Windows Kiosk in Multi-App mode is designed for scenarios where a device must run more than one approved application under strict control.
Unlike traditional single-app kiosks, this configuration supports multiple apps while enforcing restrictions that prevent unauthorized use.
Administrators can define the app set, and manage user access consistently across devices. This ensures a locked-down environment that is secure, and aligned with organizational requirements.
Configuration for a multi-app kiosk #
Once in the Applivery dashboard, head to the Device Management section and select Policies (1). Select the policy you want to configure for a multi-app kiosk.
Next, in the left-hand menu, select + Add configuration (2), search for Custom Policies (3), and then click to create the new configuration.
Step 1 - Create a kiosk user #
Use the following OMA-URI to create a kiosk user:
-
OMA-URI:
./Device/Vendor/MSFT/Accounts/Users/$USERNAME/Password.Replace the
$USERNAMEvariable in the OMA-URI with the desired username. - Format: String (chr).
-
Value: This value sets the password for the kiosk user.
Step 2 - Enable Shared PC Mode #
Use the following OMA-URI to enable Shared PC Mode:
- OMA-URI:
./Vendor/MSFT/SharedPC/EnableSharedPCMode. - Format: Boolean (bool).
- Value: true.
Enables Shared PC Mode, optimizing the device for multiple users with restricted access.
Step 3 - Define the account model in Shared PC Mode #
Defines the account model in Shared PC Mode:
- OMA-URI:
./Vendor/MSFT/SharedPC/AccountModel. - Format: Integer (int).
- Value: 2 (this indicates a mode with disposable or restricted accounts).
Step 4 - Configure Assigned Access Mode #
Defines the account model in Shared PC Mode:
- OMA-URI:
./Vendor/MSFT/AssignedAccess/Configuration. - Format: String (chr).
- Value:
<?xml version=»1.0″ encoding=»utf-8″?> <AssignedAccessConfiguration xmlns:xs=»http://www.w3.org/2001/XMLSchema» xmlns=»http://schemas.microsoft.com/AssignedAccess/2017/config» xmlns:default=»http://schemas.microsoft.com/AssignedAccess/2017/config» xmlns:rs5=»http://schemas.microsoft.com/AssignedAccess/201810/config» xmlns:v3=»http://schemas.microsoft.com/AssignedAccess/2020/config» xmlns:v5=»http://schemas.microsoft.com/AssignedAccess/2022/config«> <Profiles> <Profile Id=»{9A2A490F-10F6-4764-974A-43B19E722C23}»> <AllAppsList> <AllowedApps> <App AppUserModelId=»Microsoft.WindowsCalculator_8wekyb3d8bbwe!App» /> <App AppUserModelId=»Microsoft.Windows.Photos_8wekyb3d8bbwe!App» /> <App AppUserModelId=»Microsoft.BingWeather_8wekyb3d8bbwe!App» /> <App DesktopAppPath=»C:\Windows\system32\cmd.exe» /> <App DesktopAppPath=»%windir%\System32\WindowsPowerShell\v1.0\Powershell.exe» /> <App DesktopAppPath=»%windir%\explorer.exe» /> <App AppUserModelId=»windows.immersivecontrolpanel_cw5n1h2txyewy!microsoft.windows.immersivecontrolpanel» /> <App AppUserModelId=»%ProgramFiles(x86)%\Microsoft\Edge\Application\msedge.exe» /> </AllowedApps> </AllAppsList> rs5:FileExplorerNamespaceRestrictions <rs5:AllowedNamespace Name=»Downloads» /> <v3:AllowRemovableDrives /> </rs5:FileExplorerNamespaceRestrictions> v5:StartPins<![CDATA[{ «pinnedList»:[ {«packagedAppId»:»Microsoft.WindowsCalculator_8wekyb3d8bbwe!App»}, {«packagedAppId»:»Microsoft.Windows.Photos_8wekyb3d8bbwe!App»}, {«packagedAppId»:»Microsoft.BingWeather_8wekyb3d8bbwe!App»}, {«desktopAppLink»:»%APPDATA%\Microsoft\Windows\Start Menu\Programs\System Tools\Command Prompt.lnk»}, {«desktopAppLink»:»%APPDATA%\Microsoft\Windows\Start Menu\Programs\Windows PowerShell\Windows PowerShell.lnk»}, {«desktopAppLink»:»%APPDATA%\Microsoft\Windows\Start Menu\Programs\File Explorer.lnk»}, {«packagedAppId»: «windows.immersivecontrolpanel_cw5n1h2txyewy!microsoft.windows.immersivecontrolpanel»}, {«desktopAppLink»: «%ALLUSERSPROFILE%\Microsoft\Windows\Start Menu\Programs\Microsoft Edge.lnk»} ] }]]></v5:StartPins> <Taskbar ShowTaskbar=»true» /> </Profile> </Profiles> <Configs> <Config> <AutoLogonAccount rs5:DisplayName=“$USERNAME” /> <DefaultProfile Id=»{9A2A490F-10F6-4764-974A-43B19E722C23}» /> </Config> </Configs> </AssignedAccessConfiguration>
The Profiles Section defines a profile with a unique ID ({9A2A490F-10F6-4764-974A-43B19E722C23}) and specifies a whitelist of allowed applications under <AllowedApps>. This includes UWP apps such as Microsoft Calculator, Photos, and Bing Weather,, as well as desktop apps like Command Prompt, PowerShell, and File Explorer.
File Explorer restrictions (rs5:FileExplorerNamespaceRestrictions) are applied to allow access to the Downloads folder only, while still permitting the use of removable drives. The Start Menu pinned apps (v5:StartPins) section defines which applications appear pinned to the Start Menu, corresponding to the allowed apps. Taskbar configuration is enabled (<Taskbar ShowTaskbar="true" />), ensuring the taskbar is visible in kiosk mode.
In the Configs Section, Auto Logon automatically signs in the user, with $USERNAME replaced by the actual username for the kiosk. Profile assignment sets the defined profile as the default. Ensure you replace $USERNAME in the <AutoLogonAccount rs5:DisplayName> element with the username of the previously created user intended for this kiosk mode.
