iPad Kiosk Mode: The Complete 2026 Guide (Guided Access, Single App Mode, MDM)

iPad Kiosk Mode is how you turn an off-the-shelf iPad into a single-purpose device — a visitor sign-in kiosk, a self-service ordering screen, a museum exhibit, a digital menu board. The user can only use the app you’ve locked the iPad to. They can’t exit, swipe to another app, change settings, or browse the web.

There are four ways to do it, ranging from “30 seconds, no admin tools” to “managed across 500 iPads in 12 offices.” Picking the right one depends on how many iPads you’re locking down, whether they need to survive reboots unattended, and whether you have a Mac or an MDM. This guide covers all four with step-by-step setup, a comparison table, and the gotchas that bite people in production.

9:41

Reception · Building 1

Welcome

Tap below to check in or check out. We’ll let your host know you’re here.

Sign in Sign out

Returning visitor

What is iPad kiosk mode?

iPad kiosk mode is any configuration that locks an iPad to a single app (or a curated set of apps) and prevents the user from leaving it. iPadOS supports four distinct mechanisms:

• Guided Access — a free accessibility feature, no admin tools needed. Best for one or two iPads in a low-risk environment.
• Single App Mode via Apple Configurator — a free Mac tool that pushes a permanent kiosk lock to a supervised iPad. Best for handful-of-iPads deployments where you control the hardware.
• Single App Mode via MDM (Jamf, Microsoft Intune, Mosyle, ManageEngine, Kandji) — the same lock, deployed remotely at scale. Best for fleets.
• Autonomous Single App Mode (ASAM) — an API-driven version where the app itself enters and exits the lock. Best when the kiosk app needs to hand off control (e.g., for staff overrides) without anyone touching Settings.

The first one runs on any iPad. The other three require the iPad to be supervised — a stricter management state we’ll cover below.

Method 1: Guided Access (free, 30 seconds, no MDM)

Guided Access has shipped with iPadOS since iOS 6. It’s the fastest way to put a single iPad in kiosk mode and the right choice for small offices, single-location event check-ins, or trying out kiosk-mode visitor sign-in before committing to a fleet rollout.

One-time setup:

1. Open Settings on the iPad.
2. Tap Accessibility → scroll to the General section → Guided Access.
3. Toggle Guided Access on.
4. Tap Passcode Settings → Set Guided Access Passcode. Enter a 6-digit passcode and confirm it. This passcode ends the session — keep it separate from the device unlock passcode.
5. (Optional) Toggle Face ID or Touch ID on so authorized staff can end the session with biometrics instead of typing.

To start a kiosk session:

1. Open the app you want to lock the iPad to.
2. Triple-click the side button (or the home button on older iPads).
3. The Guided Access panel appears. Tap Options in the bottom-left to fine-tune the session — you can disable the Sleep/Wake button, Volume buttons, Motion, the software keyboard, touch input on specific regions of the screen, and Dictionary Lookup. You can also set a time limit that auto-ends the session.
4. Tap Start in the top-right.

The iPad is now locked. The Home Screen is unreachable. Swipes from the bottom and Control Center are disabled. The app you started in is the only thing the visitor can interact with.

To end the session: triple-click the side button again, enter the passcode (or use Face ID / Touch ID), and tap End in the top-left.

The catch: Guided Access does not survive a reboot. If the battery drains, an iPadOS update kicks in, or someone holds the power button long enough to force-restart, the iPad boots back to the Home Screen and Guided Access is off until you manually re-engage it. For a single iPad with someone on-site to reset it, that’s fine. For an unattended kiosk in a remote office, it’s a problem — which is what Method 2 is for.

Method 2: Single App Mode via Apple Configurator (free, persistent)

Single App Mode is the production-grade version of kiosk lock. Once enabled, the iPad reboots directly into your kiosk app and cannot be unlocked without an admin pushing a configuration change. It survives reboots, OS updates, and physical tampering.

To use Single App Mode, the iPad must be supervised. Supervision is a stricter management state Apple unlocks for institutional buyers — it gives you control over things like silent app installs, app allowlists, web content filtering, and Single App Mode itself.

Step 1: Supervise the iPad.

