You can use Workspace ONE UEM to create a kiosk or digital sign using your Android devices which presents a single application as the primary interaction for users. The user will only have access to this application and cannot access the Android homescreen.


This topic assumes you have knowledge of certain work flows in the Workspace ONE UEM console, and have completed the following:

  • Completed Android EMM registration using managed Google accounts.
  • Created Smart Groups for your Android devices.
  • Added the Android version of the app that will act as the primary interaction for users to the console (either as a public app from Google Play, or uploaded to the Workspace ONE UEM console as an internal app). You can think of this app as your kiosk app.
  • Enrolled Android devices running OS version 8.0 or higher.

Enrollment Configuration

The best option to meet the kiosk use case is to use Work Managed enrollment with device based accounts. The recommendation is based on two key assumptions:

  • Devices used for kiosk or digital signage are not assigned to an end user.
  • The enrollment occurs at a central location and then shipped to the location where the device will be used as a kiosk.

Configure Device-based Accounts

Device-based accounts is only available when Android EMM is registered using managed Google Accounts.

Device-based accounts add a unique managed Google account on each device, even if the enrollment user is the same. This is important because Google limits how many devices can be used by a single user (limited to 10). With device-based accounts, any number of devices can be enrolled with the same user.

To configure device-based accounts in the Workspace ONE UEM console:

  1. Navigate to Groups & Settings > All Settings > Devices & Users > Android > Android EMM Registration > Enrollment Settings.
  2. Set the Work Managed Enrollment Type to Device-Based.

Create a User Account for Enrollment

You can enroll multiple devices with the same user by using device-based accounts.

To create a user:

  1. Navigate to Accounts > Users > List View > Add User.
  2. Add the Username, Full Name, E-mail, and Password for the account in the General tab.
  3. Select Save.

Create a QR code for Enrollment

To ensure that the enrollment is easy to perform in bulk, the best option is to use a QR code. A QR code can be created within the Workspace ONE UEM console that includes server details, group ID and authentication details. By simply scanning the QR code during the out of box setup, the device will enroll without any further interaction.

To create a QR code in the Workspace ONE UEM console:

  1. Navigate to Lifecycle > Staging > List view.
  2. Select Configure Enrollment.
  3. Navigate to Android > QR Code and select Configure.
  4. Connect the device to Wi-Fi prior to enrollment by enabling the Wi-Fi toggle. This enabling action displays the following options.

    Setting Description
    SSID Enter the Service Set Identifier, more commonly known as the name of the Wi-Fi Network.
    Password Enter the Wi-Fi password for the entered SSID.
  5. Select Next.

  6. Select the Workspace ONE Intelligent Hub to push to devices during staging. The default selection is Use latest Workspace ONE Intelligent Hub. If you do not have a Workspace ONE Intelligent Hub added, select Hosted on an external URL and enter the address in the URL text box to point to an externally-hosted Workspace ONE Intelligent Hub Package.
  7. Select Next.
  8. Set the Enrollment Details settings. To use token-based authentication, leave both options disabled.
  9. Configure Organization Group.

    Setting Description
    Organization Group Enable and select the organization group to enroll the device into.
  10. Configure Login Credentials.

    Setting Description
    Username Enable to configure login credentials. Enter the username of the user account created earlier.
    Password Enter the corresponding password for the user.
  11. Select Next.

  12. The Summary page allows you to the download the QR code as a PDF file.

You can use this QR code for enrolling your Android devices into Work Managed mode.

Workspace ONE UEM Launcher Configuration

VMware Workspace ONE UEM Launcher provides a highly configurable experience for your kiosk and digital sign devices.

Prior to creating a Launcher profile, you should add your kiosk application to the Workspace ONE UEM console.

Create a Launcher Profile

  1. Navigate to Devices > Profiles & Resources > Profiles > Add > Add Profile > Android.
  2. Under the General Tab, provide a name for the profile and assign the profile to smart group(s) that include your kiosk devices.
  3. Select the Launcher payload, and select Configure.
  4. Select Single App.
  5. Drag and drop the application that will be used as the kiosk from the left navigation to the canvas on the right.
  6. Under Layout, select the orientation of the device.
  7. Under the Settings drop-down, you can enter an administrative passcode that enables you to exit out of the single app mode for troubleshooting.
    • Additionally, you can also customize which settings your users can access. Once you're done customizing settings, select Save.
  8. Select Save to complete the Launcher configuration.
  9. Select Save and Publish.

Enroll the Device Using a QR Code

  1. Power on the device. The setup wizard prompts the user to tap the Welcome screen six times. The taps have to be done in the same place on the screen.
    • For Android 8.0 or higher devices, proceed to step 2 in order to download the QR Code reader.
    • For Android 9.0 or higher devices, the camera will open automatically after you complete the six taps, so you can skip to step 3.
  2. Connect to Wi-Fi and the setup wizard automatically downloads a QR code reader. The QR code reader app automatically starts once complete.
  3. Scan your QR code. For Android 9.0 or higher devices, use the QR code option on the camera to scan.
  4. The setup wizard automatically downloads the Workspace ONE Intelligent Hub and will setup the device by enrolling using the user account you created earlier.
  5. After enrollment is complete, Workspace ONE Launcher downloads and launches.
  6. The application configured in the Launcher profile is launched and locked in the foreground.

The device is now ready for use.

check-circle-line exclamation-circle-line close-line
Scroll to top icon