Kiosk mode locks a Chromebook to a single application or website, preventing users from accessing the Chrome desktop, taskbar, or other apps.
This is commonly used for digital signage, exam environments, library catalogue stations, and self-service kiosks in schools.
Mobile Guardian supports Single App Mode for ChromeOS devices at the profile level, allowing administrators to lock managed Chromebooks to a specific app or URL through the dashboard.
For scenarios requiring a deeper OS-level lock (where the device boots directly into a single app with no user login), Google Admin Console provides native ChromeOS Kiosk Mode, which can be used alongside Mobile Guardian.
What You Will Learn
- How to configure Single App Mode for ChromeOS using Mobile Guardian profiles
- How to stop Single App Mode on individual or multiple devices
- How native Google Admin Kiosk Mode differs from MG Single App Mode
- How to configure native Kiosk Mode in Google Admin Console
Prerequisites
- ChromeOS devices enrolled in Mobile Guardian (see ChromeOS Onboarding Overview)
- Admin access to the Mobile Guardian School Dashboard
- For native Kiosk Mode: Admin access to Google Workspace Admin Console (admin.google.com)
Understanding the Two Approaches
ChromeOS offers two ways to lock a device to a single app. Choose the approach that matches your use case:
| Feature | MG Single App Mode | Google Admin Kiosk Mode |
| Configured in | Mobile Guardian dashboard (Profiles) | Google Admin Console |
| How it works | MG Chrome extension restricts the device to a specified app while a profile is active | ChromeOS boots directly into a single app with no user login screen |
| User login required | Yes, user logs in normally; restriction is applied by the active profile | No, device launches the kiosk app automatically on startup |
| Can be toggled | Yes, by switching profiles or using Stop Single App Mode | No, requires changing the device policy in Google Admin |
| Best for | Temporary lockdown (exams, focused class time, scheduled restrictions) | Permanent kiosk use (digital signage, library stations, self-service terminals) |
Note: Both approaches can be used on the same fleet. For example, use Google Admin Kiosk Mode for permanently deployed signage devices, and MG Single App Mode for student Chromebooks during exams.
Method 1: MG Single App Mode (Profile-Based)
This method uses Mobile Guardian profiles to lock ChromeOS devices to a single app. The restriction is applied when the profile is active and can be removed by switching profiles or issuing a Stop Single App Mode command.
Step 1: Navigate to Profiles
- Navigate to Profiles in the left-hand menu
- Select the profile you want to configure (Baseline or Conditional)
Note: For exam or test scenarios, a Conditional Profile is recommended. This allows you to apply Single App Mode during specific times or for tagged device groups, while the Baseline profile keeps devices in normal mode outside of those periods.
Step 2: Configure Single App Mode
- Select the Single App Mode section within the profile
- Enable Single App Mode
- Specify the application or URL that the device should be locked to
- Save the profile
Step 3: Apply the Profile
- The profile will be pushed to all ChromeOS devices assigned to it at the next device refresh
- Devices will enter Single App Mode once the profile is active
Important: Ensure the specified app or extension is installed on the target devices before enabling Single App Mode. If the app is not present, the device may display an error or fail to enter kiosk mode. Use the Applications menu to deploy the app first if needed.
Stopping Single App Mode
Single App Mode can be stopped in three ways:
For a single device:
- Navigate to Devices > All Devices
- Locate the ChromeOS device and click the eye icon to open the Device Information view
- Click the Actions button
- Select Stop Single App Mode (if available for the device)
For multiple devices (bulk action):
- Navigate to Devices in the left-hand menu
- Select the ChromeOS devices using the tick boxes
- Click the Actions button
- Select Stop Single App Mode
By switching profiles:
- Assign the devices to a different profile that does not have Single App Mode enabled
- The restriction will be removed at the next device refresh
Method 2: Native Google Admin Kiosk Mode
Google Admin Kiosk Mode is a ChromeOS feature configured entirely in the Google Workspace Admin Console. It locks the Chromebook at the OS level: the device boots directly into a single Chrome app or URL with no user login screen. This is the appropriate option for devices that should always operate as a kiosk.
