Assigned Access in Windows 11 Kiosk Mode: How to Prepare Windows to Launch a Specific App

Assigned access and kiosk mode in Windows 11 Restricted Devices represent two of the most powerful and little-known options for configuring restricted devices. While this may sound like a feature exclusive to large companies, the reality is that more and more organizations—including SMEs, educational centers, and even customer-facing businesses—are turning to these settings to control what apps and functionalities the user can access on a Windows computer.

In this article you will find a complete guide What kiosk mode and assigned access actually are in Windows 11, the differences between the different types of kiosks, and how you can configure them, both with Windows-based tools and modern device management solutions. You'll also learn about real-world use cases, essential requirements, and best practices to get the most out of these features.

What is Assigned Access and Kiosk Mode in Windows 11?

Kiosk mode is not a feature intended for the average home user.. Although it is included as standard in the Pro, Enterprise, Education and IoT Windows, is clearly oriented towards business contexts, educational environments or environments where a computer is required to only allow the use of one or more predefined applications.

In essence Kiosk mode transforms a conventional PC into a dedicated device. The logged-in user can only access the permitted application(s), without the ability to explore the system, open personal files, modify important settings, or install software. It's ideal for Self-service equipment, public terminals, shared computers, computer labs or points of sale.

Kiosk mode is based on the functionality of assigned access (Assigned Access), which is responsible for limiting the user's actions on the device. It should not be confused with guest mode or the well-known "god mode," as it pursues exactly the opposite: close the system to what is essential.

What exactly is it for?

• Ensure that users can only use one or more specific applications, preventing tampering or system clutter.
• Protect sensitive information by preventing access to internal files and advanced settings.
• Facilitate the monitoring and control of devices used in public spaces or by multiple people.
• Optimize the self-service experience and streamline procedures in environments such as airports, hotels, museums, hospitals, schools, and businesses.

Types of kiosk mode in Windows 11

In Windows 11, Two main kiosk modalities can be enabled through assigned access:

• Single application kiosk: The user can only use one application (usually an app from the Microsoft Store or Microsoft Edge). When you log in, the app runs automatically, and you can't access any other features, switch apps, or browse the desktop.
• Multi-App Kiosk (Restricted User Experience): Allows the use of several specific apps. The Windows desktop appears restricted, the Start menu and taskbar display only allowed apps, and AppLocker rules and custom policies can be applied to strengthen security and further restrict the experience.

Each modality responds to different needsA single-app kiosk is typical for public kiosks for quick reference, digital signage, or highly specific uses, while a multi-app kiosk is useful for shared devices in businesses or schools, where flexibility is required without losing control.

Strategic advantages of kiosk-mode devices

Deploy devices with assigned access and kiosk mode provides key benefits for organizations:

• Efficient customer serviceEssential services—such as billing, reservations, restaurant orders, or card printing—can be provided without the need for specialized personnel, saving operational costs and reducing wait times.
• Fewer errors and greater security: : The chances of the user performing inappropriate actions (deleting files, installing third-party apps, modifying critical parameters, etc.) are minimized.
• Professional and consistent brand image: The interface and applications the user accesses remain under the company's control, reinforcing visual and functional consistency across all devices.
• Advanced customization: It is possible to configure everything from touch devices and interactive kiosks to self-service terminals, adapting to different needs (catalogs, directories, wayfinding, etc.).

Some common use cases include airport check-in kiosks, point-of-sale terminals, museum information panels, library reference computers, hospital monitoring devices, and many others.

Essential requirements to activate kiosk mode and assigned access

Before you jump into setting up a kiosk in Windows 11, it's a good idea to review the technical and accounting requirements that must be met:

• Compatible Windows Edition: Only available on Windows 11 Pro, Enterprise, Education, and IoT versions.
• supported applicationsFor single-app kiosks, only UWP (Universal Windows Platform) or Microsoft Edge apps can be selected. For multiple apps, allowed apps must be previously installed and registered on the device.
• User Account Control (UAC): Must be enabled on the system.
• Standard user account: : The access assigned is associated with standard accounts, not administrator accounts.
• Kiosk mode must be configured locally (not via Remote Desktop).
• The selected user must have permissions to log in locally. It can be adjusted through local security policies (user rights assignment section).

