Android kiosk enrollment shows Activate VPN promptSolved

Hello @sophia_miller ,

For the “Activate VPN” screen:

Hexnode may show this prompt when Android data restriction or network data usage tracking is enabled. This does not necessarily mean that a VPN policy was configured. Hexnode uses a local VPN on Android devices to monitor or restrict network data usage.

To prevent this prompt for future enrollments:

1. Go to Admin > General Settings.
2. Scroll to Data Restriction (Android).
3. Disable the options to prompt for VPN activation, including the kiosk-related VPN prompt if enabled.
4. Save the changes.
5. Also check Enroll > Android > Android Enterprise > Enrollment profile > App Configuration and make sure VPN activation is not set as a mandatory or auto-enabled permission unless you actually need Android data restriction.

Android Enterprise enrollment profile changes are applied during the device’s initial setup. If the device has already been enrolled or is partway through provisioning, a restart is usually not enough. Factory reset the device and enroll it again using the updated Android Enterprise enrollment profile.

For a device already stuck on the VPN screen, you can temporarily activate the local VPN to complete setup, then remove or disable the VPN later from the Android settings if you do not need data usage tracking.

Regards,
Simon Scott
Hexnode UEM

That explains the VPN part. Factory reset and re-enrollment worked for the VPN prompt. I’ve another issue, I already have location tracking and Force GPS configured in policy, but the Hexnode app still shows a notification for location services need to be enabled, and I’m trying to avoid exiting kiosk mode during setup to deal with that manually.

Okayy. One more thing to ask, I don’t want users to see an obvious kiosk exit button during or after setup. Is there a cleaner way to keep kiosk locked down but still allow admins to exit if needed?

Yes. In the kiosk policy, you can modify the kiosk exit settings so that admins use a multi-tap gesture to exit from the kiosk mode.

For example, configure kiosk exit so the user must tap the screen a defined number of times, such as 10 taps, to bring up the kiosk exit flow. This keeps the device locked down for end users while still giving technicians a controlled way to exit kiosk mode when required.