What is single app mode and how to set it up?

Single app mode is a device lockdown state that restricts an endpoint to one designated application, disabling navigation, multitasking, and access to system settings. It converts consumer or rugged hardware into dedicated-purpose devices – POS terminals, self-service kiosks, digital signage, and exam stations – where the user can interact with nothing but the assigned app. When enforced through a Unified Endpoint Management (UEM) platform, this lockdown becomes persistent, remotely managed, and resistant to user tampering.

This guide breaks down what single application mode does, how it differs from native OS tools, and the exact steps to deploy it across iOS, Android, Windows, and tvOS using Hexnode UEM.

Defining the Single Application Lockdown

A single application environment restricts the user interface so that only one designated application remains accessible while the operating system continues running its normal background services.

The device becomes a controlled environment where users cannot access the Home screen, Settings, or other unauthorized system interfaces, while policy restrictions prevent unauthorized configuration changes.

For IT and endpoint administrators, this delivers three concrete operational outcomes:

• Reduced distraction surface — Access to social media, games, browsers, and non-essential settings is removed entirely.
• Hardened security posture — Restricting browser access and system-level configuration shrinks the attack surface on public-facing hardware.
• Lower support overhead — Preventing accidental setting changes cuts the on-site troubleshooting tickets that dedicated devices typically generate.

Choosing the Right Device for the Job

Hardware selection depends on the deployment environment, durability requirements, and the platform’s native lockdown depth. iPads offer a stable OS and premium build for customer-facing retail; Android tablets provide rugged variants and lower per-unit cost for the field; Windows PCs handle peripheral-heavy check-in stations; and Apple TV drives always-on signage.

Single App Mode vs. Guided Access

The most common point of confusion is the distinction between Guided Access and UEM-driven single app mode. Guided Access is a temporary, manual lock initiated by hand on an individual iOS device. Single app mode is a persistent, policy-enforced state pushed from the management console.

The operational difference matters at scale. Guided Access can be exited by anyone who knows the passcode and does not survive reprovisioning cleanly. Hexnode can maintain single-app kiosk lockdown across reboots, but available exit mechanisms vary by platform and configuration; for example, Android can optionally permit passcode-based local exit, while Windows provides device-side kiosk-account exit methods. For a fleet of hundreds or thousands of kiosks, manual per-device locking is not a viable model – centralized policy is.

Setting Up Single App Mode: Platform Breakdown

Each operating system enforces the lockdown through a different native mechanism. Below are the verified configuration paths in the Hexnode UEM portal.

iOS Single App Mode (iPhone & iPad)

To enable Single App Mode on iPhone or iPad, the device must be supervised using Apple Business Manager (Automated Device Enrollment) or Apple Configurator. The device must also be enrolled in Hexnode UEM with a valid APNs certificate configured, and the kiosk application should already be installed before the policy is deployed.

To configure Single App Mode:

1. Navigate to Policies and either create a New Policy or select an existing one.
2. Go to Kiosk Lockdown > iOS Kiosk Lockdown > Single App.
3. Click Configure.
4. Click the + icon and select the Store app or enterprise app that will run in kiosk mode.
5. (Optional) Configure Advanced Kiosk Settings and User Enabled Options if required.
6. Open the Policy Targets tab and assign the policy to the required Devices, Device Groups, Users, User Groups, or Domains.
7. Click Save to deploy the policy.

Once you apply the policy, the selected application launches automatically and remains the only accessible foreground application. You can also configure additional kiosk restrictions, such as disabling hardware buttons or screen rotation, through the same policy.

When to Use Autonomous Single App Mode

Autonomous Single App Mode (ASAM) is designed for applications that can automatically enter and exit kiosk mode based on their own workflow – for example, online assessment or testing applications that lock the device only while an exam is in progress.

To configure Autonomous Single App Mode:

1. Navigate to Policies and create or edit a policy.
2. Go to Kiosk Lockdown > iOS Kiosk Lockdown > Autonomous Single App Mode.
3. Click Configure.
4. Click the + icon and add the ASAM-supported application.
5. Open Policy Targets and assign the policy to the required devices or groups.
6. Click Save.

Note: The application must explicitly support Autonomous Single App Mode and be associated through the Autonomous Single App Mode policy. Assigning the app through another kiosk policy will not enable ASAM behavior.

