iPad Single App Mode: Lock an iPad to One App (2026)

A supervised iPad in iPad Single App Mode boots directly into the app you locked it to, ignores the Home button, and refuses to leave that app until an admin says otherwise. That is the difference between a Guided Access session that ends the next time the battery dies and a kiosk that survives 18 months of unattended deployment in a lobby.

This post is the deeper companion to our iPad kiosk mode guide. The pillar covers all four kiosk-lock options at a high level. This one drills into Single App Mode specifically — supervision, Apple Configurator step-by-step, MDM deployment, the raw .mobileconfig payload, and the right way to exit.

9:41

Reception · Building 1

Welcome

Tap below to check in or check out. We’ll let your host know you’re here.

Sign in Sign out

Returning visitor

What Single App Mode is, and how it differs from Guided Access

iPad Single App Mode is a managed configuration that locks a supervised iPad to a single app’s bundle ID. It is implemented through Apple’s com.apple.app.lock payload, which is delivered either by Apple Configurator 2 over USB or by a mobile device management (MDM) platform over the air. Once active, the iPad reboots into the locked app and stays there.

Guided Access is a different mechanism entirely. It is an iPadOS Accessibility feature, built into every iPad since iOS 6, that you start from inside an app by triple-clicking the side button. It does not require supervision, does not require a Mac, does not require an MDM, and is free. It also does not survive a reboot — that is the tradeoff.

Here is the side-by-side. Autonomous Single App Mode (ASAM) is included because it is a third variant people often ask about.

The honest tradeoff statement: Single App Mode survives a reboot; Guided Access doesn’t. That’s why production fleets use Single App Mode and small-office single-iPad deployments often stay on Guided Access. Pick the lighter tool until you actually need the heavier one.

If you want the full landscape of options before zooming in on Single App Mode, the iPad kiosk mode pillar covers Guided Access setup, ASAM, and multi-app allowlist patterns alongside this one.

Prerequisite: supervising the iPad

Single App Mode is one of the features Apple gates behind supervision. An unsupervised iPad cannot accept the com.apple.app.lock payload — the profile installs but the lock never engages. So before any of the methods below work, the iPad has to be in a supervised state.

You have two routes to a supervised iPad, and the right one depends on how you bought the hardware and how many iPads you are managing.

Route A: Apple Configurator 2 (Mac App Store, free). Connect the iPad to a Mac via USB, open Apple Configurator 2, choose Prepare, check Supervise devices, and walk through the wizard. This factory-erases the iPad. Use this when the iPad was bought retail and is not enrolled in your Apple Business Manager account. The Apple Configurator User Guide covers batched prep workflows once you have the steps saved.

Route B: Apple Business Manager + Automated Device Enrollment. Buy iPads through an Apple-authorized reseller that supports your ABM account. The iPads auto-supervise on first power-on and assign themselves to your MDM. No factory-erase, no USB cable, no manual prepare step. This is the only sensible route past about 20 iPads.

Use Apple Configurator 2 to retrofit supervision on iPads you already own. Use ABM with Automated Device Enrollment for new fleet purchases. Once an iPad is supervised, you will see “This iPad is supervised and managed by [your organization]” in Settings → General → About — that confirmation is the gate for everything below.

Method A: Apple Configurator 2 (Mac, free)

Apple Configurator 2 is a free Mac app from the Mac App Store. It is the lowest-friction way to put a single iPad into Single App Mode without spending money on an MDM license.

The workflow assumes the iPad is already supervised by either route above and that the kiosk app is installed on the iPad.

1. Connect the supervised iPad to your Mac via USB-C or Lightning. Trust the computer if iPadOS prompts.
2. Open Apple Configurator 2. The iPad appears in All Devices.
3. Click the iPad to select it.
4. Choose Actions → Advanced → Start Single App Mode from the menu bar.
5. A list of installed apps appears. Pick the app to lock to — for visitor sign-in deployments, that is the InstaCheckin iPad app.
6. Click Select.

Apple Configurator pushes the com.apple.app.lock payload over USB. The iPad relaunches into the chosen app, with the Home indicator, app switcher, Control Center, and Notification Center all disabled. The visitor cannot leave the app. The lock persists across reboots, OS updates, and battery drain.

