Kiosk mode dedicates a client's supervised iPhone or iPad to a specific purpose. In SuperOps, you set it up from the Apple kiosk policy: you manage which apps are installed and visible, customize the home screen, and choose a kiosk mode.
SuperOps supports two Apple kiosk modes.
Persistent Single App locks the device to one app permanently, and only an admin can release it by removing or changing the policy. This is useful for devices that are always dedicated to one purpose, such as a point-of-sale screen, a check-in tablet, or digital signage.
Autonomous Single App lets you approve a set of apps that can lock and unlock the device themselves. The end user triggers the lock from within the app when a task starts, and releases it when the task ends, without the help of an MSP technician stepping in each time. This works only if the app’s developer has built in support for Apple’s autonomous single app mode.
Client device scenarios
Scenario | Recommended setup | Client examples |
The device runs only one app | Persistent Single App | Retail point-of-sale, restaurant ordering iPads, clinic or salon check-in, digital signage |
An app locks the device only while it's in use | Autonomous Single App | Patient check-in at a clinic front desk |
The device runs a small set of apps and nothing else | Restrict app visibility to those apps and arrange them on the home screen. To let one of the apps lock the device during a task, also approve it in Autonomous Single App. See further details below. | Clinic front desk iPads, retail floor iPads, delivery driver iPhones |
Prerequisites
The device is supervised, enrolled through Automated Device Enrollment (ADE), and linked to the client's Apple Business Manager account.
The device is marked as a Kiosk device. On Basic hierarchy, set the device type to Kiosk. On Advanced hierarchy, set the device category to Kiosk. The matching kiosk policy then applies to the device.
App visibility settings require iOS or iPadOS 15 or later.
Kiosk Mode is available under both Apple iOS Kiosk Policies and Apple iPadOS Kiosk Policies.
Step 1: Enroll the device as a Kiosk device
Open the client's MDM configuration and select the Apple tab.
Under Automated Device Enrollment, go to Map devices. If the device isn't listed, click Sync Devices.
Find the device and set its Device Type to KIOSK_DEVICE.
Select Mark as ready for enrollment. The ADE profile is applied automatically, and the device picks up the kiosk enrollment profile the next time it checks in. To customize the enrollment profile, use ADE Profile in the kiosk policy; otherwise, the default profile applies.
Step 2: Manage apps
Navigate to Settings > Policy Management, open Apple iOS Kiosk Policies or Apple iPadOS Kiosk Policies, and select App Management. App Management has three tabs: Install/Update, Block, and Visible on device.
Install apps
Kiosk Mode works only with apps that are installed on the device.
Open the Install/Update tab.
Click Add Software/Bundle and add apps from the App Store or the client's VPP-licensed catalog. Every device in scope receives these apps on the schedule you set.
Under Schedule software installation, set the deployment frequency (hourly, daily, weekly, or monthly), a start date, and an end date, or set it to never end.
Under Apps and Books, choose how licensing is handled:
Install public apps if license is not found on a site's VPP token: installs the public App Store version when the client's site has no VPP license for the app.
Install public apps even if Apps and Books is not configured for a site: installs public apps on client sites that don't have Apps and Books set up.
Click Save.
Installed apps are visible on the device by default. You can change this visibility here.
Block apps (optional)
On the Block tab, add apps that can't be found or installed from the self-service store.
Choose which apps are visible
By default, every installed app is visible. To limit what the client's end users can see, restrict visibility to specific apps. All other apps, including system apps and installed apps you don't select, are hidden.
Open the Visible on device tab.
Select Show every app on the device (the default) or Restrict to specific apps.
If you restrict apps, toggle on the installed apps end users should see on the Managed Apps tab.
On the System Apps tab, toggle on the built-in apps end users need, such as Safari, Camera, or Maps. Settings and Phone are always visible.
To add a system app that isn't listed, click Add Custom App and enter its App title and App Bundle ID. SuperOps can't verify that the app exists, so it appears with a placeholder icon.
Note: keep the App Store visible when users need it. If the client's end users need to install apps themselves, the App Store must be installed, visible, and placed on the home screen. This also applies when you deploy public App Store apps through SuperOps. Only VPP apps use the client's organizational licenses; public apps require the end user to sign in to the App Store with their own Apple ID first. If the App Store is hidden, end users can't sign in, and those apps won't install.
Step 3: Customize the home screen
Homescreen Layout controls where the visible apps appear, so end users see the same apps in the same place on every device. Apps you don't place may appear on other pages or in the App Library.
Select Homescreen Layout and turn on the toggle.
Drag managed and system apps from the left panel onto the device preview, including the dock.
