メインコンテンツへスキップ

103: Managed Home Screen (MHS) for Android Enterprise

Implementation Effort: Medium – Requires configuring Managed Home Screen app configuration policies, device configuration profiles, and optional Microsoft Entra Shared Device Mode.

User Impact: Low to Medium – Locks corporate-owned dedicated or shared devices into a controlled kiosk launcher while enforcing session sign-in and PIN protections.

Overview​

Microsoft Managed Home Screen (MHS) is the custom launcher application used on Android Enterprise corporate-owned dedicated devices (COSU), corporate-owned Dedicated devices with Microsoft Entra Shared Device Mode, and fully managed (COBO) devices to provide a locked-down single-app or multi-app kiosk experience.

Key 2025–2026 security and manageability enhancements to Managed Home Screen include:

  • Require MHS Authentication for Protected App Activities (September 2026 / 2609): Prevents users from bypassing Managed Home Screen authentication when accessing protected activities inside MAM-integrated apps. If MHS requires sign-in or a session PIN, the app automatically redirects the user back to MHS to authenticate before allowing access to organizational content.
  • Silence Apps During MHS Lock / Session PIN Prompt (June 2026 / 2605): Admins can configure MHS to silence background apps whenever MHS prompts for authentication (at sign-in or the session PIN screen). Silenced apps cannot start activities, show notifications, appear in recent apps, or pop dialogs/toasts to bypass the lock screen. Admins can define an allowlist for critical communication apps (such as voice/calling apps).
  • Remote Actions to Temporarily Suspend and Restore MHS (April 2026 / 2604): Helpdesk admins can trigger Suspend Managed Home Screen from the Intune admin center to let a technician or user exit kiosk mode to the native launcher for a defined time window without revealing the exit PIN or removing policies. MHS automatically re-locks when the timer expires or when Restore Managed Home Screen is triggered.
  • Device Configuration Profile Required for Exit Lock Task Mode Password (June 2026 / 2605): The MHS exit lock task mode password must now be configured via an Android Enterprise Device Configuration profile rather than an app configuration policy.
  • Custom Top Bar Elements & Expanded Volume Sliders (2511 / 2605): Supports custom free-text strings with dynamic variables ({{SerialNumber}}, {{DeviceName}}, {{TenantName}}) in the top bar and granular sliders for call, ring/notification, and alarm volumes.

Implementation Guidance​

  1. Use Managed Home Screen primarily with Android Enterprise dedicated devices and other supported shared or task-oriented scenarios.
  2. Deploy the Managed Home Screen app from Managed Google Play and assign it together with the apps that workers actually need for their role.
  3. Create app configuration policies for Managed Home Screen to define layout, sign-in expectations, PIN or session settings, virtual home screen behavior, and any approved links or widgets.
  4. Combine Managed Home Screen with kiosk and device restriction settings so users cannot leave the intended workflow or access unsupported settings.
  5. Pilot with actual frontline users to validate navigation, barcode or camera flows, sign-in friction, app launch performance, and recovery after a restart.
  6. Document support steps for cache reset, launcher updates, and device reprovisioning so help desk can restore service quickly.

Reference​