iPad Single App Mode: Lock an iPad to One App

Guided Access stops working the moment a visitor triple-clicks the Home button, a receptionist accidentally triggers the exit shortcut, or someone reboots the iPad overnight. iPad Single App Mode doesn’t have those failure modes. It’s enforced at the MDM level — the device can’t exit the app regardless of what the user does, and the lock survives reboots.

This guide covers three paths to Single App Mode: a .mobileconfig profile via Apple Configurator 2 (no MDM subscription needed), a remotely managed MDM restriction, and Autonomous Single App Mode (ASAM) — the variant visitor sign-in apps use to self-lock without a continuous MDM command. Pick the one that fits your deployment size.

If you’re still deciding between Guided Access and Single App Mode — or you haven’t locked down an iPad before — read our iPad kiosk mode guide first. It maps every method with honest tradeoffs.

Single App Mode vs. Guided Access: What Actually Differs

Both lock the iPad to one app. That’s where the similarity ends.

Guided Access runs entirely on-device. You enable it in Settings → Accessibility, set an optional passcode, and triple-click the side button to exit. It’s fast to set up, costs nothing, and works on any iPad regardless of management status. But it has two failure modes that matter for a reception kiosk:

It doesn’t survive a restart. Power the iPad off and back on — Guided Access is off. The next person to pick it up sees the home screen.

The exit passcode sits in Settings. Anyone with Settings access can change or remove it. That’s not a real lock for an unmanned desk.

Single App Mode is enforced by your MDM server. The iPad can’t exit the restricted app through any on-device action — no triple-click, no Settings access, no hard reset. The only way out is a command from the MDM console or removing the configuration profile. The restriction re-engages automatically on every reboot.

The catch: you need a supervised iPad and an MDM. Those prerequisites are why most single-location offices start with Guided Access and move to Single App Mode when they’re managing more than two or three kiosks.

What You Need Before You Start

A supervised iPad. Supervision gives Apple’s MDM protocol full administrative control over the device. Without it, the AppLock payload does nothing. You get there two ways:

• Apple Configurator 2 (free, Mac-only): supervise by connecting the iPad via USB and running the Prepare workflow. Works for one-off devices or small fleets.
• Apple Business Manager (ABM) + an MDM: iPads purchased or enrolled through Apple Business Manager can be supervised over the air during setup, without USB.

An MDM. Every major MDM supports Single App Mode: Jamf Pro, Jamf Now, Microsoft Intune, Mosyle, SimpleMDM, Kandji, and others. The menu paths differ; the underlying Apple MDM protocol command is the same. If you’re using Intune because your company runs Microsoft 365, the Intune path works fine — you don’t need a separate Apple-specific MDM.

You don’t need an app that explicitly advertises SAM support. The MDM holds the lock; the app just needs to be installed on the device.

Method 1 — Apple Configurator 2 and a Configuration Profile

This is the no-subscription path. You’ll supervise the iPad through Configurator and push an AppLock configuration profile — Apple’s documented MDM payload for Single App Mode.

Step 1: Install Apple Configurator 2

Download Apple Configurator 2 from the Mac App Store (free). You’ll need a Mac — Configurator doesn’t run on Windows or iPad.

Step 2: Supervise the iPad

1. Put the iPad into recovery mode: hold the Side button and Volume Down until the recovery screen appears (on older iPads with a Home button, hold Home + Side).
2. Connect to the Mac via USB and open Apple Configurator 2.
3. Choose Actions → Prepare. Select Manual Management (or Automated Enrollment if you’re pairing with ABM).
4. Check Supervise devices and proceed through the prompts.

The iPad wipes and reboots as a supervised device. Supervision is permanent until you erase it or remove supervision via Configurator.

Step 3: Create the AppLock Profile

1. In Configurator, go to File → New Profile.
2. Under the General section, give the profile a name and identifier.
3. Find the Single App Mode payload (labeled “Single App Mode” or similar — the exact name varies with Configurator versions).
4. Enter the Bundle ID of the app you want to lock to. Get this from the app developer’s IT setup documentation or via Configurator’s own app library (select an installed app → Get Info).
5. Configure optional restrictions: disable volume controls, disable the ringer switch, disable Touch ID to prevent unauthorized passcode prompts.
6. Save the profile and drag it onto the device in Configurator’s device view.

The iPad immediately restricts to that app. Remove the profile in Configurator to exit Single App Mode.

Method 2 — MDM Remote Single App Mode

With a full MDM, you don’t need a USB cable. Push the AppLock restriction from the console and it lands on every device in the assigned group.

In Jamf Pro:

1. Navigate to Devices → [Device] → Management Commands.
2. Select Enable Single App Mode.
3. Enter the target app’s Bundle ID and send.

Or create a Configuration Profile (Computers/Devices → Configuration Profiles → New) with the App Lock payload, and scope it to a Smart Group filtered on Supervised = Yes. The profile deploys automatically to any supervised iPad that joins the group.

In Microsoft Intune:

Navigate to Devices → Configuration → Create → iOS/iPadOS → Templates → Kiosk. Under Kiosk Mode, choose Single app, managed app, select the app from your Intune app catalog, and assign the profile to a device group. For the full setup — ABM enrollment, supervision checks, and policy scoping — see our Intune iPad kiosk guide for M365 admins.

One console, however many iPads. This is the right path for any deployment beyond three or four devices.

Autonomous Single App Mode (ASAM): How Kiosk Apps Self-Lock

ASAM flips the model. Instead of the MDM locking the device, the app locks itself — once an MDM or Configurator profile has granted it permission to do so.

The MDM pushes a list of Bundle IDs that are authorized to enter ASAM. After that, the app can call Apple’s accessibility APIs to enter and exit its own single-app session programmatically, without waiting for a remote MDM command. Apple documents the authorization payload under the AutonomousSingleAppModePermittedAppIDs key in its device management restrictions reference.

This is how visitor management kiosk apps handle the sign-in experience. When the iPad enters kiosk mode:

• The app calls the ASAM API to lock the screen to itself.
• Visitors see only the sign-in flow — no Home button escape, no app switcher.
• Staff unlock the app using a passcode or admin toggle inside the app itself, and the app releases the ASAM lock.

The practical benefit over MDM-managed SAM: the app controls the lock-unlock cycle locally. Staff can take the iPad out of kiosk mode for a few minutes without an IT admin sending a remote command, then lock it back with the in-app toggle. For a single reception desk, that flexibility matters.

InstaCheckin’s iPad app is built for this pattern — lock mode engages when you activate the kiosk from the admin settings, host notifications and badge printing run in the foreground, and the passcode-protected admin panel handles the exit.

How to Exit Single App Mode

How you get out depends on how you got in:

There’s no on-device shortcut to escape MDM-managed Single App Mode. This is by design. If you’re in an emergency — MDM server down, device lost its connection, passcode forgotten — a factory reset via recovery mode will break supervision and clear all profiles. You’ll lose the MDM enrollment and have to re-enroll and re-supervise, but you’ll have access to the hardware.

For ASAM-locked devices, if the app itself becomes inaccessible, the same recovery-mode factory reset applies. The ASAM authorization lives in the profile, not the app, so removing supervision removes the lock.