Are you really making the most of Windows 11's kiosk mode?

Hi, I'm Shii-chan! Today I found a news story that's a bit low-key but really practical: how to turn a Windows 11 PC into a kiosk device.

What was announced?

This one comes from JP Windows Support, a blog run by Microsoft staff that shares Windows support information. This time they walk through, with actual configuration examples, how to set up a kiosk on Windows 11, a device that can only run the apps you approve.

Why it matters

Think of reception desks, digital signage, or in-store guide terminals, places where you really don't want people touching anything besides the intended app. Leave a device as a regular Windows PC in a spot like that, and someone could launch a random app or mess with the settings.

Kiosk mode locks the device down to only the approved apps, which cuts maintenance overhead and lets you offer the same consistent experience across every device. It sounds mundane, but it directly affects how much work day-to-day operations end up costing.

What changes

Once a device is set up as a kiosk, the signed-in user can only use the apps you've allowed. That means far less risk of the system breaking from a stray click or misconfiguration, and admins can operate on the assumption that "this device always stays in this state," which makes support easier too. It's a helpful, organized look at the options IT admins have when designing how to deploy and run these devices.

Dive Deep

The article covers two main ways to build a kiosk.

• Assigned Access — runs an approved app full-screen (single-app mode), or lets users pick from multiple apps via the Start menu (multi-app mode). It supports UWP apps and Edge, and importantly, it works on Windows 11 Pro
• Shell Launcher — replaces Explorer itself with a specified Win32 or UWP app. This one is not available on Pro; it requires Enterprise, Education, or IoT Enterprise

Both share the same overall setup flow: you build the configuration as an XML file, then push it to the device through the MDM Bridge WMI Provider. Applying it locally means running PowerShell with SYSTEM privileges and writing the XML content, HTML-encoded, into the Configuration property (for Assigned Access) or the ShellLauncher property (for Shell Launcher) of the MDM_AssignedAccess class. One thing to watch for: admin rights alone aren't enough, you specifically need SYSTEM privileges.

If you're using Edge as the kiosk app, launch arguments let you fine-tune the behavior quite a bit.

• --kiosk {URL} — opens the given URL in kiosk mode
• --edge-kiosk-type=fullscreen — full-screen display, good for digital signage
• --edge-kiosk-type=public-browsing — an InPrivate-like mode for shared public devices
• --kiosk-idle-timeout-minutes={minutes} — how long to wait before auto-resetting after no activity

For deployment via Intune, the article recommends skipping the standard "Kiosk" template, since it doesn't always behave as expected on Windows 11, and instead using a custom profile with OMA-URI settings. For Assigned Access that's ./Vendor/MSFT/AssignedAccess/Configuration, and for Shell Launcher it's ./Vendor/MSFT/AssignedAccess/ShellLauncher; either way you set the XML file's contents as a string value.

If you need to look up an app's AUMID (its identifier), these PowerShell commands come in handy:

Get-StartApps | Where-Object { $_.Name -like "*Edge*" }
Get-AppxPackage | Select-Object Name, PackageFamilyName

The article is also careful about the caveats. Shell Launcher doesn't automatically block launching other apps, so things like keyboard shortcuts or an "open file" dialog could let someone escape into an app you didn't intend to allow. You're expected to pair it with AppLocker or Group Policy restrictions to actually close that gap. Also worth noting: kiosk users must sign in from the device's own console, since the kiosk experience isn't available over a Remote Desktop connection.

If something isn't working, the article points to checking the Microsoft-Windows-AssignedAccess event log (disabled by default), or, for Intune deployments, the Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider log, both of which record things like XML schema errors.

Wrap-up

• Windows 11 kiosk mode comes in two flavors, Assigned Access and Shell Launcher, each with different edition requirements and strengths
• Setup means building an XML config and applying it via SYSTEM-level PowerShell or an Intune custom profile (OMA-URI)
• Edge kiosk mode can be tuned with launch arguments for full-screen display, InPrivate-style browsing, and idle timeouts
• Shell Launcher can be bypassed if left on its own, so pairing it with AppLocker and similar tools is assumed

If you're the one managing reception desks, digital signage, or in-store terminals, this reads almost like a ready-to-use setup guide!