How to lockdown Windows 11 devices in Multi-app kiosk mode?

Windows devices dominate the desktop market, with Windows 10 still leading at around 65% market share as of July 2024. While Windows 11 adoption is growing, holding 31% of devices, many businesses and institutions continue to rely on Windows 10 for their operations. Effective management of these devices is crucial, primarily when used for specific business or educational purposes.

One of the most practical ways to optimize Windows devices for business or public use is through Windows kiosk mode multiple apps. This feature allows organizations to restrict devices to selected apps, creating a secure and focused user experience. Windows kiosk lockdown mode is popular in self-service setups, a market valued at $23.41 billion in 2024 and projected to grow to $25.65 billion by 2025, reflecting a 9.6% CAGR.

This dedicated mode can transform Windows 10 and Windows 11 devices into dedicated-purpose systems. Self-service kiosks improve customer interactions in public spaces like museums, libraries, or restaurants. In enterprises, they streamline processes such as employee training while ensuring productivity by limiting access to only essential applications. Managing these kiosk devices effectively is key to maximizing their potential, whether for education, retail, or corporate settings.

What is multi-app kiosk mode on 11 Windows devices?

Multi App Kiosk Mode in Microsoft Windows is a feature that allows you to configure Windows 10 and Windows 11 devices to run in a locked-down environment, where only selected applications are accessible to users. It is beneficial when the device is intended for a specific purpose, such as a public kiosk, information booth, or self-service terminal.

With Multi App Kiosk Mode, you can set up a custom user interface that restricts users from accessing the desktop, Start menu, and other system settings. Instead, users are presented with a restricted interface that displays a specific set of applications or content they choose.

This mode allows you to personalize the experience for users by controlling which apps they can access. You can set it up so that certain apps open automatically when the device starts, stop users from switching between apps, and limit access to specific features within the allowed apps. This way, you can tailor the device to fit your needs better and enhance user experience.

Administrators can configure and manage Windows multiple app restricted mode using tools provided by Microsoft, such as the Assigned Access feature, the Windows Configuration Designer, or third-party kiosk software. These tools allow you to define the user experience, specify which apps can be accessed, and set up additional restrictions if necessary.

By using Windows Restricted Multi-App Mode, organizations can create dedicated and secure environments for users, ensuring that the device is used only for its intended purpose and preventing unauthorized access to sensitive information or system settings.

Key features of Windows multi-application kiosk mode

1. Application restriction

• Pre-Selected App Access: Administrators define a strict allowlist of applications (UWP, Win32, or Microsoft Edge) that users can run. Unauthorized apps are blocked, ensuring the device operates only for its intended purpose.
  
  Example: A retail kiosk might allow only a point-of-sale (POS) app and an inventory management tool.

• App Dependencies: Both must be included in the allowlist if an app requires dependencies (e.g., 32-bit and 64-bit versions of Internet Explorer).

2. Consistent user experience

• Customized start menu: Users see a Start menu with only the allowed apps pinned as tiles, hiding all other programs and system features. This ensures uniformity across devices and reduces distractions.

• Locked-down desktop: The Windows desktop is accessible but stripped of non-essential UI elements (e.g., context menus, system tray). Users cannot access File Explorer or modify taskbar settings.

• Multi-monitor support: Configurations can extend across multiple displays, which is ideal for complex workflows like digital signage paired with transactional interfaces.

3. Blocked app downloads and installations

• No new apps: Users can’t install or download applications. The managed multi-app environment enforces strict app execution policies, ensuring only pre-approved software runs.

• Edge browser limitations: If Microsoft Edge is included, administrators can restrict browsing to specific URLs using allow/block lists. Features like developer tools (F12) and new tab creation (Ctrl+T) are disabled.

4. System change prevention

• Settings lockdown: Access to system settings (e.g., Control Panel, network configurations) is blocked, except for essential functions like Wi-Fi connectivity or screen brightness adjustments.

• Policy enforcement: Group Policies or Mobile Device Management (MDM) tools like Scalefusion apply configurations such as:
  • Disabling taskbar customization.
  • Hiding notification pop-ups and toast messages.

• Session reset: After inactivity, sessions automatically reset to clear temporary data (e.g., cookies, downloads) and restore the default state.

5. Security and compliance

• AppLocker integration: Unauthorized app launches trigger AppLocker alerts (e.g., “This app has been blocked by your system administrator”).

• Audit logs: Event logs (e.g., Microsoft\Windows\AssignedAccess\Operational) track configuration errors and unauthorized access attempts.