To layer in additional restrictions — block screenshots, block AirDrop, block iCloud backup, block the App Store, block iPadOS update prompts — pair Single App Mode with a separate Restrictions payload. In Apple Configurator, that lives under File → New Profile → Restrictions and gets installed on the iPad through Add → Profiles.

Apple Configurator 2 caps out at “iPads you can physically touch.” Past about 20 devices, plugging each one in to flip a setting becomes the bottleneck. That is where MDM-deployed Single App Mode takes over.

Method B: MDM-deployed Single App Mode

For fleet deployments, an MDM pushes Single App Mode to supervised iPads over the air. You scope a configuration profile to a smart group of iPads filtered on Supervised = Yes, and the lock applies within minutes — no USB cable, no per-device touch.

The structure is identical across MDM platforms. You create a Single App Mode payload, name the kiosk app’s bundle identifier, and assign it to your kiosk iPads. The vendor-specific clickpath is what differs:

• Microsoft Intune — Devices → Configuration → Create profile → iOS/iPadOS → Templates → Device features → expand App and Single Sign-On → enable App Single App Mode and enter the bundle ID. We walk through every screen in the Intune iPad kiosk mode guide.
• Jamf Pro — Mobile Devices → Configuration Profiles → New → add Single App Mode payload → bundle ID → scope to a smart group filtering on Supervised = Yes. The full clickpath including ASAM allowlist setup is in the Jamf iPad kiosk mode walkthrough.
• Mosyle Manager — Profiles → iOS/iPadOS → Single App Mode → choose app → assign.
• ManageEngine MDM — Profiles → Apple → iOS Profile → Restrictions → Single App Mode → enter bundle ID.

For visitor sign-in kiosks specifically, the bundle ID for the InstaCheckin iPad app is io.instacheckin.app. Drop that into the Single App Mode payload and the iPad locks to the visitor sign-in screen on next check-in.

A few things that bite people in production, regardless of which MDM you picked:

• Scope on Supervised = Yes. If a non-supervised iPad ends up in scope, the profile installs but the lock never engages.
• Pair Single App Mode with a Restrictions payload. The lock alone does not block screenshots, AirDrop, AirPrint, Siri, iCloud backup, or the App Store.
• Defer iPadOS updates. Hold updates until you have validated the kiosk app on the new version. Auto-updates at 2 a.m. are how kiosks break.
• Configure lost mode and remote wipe for any kiosk iPad that leaves the building.

The .mobileconfig payload route

If you are the kind of admin who prefers a text editor over a vendor UI, you can hand-author the Single App Mode profile and push it through any tool that accepts a .mobileconfig file — including Apple Configurator’s profile installer, an MDM that lets you upload custom profiles, or a one-off install via email or AirDrop on a supervised iPad.

The Single App Mode payload type is com.apple.app.lock. A minimal profile looks like this:

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
  <key>PayloadContent</key>
  <array>
    <dict>
      <key>PayloadType</key>
      <string>com.apple.app.lock</string>
      <key>PayloadIdentifier</key>
      <string>io.instacheckin.kiosk.applock</string>
      <key>PayloadUUID</key>
      <string>D1B0C4A0-1A2B-4C3D-9E4F-5A6B7C8D9E0F</string>
      <key>PayloadVersion</key>
      <integer>1</integer>
      <key>App</key>
      <dict>
        <key>Identifier</key>
        <string>io.instacheckin.app</string>
        <key>Options</key>
        <dict>
          <key>DisableTouch</key>
          <false/>
          <key>DisableDeviceRotation</key>
          <false/>
          <key>DisableVolumeButtons</key>
          <false/>
          <key>DisableRingerSwitch</key>
          <false/>
          <key>DisableSleepWakeButton</key>
          <false/>
          <key>DisableAutoLock</key>
          <true/>
          <key>EnableVoiceOver</key>
          <false/>
          <key>EnableZoom</key>
          <false/>
          <key>EnableInvertColors</key>
          <false/>
          <key>EnableAssistiveTouch</key>
          <false/>
          <key>EnableSpeakSelection</key>
          <false/>
          <key>EnableMonoAudio</key>
          <false/>
        </dict>
      </dict>
    </dict>
  </array>
  <key>PayloadDisplayName</key>
  <string>InstaCheckin Single App Mode</string>
  <key>PayloadIdentifier</key>
  <string>io.instacheckin.kiosk</string>
  <key>PayloadType</key>
  <string>Configuration</string>
  <key>PayloadUUID</key>
  <string>9F8E7D6C-5B4A-3210-FEDC-BA9876543210</string>
  <key>PayloadVersion</key>
  <integer>1</integer>
</dict>
</plist>

