Configuring a single app, full-screen kiosk with Microsoft Edge on Windows 11

This week is all about configuring a single app, full-screen kiosk with Microsoft Edge on Windows 11 devices. A kiosk is nothing new and the Microsoft Edge browser not either. And even the combination of both is nothing new. That being said, there are often unknowns in the configuration options and what actually happens with Microsoft Edge when configuring it as the kiosk application. And that often causes questions. So, this post should take some of those questions away. One of the things that’s often forgotten, for example, is that the Microsoft Edge browser will also run in kiosk mode. And that puts limitations on its capabilities. This post will focus on configuring a single app, full-screen kiosk with Microsoft Edge on Windows 11 devices, by using Microsoft Intune. Besides that, it will describe the main configurations options and configuration methods. This post will end by showing the user experience with the applied a single app, full-screen kiosk with Microsoft Edge.

Note: For more information about configuring a multi-app kiosk mode on Windows 11 devices, refer to this post.

Introducing single app, full-screen kiosk with Microsoft Edge

When looking at a single app, full-screen kiosk with the Microsoft Edge browser, it’s important to understand that the browser will also run in a kiosk mode. That kiosk mode of Microsoft Edge will automatically run in an InPrivate session. All with the focus on protecting the user data. Besides that, the kiosk mode of Microsoft Edge can be used in two different lockdown experiences. Both of those experiences have their own use cases, so organizations can create, manage, and provide the best experience to their users. The following experiences are available for the kiosk mode of Microsoft Edge:

• Digital/Interactive Signage: This experiences displays a specific site in full-screen mode.
• Public-Browsing: This experience runs a limited multi-tab version of Microsoft Edge.

The different experiences for kiosk mode of Microsoft Edge also come with support for different features. How that differs per experience is summarized in the table below. Besides that, it’s good to know that these experiences can also be managed like any another Microsoft Edge experience. It is, however, important to keep in mind that some of the policies might negatively influence the experience with the kiosk mode of Microsoft Edge. That should be carefully tested.

Feature	Digital signage	Personal browsing
InPrivate Navigation
Reset on inactivity
Read only address bar (via policy)
Delete downloads on exit (via policy)
F11 blocked (enter/exit full-screen)
F12 blocked (launch Developer Tools)
Multi tab support
Allow URL support (via policy)
Block URL support (via policy)
Show home button (via policy)
Manage favorites (via policy)
Enable printer (via policy)
Configure the new tab page URL (via policy)
End session button
All internal Microsoft Edge URLs are blocked (except edge://downloads and edge://print)
CTRL+N blocked (open a new window)
CTRL+T blocked (open new tab)
Settings and more (…) will display only the required options
Restrict the launch of other applications from the browser
UI print settings lockdown
Set the new tab page as the home page (via policy)

Note: The settings that are tested and enhance the kiosk experience in Microsoft Edge are documented here.

Configuring single app, full-screen kiosk with Microsoft Edge

When looking at the configuration of a single app, full-screen kiosk with Microsoft Edge, it all starts with the different features for configuring the kiosk mode experience. That can be achieved via the following two features:

• Assigned Access: This feature can be used to execute a single Universal Windows Platform (UWP) app or Microsoft Edge in full screen above the lock screen. The kiosk app launches automatically and it automatically restarts, if needed.
• Shell Launcher: This feature can be used to configure a device to execute a Windows desktop application as the user interface. The specified application replaces the default Windows shell and doesn’t run above the lock screen

Both features can be configured by using the AssignedAccess CSP. That CSP provides the interface for MDM provider to easily configure a kiosk experience, with or without Microsoft Edge. Microsoft Intune provides a configuration template that can be used for configuring Windows with Microsoft Edge in kiosk mode. That template relies on the Assigned Access profile. The following 8 steps can be used to configure an autologon single app, full-screen kiosk with Microsoft Edge.

1. Open the Microsoft Intune admin center portal and navigate to Devices > Windows > Configuration profiles
2. On the Windows | Configuration profiles blade, click Create > New Policy
3. On the Create a profile blade, select Windows 10 and later > Template > Kiosk and click Create
4. On the Basics page, provide at least a unique name to distinguish it from similar profiles and click Next
5. On the Configuration settings page, as shown below in Figure 1, perform the following actions and click Next

• Select a kiosk mode (1): Select Single app, full screen kiosk to start the configuration
• User logon type (2): Select Autologon to create a single app, full screen kiosk with an autologon user
• Application type (3): Select Add Microsoft Edge browser to create a single app, full screen kiosk with Microsoft Edge
• Edge Kiosk URL (4): Specify the URL that should automatically be opened in Microsoft Edge
• Microsoft Edge kiosk mode type (5): Select Public Browsing (InPrivate) to allow browsing in Microsoft Edge
• Refresh browser after idle time (6): Specify the idle time of an inactive user after which to refresh the browser
• Specify Maintenance Window for App Restarts (7): Select Require to configure a maintenance window
  • Maintenance Window Start Time: Specify the start date and time for the maintenance window
  • Maintenance Window Recurrence: Select Daily for a daily maintenance window

6. On the Assignments page, configure the assignment for a device group and click Next
7. On the Applicability rules page, configure the applicability rules and click Next
8. On the Review + create page, verify the configuration and click Create

Note: At moment of writing, this method cannot be used for configuring multi-app kiosk mode on Windows 11.

Experiencing single app, full-screen kiosk with Microsoft Edge

When the configuration for the single app, full screen kiosk with Microsoft Edge is in place, it’s pretty straight forward to experience the applied configuration. After applying the configuration and restarting the Windows device, it will automatically logon and start the Microsoft Edge browser in the configured mode. Below in Figure 2 is the experience with the Public Browsing mode. That mode still allows a user to browse the Internet, via a functionally locked down browser experience. It also clearly shows the usage of the InPrivate mode in the browser. Below in Figure 3 is the experience with the Digital Signage mode. That mode only displays the configured website and doesn’t allow any user input for browsing the Internet.

More information

For more information about single app, full screen kiosk with Microsoft Edge on Windows 11, refer to the following docs.

• AssignedAccess CSP – Windows Client Management | Microsoft Learn
• Kiosk settings for Windows 10/11 in Microsoft Intune | Microsoft Learn
• Configure Microsoft Edge kiosk mode | Microsoft Learn