How to Set Up and Use Windows 11 Kiosk Mode for Secure, Single-App Access

Windows 11 Assigned Access can provide a single-app kiosk or a restricted experience with an approved set of apps. These are different configurations: single-app mode runs a supported UWP app or Microsoft Edge full-screen, while the multi-app experience can retain a restricted desktop, Start menu, and taskbar. It supports Pro, Enterprise, Education, and IoT Enterprise editions, including the relevant LTSC editions; Home is not supported.

What exactly is Windows 11 kiosk mode and why should I use it?

A kiosk can focus a public or shared device on a specific task, but it is not a guarantee against malware or unauthorized access. Assigned Access kiosk mode requires UAC to be enabled and a local console session; it is not supported over Remote Desktop. Plan application, network, physical-access, and maintenance controls for the actual use case.

How do I set up kiosk mode on a Windows 11 device?

Sign in as an administrator and open Settings > Accounts > Other users > Set up a kiosk > Get started. Create the dedicated local standard account or choose an eligible existing one, then select an available supported app. This wizard is not a generic selector for every Win32 desktop application. For Edge, configure digital-signage or public-browser behavior, the starting URL, and offered idle options. Close the wizard and test locally as the kiosk user. Review automatic-sign-in behavior for the device’s join state rather than assuming the wizard presents a universal on/off choice.

Can I customize kiosk mode for different types of users or apps?

For multiple approved apps, configure Assigned Access’s restricted user experience using an appropriate XML configuration and supported deployment method, such as Intune/CSP or a provisioning package. It is not simply Assigned Access combined with Shell Launcher. Shell Launcher is a separate feature that replaces Explorer with a custom shell and supports Enterprise, Education, and IoT Enterprise editions, not Pro. By itself, replacing the shell does not prevent launching other applications or system components; additional controls may be required.

What common problems might I run into with kiosk mode and how can I fix them?

Common issues include kiosk apps crashing or failing to launch, which can render the device unusable. To fix this, verify the app’s compatibility with kiosk mode and ensure it’s installed and updated correctly. Another issue is locking yourself out by misconfiguring user accounts or settings; maintaining a separate administrator account prevents this. Selecting unsupported apps or granting incorrect permissions can cause unpredictable behavior. Troubleshooting steps include reviewing kiosk settings, checking event logs for errors, and resetting the kiosk user profile if necessary. Not all apps support kiosk features like auto-launch or full-screen mode, so thorough testing before deployment is essential.

Once kiosk mode is running, how do I manage and update these devices effectively?

Keep Windows and kiosk apps serviced through a planned maintenance process. Microsoft Intune or other supported management tools can deploy policies and updates; test changes before broad rollout. Preserve a separate administrator access route and monitor health and logs. Kiosk users can still report problems through an external support process, even if they cannot access system diagnostics. Do not assume a locked-down user interface removes the need for security updates or operational support.

Conclusion

Choose a supported edition, account, and kiosk configuration for the task. Test application behavior, exit and administrator access, network restrictions, and maintenance before deployment. Assigned Access narrows what users can do, but it does not remove every security risk or replace ongoing device management.

Frequently Asked Questions

Can I use any app in Windows 11 kiosk mode?

Assigned Access single-app mode supports a suitable UWP application or Microsoft Edge. An app being listed in Microsoft Store does not by itself prove that it is a compatible UWP kiosk app. For a custom desktop shell, evaluate Shell Launcher on a supported edition; for an approved app list, evaluate the restricted user experience.

How do I exit kiosk mode if I need to make changes?

The default breakout sequence is Ctrl+Alt+Del, unless the deployment configured a different sequence. Then sign in with the separate administrator account. For a Settings-created kiosk, manage or remove it under Accounts > Other users > Kiosk. Centrally managed and multi-app configurations should be changed through their deployment policy; deleting a policy may not revert every customization.

Is it possible to run multiple apps in Windows 11 kiosk mode?

Yes. Assigned Access’s restricted user experience can allow several apps with a tailored desktop, Start menu, and taskbar. It requires the appropriate configuration and a supported Windows release. Shell Launcher is a different custom-shell option, not a requirement for every multi-app kiosk.

Will kiosk mode prevent users from accessing the internet?

Kiosk mode itself doesn’t block internet access. To restrict internet use, you’ll need to apply separate network controls like firewall rules, network policies, or app-specific settings.

How do I keep kiosk devices updated without disrupting users?

Schedule updates for times when the device isn’t in use. Use Windows Update policies or device management tools to push updates remotely. Regular maintenance and monitoring help ensure the kiosk stays secure and stable without interrupting users.