Kiosk Mode Setup in ManageEngine MDM Single App for Attendance and Shop Devices
An attendance tablet that staff also use for YouTube is not an attendance tablet. Kiosk mode locks the device to exactly the apps work needs — here is how to set it up properly in MDM Plus.
🎥 Full video — kiosk profile creation and device restrictions in the console
Shops, warehouses and offices all have devices that exist for one job: a tablet at the door for attendance, a phone at the counter for billing, a screen showing the menu or the queue. Left open, these devices collect games, personal accounts and changed settings within a week. Kiosk mode in ManageEngine MDM Plus locks a device to a single app — or a small approved set — with the home screen, settings and everything else out of reach. This guide covers the setup and the checks to do before the device goes on the wall.
Profile → Kiosk — Attendance Tablet
ModeSingle App
Allowed appAttendance App
Settings / Play Store / BrowserBLOCKED
Admin exitPasscode protected
The kiosk profile defines the one job of the device — everything not listed is simply not available to the user.
1
Before You Start — Kiosk Needs a Fully Managed Device
Kiosk is a strong restriction, so Android only allows it on devices the company fully owns inside MDM:
Enroll the device as fully managed (QR code, Zero Touch or Knox) — a BYOD work-profile phone cannot be put into full kiosk
Install and test the target app (attendance, billing, POS) on the device first, through the console's app distribution
Confirm the device reliably syncs — a kiosk device that stops checking in can only be recovered physically
2
Create the Kiosk Profile
Open Profiles → Create Profile → Android and add the Kiosk configuration
Choose Single App mode for a one-job device, or Multi App mode and list the few approved apps for a counter device that needs billing plus a calculator, for example
Select the app(s) from the managed app list — only apps distributed through MDM can be pinned
Set the kiosk exit passcode and store it in the company password records — this passcode is the only way an admin can exit kiosk on the spot
3
Add the Supporting Restrictions
A kiosk profile alone is not the whole job — add these in the same profile set so the device behaves like an appliance:
Block Settings access, the Play Store and app installation, so nothing new can be added
Push the Wi-Fi profile for the shop network in the same group, so the device is always online for sync and attendance upload
Set screen timeout and brightness rules sensibly for an always-on device, and schedule OS/app updates for off-hours
Restrict USB and factory-reset options where the platform allows, so the device cannot be wiped by a curious user
4
Publish, Associate and Test Like a User
Publish the profile and associate it with the device's group — the device enters kiosk on its next sync
Now test as an outsider: try to open Settings, try the recents button, try installing an app, reboot the device — it must come straight back into kiosk
Test the attendance or billing app itself end-to-end: a network drop mid-day should not lock staff out of marking attendance — know the app's offline behaviour before deploying
Only then mount the device at the door or counter
🟢 Keep the exit passcode safe. Losing it does not brick the device — you can always remove the kiosk profile from the console and the device frees itself on its next sync. But if the device is offline at that moment, the passcode is your only immediate way out, so record it when you create the profile, not later.
🎥 Watch the Complete MDM Setup in the Video
Every step shown live in the ManageEngine MDM console — enrollment, profiles, apps and security commands, in full detail.
Can kiosk mode be used on an employee's personal phone?
No. Kiosk requires a fully managed, company-owned device. A personal phone enrolled as BYOD has only a work profile, and the owner's own apps and home screen cannot be locked down — that boundary is deliberate and protects the employee.
What is the difference between single app and multi app kiosk?
Single app mode pins exactly one app — right for attendance tablets and information displays. Multi app mode shows a locked launcher with a small set of approved apps — right for a billing counter that needs the billing app, a payment app and maybe a calculator, and nothing else.
How do I take a device out of kiosk mode?
Two ways: on the device, use the kiosk exit option and enter the admin passcode; or from the console, remove/unassociate the kiosk profile and let the device sync — it exits kiosk automatically. The console route needs the device to be online.
This guide is based on the ManageEngine MDM video by Technical Anshu • Stuck on a step? Ask in the video comments — that is where answers come fastest 🙏