iPad Kiosk Mode locks an iPad to one app — or a curated set of apps — so the device does exactly what it was put there to do and nothing else. Whether you're running self-checkout counters in a retail store, check-in tablets at a hotel lobby, or shared iPads in a classroom, kiosk mode keeps users on task and keeps your data off-limits.
There are two ways to get there. Guided Access is Apple's built-in option: you set it up on the device itself in under five minutes. It works fine for a single iPad, but it doesn't scale and it's easy to exit accidentally. The other path is MDM Single App Mode — configured remotely through a mobile device management solution like ManageEngine MDM Plus — which is what most IT teams use when they're managing more than a handful of devices.
This guide covers both, plus multi-app kiosk, web kiosk, prerequisites, remote management, and troubleshooting.
iPad Kiosk Mode — Apple's official name for it is Single App Mode — is a supervised device state where an iPad is restricted to one specific app, or in multi-app configurations, to a controlled group of apps. Everything else is locked out: the Home button, Settings, Safari, the App Store, and any other app the user might otherwise reach.
When a device is in Single App Mode, the user can only interact with what you've put in front of them. Hardware buttons like volume controls and the side button can be disabled individually. Screen rotation, auto-lock, and touch input can all be configured or blocked.
With a mobile device management solution like Mobile Device Manager Plus, that also doubles up as iPad Kiosk software, it is possible to lock down iPadOS devices to Kiosk mode, and have them run only the required app(s), control their device settings, and even restrict the hardware buttons on them. Furthermore, a large number of iPads can be remotely provisioned into iPad Kiosk Mode with single app or multi-app Kiosk Mode, from a central point of control using the iPad Kiosk software/app.
iPad Kiosk Mode requires the device to be supervised — more on that in the Prerequisites section below. Once supervised, you can push a kiosk profile to one iPad or ten thousand from the same MDM console, and change it any time without touching the device.
The steps in this guide apply to iPadOS 17 and iPadOS 18.
This iPad Kiosk Mode guide covers the following
To configure iPad Kiosk Mode using an MDM solution like Mobile Device Manager Plus or an iPad Kiosk app/software, ensure the following pre-requisites are met:
NOTE: As the support for Device Enrollment Program is discontinued by Apple from December 1, 2019, migrate to Apple Business Manager to continue managing devices.
There are two ways to supervise an iPad:
Option 1 — Apple Business Manager (ABM)
ABM is the standard path for organizations buying iPads in any volume. Devices purchased through Apple or an authorized reseller can be enrolled in ABM automatically. Once the device powers on and connects to the internet, it enrolls into your MDM automatically — no manual setup, no user intervention. This is what zero-touch deployment looks like in practice. To get started, your organization needs an ABM account (free at business.apple.com), and your MDM solution needs to be connected to it as the MDM server.
Option 2 — Apple Configurator 2
If you have iPads that weren't purchased through ABM, or devices you need to supervise manually, Apple Configurator 2 (free on the Mac App Store) handles this over USB. Connect the iPad, prepare it through Configurator, and it comes out supervised and enrolled in MDM.
To setup iPad Kiosk Mode using an iPad Kiosk software, follow the steps given below:
Step 1: On the MDM console, navigate to Device Mgmt->Profiles->Create Profile dropdown and choose iOS/iPadOS.

Step 2: Provide a reference name and if required, a description and click on Continue.

Step 3: Click on Kiosk from the list of policies. Choose the Kiosk type as Single App Mode to provision the device with a single app, or choose Multi App Mode, to enable iPad Kiosk Mode with multiple apps, or Autonomous App(s) if you wish to lock the device to single app kiosk mode temporarily, and in the next field specify the iPad Kiosk app(s). Configure the device settings, and restrict the hardware buttons as required. If Single App Mode has been selected, you'll be able to configure the device settings, and restrict the hardware buttons as required under the Settings section.

Step 4: Click on Edit Screen Layout and select iPad to configure the device screen layout. In case the iPad is provisioned with a single app, the selected app will open in full screen mode. However, in the case of multi app kiosk mode, the admin will be able to configure the layout of the added apps on the home screen or pin them to the dock for easier access.

