Android Kiosk policies lock your organization's corporate-owned Android devices to one app (Single App Mode) or to a set of approved apps (Multi App Mode), while background apps keep running silently. Apps can be public Play Store apps, private apps, or web apps.
Single App Mode or Multi App Mode?
Mode | Use it when | Typical examples |
Single App Mode | The device needs to be locked into one app. | Front desk visitor check-in, meeting room booking panels, lobby digital signage, self-service kiosks |
Multi App Mode | Employees need a few work apps, and nothing else | Field service phones, warehouse scanners, shared shift devices, frontline staff tablets |
In Multi App Mode, employees see a kiosk launcher with only the apps you approve, plus any device details and settings you choose to show.
Before you begin
Android Enterprise is set up in SuperOps.
Devices are corporate-owned and enrolled through zero-touch or manual enrollment.
If you plan to use web apps, Google Chrome is installed on the devices.
Kiosk policy management
To open the policy:
Navigate to Settings and select Policy Management to view the policies across your organization's devices.
Click Android KIOSK Policies. The policy opens on the Apps section.
The policy has two parts. Set them up in this order:
Apps: choose the mode and the apps that run in kiosk mode.
Settings: control how the device behaves. This covers Restrictions (Kiosk, General, Security, Network) and MDM Configurations (Password, Network, OS Update).
Step 1: Choose your apps
At the top of the Apps section, select Single App Mode or Multi App Mode.
Single App Mode
Kiosk App: Select the single app that devices will run in kiosk mode. Only one app can be selected per policy. This can be a public app, a private app, or a web app. To replace the current app, click Replace via Play Store, then choose Search Play Store, Private Apps, or Web Apps from the left sidebar.
Background Apps: Add apps that need to run silently in the background while the device is in kiosk mode. Click Add from Play Store and choose Search Play Store, Private Apps, or Web Apps from the left sidebar. For each background app, choose Install/Update or Block. To remove an app, click the delete icon.
Multi App Mode
Select multiple apps per policy. The apps you add appear on the kiosk launcher. There's no separate Background Apps list in Multi App Mode: every app you add is visible on the device by default, so you don't need to choose background apps.
Under Kiosk App, add the apps employees need:
Click Add from Play Store to add public apps, private apps, or web apps. Choose Play Store, Private Apps, or Web Apps from the left sidebar. For a web app, enter its title and URL, as described in "Adding public, private, and web apps" below.
Click Add Bundle to add a software bundle.
For each app, choose Install/Update or Block. Bundles expand to show the apps inside them.
To remove an app or bundle, click the delete icon.
Click Save.
Adding public, private, and web apps
These steps apply whether you're adding a kiosk app or a background app.
Public apps: Click Add from Play Store and select Search Play Store. Search the Google Play Store and select the apps you need.
Private apps
Note: Make sure the first person to upload a private app is the right person for this role, ideally your MDM administrator. Changing the admin later is possible, but requires extra steps in Google Play Console.
Click Add from Play Store, select Private Apps from the left sidebar, then click Add to open the Private app form.
Enter a Title (maximum 30 characters).
Click Upload App and select your app file (.apk or .aab).
The package name must be unique. You can't reuse a package name already used on the public Play Store or by another app in your private apps list. If it's already in use, you'll see an error as soon as the upload finishes.
Click Create. Google validates the app file, including the package name and a security and versioning review. While validation is in progress, the app shows as "Not available yet." This typically takes around 10 minutes.
Once available, select the app and click Add.
Note: Google doesn't publish full details on its validation checks for private apps. If you run into a validation error that isn't explained in SuperOps, refer to Google's documentation on managing private apps.
Updating a private app: Go to your Private Apps list, open the app, select Edit, and upload the new version.
Web apps
Click Add from Play Store, select Web Apps from the left sidebar, then click Add to open the New web app form.
Enter a Title. This is the name shown on the device.
Enter the URL you want Chrome to open.
Choose a Display mode:
Full screen: the web app uses the entire screen.
Standalone: shows the phone's navigation and status bars.
Minimal UI: shows the navigation and status bars, plus the URL bar and refresh button.
Optionally, upload an icon. It must be a maskable 512px square PNG or JPEG.
Click Create. The app shows as "Not available yet" while Google validates the URL. This typically takes 5 to 10 minutes.
Once available, select the app and click Add.
Note: A web app requires Google Chrome on the device. It will not work with any other browser.
Step 2: Configure the kiosk settings
Once your apps are in place, use the settings to control what employees can and can't do on the device.
Kiosk
Under RESTRICTIONS, click Kiosk. The Kiosk configuration works in three layers, set up in this order:
Lock down the device with Essential Device Permissions, so employees can't leave the kiosk experience.
Shape what employees see with Launcher Customisation, so employees have the device details your IT team needs.
Give your IT team a way in with Admin Mode, so they can reach device settings on site without removing the policy.
1. Essential Device Permissions: Set power button behaviour, how system errors and warnings appear, access to system navigation (Home, Back, Recents), status bar visibility, and access to device settings.
2. Launcher Customisation: Choose which device details appear on the kiosk launcher, such as Device ID, battery, time, serial number, and public IP. These are the details your IT team usually asks for on a support call.
3. Admin Mode: Give your IT team password-protected access to device settings on site, without removing the kiosk policy.
Under Advanced Settings, turn on Admin Mode and enter a Password.
In the Features table, choose what employees can access (User) and what IT admins can access after entering the password (Admin).
Click Save.
On the device, IT admins tap Enable Admin Settings in Settings and enter the password to unlock the admin features.
General, Security, and Network
Click General under RESTRICTIONS to manage the camera, microphone, factory reset, and volume adjustments.
Click Security to control lock screen features, including notifications, camera access, and biometric authentication.
Click Network to configure cellular networks, Bluetooth, and Network Escape Hatch, which lets a device temporarily connect to a network at boot if it can't connect, so it can refresh the device policy.
MDM configurations
Under MDM CONFIGURATIONS, click Password to set the password type, minimum password length, reuse of previous passwords, and whether employees must enter their password every 24 hours.
Click Network, turn on the toggle, and click Add to create a Wi-Fi profile. Enter the Wi-Fi Name, Security Type, and Password.
Click OS Update and turn on the toggle to define when automatic OS updates can occur.
Pinning and unpinning kiosk devices
Kiosk devices are locked by design, which creates a problem when they need maintenance or troubleshooting. Removing and re-associating the kiosk policy every time is time-consuming and risks misconfiguration. Pin and Unpin solves this by letting you temporarily lift the kiosk lockdown from the console, fix the issue, and restore kiosk mode instantly without touching the policy.
To pin or unpin a single device, open the device page from Assets and click Pin Kiosk App or Unpin Kiosk App in the top right corner. The current state is shown in the status badge next to the button. Every action is logged in the activity feed with a timestamp and the name of the technician who triggered it.
To pin or unpin multiple devices at once, go to Assets > Android KIOSK, select the devices using the checkboxes, and click Pin Kiosk App or Unpin Kiosk App from the bulk action bar. The PIN STATUS column in the list shows the current state of each device.
Summary
By configuring Android Kiosk Policies, you can ensure your dedicated devices remain secure, compliant, and focused entirely on their primary task.