Android kiosk mode blocks SSO webview in custom appSolved

Hi @jayceon,

For this type of deployment, Android Enterprise enrollment with a kiosk policy is the recommended approach. Here is how each requirement can be handled in Hexnode:

1. Returning to kiosk mode locally

If kiosk mode was exited manually, open the Hexnode for Work app on the tablet and select Activate Kiosk. This will place the device back into kiosk lockdown.

2. WebView or SSO flow showing “ACCESS DENIED” in kiosk mode

This usually happens when the app launches another package that is not allowed in the kiosk policy. For example, a sign-in flow may invoke WebView, browser, Google services, or another authentication-related package.

To fix it:

– Identify the blocked package from the device/application details in the Hexnode portal.
– Add the blocked package identifier to Hexnode as an app/package.
– Open the kiosk policy.
– Go to Kiosk Lockdown > Android Kiosk Lockdown > Background Apps.
– Add the required blocked package there.
– Save the policy and sync it to the device.

Background apps are allowed to run behind the kiosk app without becoming visible as launchable apps in kiosk mode.

3. Screen timeout / keeping the screen on

You can configure screen timeout from Policies > Android > Restrictions > Basic > Screen Timeout. If the portal offers Never, it can be used even if the same option is not shown in the device’s native Android settings.

For devices in kiosk mode, also configure: Policies > Kiosk Lockdown > Peripheral Settings > Keep screen on.
This is the better kiosk-specific setting if the tablet should not sleep during active use.

4. Updating the app on a group of tablets

For a public Google Play app:

– Go to Apps tab, and open the app.
– Use the settings/gear option and select Check for updates.
– If the app is deployed through a policy, Hexnode pushes the latest available version to assigned devices.

For an enterprise APK:

– Go to Apps tab, open the enterprise app, and edit the app.
– Replace the APK with the newer version and save.
– Android Enterprise devices can install the update silently.

To deploy the app update immediately to a group:

– Go to Manage tab, and select the device group.
– Choose Actions > Install Application.
– Select the updated app.

5. Naming tablets during enrollment

You can automate names using Android Enterprise enrollment profiles. Create separate enrollment profiles for different locations or groups, set a friendly name prefix, and use sequential numbering such as:

Tablet 1, Tablet 2, Tablet 3

The friendly name is shown in the Hexnode portal and can also be viewed on the device from Hexnode app settings or from the kiosk peripheral settings About section, if that option is enabled.

For unique identification, the Hexnode Device ID is still the safest value to use because it is unique in the portal. Friendly names are useful for field staff and location-based tracking.

Regards,
Sienna Carter
Hexnode UEM