Intune iPad Kiosk Mode: Step-by-Step for Microsoft 365 Admins

If your company runs Microsoft 365, you already pay for Microsoft Intune. Setting up Intune iPad kiosk mode for a visitor sign-in desk doesn’t require a separate MDM subscription, a Jamf license, or anything beyond what’s already in your M365 plan — the configuration lives inside the same admin center you use for Windows device management.

The goal is simple: the iPad locks to one app, the Home bar and app switcher disappear, and no on-device action can return a visitor to the home screen. Some offices also pair a sign-in kiosk with an AI receptionist for overflow and after-hours calls so the front desk stays covered even when no one’s sitting at it.

This guide walks the exact clickpath from a default Intune tenant to a locked reception iPad. If you’re still weighing which kiosk method to use — Guided Access vs. Single App Mode vs. Intune vs. Jamf — read our iPad kiosk mode guide first. That post maps every option with honest tradeoffs before you commit.

How Intune iPad Kiosk Mode Works Under the Hood

Intune’s iOS/iPadOS device configuration templates include a profile type called “Kiosk.” It exposes three locking modes:

• Single App, Managed App — locks the iPad to one app from your Intune app catalog
• Single App, Built-In App — locks to a pre-installed Apple app such as Safari or Maps
• Multi-App — shows a custom home screen grid limited to a defined set of apps

For a visitor sign-in desk, you want Single App, Managed App.

What Intune labels “Kiosk” is Apple’s Single App Mode AppLock payload — the same protocol command every other MDM uses to lock an iPad to one app. Intune sends that command to the supervised iPad; iOS enforces it at the operating-system level. The restriction re-engages every time the iPad reboots and checks back in, which is why this method survives power cycles where Guided Access doesn’t.

Worth clarifying early: this is not Guided Access. Guided Access is free, requires no MDM, and takes two minutes to configure — but it exits with a triple-click and won’t re-lock after a reboot. For a single staffed reception desk, Guided Access may be sufficient. For an unattended kiosk, multiple devices, or any deployment where you can’t rely on staff to re-lock the iPad each morning, Intune Single App Mode is the right call.

Prerequisites Before You Open the Admin Center

Three things need to be in place before the kiosk profile does anything useful.

1. A supervised iPad

Single App Mode requires iPad supervision — a device state where iOS grants the MDM full device-level control. Without supervision, Intune sends the AppLock command and the iPad silently ignores it. The Intune console may show the profile status as “Succeeded” while the iPad remains unlocked. This silent failure is the most common source of confusion for first-time Intune kiosk deployments.

Supervision happens two ways:

• Apple Business Manager — iPads purchased through an authorized reseller or added to ABM can be supervised and enrolled over the air during initial setup. Right path for any fleet larger than one or two devices.
• Apple Configurator 2 — supervises an iPad over USB from a Mac. Free. Works for one or two kiosks, but requires physical access to each device.

2. The iPad enrolled in Intune

The iPad must appear as a managed device in your Intune tenant. For ABM-enrolled devices, enrollment happens automatically when you link ABM to Intune and assign an enrollment profile. For Configurator-supervised devices, enrollment completes when the user steps through initial setup and the Company Portal app registers the device.

3. The sign-in app deployed to the device

The kiosk profile locks the iPad to one app — that app must already be installed and assigned to the device before the kiosk profile applies. Add it as a managed app first: Apps → iOS/iPadOS → Add, assign it to the device group you’ll target. A kiosk profile that references an uninstalled app will show an error in the device configuration view.

Create the Kiosk Configuration Profile

Open the Intune admin center and go to:

Devices → Configuration → Create → New policy

Set Platform to iOS/iPadOS and Profile type to Templates → Kiosk. Click Create.

Basics tab — name the profile something recognizable: Reception iPad — Single App Kiosk is easy to find when troubleshooting.

Configuration settings tab — three Kiosk Mode options appear. Select Single App, Managed App, then configure:

• App to run in kiosk mode: Click Select a managed app and choose the visitor sign-in app you deployed. If it doesn’t appear, confirm the app is assigned as a managed app first, then try again.
• Touch — leave enabled. Visitors need to interact with the sign-in screen.
• Screen rotation — match your kiosk stand orientation. Most reception desks use a fixed portrait or landscape mount.
• Volume buttons — disable if the iPad is wall-mounted and you don’t want visitors adjusting volume.
• Sleep/wake button — disable to prevent the screen going dark between visitors.
• Auto lock — set to Never for a permanent kiosk. Otherwise the screen locks between visitors and requires a tap to wake before they can sign in.

