How do we set up shared or kiosk devices with Intune?

Key facts

• Kiosk and shared are different: kiosk has no personal sign-in, shared has many.
• Windows Autopilot self-deploying mode enrolls kiosks without a user, and needs TPM 2.0.
• Android Enterprise dedicated devices use Managed Home Screen for locked-down layouts.
• Shared iPad needs Automated Device Enrollment and Managed Apple Accounts.
• Userless devices can use an Intune device-only licence where it fits.

Pick the right model

Most problems with shared devices come from choosing the wrong model, such as a generic shared account used by a whole team on a front desk PC. Shared accounts break MFA, hide who did what and are hard to secure. Match the device to how it is actually used.

Windows kiosks and shared PCs

For kiosks, Windows Autopilot self-deploying mode enrolls the device and applies policy without a user signing in. It requires TPM 2.0 and attestation support. Assign a kiosk configuration profile that sets Assigned Access to a single app, such as Edge in kiosk mode for a web app or a check-in app, or a multi-app layout with a restricted Start menu. Add auto-logon with a local kiosk account so the device survives restarts.

For shared PCs where staff sign in with their own accounts, use the shared multi-user device settings. They can delete local accounts after sign-out or when disk space runs low, set guest access, and control power and maintenance hours. Pair this with Windows Hello for Business or FIDO2 security keys for fast, phishing-resistant sign-in.

Android and Apple devices

Android Enterprise dedicated devices are the standard for scanners, tablets and frontline phones. Enroll with a QR code or zero-touch, and use Managed Home Screen to show only approved apps. With Microsoft Entra shared device mode, a worker signs in once to an app such as Teams, gets single sign-on to other supported apps, and signs out at the end of a shift to clear their data.

For iPads, Shared iPad lets multiple users sign in with Managed Apple Accounts and keeps their data in separate partitions; it requires Automated Device Enrollment through Apple Business Manager. Supervised iPads can also run in Single App Mode or Autonomous Single App Mode for kiosks, or use shared device mode with Microsoft apps for frontline workers.

Security and licensing points

Shared and kiosk devices still need compliance policies, encryption and updates. Conditional Access rules for frontline staff can allow access from compliant shared devices with MFA through a security key or passkey, or set a shorter session for shared tablets.

• Userless kiosks can be licensed with an Intune device-only licence where no user features are needed.
• Frontline workers on shared devices are often licensed with Microsoft 365 F1 or F3.
• Block personal email, app stores and browsing on kiosks unless there is a business reason.
• Set a maintenance window for updates and restarts that fits the site's hours.
• Label devices physically and in Intune with location and purpose, so support can find them.

Pilot at a real site

Shared devices are used under pressure: a busy front desk, a warehouse shift change, a clinic waiting room. Pilot at one real site with the people who will use the devices, and watch them work. Test sign-in speed, sign-out, what happens after a power cut, and how a lost or broken device is replaced.

Write a one-page support guide for each device type, including how to re-provision it with Autopilot reset, a wipe or a new QR enrollment.

How Accred Consulting approaches it

Accred Consulting designs and deploys shared and kiosk devices as part of Intune projects. Discovery maps each device type, location, app, shift pattern and licensing. The proposal sets a clear scope, fixed price and timeline. US-based specialists then build the enrollment method, kiosk or shared profiles, compliance and Conditional Access for frontline users, and pilot at a real site before rolling out by location. A roughly 280-device estate across 11 locations moved to Autopilot and Intune with this kind of planning. Handover includes device runbooks, documentation and knowledge transfer.

Track record: 475+ client projects, 2,000+ migration workstreams and 210,000+ users migrated by a US-based team. Company facts · Case studies

Related questions