Single-app vs. Multi-app Kiosk Mode: A Complete Guide

Android Kiosk Mode Deployment

Hexnode Single App Kiosk supports multiple Android management methods, including General Android, Android Enterprise Device Owner, Samsung Knox, LG GATE, Kyocera Business Phones, Custom ROM devices, and Android TV. On Android Enterprise Device Owner devices running Android 6.0 or later, administrators can optionally enable Lock Task Mode for additional system UI restrictions.

To configure Android Single App Kiosk:

1. Navigate to Policies and create a New Policy or edit an existing one.
2. Go to Kiosk Lockdown > Android Kiosk Lockdown > Single App.
3. Click Configure.
4. Select the application that will run in kiosk mode.
5. (Optional) Configure kiosk settings such as peripheral controls, launcher behavior, or Lock Task Mode (where supported).
6. Open the Policy Targets tab and assign the policy to the required devices or groups.
7. Click Save.

Depending on your deployment, you can also:

• Lock the device to a single website using Hexnode Browser Lite.
• Silently install enterprise APKs on supported Android management types.
• Configure the kiosk app to relaunch automatically after device reboot or shutdown.

Windows Single App Kiosk

Windows Single App Kiosk uses Microsoft’s Assigned Access framework to restrict a device to a single application. It supports Windows 10 (version 1709 or later) and Windows 11, with app support varying by Windows edition.

To configure Windows Single App Kiosk:

1. Ensure the kiosk application is installed and available to the kiosk account.
2. Create a New Policy or edit an existing one.
3. Navigate to Kiosk Lockdown > Windows Kiosk Lockdown > Single App.
4. Choose the kiosk application type (UWP or Desktop App, where supported).
5. Specify the kiosk account or configure Autologon if applicable.
6. Open Policy Targets and associate the policy with the required Windows devices.
7. Click Save.

When the kiosk account signs in, Windows automatically launches the configured application in kiosk mode.

Apple TV Digital Signage

Apple TV devices running tvOS 10.2 or later can be configured in Single App Mode when they are supervised and managed through Hexnode.

To configure Apple TV Single App Mode:

1. Ensure the Apple TV is supervised and enrolled in Hexnode UEM.
2. Navigate to Policies and create or edit a policy.
3. Go to Kiosk Lockdown > tvOS Kiosk Lockdown > Single App.
4. Click Configure and select the application.
5. Associate the policy with the target Apple TV devices.
6. Click Save.

Install Store apps on the Apple TV before using them in kiosk mode, or deploy supported enterprise applications through Hexnode. Once you apply the policy, the Apple TV launches directly into the selected application, making it well suited for digital signage and information displays.

Why Hexnode for Single Application Management

Hexnode provides cross-platform single app enforcement across iOS, iPadOS, Android, Windows, and tvOS from one console. Where native tools like Guided Access or Assigned Access are designed for local, manual configuration, Hexnode adds the remote-managed infrastructure that enterprise fleets require.

Capabilities that directly support single app deployments include:

• Zero-Touch Provisioning — Zero-touch enrollment can simplify large-scale deployment through Apple Automated Device Enrollment and Android Zero-Touch Enrollment. On iOS/iPadOS, preventing users from removing management requires a supported supervised ABM/ASM enrollment and an ADE profile configured to disallow UEM profile removal.
• Advanced Peripheral Controls — Remotely disable hardware buttons (Volume, Sleep/Wake), block USB connections, and lock screen orientation to prevent tampering.
• Remote View — Remotely inspect device screens on supported platforms and kiosk configurations to aid troubleshooting.
• Hexnode Browser Lite — Hexnode Browser Lite is a single-tabbed browser for kiosk web apps that can restrict navigation to approved URLs and provides configurable options for clearing cache and cookies.

Troubleshooting a Stuck Device

When a device becomes unresponsive in single app mode, work through this sequence:

1. Network check — Confirm the device has not drifted into a Wi-Fi dead zone, which blocks policy updates from reaching it.
2. Force a policy sync — Force a device sync using the documented Scan Device action from the Hexnode portal, or use Sync device with UEM on supported Android kiosk devices once you enable that Peripheral Setting.
3. Emergency exit — On supported Android kiosk configurations, administrators can configure a local or global kiosk exit passcode for hands-on exit. Other platforms use their documented platform-specific kiosk exit procedures.