iPad Kiosk Mode Multiple Apps: ASAM + Allowlist Configuration

Single App Mode is the answer when one app owns the kiosk screen. iPad kiosk mode multiple apps scenarios — a visitor sign-in app running alongside a badge printer utility, or a staffed desk where agents need to switch between tools — need a different approach. Two mechanisms handle this: Autonomous Single App Mode (ASAM) with an app allowlist, and MDM-enforced multi-app kiosk restrictions.

This post maps both patterns, with the visitor sign-in + badge printer setup as the worked example. If you’re still comparing Guided Access, Single App Mode, and MDM-enforced methods, the iPad kiosk mode overview lays out every option with honest tradeoffs before you commit hardware and profiles.

iPad Kiosk Mode Multiple Apps: Two Configuration Models

The phrase “multiple apps” in the kiosk context actually describes two different problems — and mixing them up leads to the wrong solution.

The ASAM allowlist model: The primary app controls the lock/unlock cycle via Apple’s Autonomous Single App Mode API. The MDM allowlist defines which Bundle IDs are authorized to invoke that API. You can put multiple Bundle IDs in the allowlist, but each app can only use ASAM when it’s the active foreground app. A companion utility (a badge printer driver, for instance) can be in the allowlist without ever appearing on the visitor-facing screen.

The multi-app kiosk model: The MDM restricts the iPad to a defined home screen grid. Users can switch between allowed apps, but the full App Library, Settings, and Safari are hidden. This is a persistent device restriction, not a per-visitor lock.

Most visitor sign-in deployments use the ASAM model. Multi-app kiosk mode is better suited to staffed reception desks where an agent needs two or three tools throughout the workday.

How ASAM Works — and What the Allowlist Actually Authorizes

ASAM is an iOS API that lets an app call Apple’s UIAccessibility.requestGuidedAccessSession(enabled:) method to enter and exit a Guided Access-style lock programmatically — no IT admin command required for each visitor session.

The MDM controls which apps can use this API through the AutonomousSingleAppModePermittedAppIDs key in the Apple Device Management Restrictions payload. That key takes an array of Bundle IDs. One Bundle ID is enough for a single-app kiosk; add a second if a companion utility also needs ASAM authorization.

Two things to know before you configure this:

• Without the MDM authorization, the ASAM call is silently ignored — the app runs normally but can’t lock the screen. No error appears; the kiosk just doesn’t lock.
• The device must be supervised. An unsupervised iPad accepts the Restrictions profile and silently ignores the ASAM key. Check Settings → General → VPN & Device Management: a supervision notice must be present.

Configure the ASAM allowlist in your MDM’s Restrictions profile:

• Jamf Pro: Restrictions payload → Autonomous Single App Mode → add Bundle IDs
• Microsoft Intune: Device Restrictions → General → Autonomous Single App Mode (iOS 7.0+) → add Bundle IDs
• Mosyle: Profiles → Restrictions → iOS Restrictions → Autonomous Single App Mode → add Bundle IDs

This Restrictions profile is separate from the App Lock profile. The Apple AppLock MDM payload enforces the persistent device-level lock — ASAM is the runtime mechanism the app uses to lock and unlock per-session on top of that baseline.

The Visitor Sign-in + Badge Printer Pattern

Here’s how ASAM + allowlist plays out on a real reception kiosk.

The InstaCheckin iPad app handles visitor sign-in. When a visitor approaches, InstaCheckin uses ASAM to lock the screen — the Home bar disappears, the app switcher is inaccessible, and the visitor sees only the sign-in flow: name, email or phone, photo capture, and optionally a waiver or NDA to sign. When the visitor finishes, the host receives a notification by email or SMS, the ASAM lock releases, and the screen resets for the next person.

Badge printing goes directly from the InstaCheckin app to a Brother QL-820NWB printer over the local network. No separate printer utility app is required, so the ASAM allowlist needs only one Bundle ID: InstaCheckin’s. The iPad stays locked via an MDM-enforced App Lock profile — the Jamf iPad kiosk mode guide walks the full profile setup — while ASAM handles the per-visitor lock/unlock cycle on top.

If your print workflow does require a standalone printer utility — a custom label editor, or a printer bridge app that doesn’t support direct printing — add its Bundle ID to the ASAM allowlist too. The printer utility can invoke ASAM if it needs full-screen control during a print job; if it runs as a background process, it doesn’t need ASAM authorization at all.

For multi-location deployments, scope the ASAM Restrictions profile to the same Smart Group or device group as the App Lock profile. Any supervised iPad that joins the group receives both profiles automatically — no per-device configuration.

Multi-App Kiosk via MDM: When You Need a Visible App Grid

ASAM keeps visitors locked to the sign-in screen. But if the person at the reception desk needs to switch between InstaCheckin, a calendar lookup, and a directory app throughout the day, a multi-app kiosk configuration fits better.

