. Kiosk configuration in Intune is applied per user account. You specify the user account (local account, Entra ID account, or auto-login) that gets the kiosk experience. Other accounts on the same device can still log in normally if configured that way.

Q: Does kiosk mode work on Windows 10 Home?

No. Assigned Access (kiosk mode) requires Windows 10/11 Pro, Enterprise, or Education. It is not available on Home editions.

Related Guides
-> Deploy Win32 Apps-> Custom Compliance Policies-> Autopilot Setup
// need intune set up properly?
Fixed-price Intune setup for UK businesses

I set up Intune for UK small businesses at a fixed price - app deployment, compliance policies, Conditional Access, and full documentation.

View Packages