The two keys that actually matter are Identifier (the bundle ID of the app to lock to) and DisableAutoLock (set to true for a kiosk so the screen never sleeps). Generate fresh UUIDs for PayloadUUID whenever you author a new profile — collisions confuse iPadOS.

The Options dictionary maps to the same hardware toggles Guided Access exposes through its on-screen Options panel. If you want users to retain volume control, leave DisableVolumeButtons set to false. If you want a true kiosk where nothing physical responds except touch, flip everything in that dictionary to true. The full list of supported keys is documented in the Apple Device Management profile reference.

For MDMs that require signed profiles, sign the .mobileconfig with your organization’s distribution certificate using security cms -S -N "Your Cert" -i unsigned.mobileconfig -o signed.mobileconfig on a Mac. Unsigned profiles still install on supervised iPads, but they show a “Profile not signed” warning that some compliance teams flag.

How to exit (or stop) Single App Mode

Single App Mode does not use an end-user passcode. There is no triple-click escape, no “type 6 digits and we let you out” path. The exit is always admin-driven, and the route you take depends on how the lock was applied.

• Apple Configurator path. Connect the iPad to the Mac running Apple Configurator 2. Choose Actions → Advanced → Stop Single App Mode. The iPad relaunches to the Home Screen.
• MDM path. Either remove the Single App Mode configuration profile from the iPad’s scope or push a profile update with Single App Mode disabled. The iPad checks in within minutes and exits.
• Forgotten device passcode. Single App Mode itself has no passcode, but the iPad does. If you have lost the device passcode, the only path is Recovery Mode in Apple Configurator 2, which restores the iPad to factory state and requires re-enrolment. Never deploy a kiosk iPad whose device passcode is only stored in one head.
• Force-restart does not exit Single App Mode the way it exits Guided Access. The iPad reboots and comes right back into the locked app. That is the feature, not a bug.

The kiosk-mode pillar’s exit guide covers exit paths for Guided Access and ASAM alongside Single App Mode.

Worked example: locking InstaCheckin into Single App Mode

Here is the end-to-end flow for a real visitor sign-in deployment: a supervised iPad mounted at a front desk, locked into the InstaCheckin iPad app, surviving reboots unattended.

1. Supervise the iPad. New iPads through an ABM-enrolled reseller auto-supervise. Existing iPads get supervised through Apple Configurator 2 (back up first — supervising erases the device).
2. Install the InstaCheckin iPad app from the App Store, or push it from your MDM as a managed app.
3. Pair the kiosk using your InstaCheckin admin portal pairing code, so the iPad knows which location and host directory it serves.
4. Pair the badge printer if you are using one. Pair the Brother QL-820NWB over Bluetooth from Settings → Bluetooth before engaging the lock — Single App Mode does not block existing Bluetooth pairings, but you cannot reach Settings to add a new one once it is active.
5. Push Single App Mode from Apple Configurator 2 or your MDM, using bundle ID io.instacheckin.app.
6. Push a Restrictions payload in the same deployment — block screenshots, AirDrop, AirPrint, Siri, iCloud backup, App Store access, and pasteboard sharing.
7. Defer iPadOS updates through your MDM until you have validated the new release against the kiosk app.
8. Document the exit path with the front-desk owner. Write down which Mac runs Apple Configurator, or which MDM admin can remove the profile.

For a product-level overview of what the iPad sign-in flow actually does once it is locked down, see our office visitor management system page.

The 30-second version: supervise the iPad, push the com.apple.app.lock payload through Apple Configurator or an MDM, pair it with a Restrictions profile, and document the admin exit path. Once it is set, it stays set — through reboots, updates, and the next 18 months of front-desk traffic. If you are evaluating where Single App Mode fits next to Guided Access and ASAM, the iPad kiosk mode guide is the broader read.