Skip to main content

099: Kiosk Devices

Implementation Effort: Medium
User Impact: Medium

Overview​

Kiosk devices are single-purpose or tightly constrained multi-purpose devices used for tasks such as check-in, inventory, signage, room scheduling, or point-of-sale workflows. The goal is to expose only approved functions and to make the device resilient, predictable, and easy to recover. In Zero Trust terms, kiosk devices should implement least privilege at the device surface: only approved apps, limited settings, controlled sign-in, and no unnecessary local data persistence. They should also be easy to wipe and reprovision if tampering or drift occurs.

Implementation Guidance​

  1. Choose a supported kiosk-capable management model such as Android Enterprise dedicated devices and decide whether the user experience is single-app or multi-app kiosk.
  2. Use Managed Home Screen or supported device restriction settings to lock the device to the intended set of actions.
  3. Deploy only the required apps, certificates, Wi-Fi/VPN profiles, and update settings. Kiosk devices should not carry the same app footprint as general-purpose phones.
  4. Restrict access to settings, browsers, accounts, sharing paths, and peripherals unless the workflow requires them.
  5. Define a break/fix process that includes remote actions, local recovery steps, and a quick path to wipe and reprovision the device.
  6. Monitor usage, offline periods, and app crashes, because a kiosk that silently fails is often discovered only when a business process has already stopped.

Reference​