You have two options:

• Apple Configurator 2 (Mac App Store, free). Connect the iPad via USB, choose Prepare, check Supervise devices, and walk through the wizard. This factory-erases the iPad — back up first if there’s anything on it.
• Apple Business Manager / Apple School Manager (free for organizations). Buy iPads through an authorized reseller that supports ABM/ASM enrollment. The iPads are auto-supervised on first setup and assigned to your MDM. This is the right route for fleets larger than a handful.

Step 2: Lock the iPad to a single app.

With the iPad supervised and connected via USB to your Mac:

1. Open Apple Configurator 2.
2. Click the iPad, then choose Actions → Advanced → Start Single App Mode.
3. Pick the app to lock to (it must already be installed on the iPad).
4. Click Select. Apple Configurator pushes the change and the iPad relaunches into the chosen app, locked.

The iPad will now boot directly into that app on every restart. The Home button, app switcher, swipes, Control Center, and Notification Center are all disabled. The visitor cannot leave the app.

Step 3 (optional): Tighten down further with a configuration profile.

For real production deployments, also push a Restrictions payload that disables features you don’t want exposed. Useful toggles: block screenshots, block AirDrop, block AirPrint, block Siri, block Bluetooth pairing changes, block iPadOS update prompts, and force a managed pasteboard.

To exit Single App Mode: physically connect the iPad back to the same Mac running Apple Configurator and choose Actions → Advanced → Stop Single App Mode. There is no on-device way out — that’s the point.

This method is great for 1–20 iPads where you can physically touch them periodically. Past that, you want an MDM.

Method 3: MDM kiosk mode (Jamf, Intune, Mosyle, ManageEngine, Kandji)

For fleet deployments, an MDM (mobile device management) platform pushes Single App Mode to supervised iPads over the air. No USB cable, no per-device touch — you scope a configuration profile to a group of iPads and they all lock to the same app within minutes.

The exact steps differ by MDM, but the structure is identical: create a Single App Mode payload, name the app’s bundle identifier, scope it to your kiosk iPads.

Microsoft Intune: Devices → Configuration → Create profile → iOS/iPadOS → Templates → Device features → expand App and Single Sign-On → enable App Single App Mode and enter the kiosk app’s bundle ID (for example, io.instacheckin.app). Save and assign to the iPad group.

Jamf Pro: Computers / Mobile Devices → Configuration Profiles → New → add Single App Mode payload → bundle ID → scope to a smart group filtering on Supervised = Yes.

Mosyle Manager: Profiles → iOS/iPadOS → Single App Mode → choose app → assign.

ManageEngine MDM: Profiles → Apple → iOS Profile → Restrictions → Single App Mode → enter bundle ID.

Kandji: Library → Add Library Item → Single App Mode → choose app → assign to the kiosk Blueprint.

A few production tips that apply to all of them:

• Pair the Single App Mode profile with a Restrictions payload — block screenshots, AirPrint, AirDrop, Siri, iCloud backup, and the App Store. The Single App Mode lock by itself doesn’t disable these.
• Add a Web Content Filter if your kiosk app uses an embedded browser (some visitor flows redirect to a host-confirmation URL). Allowlist the domains it needs and nothing else.
• Use deferred software updates so iPadOS updates roll out only after you’ve validated the kiosk app works on the new version. Otherwise, you’ll get a 2 a.m. surprise.
• If your MDM supports lost mode, configure it. A stolen kiosk iPad that’s still in Single App Mode is significantly less useful to a thief, but with lost mode you can also remote-wipe.

Method 4: Multi-app kiosk mode (autonomous & allowlist)

Sometimes you want the kiosk to support more than one app — a visitor sign-in app and a Bluetooth badge printer utility, or a self-service app and a payment app. iPadOS handles this two ways.

Autonomous Single App Mode (ASAM): The app calls UIAccessibility.requestGuidedAccessSession(enabled:) to lock and unlock itself programmatically. For ASAM to work, an MDM-pushed configuration profile (the com.apple.app.lock payload) must allowlist the app’s bundle ID. This is how purpose-built kiosk apps — InstaCheckin’s iPad app included — give themselves single-app behavior without staff needing to engage Guided Access between visitors. The app can also break out of single-app for staff overrides (admin login, settings) and re-lock itself afterward.