Step 5: Click on Save and Publish the profile.
Step 6: Distribute the Kiosk profile to a single device to test it, before deploying it to your production environment.
While enabling Kiosk Mode on iPad:
Both Guided Access and MDM Single App Mode lock an iPad to one app, but they work very differently and suit different situations.
| Guided Access | MDM Single App Mode | |
|---|---|---|
| Setup | On the device, manually | Remote, from MDM console |
| Supervision required? | No | Yes (ABM or Apple Configurator) |
| Exit method | Triple-click + passcode, on the device | Remote command from MDM console |
| Scale | One device at a time | Any number of devices simultaneously |
| Tamper resistance | Low — passcode can be forgotten or bypassed | High — only MDM admin can exit |
| App switching | No — single app only | Yes — switch profiles or apps remotely |
| Best for | One-off demos, classrooms, short sessions | Deployed fleets, public-facing kiosks, retail, healthcare |
If you manage more than a few iPads, MDM Single App Mode is the right choice. Guided Access has no remote management capability — if a user exits it or the passcode gets lost, someone has to physically pick up the device. With MDM, you push the fix from your desk.
ManageEngine MDM Plus supports three kiosk configurations for iPads:
The iPad is locked to one specific app. Everything else — Settings, Safari, the Home screen — is inaccessible. This is the standard setup for POS terminals, check-in kiosks, and information displays where one app covers the entire use case.
The iPad is locked to a defined set of apps. The home screen is configured by the admin, and users can only see and open the apps in that set. Useful in situations where users need access to a few tools — for example, a frontline worker who needs a messaging app, a task app, and a scanner app, but nothing else.
The app itself enters and exits kiosk mode based on what's happening in the session. A payment app might lock the device to a transaction screen while a payment is in progress, then release it once the transaction is complete. This mode is configured by the app developer using Apple's Autonomous Single App Mode API.
iPad Kiosk Mode allows organizations to turn iPads into Kiosks by locking them to a single app or multiple apps. iPad Kiosk Mode enabled devices are finding extensive use in various sectors such as retail, education and healthcare among others. Here's how iPad Kiosk Mode plays an important role
Retail stores are increasingly adopting self check-out counters as they reduce the chances of human error and provide better customer service. Devices provisioned in iPad Kiosk Mode are the perfect solution. The devices can be locked down to a single app to avoid misuse and features like Auto Lock and Screen Rotation disabled to allow better user experience.
Schools are integrating with Apple School Manager and are adopting iPads to conduct classes and exams. In such cases, putting iPads into Kiosk Mode is the obvious answer. Kiosk Mode can ensure students don't access browser, calculator and other apps that may cause distractions during classes.
In hospitals, iPad Kiosks are used extensively for patient bedside monitoring, employee attendance, and even during surgeries. To ensure these devices are not misused and are used only for specified purposes, these devices are locked down into Kiosk Mode.
Digital menu displays, table-side ordering kiosks, and payment terminals. Single App Mode keeps the ordering app front and center and prevents staff from using the device for anything else.
Passenger check-in counters, boarding pass scanning stations, and event registration kiosks. These environments often require profile switching — the same iPads may be used for different events or flight segments, and MDM makes that switch remotely.
Guest-facing kiosks in lobbies for check-in, concierge services, and local information. These iPads often run a web-based portal, making the web kiosk setup (Single App Mode with a managed browser) the most practical option.
iPads set up as donation kiosks at events or in permanent locations. Single App Mode with a payment app keeps the experience clean and ensures no one accidentally — or intentionally — navigates away from the donation screen.
Information displays in corporate lobbies, waiting rooms, and public spaces. Autonomous Single App Mode works well here — the signage app controls when it occupies the full screen and when other functions might be accessible.
In these sectors, with a huge number of devices in use, it might be an arduous task to manually configure kiosk mode on each device. Instead, if an iPad Kiosk software is used, multiple devices can locked down into kiosk mode within a few minutes. Moreover, it will also be possible to monitor device health and execute remote commands at any time.
Using an iPad Kiosk software/app such as Mobile Device Manager Plus (MDM), that also functions as Apple MDM, to lock down Apple iPads in to Kiosk Mode provides additional control and has the following benefits over the built-in Guided Access capabilities
Check out how to customize your iPad's home screen by using Mobile Device Manager Plus as your iPad kiosk software in this short demo video.
If your kiosk use case is browser-based — a self-service portal, a booking form, a digital menu — you don't need to lock the iPad to an app. You can lock it to a single URL instead.
There are two ways to do this in ManageEngine MDM Plus:
Option 1 — Single App Mode with a managed browser
Push a managed browser app (such as a kiosk browser) to the iPad via MDM, configure the allowed URL in the browser's app configuration, then set that browser as the kiosk app in your Single App Mode profile. The iPad opens directly to your URL and the user can't navigate away.
Option 2 — Web Clips (Web Shortcuts)
Web Clips are MDM-pushed shortcuts that open a URL in a full-screen browser view. Add the Web Clip to a Multi-App kiosk profile along with a locked-down browser. Users see only the web shortcut on the home screen and can't access anything outside the URL you've defined.
Either way, combine with restrictions on Safari and the App Store so the user can't bypass the kiosk setup through the browser's address bar or by downloading another app.
Kiosk Mode is a powerful feature that allows IT teams to lock iPads into a specific app or set of apps, ensuring employees only use the device for its intended purpose. This is especially useful in sectors like retail, education, logistics, or frontline services.
Using ManageEngine Mobile Device Manager Plus, you can configure Kiosk Mode across all employee iPads from a single, centralized console. Here's how it helps:
This setup eliminates the need for manual device handling, making large-scale deployments quick, secure, and hassle-free.
To manually enable iPad Kiosk Mode, follow the below steps:






