4.4MD-102Advanced

Est: ~15 mins•Verified: 2026-08

Assigned Access: Single-App & Multi-App Kiosk

Deploy dedicated Windows 10 & 11 kiosk endpoints using Intune Assigned Access templates and Settings Catalog for single-app full-screen display and multi-app locked desktop.

Tags:#Kiosk#Assigned Access#Shell Launcher#Microsoft Edge#Intune#MD-102

Overview

Assigned Access locks a Windows 10 or Windows 11 endpoint into a dedicated, single-purpose computing appliance. It suppresses access to the desktop, Start menu, File Explorer, Task Manager, and keyboard shortcuts (such as Ctrl+Alt+Del or Alt+Tab).

Microsoft Intune supports two primary kiosk architectures:

Single-App Kiosk: Runs one specific Universal Windows Platform (UWP) app or Microsoft Edge in full-screen mode above the lock screen. The system signs in automatically via a local auto-logon kiosk user account. If the application crashes, the OS restarts it automatically.
Multi-App Kiosk: Presents a locked-down customized Start menu displaying only an administrator-approved list of applications (Win32, UWP, and web shortcuts). File Explorer, Taskbar system tray, and system settings are strictly disabled via an AppLocker XML configuration generated by Intune.

---

When to Use

Kiosk Architecture	Best Suited Scenarios	User Interface Experience
Single-App (Edge Digital Signage)	Public advertising screens, airport flight monitors	Full screen, no address bar, no navigation controls, auto-refreshes on idle timeout.
Single-App (Edge Interactive)	Customer self-check-in, library catalog lookups	Restricted browser with InPrivate mode, cleared history upon session idle reset.
Multi-App Kiosk	Bank teller stations, warehouse shipping stations, shared lab PCs	Custom pinned tile layout; access restricted exclusively to 2–5 business apps.

---

Prerequisites

Operating System & Hardware:

Single-App Kiosk: Windows 10/11 Pro, Enterprise, or Education.
Multi-App Kiosk: Windows 10/11 Enterprise or Education (Windows 11 22H2+ Moment 3 added Multi-App kiosk support for Windows 11).
Automatic logon account created locally or managed by Intune.

Licensing & Network:

Intune Plan 1, Microsoft 365 E3/E5, or Microsoft 365 Business Premium.
Windows Autopilot Self-Deploying mode is recommended for mass kiosk provisioning.

---

Portal Path

TEXT

Microsoft Intune Admin Center (https://intune.microsoft.com)
└── Devices
    └── Windows
        └── Configuration profiles
            └── Create > New Policy > Windows 10 and later
                ├── Template: Kiosk
                └── Settings catalog: Search "Assigned Access"

---

Step-by-Step Implementation

Step 1: Create a Single-App Microsoft Edge Kiosk Profile

In Intune, go to Devices > Windows > Configuration profiles > Create > New Policy.
Platform: Windows 10 and later | Profile type: Templates > Kiosk.
Name: Kiosk-Public-Edge-DigitalSign.
Configure settings:

Select a kiosk mode: Single app, full-screen kiosk
User logon type: Auto logon (Windows 10, version 1803+ / Windows 11)
Application type: Add Microsoft Edge
Microsoft Edge kiosk mode type: Digital / Interactive signage
Enter URL: https://portal.company.com/signage
Restart browser after idle period: 5 minutes

Assignments: Target your dynamic device group for Kiosk devices (Sec-Devices-Kiosks).

Step 2: Configure a Multi-App Kiosk Profile

Create a new profile with Select a kiosk mode: Multi app kiosk.
Target devices running Windows 10/11 in S mode: No.
User logon type: Auto logon (or Local user account).
Under Applications, add approved apps:

Edge Browser shortcut: Add URL https://crm.company.com
Calculator (UWP): Microsoft.WindowsCalculator_8wekyb3d8bbwe
Line-of-Business Win32 App: Path C:\Program Files\Scanner\BarcodeApp.exe

Under Windows Start Layout, download and customize the XML tile layout.
Set Use alternative shell: Yes (Locks shell to AppLocker whitelist).