How is assigned access different from guest mode and other limited environments?

Assigned access imposes a much more severe restriction than guest mode.. In guest mode, the user has a classic Windows environment, albeit with limitations. In contrast, under assigned access, both the visible surface and the commands available resources are reduced to a minimum, making it impossible for the user to access unauthorized areas of the system.

As for other methods of restriction, such as AppLocker or custom policies, assigned access stands out because offers a user experience radically oriented towards controlled use of certain programs, without the possibility of 'escaping' to other sections of the operating system.

Step-by-Step Setup for Kiosk Mode in Windows 11 (Assigned Access)

There are several ways configure assigned access Depending on the number of devices, the environment, and the level of automation you need. Here are the main options:

Manual setup via the Windows Settings app

To enable a single-app kiosk easily:

1. Create a standard user account (non-admin). This can be done from the Accounts panel in Settings.
2. Open the Settings app (Windows + I combination).
3. Navigate to Accounts > Other users and tap “Set up assigned access” or “Set up a kiosk.”
4. Select “Getting Started.” Choose the standard account you created.
5. Choose the Microsoft Store app (UWP) or Microsoft Edge which will run in kiosk mode every time the user logs in.
6. Configure specific options (for example, if it's Microsoft Edge, you can determine whether a website will be displayed full screen (digital signage) or with basic controls for public browsing, the URL to display, and timeouts/inactivity).
7. Save and restart your computer. When you log in with the standard account enabled for assigned access, the user will be restricted to the selected app.

Exiting kiosk mode requires logging out (Ctrl+Alt+Del) or, in some cases, a reboot.

Configuration using MDM solutions (such as Intune or Mobile Device Manager Plus)

If you manage multiple devices in an organization, you can centralize the creation of kiosk profiles:

1. Access the console of the MDM solution you use (example: Intune, Mobile Device Manager Plus…).
2. Create a new configuration profile for Windows.
3. Select the “Kiosk” option and decide the type: single-app or multi-app.
4. Indicates the allowed applications (name, package identifier, etc.).
5. Define advanced policies (silent app installation, key restriction, timeout, automatic restart, etc.).
6. Associate the profile with the devices or user groups that will work in kiosk mode.
7. MDM automates both app configuration and distribution, even allowing new apps to be installed after the kiosk is activated.

This route is recommended for mass provision dozens or hundreds of devices, keep them updated and monitor their status.

Advanced PowerShell Configuration, Policies, and Provisioning Packages

For complex or highly customized scenarios, CSP policies, scripts can be applied PowerShell, or provisioning packages (PPKG) with XML code that defines exactly how the device should behave in kiosk mode.

For example, settings such as:

• Run Microsoft Edge in kiosk mode, with a fixed URL and command-line arguments to determine full-screen mode, There inactivity and exit key combinations.
• Force automatic login with a specific account.
• Block the ability to close the app except by using a specific key sequence (for example, Ctrl+A).

This method is the most technical, but also the one that provides the greatest level of control over the device's behavior.

What happens on a device with kiosk mode active?

Once the kiosk profile is configured and applied:

• Only authorized apps are accessibleIf you are in single-app mode, the entire user experience is limited to that app.
• The Start menu, taskbar, and other system functions are hidden or severely restricted..
• Upon reboot, the logged-in user will be taken directly to the configured app(s), without any additional windows or wizards.
• In multi-app kiosk mode, you can have custom menus, and AppLocker filters out any attempts to open unauthorized apps.
• Closing the kiosk or rebooting the system completely terminates the session and the device is locked again for the next user.

How to remove or disable kiosk/assigned access mode

Disabling kiosk mode is just as simple as setting it up.Simply return to the Settings app, go to Accounts > Family & other users > Configured kiosk, and remove the assigned access. You can also use PowerShell scripts that set the setting to null in the corresponding device namespace, followed by a reboot to apply the changes.