One of the main advantages of MDM-managed kiosk mode over Guided Access is that you never have to physically touch the device to make changes. Here's how the common scenarios work:
From the MDM console, select the device and remove or deactivate the kiosk profile. The iPad exits kiosk mode immediately and returns to its normal supervised state. No passcode, no physical access needed.
If you run events, retail promotions, or rotate use cases on your iPads, you can maintain separate kiosk profiles in MDM and switch between them remotely. Remove the active profile and push the new one — the device updates within seconds. This is especially useful for conference check-in iPads that need to switch between different apps or URLs for different events.
When you need to update the kiosk app, change the allowed URLs, or modify any device restrictions across a large number of iPads, you push the updated profile to a device group from the MDM console. All devices in the group receive the update simultaneously — no manual device handling.
If a technician needs to access a kiosk iPad for a software update or hardware check, an admin can remotely suspend the kiosk profile, allow the work to be done, and re-enable kiosk mode — all from the MDM console without visiting the device.
ManageEngine MDM Plus handles the full kiosk lifecycle for iPad fleets of any size — from initial enrollment through day-to-day management and eventual decommission.
Connect MDM Plus to Apple Business Manager and iPads enroll automatically the first time they're powered on. No manual setup per device. Define the kiosk profile in MDM and it's pushed to the device as part of the enrollment flow — devices come out of the box kiosk-ready.
Switch an iPad between kiosk profiles, update the allowed apps, change the kiosk URL, or exit kiosk mode entirely — all from the MDM console, without touching the device. Profiles can be assigned to individual devices or to groups, making fleet-wide changes a single operation.
If your organization runs a mix of iPads, Android tablets, Windows devices, or macOS machines as kiosks, MDM Plus manages kiosk mode across all of them from the same console. No separate tool needed for Android kiosk mode or Windows assigned access.
Push new kiosk apps silently, manage updates with a test-before-deploy workflow, and handle App Store licensing through Apple Business Manager — all from MDM Plus. Enterprise apps (.ipa files) can be uploaded directly and deployed without requiring an ABM account.
MDM Plus monitors enrolled devices continuously. Get alerts when a kiosk device goes offline, runs low on storage, or falls out of compliance with your kiosk profile. Run remote commands — lock, wipe, restart — on any device from the console.