Intune iPad Kiosk Mode: Lock to One App, No Extra MDM

If your company runs Microsoft 365, you already pay for Microsoft Intune. Setting up Intune iPad kiosk mode for a visitor sign-in desk doesn’t require a separate MDM subscription, a Jamf license, or anything beyond what’s already in your M365 plan — the configuration lives inside the same admin center you use for Windows device management.

The goal is simple: the iPad locks to one app, the Home bar and app switcher disappear, and no on-device action can return a visitor to the home screen. Some offices also pair a sign-in kiosk with an AI receptionist for overflow and after-hours calls so the front desk stays covered even when no one’s sitting at it.

This guide walks the exact clickpath from a default Intune tenant to a locked reception iPad. If you’re still weighing which kiosk method to use — Guided Access vs. Single App Mode vs. Intune vs. Jamf — read our iPad kiosk mode guide first. That post maps every option with honest tradeoffs before you commit.

How Intune iPad Kiosk Mode Works Under the Hood

Intune’s iOS/iPadOS device configuration templates include a profile type called “Kiosk.” It exposes three locking modes:

• Single App, Managed App — locks the iPad to one app from your Intune app catalog
• Single App, Built-In App — locks to a pre-installed Apple app such as Safari or Maps
• Multi-App — shows a custom home screen grid limited to a defined set of apps

For a visitor sign-in desk, you want Single App, Managed App.

What Intune labels “Kiosk” is Apple’s Single App Mode AppLock payload — the same protocol command every other MDM uses to lock an iPad to one app. Intune sends that command to the supervised iPad; iOS enforces it at the operating-system level. The restriction re-engages every time the iPad reboots and checks back in, which is why this method survives power cycles where Guided Access doesn’t.

Worth clarifying early: this is not Guided Access. Guided Access is free, requires no MDM, and takes two minutes to configure — but it exits with a triple-click and won’t re-lock after a reboot. For a single staffed reception desk, Guided Access may be sufficient. For an unattended kiosk, multiple devices, or any deployment where you can’t rely on staff to re-lock the iPad each morning, Intune Single App Mode is the right call.

Which Microsoft 365 License Includes Intune?

Kiosk mode isn’t an upsell. It’s a core Intune device-configuration feature, and base Intune — Plan 1 — ships inside the Microsoft 365 bundles most offices already run: Microsoft 365 E3, E5, F1, F3, Business Premium, and the standalone Enterprise Mobility + Security (EMS) E3/E5 plans. If you manage Windows laptops or M365 accounts through one of those, you can build the iPad kiosk profile in the same admin center today. No Jamf seat, no separate MDM contract.

Microsoft is folding more into those base plans, not less. Under the 2026 Microsoft 365 packaging update, advanced Intune Suite capabilities — Remote Help, Advanced Analytics, and others — roll into E3 and E5 through the second half of 2026, scheduled to complete by August 1, 2026. A reception kiosk needs none of that; base Intune handles Single App Mode by itself. But it’s worth knowing the licensing direction before you sign for a third-party tool you may already own the equivalent of.

One requirement to check first: the iPad has to be on a current OS. Intune lists iOS/iPadOS 17.x and later as fully supported and allows enrollment back to 15.x, with no guarantee that older releases behave. Any iPad you’d buy new for a front desk clears this easily — just don’t try to repurpose a long-retired one.

Prerequisites Before You Open the Admin Center

Three things need to be in place before the kiosk profile does anything useful.

1. A supervised iPad

Single App Mode requires iPad supervision — a device state where iOS grants the MDM full device-level control. Without supervision, Intune sends the AppLock command and the iPad silently ignores it. The Intune console may show the profile status as “Succeeded” while the iPad remains unlocked. This silent failure is the most common source of confusion for first-time Intune kiosk deployments.

Supervision happens two ways:

• Apple Business Manager — iPads purchased through an authorized reseller or added to ABM can be supervised and enrolled over the air during initial setup. Right path for any fleet larger than one or two devices.
• Apple Configurator 2 — supervises an iPad over USB from a Mac. Free. Works for one or two kiosks, but requires physical access to each device.

