Getting Started with Android Kiosk Management

Android kiosk management refers to the process of locking down a device to a specific environment, limiting it to a single application or a restricted set of apps. This ensures devices used for specific purposes; such as retail POS, digital signage, or education, remain secure and focused.

With Hexnode UEM, administrators can easily transform standard Android devices into dedicated kiosks.

Enrollment Prerequisites

Before configuring Android kiosk management profiles, devices must be properly enrolled.

• Standard Enrollment: Suitable for basic management.
• Android Enterprise (Device Owner): Required for the most robust kiosk security. You must enroll your organization in the Android Enterprise program first.
• Custom ROM Enrollment: Devices flash with a custom ROM are automatically enrolled upon first boot.

Kiosk Modes and Configuration

Hexnode offers versatile kiosk modes depending on the use case.

Single App Kiosk

Locks the device to a single application. The user cannot minimize the app or access the home screen.

Best for: Self-service terminals, ticket machines.

Multi-App Kiosk

Allows access to a specific list of “Allowlisted” apps. Users can switch between these approved apps but cannot access unapproved software or device settings.

Best for: Employee devices, logistics field tools.

Digital Signage & Screensavers

• Digital Signage: Transforms the device into a media streaming tool, playing images or videos in a continuous loop.
• Kiosk Screensaver: Displays audio, video, or images when the device is idle.

Web Kiosk Settings

For devices intended to browse the web, Hexnode allows you to block unapproved URLs and strictly allow essential websites.

Hexnode Browser Modes:

• Single Tab: Opens one web app.
• Multi-Tab: Allows switching between allowlisted websites (Android 5.0+).
• Web View: Opens web apps in full screen with periodic refresh capabilities.

External Browsers:

You can also choose a third-party browser (e.g., Chrome) by installing it and adding it to the Kiosk allowlist.

App Management in Kiosk Mode

Installing Apps

You can push applications from various sources to a Kiosk device:

• Store Apps (Google Play)
• Enterprise Apps (APKs)
• Web Apps (URLs)
• Managed Google Apps
• Bundle IDs

Silent Installation Support:

To install apps without user interaction (Silent Install), the device must be:

• Samsung Knox
• LG GATE
• Kyocera Business Phone
• Rooted Android
• Android Enterprise (Device Owner)
• Device with Hexnode UEM as a System App

Updating Apps

Hexnode allows you to update apps without exiting kiosk mode.

• Store/Enterprise Apps: Deploy the new version via policy; the app updates in the background or upon restart depending on the configuration.
• Hexnode UEM Agent: The Hexnode UEM agent can be updated while the device remains locked.

Background Apps (Hidden Apps)

• Function: Allows an app to run in the background without showing an icon on the kiosk screen.
• Use Case: Critical for dependency management. If a Kiosk app requires a second app/package to function, that second app must be added as a “Background App.” If not, the device may show a “Blocked Package” error.

Exit Kiosk Mode

Administrators can disable Android kiosk management to return the device to normal functionality. This is done via the “Disable Kiosk Mode” action in the Hexnode console.

Troubleshooting Android Kiosk Management

Common issues encountered during Android kiosk management and their solutions.

1: “Blocked Package” Error Message

Cause: The active kiosk app is trying to call a background process or another app that is not in the allowlist.

Solution: Identify the dependent package name and add it to the Background Apps section of the Kiosk Lockdown policy.

2: Physical Buttons (Home/Back) still work

Cause: The kiosk profile has not restricted hardware keys, or the device is not in “Device Owner” mode.

Solution: Ensure “Peripheral Settings” are configured to disable hardware keys.

3: Web Kiosk is showing an “Access Denied” error

Cause: The URL being accessed attempts to redirect to a domain not on the allowlist.

Solution: Check the URL structure. If a login page redirects to an authentication server (e.g., sso.company.com), that redirect URL must also be allowlisted.

Frequently Asked Questions (FAQ)

Q: Can admin update an app while the device is in Kiosk mode?

A: Yes. Hexnode allows you to deploy app updates remotely. The device will update the software without the user needing to manually exit the Kiosk environment.

Q: What is the difference between Single App Mode and Digital Signage?

A: Single App Mode locks the device to an interactive application. Digital Signage is non-interactive; it is strictly used to display media (videos/images) in a loop for advertising or information.

Q: Can admins run a standard website as a Kiosk app on Android?

A: Yes. You can add the URL as a “Web App” in the Hexnode inventory. You can then choose to launch it using the secure Hexnode Browser or a standard browser like Chrome (if allowed).

Q: Why do admins need to add “Background Apps”?

A: Kiosk mode is a “Deny All” environment by default. If your main app relies on a helper service (like a barcode scanner service or a map service) to function, that helper service will be blocked unless you explicitly permit it as a background app.