Assignments tab — scope the profile to the device group containing your reception iPads only. Don’t assign it to all iOS devices. An accidental kiosk policy on a senior employee’s personal iPad is not an easy incident to explain.

Click Review + create, verify the summary, and save.

Assign the Profile and Confirm the Lock

After you save and publish the profile, Intune pushes it on the iPad’s next scheduled check-in. To apply it immediately:

1. Go to Devices → All devices and select the reception iPad.
2. Click Sync in the top action bar.
3. After 30–60 seconds, refresh the device view and open the Device configuration tab.
4. The kiosk profile should show Succeeded.

On the iPad: when the profile applies, the current app closes, the Home bar disappears, and the sign-in app launches automatically. Visitors can’t reach the home screen or switch apps through any on-device control — no triple-click exit, no Settings access, no app switcher.

When the iPad Won’t Lock: Common Issues

Profile shows “Succeeded” but the iPad isn’t locked

The device isn’t supervised. On the iPad, check Settings → General → VPN & Device Management. If you see an enrollment profile but no supervision indicator, the device enrolled without supervision — the AppLock command arrives and iOS ignores it silently. Fix: re-enroll through ABM or Configurator with supervision enabled. Our iPad Single App Mode guide covers the supervision process for both paths.

The app isn’t locking — home screen is still accessible

The sign-in app isn’t installed on the device. Confirm it shows Installed in the device’s App Inventory inside Intune, then trigger another sync. The kiosk profile references the app’s Bundle ID; if the app isn’t present when the profile applies, iOS can’t lock to it.

Profile status shows “Conflict”

Two configuration profiles are sending competing restrictions to the same device. Open the device’s profile list and look for duplicate Kiosk assignments. Remove whichever one shouldn’t be there.

The wrong app is showing in kiosk mode

Double-check the Bundle ID in the kiosk profile. One character off causes the wrong app to run — or a silent failure where no lock applies at all. Verify against the app developer’s IT documentation or Apple Configurator 2’s Get Info view on the installed app.

FAQ

Does Intune kiosk mode survive an iPad reboot?

Yes. This is the main advantage over Guided Access. When the iPad reboots and reconnects to Intune, the MDM re-sends the AppLock restriction and the device comes back up locked to the same app. No staff action required.

Do I need Apple Business Manager, or will Apple Configurator 2 work?

Both work. Apple Configurator 2 supervises over USB from a Mac — it’s free and fine for one or two kiosks. Apple Business Manager is the right path for larger fleets: ABM-enrolled iPads are supervised over the air during initial device setup, so no USB cable or physical access is needed per device.

Can staff exit kiosk mode without involving IT?

Not with MDM-managed Single App Mode. The only exits are a Disable Single App Mode command from the Intune console or removing the configuration profile. If staff need to occasionally break out of kiosk mode without an IT ticket, ask your visitor sign-in app vendor whether they support Autonomous Single App Mode (ASAM) — that lets the app self-lock and self-unlock via an in-app passcode, while the MDM controls the overall authorization.

Does the iPad need to stay connected to the internet to remain locked?

No. Once Intune applies the AppLock profile, iOS enforces the restriction locally. The iPad stays locked even offline. It does need to reach Intune periodically to receive policy updates or the command to disable Single App Mode.

Where do I find the Bundle ID for the InstaCheckin iPad app?

It’s listed in the InstaCheckin admin portal under Settings → Device Setup. You can also find it in Apple Configurator 2 by selecting the installed app and choosing Get Info, or in the IT setup documentation InstaCheckin provides when you start a trial.

Set Up InstaCheckin on Your Kiosk iPad

InstaCheckin’s iPad app is built for MDM-managed kiosk deployments. Lock it to Single App Mode through Intune, and visitors see only the sign-in flow — photo capture, NDA or waiver signature if required, and a host notification by email or SMS the moment they check in. The InstaCheckin admin portal gives your IT team the app’s Bundle ID and enrollment steps without hunting through third-party documentation. Start a free trial and pair it with your existing Intune setup.