2. The iPad enrolled in Intune

The iPad must appear as a managed device in your Intune tenant. For ABM-enrolled devices, enrollment happens automatically when you link ABM to Intune and assign an enrollment profile. For Configurator-supervised devices, enrollment completes when the user steps through initial setup and the Company Portal app registers the device.

3. The sign-in app deployed to the device

The kiosk profile locks the iPad to one app — that app must already be installed and assigned to the device before the kiosk profile applies. Add it as a managed app first: Apps → iOS/iPadOS → Add, assign it to the device group you’ll target. A kiosk profile that references an uninstalled app will show an error in the device configuration view.

Create the Kiosk Configuration Profile

Open the Intune admin center and go to:

Devices → Configuration → Create → New policy

Set Platform to iOS/iPadOS and Profile type to Templates → Kiosk. Click Create.

Basics tab — name the profile something recognizable: Reception iPad — Single App Kiosk is easy to find when troubleshooting.

Configuration settings tab — three Kiosk Mode options appear. Select Single App, Managed App, then configure:

• App to run in kiosk mode: Click Select a managed app and choose the visitor sign-in app you deployed. If it doesn’t appear, confirm the app is assigned as a managed app first, then try again.
• Touch — leave enabled. Visitors need to interact with the sign-in screen.
• Screen rotation — match your kiosk stand orientation. Most reception desks use a fixed portrait or landscape mount.
• Volume buttons — disable if the iPad is wall-mounted and you don’t want visitors adjusting volume.
• Sleep/wake button — disable to prevent the screen going dark between visitors.
• Auto lock — set to Never for a permanent kiosk. Otherwise the screen locks between visitors and requires a tap to wake before they can sign in.

Assignments tab — scope the profile to the device group containing your reception iPads only. Don’t assign it to all iOS devices. An accidental kiosk policy on a senior employee’s personal iPad is not an easy incident to explain.

Click Review + create, verify the summary, and save.

Assign the Profile and Confirm the Lock

After you save and publish the profile, Intune pushes it on the iPad’s next scheduled check-in. To apply it immediately:

1. Go to Devices → All devices and select the reception iPad.
2. Click Sync in the top action bar.
3. After 30–60 seconds, refresh the device view and open the Device configuration tab.
4. The kiosk profile should show Succeeded.

On the iPad: when the profile applies, the current app closes, the Home bar disappears, and the sign-in app launches automatically. Visitors can’t reach the home screen or switch apps through any on-device control — no triple-click exit, no Settings access, no app switcher.

Locking the iPad to More Than One App

Most reception desks want exactly one app on screen. But if your front desk also runs, say, a room-booking app or a building directory next to sign-in, Intune’s Multi-App kiosk mode shows a controlled home screen with only the apps you pick — everything else stays hidden. You set it up in the same Kiosk profile: choose Multi-App instead of Single App, Managed App, then add each app and lay out the grid.

Two things to weigh before going multi-app:

• Single App Mode is the stronger lock. One app, no Home bar, nothing for a visitor to wander into. Multi-app puts a home screen back on the device — fine for a staff-facing kiosk, riskier for an unattended lobby.
• The Kiosk profile can lock to three app sources. A managed app from your Intune catalog, a built-in app such as Safari or Maps by bundle ID, or a Store app by its App Store URL, per Apple device restriction settings in Intune. For a visitor sign-in desk, a single managed app is almost always the right answer.

One caveat that catches people: a device locked in Single App Mode can’t switch to an authenticator app to finish a multi-factor prompt. If your sign-in app expects per-device MFA, plan to handle that login on the backend or at the host level — the locked iPad can’t satisfy a second-factor challenge that lives in another app.

When the iPad Won’t Lock: Common Issues

Profile shows “Succeeded” but the iPad isn’t locked

The device isn’t supervised. On the iPad, check Settings → General → VPN & Device Management. If you see an enrollment profile but no supervision indicator, the device enrolled without supervision — the AppLock command arrives and iOS ignores it silently. Fix: re-enroll through ABM or Configurator with supervision enabled. Our iPad Single App Mode guide covers the supervision process for both paths.

