Last updated: August 14, 2026
Kiosk
This page explains how to configure the Chromebook Kiosk Profile in MDM to lock devices to one or more specific apps, preventing users from accessing other content or modifying settings. It covers the two available Kiosk modes (single app and multi-app), configurable settings such as Bailout, Health Monitor, Log Upload, and OS Update, along with best practices like associating only one Kiosk profile per device and ensuring apps are added to the repository before applying the profile.
With POS devices and single-purpose devices finding an exponential level of usage in organizations, ensuring devices are locked to specific apps and/or settings becomes a cumbersome task for system administrators. With Kiosk for Chromebooks, this can be easily and efficiently solved as it lets you lock the devices to specific and/or settings as well as ensure the user cannot move away from the app or modify the settings.
Policy Description
| SPECIFICATION | DESCRIPTION |
|---|---|
| Kiosk Mode | Specify the mode based on whether the device is to be locked to a single app or multiple apps. In multi-app Kiosk mode, the device can still access Phone and Settings |
| Allowed App(s) | Select the app(s) to be provisioned under Kiosk in the device. Usage of the device is singled down to access/using only the Kiosk app(s). Any app in the enrolled device and apps in the app repository can be specified. If the app is not available in the device, it is recommended to push the app first and then the Kiosk profile. |
| SETTINGS (Applicable only if Kiosk Mode is configured as 'Single App') | |
| Bailout | Allow/Restrict users from preventing auto-provisioning of Kiosk by using the key combination(Ctrl+Alt+S) within 3 seconds. Users can utilize the device normally and the profile will be applied after a restart. |
| Prompt Network | Allow/Restrict users from selecting/configuring device network connectivity. |
| Health Monitor | Allow/Restrict the device health monitory, which information such as battery health etc. |
| Log Upload | Allow/Restrict uploading of device logs on the Google portal. This is usually done by the device user, on request from the Admin. |
| OS Update | Allow/Restrict OS update on the devices, provisioned as Kiosk. |
| Notify, if device is offline | Specify the means by which the Admin is to be notified, if the device is offline. |
| E-mail address(es) | Specify the E-mail address(es), to which the notification mails are to be sent. |
| Contact Number(s) | Specify the contact number(s), to which the notifications are to be sent. |
Best Practices
- It is recommended to associate only one Kiosk profile to the managed devices.
- You can provsion only those app(s) which are already present in App Repository or Inventory alone, for Kiosk. If the App(s) is/are not present, first add the app(s) to the App Repository and distribute and install the app(s) in the devices. Click here to know more about adding and distributing apps
- If Kiosk has been applied but the app(s) are/is not present in the device, you can distribute and install the app(s) on the device. On successful installation of the app(s), the Kiosk Profile automatically gets re-associated to the device. If you've configured multi-app Kiosk but some of the apps are not present in the device, then Kiosk will be configured for the apps present in the device.
Frequently Asked Questions
What happens if the Kiosk app isn't installed on the device yet?
If the app(s) are not present in the device, you can distribute and install them; once installed, the Kiosk profile automatically gets re-associated to the device.
Can users exit Kiosk mode on their own?
The Bailout setting controls this: if allowed, users can prevent auto-provisioning of Kiosk using the key combination Ctrl+Alt+S within 3 seconds, and the profile applies after a restart.
Can multiple Kiosk profiles be applied to the same device?
No, it is recommended to associate only one Kiosk profile per managed device.