kioskpe ← MDM setup

MDM setup · Intune

Deploy Kioskope with Microsoft Intune

Enroll iPads through Automated Device Enrollment, install Kioskope with an Apps and Books license, and push its settings with one app configuration policy. About an hour the first time; after that, new devices configure themselves.

Menu paths match the Intune admin center and Apple Business as of September 2026.

Before you start

1. Connect Apple Business to Intune

Two tokens, each renewed yearly: one lets Intune enroll devices, the other lets it assign app licenses.

Enrollment program token

  1. Intune: Devices›Enrollment›Apple mobile›Enrollment program tokens›Add. Agree, then Download the Intune public key certificate (.pem). Keep this tab open until the end.
  2. Apple Business: Devices›Management Services, connect an external device management service. Name it Intune, upload the .pem, then Download Service Token (.p7m).
  3. Back in Intune: enter the Managed Apple Account you used, upload the .p7m, and Create. Intune syncs your device list.

Apps and Books token

  1. Apple Business: Settings›Payments & Billing›Apps & Books›Download for the organizational unit that will hold your Kioskope licenses.
  2. Intune: Tenant administration›Connectors and tokens›Apple VPP tokens›Create. Upload the token, pick your Country/Region, set Type of VPP account to Business and Automatic app updates to Yes, agree, Create.

A content token works with one MDM at a time. If it was used elsewhere, revoke it there first.

2. Create the enrollment policy

  1. Devices›Enrollment›Apple mobile›Enrollment program tokens, open your token, then Enrollment policies›Create policy›iOS/iPadOS.
  2. User Affinity: Enroll without User Affinity. Supervised: Yes. Locked enrollment: Yes. Await final configuration: Yes.
  3. Under Setup Assistant, hide every screen a kiosk doesn't need. Most fleets hide all of them.
  4. Create, then in the token choose Set Default Policy so new devices pick it up, or select devices under Devices and Assign policy.
  5. Apple Business: Devices›Inventory, select the iPads, Assign Device Management, choose Intune. Or set it once under Devices›Management Services›Default Device Assignment.

Enrollment policy changes only reach a device after a factory reset, so settle these before you unbox.

3. Buy Kioskope and assign it

  1. Apple Business: Apps & Services›Apps and Books›App Store›View Store. Search Kioskope, pick the organizational unit tied to your token, enter the quantity, Buy. A payment method must be on file first.
  2. Intune: Tenant administration›Connectors and tokens›Apple VPP tokens, select the token, Sync. Without this, Intune syncs once a day.
  3. Apps›All apps›Kioskope›Properties, edit Assignments. Under Required, add your kiosk device group. Leave the license type on Device. Save.

Device licensing is what makes the rest silent: no Apple Account on the iPad, no install prompt on a supervised device, updates through Intune.

4. Push Kioskope's settings

  1. Apps›Configuration›Create›Managed devices. Name it, set Platform to iOS/iPadOS, and for Targeted app select Kioskope.
  2. On Settings, set Configuration settings format to Enter XML data and paste your configuration. Start from this and change the values:
<dict>
  <key>startURL</key>
  <string>https://inventory.example.com/scan</string>
  <key>allowlist</key>
  <array>
    <string>*.example.com</string>
    <string>sso.example.net</string>
  </array>
  <key>showChrome</key>
  <false/>
  <key>idleResetSeconds</key>
  <integer>120</integer>
  <key>clearSessionOnReset</key>
  <true/>
  <key>symbologies</key>
  <array>
    <string>pdf417</string>
    <string>code128</string>
    <string>qr</string>
  </array>
  <key>terminator</key>
  <string>enter</string>
  <key>adminPIN</key>
  <string>2468</string>
</dict>
  1. Assign the policy to the same kiosk device group, then Create.

Why XML: Intune's configuration designer offers only Integer, Real, String, and Boolean, and allowlist and symbologies are arrays. Intune tokens work inside strings, so https://app.example.com/kiosk?device={{serialnumber}} gives every iPad its own start URL. The full key list is on the MDM setup page.

5. Lock the iPad to Kioskope (optional)

Create a device restrictions profile: Devices›Manage devices›Configuration›Create›New policy, platform iOS/iPadOS, then Templates›Device restrictions. Pick one of the two, not both.

Kiosk (Single App Mode)

Under Kiosk, set App to run in kiosk mode to Managed app and choose Kioskope. Block auto lock and the buttons you don't want touched. The iPad boots into Kioskope and stays there until you remove the profile. Remember apps can't update while pinned.

Autonomous single app mode

Under Autonomous single app mode, add app name Kioskope and bundle ID com.kioskope.Kioskope. Then add <key>asam</key><true/> to the app configuration policy. Kioskope pins itself when it opens and releases when asam turns false (restart the iPad if it doesn't), which is the easier way to free a device for maintenance.

Assign the profile to the kiosk device group.

6. Power on and check

A fresh iPad on Wi-Fi activates, enrolls, installs Kioskope, and opens your start URL. No wizard, no prompts. Confirm the configuration landed under Devices›All devices›the iPad›App configuration.

If something's off