• Auto-logon accounts: Kiosk devices can use dedicated local or cloud accounts (e.g., Azure AD) without admin privileges, reducing breach risks.

6. Implementation methods

• UEM: Deploy XML configurations via Scalefusion UEM to enforce kiosk settings globally.

• PowerShell scripts: Use MDM Bridge WMI Provider and tools like PSExec to apply XML-based profiles for multi-app setups.

• Custom XML configuration: Define allowed apps, Start menu pins, and taskbar visibility in an XML file (example below):

<AllowedApps>

<App AppUserModelId="Microsoft.WindowsCalculator_8wekyb3d8bbwe!App" />

<App DesktopAppPath="C:\Windows\System32\notepad.exe" />

</AllowedApps>

7. Key considerations

• Windows edition wequirements: Multi-app kiosk mode is supported on Windows 11 Pro, Enterprise, and Education editions.

• User authentication: Supports local accounts, Azure AD users, or auto-login for public-facing devices.

How to manually set up single app kiosk mode using assigned access for desktop & laptop?

You can run kiosk mode using the Assigned Access feature on a Windows 10/11 device. When you sign into the kiosk account, the app is launched automatically.

1. Open the Settings app > Accounts. Select Other users or Family and Other users
2. Select Set up a kiosk > Assigned access; Select Get started.
3. Enter a name for a new account.  
4. Choose the app that will run when the kiosk account signs in.

Limitations of Assigned Access 

While Assigned Access in Windows does offer simple kiosk configurations, it has several limitations that could impact functionality and security:

• Single-app limitation: It is primarily designed for single-app kiosk configurations. Setting up assigned access multi-app kiosks can be complex and may not deliver the seamless experience that businesses need.
• Manual application provisioning: Administrators must manually install and configure applications on each device before enabling kiosk mode, leading to increased setup time and potential inconsistencies across devices.
• Restricted control over system commands: It lacks built-in functionality to turn off specific keyboard shortcuts, such as Ctrl+Alt+Delete, which users could exploit to access system functions and exit the kiosk environment.

Given these limitations of Assigned Access, businesses need a more robust and scalable solution.

To overcome these challenges and enable a seamless multi-app kiosk experience, organizations can leverage Scalefusion UEM. 

Prerequisites to setup multi-app kiosk mode on Windows devices using Scalefusion

For Multi-App Kiosk configuration on the Windows platform, you must meet particular prerequisites and follow specific steps to apply the kiosk policy. Here are the prerequisites:

1) Supported operating systems:

• Windows 10 and Above: Professional, Enterprise, Education, or Business editions with version 1803 or later.
• Windows 7, 8.1, and Windows Home (10 & 11): These versions require enrollment with the Scalefusion MDM agent for Multi-App Kiosk functionality.

2) Scalefusion MDM Agent: Install the Scalefusion MDM agent on Windows 7, 8.1, or Windows Home editions to enable kiosk features.

3) User account configuration: The Multi-App Kiosk policy applies exclusively to non-administrator user accounts. Ensure a dedicated standard user account is set up for kiosk mode deployment on each device.

4) Application installation: Verify that all applications intended for kiosk mode are pre-installed on the devices. This includes both Universal Windows Platform (UWP) and Win32 applications.

5) Administrative access: Maintain administrative credentials for initial device setup and configuration.

6) Scalefusion dashboard access: Confirm that you have an active Scalefusion account and can access the dashboard to create and manage device profiles.

How to set up a multi-app kiosk mode on Windows 10 and Windows 11 with Scalefusion?

Experience every step of the process firsthand with our interactive demo:

Watch a step-by-step instructional video:

Follow this step-by-step process to configure the setting on the dashboard to experience Windows multi-app kiosk mode:

To configure a Windows multi-app kiosk, it is necessary to create a Windows kiosk mode profile.

