Kaspersky Secure Mobility Management

Configuring kiosk mode for Android devices

These settings apply to corporate devices.

Expand all | Collapse all

Kiosk mode is a Kaspersky Endpoint Security for Android feature that lets you limit the apps available to a device user to a single app or a set of multiple apps. You can also efficiently manage some device settings.

Kiosk mode does not affect the work of the Kaspersky Endpoint Security for Android app. It runs in the background, shows notifications, and can be updated.

Types of kiosk modes

The following types of kiosk mode are available in Kaspersky Endpoint Security:

• Single-app mode

  Kiosk mode with only a single app. In this mode, a device user can open only the one app that is allowed on the device and specified in the kiosk mode settings. If the app that you want to add to kiosk mode is not installed on the device, kiosk mode activates after the app is installed.

  On Android 9 or later, the app launches directly in kiosk mode.
  On Android 8 or earlier, the specified app must support kiosk mode functionality and call the startLockTask() method itself to launch the app.

• Multi-app mode

  Kiosk mode with multiple apps. In this mode, a device user can open only the set of apps that are allowed on the device and specified in the kiosk mode settings.

Before you configure kiosk mode

Before you configure kiosk mode, do the following:

• Before specifying the apps that are allowed to be run on the device in kiosk mode, you first need to select the Install action for these apps on the App management tab of the App Control card. Then, they will appear in the App package list of the kiosk mode.
• Before activating kiosk mode, we recommend that you prohibit starting Google Assistant by enabling the corresponding restriction in Assets (Devices) → Policies & profiles → Application settings → Android → Restrictions → Device feature restrictions → Apps → Prohibit Google Assistant. Otherwise, Google Assistant starts in kiosk mode and allows non-trusted apps to be opened.

Open the kiosk mode settings

To open the kiosk mode settings:

1. In the main window of Kaspersky Security Center Web Console, select Assets (Devices) → Policies & profiles. In the list of group policies that opens, click the name of the policy that you want to configure.
2. In the policy properties window, select Application settings.
3. Select Android and go to the Restrictions section.
4. On the Kiosk mode card, click Settings.

The Kiosk mode window opens.

Configure single-app mode

To configure single-app mode:

1. Enable the settings using the Kiosk mode toggle switch.
2. In the Operating mode drop-down list, select Single-app mode.
3. In the App package drop-down list, select an app package with the app that is allowed to be run on the device.
4. Specify any required restrictions. For available restrictions, see the "Kiosk mode restrictions" section below.
5. Select the Allow navigation to trusted apps check box if you want to add other apps that a device user can navigate to. For more details, see the "Add additional apps" section below.
6. Click OK.
7. Click Save to save the changes you have made.

Mobile device settings are changed after the next device synchronization with Kaspersky Security Center.

Configure multi-app mode

To configure multi-app mode:

1. Enable the settings using the Kiosk mode toggle switch.
2. In the Operating mode drop-down list, select Multi-app mode.
3. Click Add package and select the apps that are allowed to be run on the device.
4. Specify any required restrictions. For available restrictions, see the "Kiosk mode restrictions" section below.
5. Select the Allow navigation to trusted apps check box if you want to add other apps that a device user can navigate to. For more details, see the "Add additional apps" section below.
6. Click OK.
7. Click Save to save the changes you have made.

Mobile device settings are changed after the next device synchronization with Kaspersky Security Center.

Kiosk mode restrictions

You can set the following restrictions in kiosk mode:

• Prohibit Overview button

  Selecting or clearing this check box specifies whether the Overview button is hidden. This restriction is supported on devices with Android 9 or later.

  The check box is selected by default.

• Prohibit Home button

  Selecting or clearing this check box specifies whether the Home button is hidden. This restriction is supported on devices with Android 9 or later.

  The check box is selected by default.

• Prohibit status bar

  Selecting or clearing this check box specifies whether the status bar displays notifications, indicators such as connectivity and battery, and the sound and vibrate options. This restriction is supported on devices with Android 9 or later.