---

PowerShell Automation

Inspect Assigned Access Configuration via WMI/CIM:

PowerShell

# Query Assigned Access configuration bridge on client PC
Get-CimInstance -Namespace "root\cimv2\mdm\dmmap" -ClassName "MDM_AssignedAccess"

# Inspect auto-logon registry settings for kiosk user
Get-ItemProperty -Path "HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon" |
    Select-Object DefaultUserName, AutoAdminLogon

Export Installed UWP App Package Family Names (AUMID):

PowerShell

# Required when building Multi-App kiosk XML definitions
Get-AppxPackage -AllUsers | Select-Object Name, PackageFamilyName | Format-Table -AutoSize

---

Microsoft Graph Automation

Create Kiosk Configuration Profile via Graph:

PowerShell

Connect-MgGraph -Scopes "DeviceManagementConfiguration.ReadWrite.All"

$KioskPolicy = @{
    "@odata.type" = "#microsoft.graph.windows10KioskConfiguration"
    displayName = "Graph-SingleApp-Edge-Kiosk"
    description = "Edge interactive kiosk provisioned via Graph"
    kioskModeType = "singleApp"
    kioskAutoLogon = $true
}

New-MgDeviceManagementDeviceConfiguration -BodyParameter $KioskPolicy

---

Verification Checklist

VERIFICATION CHECKLIST

0/5 (0%)

Device boots and signs in automatically without prompting for password or PIN.

Targeted application (e.g., Microsoft Edge) opens automatically in borderless full-screen mode.

Pressing Ctrl + Alt + Delete or Windows Key does NOT reveal Task Manager or Start Menu.

Closing or terminating the application causes the OS to re-launch it within 5 seconds.

In Multi-App mode, only explicitly whitelisted apps appear on the Start screen.

Diagnostic Logs & Channels

Channel / Tool	Log Location	Purpose
Assigned Access Operational Log	`Applications and Services Logs > Microsoft > Windows > AssignedAccess > Operational`	Records kiosk logon events, shell launch failures, and user profile transitions.
AppLocker Packaged App Log	`Microsoft-Windows-AppLocker/Packaged app-Deployment`	Verifies multi-app UWP whitelist restrictions and blocked unauthorized applications.
Winlogon Event Log	`Microsoft-Windows-Winlogon/Operational`	Diagnoses autologon account credential or registry parsing errors.

---

Troubleshooting Matrix

Error Code / Symptom	Root Cause	Exact Resolution
"We weren't able to start your app"	AppUserModelId (AUMID) is incorrect or the app failed to install for the auto-logon account.	Ensure the target app is deployed in Device context (All Users), not User context.
Kiosk boots to black screen	Shell Launcher cannot find the executable path specified for Win32 multi-app shell.	Verify the target `.exe` file path exists on the local disk (e.g., `C:\Apps\app.exe`).
Multi-App policy fails on Windows 11 Pro	Multi-App kiosk mode requires Windows Enterprise or Education edition.	Upgrade OS license from Pro to Enterprise using an Intune Edition Upgrade policy.

---

Production Best Practices

Production Best Practice

Breakout Maintenance Account:

Always create a secondary local administrator account on kiosk machines that is excluded from the Assigned Access policy. This allows IT engineers to sign in locally and bypass the kiosk shell for hardware diagnostics and troubleshooting.

Security Caution

Clear Edge Cache on Idle:

In public interactive kiosks, always configure Restart browser after idle period. Otherwise, the previous user's search history, entered web forms, or session cookies will remain visible to the next public user.

---

MD-102 Exam Notes

Exam Blueprint & High-Yield Traps

High-Frequency Exam Objectives & Traps:

Auto-Logon Account: An auto-logon kiosk user is created locally as a Standard User. It cannot be added to the local Administrators group.
Multi-App Edition Requirement: Multi-app kiosk mode is supported only on Windows 10/11 Enterprise and Education. Single-app kiosk is supported on Pro, Enterprise, and Education.
Edge Kiosk Types: "Digital/Interactive signage" runs full screen without browser chrome. "Public-browsing" displays a limited top navigation bar and tabs.

---

Official Documentation

PREVIOUS TOPIC4.3 Windows Update for Business: Update Rings & Policies NEXT TOPIC5.1 Win32 App Packaging, Detection Rules & ESP Blocking