1. Navigate to Device Profiles & Policies > Devices Profiles

2. Click Create New Profile on the upper right corner of the screen

3. Select the Windows tab; Enter a profile name; Click Submit

4. Now, under Select Apps (on the left menu), choose Multi-app Kiosk Mode

• Step 1: Configure policy mode – Select Scalefusion MDM Agent App

• Step 2: Add user info – Configure the user info

• Step 3: Select apps – Select the apps to enable on multi-app kiosk mode

5. Click Create Profile on the upper right corner of the screen to finish

6. Click Apply to push the multi-app kiosk profile to device groups/user groups/individual devices

Benefits of Windows kiosk mode multiple apps for Businesses

• Enhanced security: Kiosk software ensures that only authorized users access specific applications or features, reducing security risks. MDM strengthens this further by enforcing encryption, VPN connections, and controlled access policies.
• Increased productivity: By limiting user access to necessary applications, Restricted Multi-App Mode eliminates distractions. MDM enhances this by silently installing apps and managing updates without interrupting workflow.
• Easy configuration and management: Managing multiple Windows 10/11 kiosk devices becomes seamless with centralized controls. Businesses need MDM for device lock down mode on the Windows platforms to enforce policies, enable/disable hardware, and monitor device compliance remotely.
• Customizable user experience: Windows 11 multiple application dedicated mode allows businesses to tailor device access, ensuring a consistent interface. MDM complements this by deploying in-house apps, securing data, and enabling multi-app usage for shared environments.
• Improved user satisfaction: Employees and customers get a focused, distraction-free experience. MDM ensures smooth app deployment, controlled navigation, and reliable performance.
• Cost savings: By securing devices, preventing unauthorized access, and streamlining management, businesses reduce maintenance costs. MDM further extends device longevity by enabling remote troubleshooting and proactive security measures.

Maximizing kiosk efficiency with Scalefusion UEM

Scalefusion UEM allows you to configure Windows 10 devices in multi-app kiosk mode with ease by adopting modern management. Multi-app dedicated mode on Windows is the most preferred device management mode for enterprises and schools to ensure the distractions, data costs, and security threats due to unnecessary apps are minimized while ensuring end-users have access to the work/educational apps! 

Our kiosk solution allows you to set up multi-app kiosk mode for Windows devices. Try our 14-day free trial today!

Frequently asked questions (FAQs)

Q1. Can I customize the user experience in multi-application kiosk mode?

Ans: Yes, Scalefusion allows administrators to customize the user interface by selecting which applications are accessible, configuring the Start menu layout, and applying custom branding elements to align with organizational requirements.

Q2. How can I allow limited access to essential settings (e.g., Wi-Fi or system updates) without compromising the kiosk lockdown?

Ans: In Scalefusion’s Multi-App Kiosk Mode, administrators can permit access to specific system settings to facilitate tasks like connecting to Wi-Fi networks or performing system updates. This is achieved by configuring the kiosk profile to include the necessary settings applications. For instance, you can allow the ‘Settings’ app and restrict it to only the ‘Network & Internet’ section, enabling users to manage Wi-Fi connections without accessing other system configurations. 

This selective access ensures that users can perform essential tasks without compromising the overall security and restrictions of the kiosk environment. Detailed guidance on configuring Wi-Fi settings can be found in Scalefusion’s documentation.

Q3. How do local, Active Directory, and Azure AD (Entra ID) user accounts affect kiosk mode deployment?

Ans: The type of user account utilized can influence the deployment and management of kiosks:

• Local Accounts: Kiosk mode can be configured for local non-administrator accounts, providing straightforward setup and management.
• Active Directory (AD) Accounts: When devices are joined to an on-premises AD, kiosk configurations can be applied to AD user accounts. Ensure that group policies do not conflict with kiosk settings.
• Azure Active Directory (Azure AD) Accounts: For devices joined to Azure AD, kiosk locked mode can be assigned to Azure AD user accounts. It’s important to note that the username format typically follows ‘azuread\[email protected]’. Proper configuration ensures seamless kiosk deployment in cloud-managed environments.

Understanding these nuances is crucial for effective kiosk lockdown mode deployment across different account types. For detailed instructions, consult Scalefusion’s documentation

By considering these factors, administrators can effectively manage kiosk environments while providing necessary access and maintaining security.

Q4. How do I troubleshoot common issues encountered in multi-app kiosk mode on Windows 10/11?

Ans: When troubleshooting common issues in multi-app kiosks on Windows 10, ensure the device has the latest updates installed, check for conflicts with installed software, review configuration settings, and consult online resources or contact technical support for further assistance if needed. An MDM solution also allows IT admins to troubleshoot multiple application kiosk restricted modes on the Windows platforms remotely.

Q5. How to exit kiosk mode from Windows devices?

Ans: Exiting kiosk mode typically involves specific actions configured within the Mobile Device Management (MDM) platform used to deploy the kiosk settings. Administrators can remotely disable dedicated mode by adjusting policies or profiles through the MDM dashboard. Alternatively, users may have access to an exit option within the kiosk interface, allowing them to exit the restricted mode. These methods ensure a seamless transition out of kiosk-restricted mode while maintaining centralized control over device management through the MDM solution.