  The check box is selected by default.

• Prohibit system notifications

  Selecting or clearing this check box specifies whether system notifications are hidden. This restriction is supported on devices with Android 9 or later.

  The check box is selected by default.

• Prohibit enabling kiosk mode if not all selected apps are updated or installed

  Selecting or clearing this check box specifies whether kiosk mode can be enabled if one or more kiosk-mode apps are not updated or installed on the device.

  If this check box is selected, kiosk mode cannot be enabled until all required apps are installed and up to date. If kiosk mode is already enabled and apps cannot be updated, Kaspersky Endpoint Security for Android displays a blocking screen to restrict use of the device. To continue using kiosk mode with older versions of apps, the user must tap Back to kiosk mode on the blocking screen.

  If this check box is cleared, kiosk mode can be enabled even if not all required apps are updated or installed.

  This check box is available only if kiosk mode is running in multi-app mode.

  The check box is selected by default.

Disabling kiosk mode using a one-time code

A one-time code is a secret code for disabling kiosk mode. The code is generated by Kaspersky Security Center and is unique for each mobile device. You can change the length of the one-time code (4, 8, 12, or 16 digits) in the Kiosk mode settings of the policy.

To configure disabling kiosk mode:

1. In the Disable using one-time code section, select the Allow disabling kiosk mode using one-time code check box.
2. If necessary, change the length of the one-time code in the corresponding drop-down list. By default, the code is 4 digits long.
3. Click OK.
4. Click Save to save the changes you have made.

Kiosk mode can now be disabled using a one-time code. The length of the one-time code is set to the selected value.

Mobile device settings are changed after the next device synchronization with Kaspersky Security Center.

To disable kiosk mode on a user's mobile device using one-time code:

1. In the main window of Kaspersky Security Center Web Console, select Assets (Devices) → Mobile → Devices.
2. Click the mobile device for which you want to get a one-time code.
3. Select Applications → Kaspersky Mobile Devices Protection and Management.

   The Kaspersky Mobile Devices Protection and Management properties window opens.

4. Select the Application settings tab.

   The unique code for the selected device is displayed in the One-time code field of the One-time code to disable kiosk mode section.

5. Use any available method (such as email) to communicate the one-time code to the user of the device.
6. After receiving a one-time code, the user must do the following:
   1. To open a window with a field for entering the one-time code, do one of the following:
      • Tap the back button 3 or more times.
      • Tap the Home button 3 or more times, if the Prohibit Home button check box is cleared in the Restrictions section of the Kiosk mode card.
      • Tap and hold the shield image on the Kaspersky Endpoint Security for Android home screen.
   2. Enter the one-time code.

Kiosk mode is disabled on the user's mobile device.

To enable kiosk mode again after disabling it using one-time code, you must configure kiosk mode settings and synchronize the user's mobile device with Kaspersky Security Center. The user must then confirm enabling kiosk mode in the message that appears on the device.

Add additional apps

Besides locking the device to a single app or set of apps, you can also specify additional apps, that the main app can use. These additional apps allow the apps added to kiosk mode to provide their full functionality. For example, the user can view a document or access a website opened from the main app. By default, these additional apps are hidden on a device and a user cannot launch them manually.

To add additional apps:

1. In the Additional apps section, select the Allow navigation to trusted apps check box.
2. Click Add package and specify the desired app package name.

   How to get the package name of an app

   To get the name of an app package:

   1. Open Google Play.
   2. Find the app and open its page.

   The app's URL ends with its package name (for example, https://play.google.com/store/apps/details?id=com.android.chrome).

   To get the name of an app package that has been added to Kaspersky Security Center:

   1. In the main window of Kaspersky Security Center Web Console, select Assets (Devices) → Mobile → Apps & files.
   2. Select Android → Apps.

      In the list of apps that opens, app identifiers are displayed in the Package name column.

3. Click OK.
4. Click Save to save the changes you have made.

Mobile device settings are changed after the next device synchronization with Kaspersky Security Center.