How to Configure Windows Kiosk Using Microsoft Intune | Windows 10 / 11

Looking to lock down Windows 10 or 11 devices for secure, purpose‑built use? Microsoft Intune makes it easy to configure kiosks that run only approved apps—perfect for self‑service stations, digital signage, or frontline workers. In this step‑by‑step guide, we’ll show you how to set up both single‑app and multi‑app kiosk modes using Intune.

Configure Windows 10/11 Device as a Single‑App Full‑Screen Kiosk with Intune

A single‑app, full‑screen Windows kiosk mode restricts the device to running only one application. That application launches automatically in full‑screen, preventing users from accessing other apps or system features. In this demonstration, we’ll configure Microsoft Edge to open a specific website URL. Once deployed, the kiosk will automatically load the site, and users will be limited to interacting solely with that single web app.

When the auto‑logon option is enabled, the device uses a dedicated kiosk account (local standard user) to sign in automatically. After logon, the assigned kiosk app launches in full‑screen mode. If the app is closed, it will automatically restart, ensuring users remain restricted to the kiosk experience without access to other apps or system features.

Follow the steps below to configure the device in single‑app, full‑screen Windows kiosk mode using Microsoft Intune. This setup ensures the kiosk launches one designated application automatically in full‑screen, restricting users from accessing other apps or system features.

Step 1: Create Device Configuration Profile

• In the Microsoft Intune admin center, go to Devices | Configuration Profiles and click on Create Profile

• In the Create a profile window, select the following and click on Create
  • Platform: Windows 10 and later
  • Profile type: Template
  • Template: Kiosk

On the Basics page, enter a name for the Device configuration profile and click Next

Step 2: Configure Kiosk Settings for Single-App kiosk setup

• On the Configuration Settings page, select the following settings for Single app Kiosk setup.
  • Select a Kiosk mode: Single app, full-screen kiosk
  • User logon type: Auto logon
  • Application type: Add Microsoft Edge browser (Required Edge version 87 and later with Windows version 1909 and later)
  • Edge Kiosk URL: Website link (company application URL or any)
  • Microsoft Edge Kiosk mode type:
    • Digital / Interactive signage (InPrivate) – The link provided above in the Edge Kiosk URL will open in full screen. The user can navigate through that website only. We have selected this setting for demonstration.
    • Public Browsing (InPrivate) – The link provided above will open by default. However user can open another website in the same tab or a new tab.
  • Specify Maintenance windows for App Restart – Select Required if you want to limit application upgrades during a specific time. Provide the maintenance window start time and schedule recurrence in the next options.

• Review the settings and click on Next to move to the Assignment page.
• On the Assignments page, select the Azure AD group on which you want to apply the policy. Click on Next.

We have applied the policy on the AAD group “Kiosk Computers – Edge browser,” and our test device was added to this AAD group.

On the Applicability Rules page, click on Next

On the Review + Create page, review the settings and click on Create.

The Device Configuration Profile for the Intune kiosk setup has now been created. To expedite testing, you can sync the policy on the device and then reboot the machine to apply the changes. You can verify policy compliance status from the Devices → Configuration Profiles blade in the Microsoft Intune admin center.

End User Experience for Single-app Full Screen Windows Kiosk Mode

As noted earlier, Microsoft Edge supports two kiosk modes: Digital/Interactive Signage (InPrivate) Mode and Public Browsing (InPrivate) Mode. In Digital/Interactive Signage mode, the end‑user experience is straightforward—the assigned web page opens automatically in full‑screen. Users can navigate within that site, but they are restricted from opening any other websites or applications.

We will now switch the Microsoft Edge browser kiosk mode to Public Browsing (InPrivate) mode. Once the updated Intune policy is applied, the end‑user experience changes: users can open new tabs in Edge and access websites beyond the default start page, while browsing sessions remain isolated through InPrivate mode.

Note: If you need to restrict which websites users can access, you must create a separate Device Configuration Profile for Microsoft Edge that enforces URL restrictions. Apply this policy specifically to kiosk devices. The built‑in kiosk template does not currently provide this option.

Configure Windows Kiosk on Windows 10 or Later Device as Multi-app Kiosk

We have successfully configured and tested a single‑app full‑screen Windows kiosk. Next, we’ll update the same Intune policy to configure the device as a multi‑app kiosk.

To edit the Intune device configuration profile, follow the steps below

• On the Microsoft Intune admin center, go to Devices | Configuration Profiles and select the profile.
• Scroll down to Configuration Settings and click on Edit.

• On the Configuration Settings, select the following settings for the Multi-app kiosk setup.
  • Select a Kiosk mode: Multi-app
  • Target devices running Windows 10/11 in mode: No
  • User logon type: Auto logon
  • Browser and Applications:
    • Add Microsoft Edge > Public Browsing (InPrivate)
    • Add Store App > Microsoft Whiteboard
  • Autolaunch: No
  • Tiles Size: Large

• Use alternative Start layout: No
• Windows Taskbar: Hide
• Allow access to Downloads folder: No
• Specify Maintenance windows for App Restart – Select Required if you want to limit application upgrade between specific time. Provide the maintenance window start time and schedule recurrence in next options.

End User Experience for Multi-app Kiosk Mode

Below is the end‑user experience for multi‑app Windows kiosk mode. In this configuration, you should see the application icons available on the desktop. However, during testing, the icons did not appear in the Start menu tiles. We will update these details once further testing of the multi‑app kiosk configuration in Intune is completed.

Comparison Table for Single-App vs Multi-App Kiosk

When configuring Windows kiosk mode with Intune, administrators can choose between single‑app and multi‑app setups. Each option delivers a different end‑user experience and serves distinct use cases—from locked‑down digital signage to shared devices with multiple approved apps. The table below highlights the key differences to help you decide which Intune kiosk mode best fits your deployment scenario.

Feature	Single‑App Kiosk	Multi‑App Kiosk
Apps Allowed	One (full screen)	Multiple (tiles)
Use Case	Digital signage, web app	Shared devices, training
User Logon	Auto logon	Auto logon
Flexibility	Very limited	Moderate

Conclusion

Choosing between single‑app and multi‑app Windows kiosk modes in Intune depends on your deployment needs. Single‑app kiosks are ideal for focused scenarios like digital signage or dedicated web apps, while multi‑app kiosks provide more flexibility for shared devices with multiple approved applications. By understanding these differences, administrators can design a kiosk experience that balances security, usability, and productivity for their specific environment.

Related Posts

• Manage Edge Chromium favorites with Endpoint Manager | Intune
• Configure Edge Chromium Homepage & Startup Page
• Configure Microsoft Edge Sleeping Tabs using Intune
• Configure Google Chrome settings using Administrative templates | Intune | Endpoint Manager
• Block USB Device with Exception
• Deny Write Access to USB Devices Using Intune Catalog Settings