Android kiosk mode: how it works and how to get out of it

Android kiosk mode locks a phone or tablet to one app, or to a short list of approved apps, and hides everything else: the home screen, the settings, the notification shade and the navigation buttons. The person holding the device can do the job it was set up for and nothing more. Companies use it on delivery tablets, guard handsets, check-in screens and any device that should only ever run work.

We set up kiosk mode every week on the Android devices we manage with Beathan MDM, more than 5,000 of them across security, logistics, universities and oil and gas. This post covers what kiosk mode does, how it is set up, and the question people search for most: how to get out of it.

Why lock an Android device to one app?

Mostly to stop the device being used for everything except work. The problems we get called in to fix are nearly always the same: staff burning through the data bundle on YouTube, chatting to family all day on a work device, and switching on a Wi-Fi hotspot so colleagues or relatives can share the company's data.

Kiosk mode deals with all three at once. If the only thing on the screen is the delivery app or the guard app, there is no browser to stream from, no chat app to open and no settings menu where the hotspot lives. A security company can hand a rugged handset to a guard knowing it will still be a guard handset at the end of the shift.

What are the two kinds of kiosk mode?

In Beathan MDM, kiosk mode works in one of two ways, depending on what the device is for.

Single-app kiosk mode

You set one content application. That app opens when the device starts, fills the screen and stays open. There is no way to switch to anything else. This suits devices with exactly one job, such as a check-in tablet at reception or a handset that only runs a scanning app.

Multi-app kiosk mode

You set the MDM itself as the content application. The device then shows only the apps you have approved, as a simple launcher, and hides the settings, the navigation bar and the status bar controls. Users can move between their work apps but cannot change Wi-Fi, install anything, or reach the phone's settings. This suits field staff who need a few apps, say a work app, the camera and a dialler.

How do you set up kiosk mode on Android?

Proper kiosk mode needs the device to be managed. Android only allows an app to lock the screen this firmly when that app is the device's owner, which is what MDM enrolment sets up. With Beathan MDM the steps are:

1. Factory reset the device, so you start from a clean one.
2. Enrol it. On the welcome screen, tap repeatedly until a QR code scanner opens, then scan the enrolment code from the MDM console. The device downloads its configuration and apps by itself, and the whole process takes about five minutes. For devices that cannot use the QR route, we set the phone up without a Google account, switch on USB debugging and install the MDM app over a USB cable as the device owner.
3. Choose the configuration. In the console, the device's configuration sets the content application: one app for single-app kiosk mode, or the MDM for multi-app kiosk mode with your approved apps.
4. Decide on a way out. Enable the admin key icon in the configuration if you want a way out on the device itself (more on that below).

Because the configuration lives on the server, you can set up one device or five hundred the same way, and change all of them later from the console.

Can you use kiosk mode on Android without MDM?

Only up to a point. Android has a built-in feature called screen pinning, or app pinning on newer versions, in the security settings. It keeps one app on the screen until someone unpins it, usually by holding the Back and Overview buttons together, and you can require the phone's PIN to unpin.

Screen pinning is fine for handing your own phone to a child or a friend. It is not kiosk mode for a business. Anyone who knows the unpin gesture and the PIN can leave, it has to be set up by hand on every device, and nothing stops the user from switching it off in settings. For a fleet of work devices you need the device-owner level of control that MDM provides.

How do you exit kiosk mode on Android?

On a Beathan MDM device, there are two ways out, and both need admin rights.

1. On the device, with the admin key. If the key icon is enabled in the device's configuration, it appears on the kiosk screen. Tap it and enter the admin password, and the device leaves kiosk mode. This is how a technician on site gets into the settings without calling the office.
2. From the MDM console. Find the device in the console and switch it to an open configuration, meaning one without kiosk mode enabled. The device picks up the change and unlocks. This works when nobody is standing next to the device.

If you are holding a work device that is stuck in kiosk mode and you are not its administrator, there is no trick that gets you out. That is deliberate: on a properly managed device, kiosk mode only ends when an administrator ends it, so the person to ask is whoever manages your company's devices.

Where to go next

Kiosk mode is one part of managing a fleet. Our plain-English guide to what mobile device management is covers the rest, from app deployment to tracking a lost phone. If you want kiosk mode on your own devices, tell us what your devices need to do and we will set up a configuration to match.