Differences between built-in kiosk mode and specialized management software

Kiosk mode included in Windows 11 It is primarily limited to running Microsoft Store apps in single-app mode.. If your organization needs:

• Allow more than one application simultaneously.
• Install or update apps after activating the kiosk.
• Remotely manage multiple devices or apply different profiles based on user groups.
• Integrate terminals of all types, from PCs to Surface Pro tablets.

… so It is better to opt for a specialized MDM management solution which significantly expands capabilities: centralized management, mass provisioning, integration with enterprise policies, support for corporate apps not available in the Store, and much more.

Taking advantage of Microsoft Edge in kiosk mode

Microsoft Edge plays a key role in the single-app kiosk mode, allowing you to launch the browser as the primary interface, ideal for digital signage, service kiosks, or self-service terminals. Among its notable options:

• Digital signage mode: Displays a specific website in full screen, with no navigation bars or options visible.
• Public browser mode: Allows some browsing within set limits, with tabs opening and closing automatically at the end of the session using InPrivate sessions, which protect privacy.

Parameters such as the launch URL, the time after which the session is restarted, and custom key combinations to enable or disable features can be directly defined.

When is each kiosk configuration appropriate?

To select the most appropriate experience, you should ask yourself questions such as:

• How many applications do I need to run? If there's only one app, opt for the single-app kiosk; if there are multiple apps, the restricted user experience is your option.
• Do I need a traditional desktop or a custom interface? Assigned access in the multi-app kiosk allows you to maintain the desktop, but only display allowed apps. If you need to completely replace the shell (graphical interface), there is an advanced mode for enterprises (Shell Launcher), which Microsoft only recommends for specific cases.
• What edition of Windows do you have? Assigned access is available in Pro, Enterprise, Education, and IoT; Shell Launcher is exclusive to Enterprise and Education.
• Will the user account be local or domain? You can apply assigned access to standard local accounts, domain accounts, or even Microsoft Sign-in IDs, depending on your environment.

Limitations and Important Considerations

Not everything is an advantage in Windows 11 kiosk mode. It's worth considering:

• For built-in assigned access you can only choose UWP or Edge apps in single app mode. It is not possible to include Win32 desktop apps without resorting to advanced methods.
• Changes to the kiosk profile usually require a restart of the computer. so that they are applied correctly.
• If an authorized app is removed, kiosk mode may stop working or become blocked until it is reinstalled.
• Accounts used for kiosks should be standard, never administrator accounts..
• Not all editions of Windows 11 support kiosk (Home edition is left out).
• The user experience on touch devices may require additional configuration and testing.

In corporate environments, it is always advisable Test the configuration thoroughly on one or more devices before mass deploying kiosk mode in the production environment.

Additional benefits of using specialized kiosk software

While the standard kiosk mode in Windows 11 is free and functional, businesses often rely on solutions like Mobile Device Manager Plus or Intune to:

• Manage, monitor, and provision hundreds of devices remotely.
• Install apps after activating the kiosk, without manual intervention.
• Supports all types of devices (PC, tablets, terminals, Surface…)
• Add or remove users and profiles based on changing needs.
• Apply advanced restrictions, such as network blocking, silent app installation, automatic Wi-Fi configuration, and more.

This removes many of the limitations of basic assigned access and makes large-scale management easier.

Kiosk mode in Windows 11, both integrated and through specialized solutions, allows organizations to maximize security, efficiency, and user experience in controlled environments. Leveraging these features can make a difference in how devices are managed and used in different environments, ensuring protection and simplification in daily operations.

Related article:

Complete guide to setting up kiosk mode in Windows 11: advanced options, requirements, and tips

Isaac

Passionate writer about the world of bytes and technology in general. I love sharing my knowledge through writing, and that's what I'll do on this blog, show you all the most interesting things about gadgets, software, hardware, tech trends, and more. My goal is to help you navigate the digital world in a simple and entertaining way.