Both Jamf Pro and Intune support this:

Jamf Pro — Home Screen Layout: Create a Home Screen Layout Configuration Profile under Mobile Devices → Configuration Profiles → New and define the exact app grid. Apps not in the layout disappear from the home screen. Pair it with a Restrictions profile that disables Settings access, Safari, and app installation. Scope both profiles to the same Smart Group as the kiosk device group.

Microsoft Intune — Multi-App Kiosk: In the Intune admin center, go to Devices → Configuration → Create → Templates → Kiosk. Set Platform to iOS/iPadOS. Under Kiosk Mode, select Multi-App and add apps from your managed app catalog. Intune builds a restricted home screen locked to those apps. The Microsoft Learn documentation on Intune iOS device restrictions has the full configuration walkthrough; the Intune iPad kiosk mode guide on this site covers the clickpath for the single-app case, which shares the same profile workflow.

One distinction matters for planning: multi-app kiosk mode is persistent. The restricted home screen is always visible, all day. ASAM locking only occurs when the authorized app invokes it, per visitor session. For an unattended kiosk, ASAM gives tighter control. For a staffed desk where the agent uses multiple tools, multi-app mode is the better fit.

Troubleshooting Multiple-App Kiosk Configurations

ASAM isn’t locking the screen despite the profile showing as applied

The device isn’t supervised. On the iPad, open Settings → General → VPN & Device Management — a supervision badge must be present. An unsupervised device accepts the Restrictions profile and ignores the ASAM key with no error. Re-enroll through Apple Business Manager or Apple Configurator 2 with supervision enabled, push the profile again, and the ASAM authorization takes effect.

Companion app isn’t visible in multi-app kiosk mode

The app isn’t installed on the device. Home Screen Layout and Managed Home Screen configurations can only surface apps that are already installed and managed. In Jamf Pro, confirm the app shows Installed under the device record’s Apps tab. In Intune, verify it appears in the device’s App Inventory. Add it as a managed app, wait for installation to complete, then re-apply the layout profile.

App Lock and ASAM Restrictions profiles conflict

Two profiles are sending competing restrictions to the same device. Open the device’s profile list in Jamf Pro or the Intune device configuration view and look for duplicate entries. Remove whichever one shouldn’t be there, then trigger a sync. The iPad Single App Mode guide covers profile conflict troubleshooting for both MDMs in more detail.

FAQ

Can you run two apps at once in iPad kiosk mode?

Not in the traditional sense. Single App Mode and ASAM lock the iPad to one foreground app at a time. Multi-App kiosk mode via MDM lets users switch between a defined app set, but doesn’t enforce a single-screen lock per visitor. For a visitor sign-in kiosk, the primary app uses ASAM to lock itself during each session — companion apps in the allowlist don’t appear on the visitor-facing screen.

What is the ASAM allowlist and how do I configure it?

The ASAM allowlist is the AutonomousSingleAppModePermittedAppIDs array in the Apple Device Management Restrictions payload — an array of Bundle IDs authorized to invoke ASAM. Configure it in Jamf Pro, Intune, or Mosyle via a Restrictions configuration profile. One Bundle ID covers a single-app kiosk; add a second if a companion utility needs ASAM authorization too.

Does a badge printer utility need to be in the ASAM allowlist?

Only if it needs to invoke ASAM itself. If the sign-in app prints directly over the local network — as InstaCheckin does with Brother QL printers — no companion app is needed. The allowlist only requires the sign-in app’s Bundle ID.

What’s the difference between ASAM and Multi-App kiosk mode?

ASAM lets the primary app lock and unlock the iPad per visitor interaction. Multi-App kiosk mode is a persistent MDM restriction that limits the device to a defined app grid all day. Use ASAM for visitor-facing sign-in kiosks; use multi-app kiosk mode for staffed desks where agents need several tools.

Does adding multiple Bundle IDs to the ASAM allowlist run them all simultaneously?

No. Multiple Bundle IDs authorize multiple apps to use the ASAM API — not run simultaneously. Only the active foreground app can invoke ASAM at any given time. The primary kiosk app controls the lock cycle; other listed apps can use ASAM only when they’re in the foreground.

Set Up Your Visitor Sign-in Kiosk with InstaCheckin

InstaCheckin’s iPad app uses Autonomous Single App Mode to manage the lock/unlock cycle per visitor — your IT team configures the MDM profiles once and the app handles the rest. The InstaCheckin admin portal lists the Bundle ID and sample App Lock configuration without requiring a call to support.

Add InstaCheckin’s Bundle ID to the ASAM Restrictions profile, pair it with your existing Jamf or Intune App Lock deployment, and visitors see only the sign-in flow: photo capture, optional NDA or waiver signature, and a host notification by email or SMS the moment they arrive. For offices running an unstaffed front desk, pairing the kiosk with an AI receptionist for overflow and after-hours calls keeps reception covered even when no one’s sitting at the desk.

Start a free trial and connect InstaCheckin to your existing MDM deployment.