Restrictions allowlist (true multi-app kiosk): Push a Restrictions payload with an Allowed Apps list that names the bundle IDs of every app the kiosk should expose. Every other app — including Settings, Safari, Photos, and so on — is hidden from the Home Screen entirely. The user sees a stripped-down Home Screen with only your allowlisted apps, and Single App Mode is off so they can switch between them.

In practice, ASAM is the right answer for 90% of kiosk needs. True multi-app allowlisting is for niche cases like a retail iPad that also needs a separate payments app, or a museum exhibit with a video-playback app and a survey app.

Comparison: which method should you use?

If you’re rolling out one or two iPads in a single office and trying things out, start with Guided Access. Once you have multiple sites or unattended deployments, jump straight to MDM-deployed Single App Mode — Apple Configurator works but doesn’t scale past about 20 iPads before the manual cable-tethering becomes painful.

Common iPad kiosk use cases

The same locked-down iPad enables wildly different products. The five most common deployments we see:

Visitor sign-in. An iPad mounted at the front desk runs a visitor management app in kiosk mode. Visitors type their name, photograph their ID, sign an NDA, and the host gets an SMS or Slack notification. Schools, manufacturing plants, government buildings, and coworking spaces all deploy this pattern — see our school and manufacturing configurations.

Event check-in. At conferences, trade shows, and corporate events, iPads in kiosk mode replace paper attendee lists. Attendees scan a QR code or type their name and get a printed badge in seconds.

Retail self-service. Quick-service restaurants and stores use locked iPads as customer-facing ordering, queue management, or self-checkout screens. Single App Mode keeps customers from accidentally exiting the ordering app.

Restaurant menus and digital signage. A locked iPad shows the menu, drink list, or daily specials. Cheaper than a custom digital signage display and easier to update.

Museum and classroom kiosks. Interactive exhibits and testing-mode classroom iPads use kiosk mode to keep visitors and students inside a single learning experience without the device becoming a distraction.

In all five cases, the security benefit is roughly the same — visitors can’t browse the web, change settings, install apps, or read the previous visitor’s data. What differs is whether the deployment needs to survive reboots unattended, which is the deciding factor between Guided Access and Single App Mode.

How to exit (or turn off) iPad kiosk mode

The exit procedure depends on which method you used:

• Guided Access: Triple-click the side or home button, enter the Guided Access passcode, tap End. With Face ID or Touch ID enabled, double-click and authenticate instead.
• Forgotten Guided Access passcode: Force-restart the iPad. On Face ID iPads, press and release Volume Up, press and release Volume Down, then hold the top button until the Apple logo appears. On Home button iPads, hold Home + top button together. The reboot ends the Guided Access session.
• Single App Mode (Apple Configurator): Connect the iPad to the Mac running Apple Configurator 2 via USB. Open the device, go to Actions → Advanced → Stop Single App Mode.
• Single App Mode (MDM): From your MDM console, either remove the Single App Mode configuration profile from the device’s scope, or push a profile update with Single App Mode disabled. Within minutes the iPad relaunches to the Home Screen.
• Autonomous Single App Mode: The app’s own admin/settings flow exits ASAM by calling UIAccessibility.requestGuidedAccessSession(enabled: false). Removing the com.apple.app.lock allowlist profile also disables ASAM.

If a kiosk-mode iPad is ever stolen or misplaced, an MDM-managed device should be remote-locked (lost mode) and remote-wiped immediately. Guided Access alone doesn’t protect anything past a force-restart, so don’t store sensitive data on a Guided Access kiosk that leaves the building.

Putting it all together

For a single front-desk iPad running InstaCheckin’s visitor sign-in app, Guided Access takes 30 seconds and is enough. For a multi-site rollout where iPads sit unattended in lobbies overnight and need to recover from reboots without anyone walking over with a cable, you want Single App Mode pushed by an MDM, paired with a Restrictions profile that blocks screenshots, AirDrop, and Settings access. For a kiosk app that needs to switch between locked visitor mode and unlocked admin mode without staff touching the iPad, you want Autonomous Single App Mode.

InstaCheckin runs in any of these configurations. If you’re deploying iPad visitor management and want to skip the tooling decisions, start a free trial — the app supports Guided Access out of the box and ASAM with an MDM allowlist payload.