Use the page controls under the preview to add, switch between, or delete pages.
To start over, click Clear Layout.
Click Save.
Step 4: Choose your kiosk mode
Select Kiosk Mode in the kiosk policy and turn on the toggle. Then choose Persistent Single App or Autonomous Single App.
Persistent Single App
As an MSP admin, you can lock the device to one app. The device stays in that app until the policy is removed or changed. This is useful for dedicated devices, such as a point-of-sale screen or a check-in tablet.
Select Persistent Single App.
Choose the app to lock the device to.
Configure the device controls you need (see below).
Click Save. The device locks to the selected app.
To change the locked app later, click Replace. You don't need to remove and reapply the policy.
Note: You can select any app that's installed on the device. Make sure the app is also visible (Step 2), because it's the app that stays on screen.
Device controls: The Interaction, Power, and Accessibility controls can be used to block touch, rotation, or hardware buttons, keep the display awake, and toggle on accessibility features such as VoiceOver or Zoom.
Autonomous Single App
As an MSP admin, you can approve a set of apps that can lock and unlock the device in kiosk mode. End users can then lock into an app for the task at hand and exit it when they're done.
For example, a clinic client's front desk staff use the iPad for scheduling during the day. When a patient arrives, staff open the check-in app, which locks the device while the patient fills in their details. The staff can then unlock the app to resume operations.
Select Autonomous Single App.
Click Add from Bundle/Software to open the software picker. Choose apps from the Apps and Books or Public App Store tab, then click Add. Only apps installed on the device can lock it.
To add an app that isn't in your software inventory yet, click Add under App Bundle ID and enter its bundle identifier.
Click Save. Approved apps can now enter and exit kiosk mode using their own in-app controls.
Note: Autonomous Single App works only if the app's developer has built in support for Apple's autonomous single app mode. Approving an app in SuperOps gives it permission to use the mode. Please confirm support with the app's developer or documentation before deploying.
Persistent Single App and the home screen layout: Persistent Single App locks the device to one app at a time. While the device is locked, the home screen isn't shown, so the home screen layout doesn't apply. The app selected in Persistent Single App takes precedence.
How to operate kiosk mode in a multi-app setup
Some client devices need more than one app but should still behave like a kiosk. For example:
Clinic front desk: a clinic client's front desk iPad runs the practice management app, a secure browser, and an internal messaging app. When a patient checks in, staff hand over the iPad, and the check-in app locks the device for the patient to finish filling up the details.
Retail floor: a retail client's floor staff share an iPad for point of sale, inventory lookup, and barcode scanning, with nothing else on the device.
Delivery and logistics: a logistics client's drivers carry iPhones limited to maps, delivery forms, and internal messaging, so the device can't be used for anything else on the road.
In scenarios like these, set up the device with the steps above:
Install the apps the device needs (Step 2).
Restrict visibility to only those apps, plus any system apps end users need (Step 2).
Place them on the home screen, for example all on the first page (Step 3).
Approve the apps that should lock the device in Autonomous Single App (Step 4), such as the check-in app.
Each app must be installed, visible, and on the home screen. Any app that locks the device must also be approved in Autonomous Single App. Don't use Persistent Single App for a multi-app setup, because it locks the device to one app and the home screen layout no longer applies.
Other settings and managing kiosk devices
This article covers the kiosk-specific settings: App Management, Homescreen Layout, and Kiosk Mode.
The other settings in the kiosk policy, Restrictions (General, Security, Network, Apps, iCloud & Apple ID Settings) and MDM Configurations (ADE Profile, Password, Network, OS Update), work the same way as in a standard iOS or iPadOS policy. Refer to this link for detailed information.
FAQs
Can I limit a device to more than one app? Yes. Restrict app visibility to the apps you need and customize the home screen. See "How to operate kiosk mode in a multi-app setup" above.
Are installed apps visible by default? Yes. Every installed app is visible unless you restrict visibility on the Visible on device tab.
How do I release a device from Persistent Single App? Remove or turn off the Kiosk Mode policy.
Can I change the locked app without removing the policy? Yes. Click Replace on the Persistent Single App screen.
Does approving an app for Autonomous Single App guarantee it will work? No. The app must be installed, and its developer must have built in support for Apple's autonomous single app mode.
Can I hide Settings or Phone? No. Settings and Phone are always visible, even when you restrict visibility.
Does Kiosk Mode work on both iPhone and iPad? Yes. It's available under both Apple iOS Kiosk Policies and Apple iPadOS Kiosk Policies.
Can I schedule when kiosk apps are installed or updated? Yes. Under App Management, set a deployment frequency, a start date, and an end date, or leave it running with no end date.