In today’s enterprise environment, there’s an increasing need to provide controlled, purpose-built computing experiences for specific user scenarios. That’s where Multi-App Kiosk Mode, also called the Restricted User Experience, comes in. This mode allows users to access a predefined set of applications in a controlled desktop environment, minimizing distractions and enhancing security.

In this article, we’ll explore how to set up Multi-App Kiosk Mode using a custom Assigned Access XML schema configuration policy deployed through Microsoft Intune. I’ll tailor the guide around a specific custom XML example that includes a mix of UWP and Win32 apps, file explorer restrictions, and a pinned Start menu.

Understanding Multi App Kiosk Mode and Restricted User Experience:

Multi-App Kiosk Mode transforms a Windows 11 device into a restricted environment where users can only run approved applications. Unlike single-app kiosks, which limit the device to one full-screen app, this mode presents a familiar Windows desktop with a customized Start menu, taskbar, and app list. It’s enforced via AppLocker rules and policy settings, ensuring users can’t access unauthorized features or settings.

Key benefits include:

• Enhanced Security: Prevents accidental or malicious changes to the device.
• User Productivity: Allows access to multiple tools (e.g., browsers, media players, and utilities) without full system freedom.
• Flexibility: Ideal for shared scenarios like retail kiosks, student devices, or corporate labs.

Prerequisites and Environment Setup:

Before implementing your Multi App Kiosk configuration, ensure you have the following prerequisites in place:

System Requirements:

• Windows Edition: Windows 11 Pro, Enterprise, or Education (version 22H2 or later recommended)
• Microsoft Intune: Active subscription with device enrollment capabilities
• Azure AD: Devices must be Azure AD joined or Hybrid Azure AD joined
• Administrative Access: Global Administrator or Intune Service Administrator role.

Preparing Your Environment:

First, verify that your target devices are properly enrolled in Intune. Navigate to the Microsoft Intune admin center and confirm that your devices appear under Devices > Windows > Windows devices.

Ensure that the applications you plan to include in your kiosk configuration are already installed on the target devices. This is crucial because the Assigned Access configuration doesn’t install applications; it only controls access to existing ones.

Deep Dive into the XML Configuration Structure:

The Assigned Access XML schema provides a structured way to define your kiosk configuration. Here’s the custom XML we’ll use as our example. It configures a kiosk for a “HCMGR Kiosk” user, allowing essential apps like Calculator, Settings, 7-Zip, VLC, Chrome, Edge, PowerShell, and File Explorer. It restricts File Explorer to the Downloads folder and removable drives, pins apps to the Start menu via JSON, and shows the taskbar.

<?xml version="1.0" encoding="utf-8"?>
<AssignedAccessConfiguration xmlns:xs="http://www.w3.org/2001/XMLSchema" 
xmlns="http://schemas.microsoft.com/AssignedAccess/2017/config" 
xmlns:rs5="http://schemas.microsoft.com/AssignedAccess/201810/config" 
xmlns:v3="http://schemas.microsoft.com/AssignedAccess/2020/config" 
xmlns:v5="http://schemas.microsoft.com/AssignedAccess/2022/config">

  <Profiles>
    <Profile Id="{9A2A490F-10F6-4764-974A-43B19E722C23}">
      <AllAppsList>
        <AllowedApps>
          <!-- UWP apps -->
          <App AppUserModelId="Microsoft.WindowsCalculator_8wekyb3d8bbwe!App" />
          <App AppUserModelId="windows.immersivecontrolpanel_cw5n1h2txyewy!microsoft.windows.immersivecontrolpanel" />

          <!-- Win32 apps (use DesktopAppPath, not AppUserModelId) -->
          <App DesktopAppPath="%ProgramFiles%\7-Zip\7zFM.exe" />
          <App DesktopAppPath="%ProgramFiles(x86)%\VideoLAN\VLC\vlc.exe" />
          <App DesktopAppPath="%ProgramFiles%\Google\Chrome\Application\chrome.exe" />
          <App DesktopAppPath="%ProgramFiles(x86)%\Microsoft\Edge\Application\msedge.exe" />
          <App DesktopAppPath="%windir%\System32\WindowsPowerShell\v1.0\powershell.exe" />
          <App DesktopAppPath="%windir%\explorer.exe" />
        </AllowedApps>
      </AllAppsList>

      <rs5:FileExplorerNamespaceRestrictions>
        <rs5:AllowedNamespace Name="Downloads" />
        <v3:AllowRemovableDrives />
      </rs5:FileExplorerNamespaceRestrictions>

      <!-- Pinned Start Menu (use desktopAppLink for Win32 shortcuts, packagedAppId for UWP) -->
      <v5:StartPins><![CDATA[{
        "pinnedList":[
          {"packagedAppId":"Microsoft.WindowsCalculator_8wekyb3d8bbwe!App"},
          {"packagedAppId":"windows.immersivecontrolpanel_cw5n1h2txyewy!microsoft.windows.immersivecontrolpanel"},
          {"desktopAppLink":"%ProgramData%\\Microsoft\\Windows\\Start Menu\\Programs\\7-Zip\\7-Zip File Manager.lnk"},
          {"desktopAppLink":"%ProgramData%\\Microsoft\\Windows\\Start Menu\\Programs\\VideoLAN\\VLC\\VLC media player.lnk"},
          {"desktopAppLink":"%ProgramData%\\Microsoft\\Windows\\Start Menu\\Programs\\Google Chrome.lnk"},
          {"desktopAppLink":"%ALLUSERSPROFILE%\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Edge.lnk"},
          {"desktopAppLink":"%APPDATA%\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell\\Windows PowerShell.lnk"},
          {"desktopAppLink":"%APPDATA%\\Microsoft\\Windows\\Start Menu\\Programs\\File Explorer.lnk"}          
        ]
      }]]></v5:StartPins>

      <Taskbar ShowTaskbar="true" />
    </Profile>
  </Profiles>

  <Configs>
    <Config>
      <AutoLogonAccount rs5:DisplayName="HCMGR Kiosk" />
      <DefaultProfile Id="{9A2A490F-10F6-4764-974A-43B19E722C23}" />
    </Config>
  </Configs>
</AssignedAccessConfiguration>

XML Schema Declaration:

<?xml version="1.0" encoding="utf-8"?> 
<AssignedAccessConfiguration xmlns:xs="http://www.w3.org/2001/XMLSchema" 
xmlns="http://schemas.microsoft.com/AssignedAccess/2017/config" 
xmlns:rs5="http://schemas.microsoft.com/AssignedAccess/201810/config" 
xmlns:v3="http://schemas.microsoft.com/AssignedAccess/2020/config" 
xmlns:v5="http://schemas.microsoft.com/AssignedAccess/2022/config"> 

<Profile Id="{fc192d3c-c510-4600-a2ab-4d1b740ae566}"> 

[guid]::NewGuid()

<rs5:FileExplorerNamespaceRestrictions>  
<rs5:AllowedNamespace Name="Downloads" />  
<v3:AllowRemovableDrives />  
</rs5:FileExplorerNamespaceRestrictions> 

<v5:StartPins><![CDATA[{  
"pinnedList":[  
{"packagedAppId":"Microsoft.WindowsCalculator_8wekyb3d8bbwe!App"},
{"desktopAppLink":"%ProgramData%\\Microsoft\\Windows\\Start Menu\\Programs\\7-Zip\\7-Zip File Manager.lnk"} // Additional apps... ] }]]> 
</v5:StartPins>