The app isn’t locking — home screen is still accessible

The sign-in app isn’t installed on the device — or it landed after the profile did. Confirm it shows Installed in the device’s App Inventory inside Intune. The kiosk profile references the app’s Bundle ID; if the app isn’t present when the profile applies, iOS can’t lock to it. One detail Microsoft calls out and most people miss: if the app is installed after you assign the kiosk profile, the iPad doesn’t enter kiosk mode until it restarts. So reboot the device after confirming the install — a plain Sync won’t trigger the lock on its own.

Profile status shows “Conflict”

Two configuration profiles are sending competing restrictions to the same device. Open the device’s profile list and look for duplicate Kiosk assignments. Remove whichever one shouldn’t be there.

The wrong app is showing in kiosk mode

Double-check the Bundle ID in the kiosk profile. One character off causes the wrong app to run — or a silent failure where no lock applies at all. Verify against the app developer’s IT documentation or Apple Configurator 2’s Get Info view on the installed app.

FAQ

Does Intune kiosk mode survive an iPad reboot?

Yes. This is the main advantage over Guided Access. When the iPad reboots and reconnects to Intune, the MDM re-sends the AppLock restriction and the device comes back up locked to the same app. No staff action required.

Do I need Apple Business Manager, or will Apple Configurator 2 work?

Both work. Apple Configurator 2 supervises over USB from a Mac — it’s free and fine for one or two kiosks. Apple Business Manager is the right path for larger fleets: ABM-enrolled iPads are supervised over the air during initial device setup, so no USB cable or physical access is needed per device.

Can staff exit kiosk mode without involving IT?

Not with MDM-managed Single App Mode. The only exits are a Disable Single App Mode command from the Intune console or removing the configuration profile. If staff need to occasionally break out of kiosk mode without an IT ticket, ask your visitor sign-in app vendor whether they support Autonomous Single App Mode (ASAM) — that lets the app self-lock and self-unlock via an in-app passcode, while the MDM controls the overall authorization.

Does the iPad need to stay connected to the internet to remain locked?

No. Once Intune applies the AppLock profile, iOS enforces the restriction locally. The iPad stays locked even offline. It does need to reach Intune periodically to receive policy updates or the command to disable Single App Mode.

Which Microsoft 365 license do I need for Intune iPad kiosk mode?

Base Intune — Plan 1 — which is included in Microsoft 365 E3, E5, F1, F3, Business Premium, and the standalone EMS E3/E5 plans. Kiosk mode is a core device-configuration feature in Plan 1, so there’s no add-on to buy. If you already manage Windows devices or Microsoft 365 accounts through one of those bundles, you can build the iPad kiosk profile in the same admin center today.

Can a kiosk iPad locked to one app still use multi-factor authentication?

Not easily. A device in Single App Mode can’t switch to an authenticator app to complete a second factor, so per-app MFA prompts tend to break under the lock. For a reception kiosk, handle authentication on the app’s own backend or at the host level rather than relying on a device-side MFA challenge the locked iPad can’t satisfy.

What iPadOS version does Intune kiosk mode require?

Intune lists iOS/iPadOS 17.x and later as fully supported and allows enrollment back to 15.x, though Microsoft doesn’t guarantee older releases behave correctly. Any iPad you’d buy new for a reception desk clears this comfortably — keep the device on a current iPadOS release so the kiosk profile and policy check-ins stay reliable.

Where do I find the Bundle ID for the InstaCheckin iPad app?

It’s listed in the InstaCheckin admin portal under Settings → Device Setup. You can also find it in Apple Configurator 2 by selecting the installed app and choosing Get Info, or in the IT setup documentation InstaCheckin provides when you start a trial.

Set Up InstaCheckin on Your Kiosk iPad

InstaCheckin’s iPad app is built for MDM-managed kiosk deployments. Lock it to Single App Mode through Intune, and visitors see only the sign-in flow — photo capture, NDA or waiver signature if required, and a host notification by email or SMS the moment they check in. The InstaCheckin admin portal gives your IT team the app’s Bundle ID and enrollment steps without hunting through third-party documentation. If you’re standing up reception for a corporate office, the office visitor management system page covers the full front-desk workflow, and our comparison of the best visitor sign-in apps shows how the iPad options stack up before you commit. Start a free trial and pair it with your existing Intune setup.