Setting the kiosk policy for Android managed devices

As a Space or Global administrator, you can set up a policy to customize the look of the Android Kiosk as well as the apps which it contains. In addition, you can select to switch to the Kiosk mode automatically. This feature is supported on devices in Device Owner mode with Android Enterprise.

For Android shared-kiosk mode, see Configuring the Android shared-kiosk mode.

Go to Policies & Configs > Policies
Select Add New > Android > Android Kiosk Mode to display the New Android Kiosk App Setting Policy dialog box.
If a Kiosk App policy exists, the Edit Android Kiosk App Setting Policy page opens.
Enter a Name for the new policy.
Ensure the Status field is set to Active.
(Optional) Customize the kiosk with a banner, background color or background image. See Branding the Android kiosk screen.

In the Kiosk Settings section, select the appropriate check boxes for your implementation:

Field	Definition	Enabled by default?
Enable Lock Task Mode	Enables the Lock Task Mode on the Android Enterprise devices connected to Android Kiosk to increase the level of security on the user devices in kiosk mode by limiting access to white listed kiosk and system apps. When a device user swipes away from an app, they will only have access to the white listed and system apps. This feature is only applicable to Android 9 devices in Device Owner (DO) mode.	Yes
System Info (Android 9+ only)	When selected, displays the date / time, connectivity, battery, and vibration mode in the status bar.	No
Keyguard (Android 9+ only)	Enables the keyguard in lock task mode.	Yes
Global Actions (Android 9+ only)	Enables the menu that is displayed when the user long-presses the power button. If this option is disabled, the user may not be able to power off the device.	Yes
Home button (Android 9+ only)	When enabled, displays the following sub-options: •Overview button - Enables the Overview button and the Overview screen during lock task mode. When using the Enable Single App Kiosk mode, Ivanti recommends the Overview button to be de-selected. •Notifications - Enables notifications during lock task mode. This includes notification icons on the status bar, heads-up. notifications, and the expandable notification shade. Note: These options are only applicable for Android 9 devices.	No
Disable Quick Settings	Select so that the device will not display the system notification drop-down menu at the top of the screen. If the following settings are enabled, the settings will be display as kiosk Settings menu items. The user can customize each of the settings for use in the kiosk.	No
Allow User to Access Wi-Fi Settings	Select to permit the device user to access Wi-Fi settings.	No
Allow User to Access Bluetooth Settings	Select to permit the device user to access Bluetooth settings.	No
Allow User to Access Location Settings	Select to permit the device user to access Location settings.	No
Enter Kiosk Mode Immediately on Registration	The device will enter Kiosk mode automatically on registration.	No
Kiosk Exit Pin	Enter a 4 - 6 digit PIN into the field. If the Kiosk Exit PIN field is left blank, it disables the ability to exit Kiosk mode. The user will not be able to exit Kiosk mode without a Kiosk exit PIN.	No
Enable Shared Device	This option is used for shared-kiosk mode. See Configuring the Android shared-kiosk mode.	No
Enable Single App Kiosk	Starting with Ivanti EPMM 11.8.0.0, administrators can select the Enable Single App Kiosk check box and then select the (single) app to pin to the device screen. This setting allows one app to be pinned to the device screen in most conditions. The dedicated single app mode will allow other apps to be available on the device, but they will not be available for the device user to directly launch. These other apps will only be launched through the pinned app. For example, Email is the pinned single app, and the device user receives an email with a link to the Gmail Maps app. When the device user taps on that link, it opens the Gmail Maps app. The pinned single app will be launched only when it is part of the Allowed App list, the Kiosk Mode Allowed Apps list, and installed on the device. The Allowed Apps listed are from the App Catalog Apps section. Ivanti recommends this be used with Lock Task mode and to have the Overview button de-selected. Applicable to Work Managed Device mode (DO) and Work Managed Device - non GMS mode (AOSP.) Note the following: Device users can exit Kiosk remotely. Ivanti Mobile@Work displays the toast message "Kiosk Exit" in the app but the dedicated single-app may still remain on pinned, as it can not be closed due to Android limitations. The Lock Task mode can only be enabled when the screen is in the foreground. If the dedicated single-app is in the foreground, then it is not possible to enable Lock Task mode. Workaround: Device user needs to tap the back or home button; the Lock Task mode becomes enabled. On devices Android 9 and below, when the single app Kiosk is disabled, then the device user may need to tap the back/home button to see the Kiosk grid screen again. The launched app may remain pinned to the foreground and the Kiosk grid screen may not display due to Android limitations.	No
Enable Driver Safety	Driver safety allows the admin to define apps that are enabled for the user when a specific velocity is detected.	No

In the Choose Apps section, optionally choose to:
1. allow any third-party phone or camera app by manually adding the package name (ID).
2. The Built-in apps must be enabled in Device Owner mode. This may not be the case with all manufacturers.
3. Add apps from the App Catalog Apps.
4. Set the apps allowed in Kiosk Mode Allowed Apps.
5. Add apps manually by entering a Package ID in the Manually Add Apps with Package ID field and click +Add.
You can now group applications within a folder. Currently, a parent folder and sub-folder structure is supported. Apps can be reorganized in different folders to change availability of the app.
After an app has been installed and is listed in the Kiosk Mode Allowed Apps section of the Edit Android Kiosk App Setting Policy page, it can be dragged up or down to change the order of appearance in the kiosk.
All apps allowed in the Kiosk Mode Allowed Apps section have an additional "broom" icon/option. Based on the specific app's settings, the Ivanti Mobile@Work app will:
1. Broom with Check mark icon = clear app data when the user logs out of shared kiosk.
2. Broom with "Not allowed" icon = do not clear app data when the user logs out of shared kiosk.
All apps allowed in the Kiosk Mode Allowed Apps section have a "gear" icon. Based on the specific app's settings, the Ivanti Mobile@Work app will:
1. Gear with Check mark icon = allows device-wide settings for the selected app to be made available to the device user. Some apps may need this to get support from Android OS for activities such as completing bluetooth pairing. This is only available in Lock Task Mode. If Lock Task Mode is de-selected, the gear icon will not display.
2. Gear with "Not allowed" icon = disallows device-wide settings for the selected app to be made available to the device user.
Optionally, hide an app. Select an app in the Kiosk Mode Allowed Apps section and click the "eye" icon to hide the app.
1. When an app is hidden it can be used by other apps, but not available to launch in the kiosk. For example, a browser can be added to the kiosk but hidden so that it can be used to open URLs from an email app.
2. The Kiosk itself does not install any app. You need to install any app that you include in the kiosk using Apps@Work or other method.
For shared kiosk mode, you can Choose Apps and make settings for those apps.
Click Save.