Android single-app kiosk: allow only Wi-Fi and hide Settings/navigation barSolved

Hi @haniel, For this use case, the recommended setup is to keep the device in Android Enterprise device owner mode and configure Wi-Fi access through Hexnode kiosk Peripheral Settings instead of allowing access to the native Android Settings app.

Use the following configuration:

1. Lock the device to the web app
   • Go to Policies > Kiosk Lockdown > Android Kiosk Lockdown.
   • Choose Single App kiosk.
   • Select the web app that should run on the device.
2. Block native Android Settings
   • In the same policy, go to Android > Restrictions > Advanced Restrictions.
   • Under Allow Settings, keep Modify settings unchecked.

   This prevents users from opening and modifying the normal Android Settings app.

3. Allow only Wi-Fi from kiosk
   • Go to Kiosk Lockdown > Android Kiosk Lockdown > Peripheral Settings.
   • If users need to change networks manually, enable Users can turn Wi-Fi on/off.
   • Keep the other peripheral options disabled if users should not access anything else.

   With this setup, users can manage Wi-Fi through Hexnode’s kiosk peripheral menu, such as the floating icon or kiosk settings shortcut, without getting access to the full Android Settings app.

4. Hide navigation/status controls for stricter lockdown
   • In Android Kiosk Lockdown > Peripheral Settings, click the Disable System Bar option if users should not access navigation controls.
   • If your policy also has Advanced Restrictions > Display Settings, make sure there is no conflicting setting. For example, if you want the status bar available, do not enable Hide Status Bar. If you want a strict kiosk with no status shade, keep the status bar hidden and use Hexnode’s floating peripheral menu for Wi-Fi access.
5. Prevent lock screen where applicable
   • Remove any passcode configuration from the policy if a passcode is not required.
   • In the kiosk policy, enable the available lock task options such as Lock Task Mode and activating lock task mode on reboot.

After saving the policy, allow the device to sync. You can confirm deployment from Manage > Devices > select the device > Action History and check whether the effective policy update completed successfully.

Regards,
Isabel Lora
Hexnode UEM

That explains part of it. I had Modify settings enabled at one point because I thought it was needed for Wi-Fi. When I turn it off and enable Wi-Fi in peripheral settings, I still see a Hexnode Settings icon on the kiosk screen. Is that normal, or does it mean users can still open Android settings?

The Hexnode Settings icon is expected when kiosk peripheral settings are enabled. It does not mean the full Android Settings app is exposed.

That icon opens Hexnode’s restricted kiosk settings panel, where only the peripheral options allowed in the policy are available. So if only Wi-Fi is enabled under Peripheral Settings, users should only be able to access Wi-Fi-related controls from there.

If users can still open the full Android Settings app and change items such as passwords, check that Modify settings option is unchecked under Android > Restrictions > Advanced Restrictions > Allow Settings.

Also verify that there is not another Android policy associated with the same device that allows settings access.

Regards,
Isabel Lora
Hexnode UEM

I ran into something similar on Android tablets. The confusing part was the status bar setting. I had enabled Wi-Fi access but also hid the status bar, so I couldn’t pull down the quick settings panel. Using the Hexnode floating menu for Wi-Fi worked better for a locked-down kiosk.

Yes @ace_98, that is the right approach for strict kiosk deployments.

There are two valid configurations depending on the intended user experience:

• If users should use Android’s pull-down quick settings, the status bar must be allowed and no Advanced Restriction should hide it.
• If users should not access the notification shade or system UI, hide/disable the status/system bar and provide Wi-Fi access only through Hexnode’s kiosk peripheral menu.

For a public-facing web kiosk, the second option is usually safer because it avoids exposing notification shade controls while still allowing Wi-Fi changes through the managed kiosk interface.

Regards,
Isabel Lora
Hexnode UEM

What about the bottom navigation bar? On one tablet it looked more like gesture navigation, and users could still try to swipe from the bottom. I disabled the system bar, but it didn’t seem immediate.

Policy changes may take a short time to apply, and some kiosk UI changes may require the device to sync and then reboot before the behavior is fully updated.

For the bottom navigation bar:

• In the Android kiosk policy, click Disable System Bar from Peripheral Settings.
• If the device manufacturer provides additional navigation controls, check Android > Advanced Restrictions > Display Settings for options such as Hide Navigation Bar.
• On some OEM builds, gesture navigation behavior may be controlled by manufacturer-specific settings. In those cases, applying the Hexnode restriction and rebooting the device is often required.

If the device is Samsung, there are additional Samsung-specific restrictions available. For Lenovo and other Android OEMs, behavior can vary based on the OS build and manufacturer customization.

Regards,
Isabel Lora
Hexnode UEM

The Wi-Fi and kiosk part is working now. One more thing: Remote View showed only a black screen on a Lenovo tablet while the device was in kiosk. Is that caused by the same kiosk settings?

A black screen in Remote View is usually related to screen capture restrictions rather than Wi-Fi or kiosk peripheral settings.

For Lenovo Android tablets, check both of the following:

1. Hexnode policy restrictions
   • Make sure Screen capture is not blocked in the Android restriction policy.
   • If a restriction disables screen capture, Remote View may connect but show a black screen.
2. Device or OEM screen sharing protection
   • Some Lenovo builds include system-level or OEM customization settings that can block screen sharing or screen capture.
   • Disable screen share protection or allow screen capture in the device/OEM customization interface if available.

Once screen capture is allowed in the policy and not blocked by Lenovo’s system customization settings, Remote View should display the live screen normally.

Regards,
Isabel Lora
Hexnode UEM