Kiosk mode locks a mobile device to a single application or a curated set of applications, preventing users from accessing the home screen, system settings, or anything outside the allowed list. IT teams use kiosk mode to turn Android tablets and iPhones into dedicated business tools: point-of-sale terminals, inventory scanners, patient check-in stations, self-service kiosks, and digital signage displays. According to VDC Research (2024), 73% of shared enterprise devices in retail and logistics run in some form of restricted or kiosk mode. Both Android Enterprise (dedicated device / COSU mode) and Apple (Single App Mode via supervision) support kiosk lockdown natively, but you need an MDM solution to configure, deploy, and enforce it across your fleet.
A warehouse worker picks up a tablet to scan incoming shipments. Instead of the scanner app, they see YouTube, Gmail, and a half-finished game from the night shift. The tablet is supposed to be a business tool, but without restrictions, it's a shared entertainment device that happens to have a barcode scanner installed. That's the problem kiosk mode eliminates. Here's how it works on Android and iOS, when to use single-app vs multi-app, and what to look for in an MDM kiosk solution.
What Is Kiosk Mode and How Does It Work?
Kiosk mode is a device lockdown feature that restricts a mobile device to a single application or a curated set of applications. The user can't access the home screen, system settings, notifications, or any app outside the allowed list.
The term comes from physical kiosks: self-service terminals in airports, hotels, and retail stores. But modern kiosk mode extends far beyond public terminals. Warehouses, hospitals, restaurants, construction sites, and schools use kiosk mode to turn tablets and phones into dedicated business tools.
Kiosk mode is configured and enforced through an MDM solution. The MDM pushes the kiosk policy to the device over the air, locks it down, and monitors compliance. If someone tries to exit the kiosk app, the device bounces them right back. No physical access to the device is needed for setup or changes.
Single-App vs Multi-App Kiosk Mode
Single-app kiosk mode locks the device to exactly one application. The device boots directly into that app. There's no way out without the admin passcode. This is the right choice for:
- Point-of-sale terminals running one POS app
- Digital signage screens showing a single display app
- Self-check-in kiosks at hotels and clinics
- Inventory scanners locked to one barcode app
Multi-app kiosk mode allows a small set of approved applications, presented in a custom launcher. The user can switch between approved apps but nothing else. Use this when workers need 2-3 tools: a scanner, a messaging app, and a CRM, for example. A 2023 SOTI mobility report found that 61% of enterprise kiosk deployments use multi-app mode rather than single-app, because most workflows require at least two applications.
Appaloosa supports both modes on Android and iOS. You configure the allowed apps, customize the launcher appearance, and deploy the kiosk profile to device groups from a single console.
Kiosk Mode on Android
Android provides kiosk mode through the Android Enterprise framework, specifically the "dedicated device" mode (also called COSU: Corporate-Owned, Single Use).
When you set up a device as fully managed via zero-touch enrollment or QR code provisioning, you can apply a kiosk policy that:
- Pins one or more apps to the screen
- Hides the navigation bar (back, home, recent apps)
- Disables the notification shade
- Blocks the power button menu (preventing factory reset)
- Auto-launches the kiosk app on boot
Samsung devices offer extra kiosk capabilities through Samsung Knox: custom boot animations, hardware button lockdown, and a more polished kiosk launcher. If your fleet includes Samsung tablets (Galaxy Tab Active series are popular in logistics), Knox integration is worth evaluating. Knox also adds peripheral lockdown: you can disable USB ports, cameras, and Bluetooth individually.
For devices running Android 9+, the lock task mode API provides system-level lockdown that's extremely hard to bypass. Combined with factory reset protection (FRP), your kiosk devices stay locked even after a reboot or attempted reset. Android 14 added further kiosk improvements: stricter background app restrictions and better control over system dialogs that previously could interrupt the kiosk app.
Kiosk Mode on iOS and iPadOS
Apple calls it "Single App Mode" (for one app) or "Autonomous Single App Mode" (ASAM, where the app itself controls when to lock and unlock). Both require the device to be supervised through Apple Business Manager (ADE).
On a supervised iPad in Single App Mode:
- The device shows only the selected app
- The home button and swipe gestures are disabled
- The lock screen is bypassed entirely
- Notification Center and Control Center are blocked
ASAM is particularly useful for exam scenarios and shared workstations. The app requests lockdown when the user starts a session and releases it when they finish, without requiring MDM commands for each transition. Apple's Classroom app for education uses this pattern.
For iPads used as reception kiosks or retail displays, you can also enable Guided Access as a lighter alternative. But for enterprise deployments at any scale, MDM-managed Single App Mode is more reliable and doesn't require manual setup on each device.
One iOS limitation to note: multi-app kiosk mode isn't natively supported the way it is on Android. You can use the Allowed Apps restriction to limit which apps appear, but you can't create a custom launcher. Some MDM providers (including Appaloosa) work around this with web-based launchers or app-level restrictions that effectively create a multi-app kiosk experience on iPads.
Common Kiosk Mode Use Cases
Retail and hospitality. Self-service ordering tablets in restaurants, product catalog browsers in stores, check-in kiosks at hotels. The tablet runs one app and customers interact with it without risk of accessing other functions. McDonald's, for instance, runs over 40,000 self-ordering kiosks globally on locked-down tablets.
Logistics and warehousing. Barcode scanners, inventory management apps, shipping label printers. Workers grab a shared device, scan items, put it back. No training on device navigation. Amazon and DHL use kiosk-locked handhelds for warehouse operations.
Healthcare. Patient check-in tablets in waiting rooms, medical record access terminals for nurses, medication tracking devices. HIPAA compliance often requires that these devices can't be used for anything outside the approved clinical workflow.
