Android Kiosk policies lock your clients' corporate-owned Android devices to one public app from the Play Store (Single app mode) or to a set of approved apps (Multi app mode), while background apps keep running silently.
Single app mode or Multi app mode
Mode | Use it when | Typical client examples |
Single App Mode | The client's device needs to be locked into one app. | Retail point-of-sale, restaurant ordering tablets, clinic or salon check-in, digital signage |
Multi App Mode | The client's staff need a few work apps, and nothing else | Delivery driver phones, field technician devices, warehouse scanners, shared frontline devices |
In Multi App Mode, the client's end users see a kiosk launcher with only the apps you approve, plus any device details and settings you choose to show.
Before you begin
Android Enterprise is set up in SuperOps.
The client's devices are corporate-owned and enrolled through zero-touch or manual enrollment.
Kiosk policy management
To open the policy:
Navigate to Settings and select Policy Management to view the policies across your clients' devices.
Click Android KIOSK Policies. The policy opens on the Apps section.
The policy has two parts. Set them up in this order:
Apps: choose the mode and the apps that run in kiosk mode.
Settings: control how the device behaves. This covers Restrictions (Kiosk, General, Security, Network) and MDM Configurations (Password, Network, OS Update).
Step 1: Choose your apps
At the top of the Apps section, select Single App Mode or Multi App Mode.
Single App Mode
Kiosk App: Select the single app that devices will run in kiosk mode. Only one app can be selected per policy. To replace the current app, click Replace via Play Store and choose a new app from the Play Store.
Background Apps: Add apps that need to run silently in the background while the device is in kiosk mode. Click Add from Play Store to search for and select apps from the Google Play Store. For each background app, choose Install/Update or Block. To remove an app, click the delete icon.
Select the relevant apps from the play store.
Multi App Mode
Select multiple apps per policy. The apps you add appear on the kiosk launcher. There's no separate Background Apps list in Multi App Mode: every app you add is visible on the device by default, so you don't need to choose background apps.
Under Kiosk App, add the apps the client's end users need:
Click Add from Play Store to add apps from the Google Play Store.
Click Add Bundle to add a software bundle.
For each app, choose Install/Update or Block. Bundles expand to show the apps inside them.
To remove an app or bundle, click the delete icon.
Click Save.
Step 2: Configure the kiosk settings
Once your apps are in place, use the settings to control what the client's end users can and can't do on the device.
Kiosk
Under "Restrictions", click Kiosk. The Kiosk configuration works in three layers, set up in this order:
Lock down the device with Essential Device Permissions, so end users can't leave the kiosk experience.
Shape what end users see with Launcher Customisation, so the client's staff have the device details your technicians need.
Give your technicians a way in with Admin Mode, so they can reach device settings at the client's site without removing the policy.
1. Essential Device Permissions: Set power button behavior, how system errors and warnings appear, access to system navigation (Home, Back, Recents), status bar visibility, and access to device settings.
2. Launcher Customisation: Choose which device details appear on the kiosk launcher, such as Device ID, battery, time, serial number, and public IP. These are the details your technicians usually ask for when a client raises a ticket.
3. Admin Mode: Give your technicians password-protected access to device settings at the client's site, without removing the kiosk policy.
Under Advanced Settings, turn on Admin Mode and enter a Password.
In the Features table, choose what the client's end users can access (User) and what your technicians can access after entering the password (Admin).
Click Save.
On the device, technicians tap Enable Admin Settings in Settings and enter the password to unlock the admin features.
General, Security, and Network
Click General under RESTRICTIONS to manage the camera, microphone, factory reset, and volume adjustments.
Click Security to control lock screen features, including notifications, camera access, and biometric authentication.
Click Network to configure cellular networks, Bluetooth, and Network Escape Hatch, which lets a device temporarily connect to a network at boot if it can't connect, so it can refresh the device policy.
MDM configurations
Under MDM CONFIGURATIONS, click Password to set the password type, minimum password length, reuse of previous passwords, and whether end users must enter their password every 24 hours.
Click Network, turn on the toggle, and click Add to create a Wi-Fi profile. Enter the Wi-Fi Name, Security Type, and Password.
Click OS Update and turn on the toggle to define when automatic OS updates can occur.
Pinning and unpinning kiosk devices
Kiosk devices are locked by design, which gets in the way of maintenance and troubleshooting. Pin and Unpin lets your technicians temporarily lift the kiosk lockdown from the console, fix the issue, and restore kiosk mode without touching the policy.
To pin or unpin a single device, open the device page from Assets and click Pin Kiosk App or Unpin Kiosk App in the top right corner. The status badge next to the button shows the current state. Every action is logged in the activity feed with a timestamp and the technician's name.
To pin or unpin multiple devices at once, go to Assets > Android KIOSK, select the devices, and click Pin Kiosk App or Unpin Kiosk App from the bulk action bar.
Summary
By configuring Android Kiosk Policies, you can ensure your client's dedicated devices remain secure, compliant, and focused entirely on their primary task.