Education. Exam tablets locked to a testing app, classroom tablets restricted to educational content, library catalog terminals. Schools need to prevent students from accessing social media and games during school hours. Apple's Shared iPad feature works well alongside Single App Mode for exam lockdown.
Field operations. Construction site tablets for safety checklists, delivery driver devices running route planning, utility technician tablets for work orders. Rugged tablets from Samsung or Zebra with kiosk mode survive field conditions while keeping the interface simple.
How to Choose an MDM for Kiosk Deployments
Not all MDM solutions handle kiosk mode equally. Some support only single-app lockdown on one platform. Others offer full multi-app kiosk with custom branding on both Android and iOS. Here's what matters when evaluating kiosk capabilities:
| Feature | What to look for | Why it matters |
|---|---|---|
| Single-app + multi-app | Both modes on both platforms | Different use cases need different lockdown levels |
| Custom launcher | Branded launcher with logo, wallpaper, layout control | Professional appearance for customer-facing devices |
| Peripheral control | Camera, USB, Bluetooth, NFC toggles | Prevents data exfiltration on shared devices |
| Exit passcode | Admin passcode to exit kiosk for maintenance | Allows IT to service devices without un-enrolling |
| Auto-launch on boot | Kiosk app starts automatically after restart | Unattended devices recover from power loss |
| Remote exit | Exit kiosk mode remotely from admin console | No need to physically touch the device |
| Website allowlist | Lock browser to specific URLs | Web-based kiosk apps (surveys, ordering forms) |
| Network restrictions | Lock to specific Wi-Fi or VPN | Prevents users from connecting to personal hotspots |
Appaloosa checks all eight criteria. You configure kiosk policies from a single dashboard and deploy them to Android and iOS device groups in bulk. Changes propagate over the air, so you can update the kiosk app, change the launcher layout, or add a new allowed app without touching any device.
Kiosk Mode Security and Compliance
Kiosk mode isn't just a productivity feature. It's a security control. Locked-down devices reduce your attack surface by eliminating the ability to install unauthorized apps, visit malicious websites, or access device settings where Wi-Fi and VPN configurations live.
For regulated industries, kiosk mode helps satisfy specific compliance requirements:
- HIPAA (healthcare): prevents access to personal apps that could expose patient data
- PCI-DSS (retail/payments): restricts POS devices to payment applications only
- GDPR (any industry handling EU data): limits data access to authorized applications, reducing the risk of accidental data exposure on shared devices
- COPPA (education): restricts student tablets to approved educational content
Combine kiosk mode with mobile security policies (mandatory passcode, encryption, remote wipe) for defense in depth. If a kiosk device is stolen, remote wipe erases all data. The device is useless outside your MDM enrollment.
Kiosk Mode Troubleshooting: Common Issues
Even well-configured kiosk deployments hit snags. These are the issues IT teams report most often:
The kiosk app crashes and the device shows the home screen. On Android, make sure the kiosk app is set as the default launcher and that lock task mode is active. On iOS, Single App Mode should automatically restart the app after a crash if the MDM profile is properly installed. If crashes persist, check the app itself: memory leaks and unhandled exceptions are the usual culprits.
Users find a way to exit kiosk mode. On Android, the most common escape is the power button menu (long-press power shows shutdown/restart options that bypass the kiosk). Disable this via the kiosk policy. On iOS, a triple-click Home button opens accessibility shortcuts that can interfere with Single App Mode. Disable accessibility shortcuts in your MDM restrictions profile.
The device won't enter kiosk mode after enrollment. Verify that the device is fully managed (not just work profile). Kiosk mode requires device owner status on Android and supervision on iOS. If the device was previously enrolled in another MDM, factory reset it first.
App updates break the kiosk. Managed app updates via the MDM give you control over when new versions roll out. Test updates on one device before deploying fleet-wide. On Android, you can pin a specific app version via managed Google Play settings.
Battery drain on always-on kiosk devices. Digital signage tablets that display content 24/7 need power management. Reduce screen brightness to 60-70%, disable sleep entirely (the MDM handles this), and use a charging cradle. Samsung Knox has an "always on" display mode designed for kiosk use that optimizes battery during constant operation.
Deploying Kiosk Mode at Scale with Appaloosa
Setting up kiosk mode for a small pilot takes about 10 minutes per device group. Scaling to hundreds of devices follows the same process:
- Enroll your devices via zero-touch enrollment (Android) or ADE (Apple). This gives you full management control, including kiosk capabilities, without manual setup per device.
- Create device groups based on kiosk use case (e.g., "Warehouse scanners", "Reception tablets", "POS terminals").
- Configure the kiosk policy: select single-app or multi-app mode, choose the allowed app(s), set wallpaper and branding, configure Wi-Fi and any other settings.
- Deploy the policy to the group. Devices lock down automatically within minutes.
- Monitor and maintain from the dashboard. Push app updates, change kiosk layouts, or temporarily exit kiosk mode for maintenance via remote support.
Zero-touch enrollment is critical for kiosk deployments at scale. Without it, someone has to manually configure each device, which doesn't work when you're deploying 500 tablets across 30 retail locations. With zero-touch, the device configures itself on first boot and enters kiosk mode automatically.
For organizations replacing legacy kiosk setups (Windows CE terminals, custom firmware, or consumer tablets with manual Guided Access), the transition to MDM-managed kiosk mode typically pays for itself within 3-6 months. The reduction in IT support calls alone (no more "the tablet shows the wrong screen" tickets) justifies the investment, and you get remote management capabilities that physical kiosks never had.
Try Appaloosa's kiosk mode free for 14 days. Set up your first kiosk device in under 15 minutes.