Step 1: Prepare the Kiosk App
Before configuring kiosk mode, identify the app you want to use:
- Chrome Web Store app or extension - you will need the app ID from the Chrome Web Store listing
- Web URL - for web-based kiosks, you can use a Chrome kiosk app that loads a specific URL, or use Google’s built-in URL kiosk option
Step 2: Configure Kiosk Settings in Google Admin
- Log in to Google Admin Console (admin.google.com)
- Navigate to Devices > Chrome > Settings > Device
- Select the organisational unit (OU) containing the kiosk devices
Note: It is best practice to create a dedicated organisational unit for kiosk devices (e.g. Top-level OU > Devices > Kiosks) so that kiosk policies do not affect standard student or staff Chromebooks.
- Scroll to the Kiosk Settings section
- Under Kiosk Apps, click Manage Kiosk Applications
- Add the Chrome app by entering the App ID from the Chrome Web Store, or specify a URL for a web kiosk
- Under Auto-Launch Kiosk App, select the app you just added. This ensures the device boots directly into the app without requiring a user to select it
Step 3: Configure Additional Kiosk Options
Within the Kiosk Settings section, you can also configure:
| Setting | Description |
| Auto-Launch Kiosk App | Selects which kiosk app launches automatically on boot |
| Public Session Kiosk | Allows a managed guest session alongside the kiosk app |
| Kiosk Power Settings | Controls screen timeout, sleep, and shutdown behaviour for unattended devices |
| Kiosk URL Blocking | Restricts navigation within the kiosk browser session |
| Kiosk Virtual Keyboard | Enables the on-screen keyboard for touchscreen kiosk devices |
Step 4: Enrol the Device as a Kiosk
- Power on the Chromebook (or factory reset it if already enrolled as a standard device)
- At the login screen, the device will detect the kiosk policy from its organisational unit
- The kiosk app will launch automatically. No user login is required
Important: A Chromebook must have a Chrome Enterprise (or Chrome Education) licence to support kiosk mode. Devices without a licence will not apply kiosk policies from Google Admin.
Mobile Guardian and Kiosk Devices
Devices running in native Google Admin Kiosk Mode operate without a user login, which affects how Mobile Guardian interacts with them:
- MG Chrome extension does not run in native kiosk sessions, as the extension requires a signed-in Chrome user profile
- Web filtering and profile restrictions from MG are not applied to devices in native kiosk mode
- Device-level actions in MG (Refresh, Disable, Message) may still function if the device is enrolled in MG, but profile-based features will not apply
For devices that need both kiosk functionality and MG management (web filtering, monitoring), use MG Single App Mode (Method 1) instead, as this operates within a signed-in user session where the MG extension is active.
Troubleshooting
| Issue | Likely Cause | Resolution |
| Single App Mode not activating on device | Profile has not refreshed on the device yet | Trigger a manual refresh from the dashboard: Devices > Actions > Refresh Device |
| App not loading in Single App Mode | The specified app is not installed on the device | Deploy the app via the Applications menu before enabling Single App Mode |
| Stop Single App Mode not appearing in device actions | The device is not currently in Single App Mode, or the profile has already been switched | Verify the device’s active profile in the Device Information view |
| Native kiosk app not auto-launching | Auto-Launch Kiosk App not configured, or device is in the wrong OU | Check Google Admin: Devices > Chrome > Settings > Device, and verify the correct OU is selected |
| Kiosk device not applying policy | Device does not have a Chrome Enterprise/Education licence | Assign a licence to the device in Google Admin: Devices > Chrome > Devices > select device > Licence |
| MG web filtering not working on kiosk device | Device is in native kiosk mode (no signed-in user profile) | Use MG Single App Mode instead if web filtering is required, or apply URL blocking through Google Admin’s kiosk settings |
Please let us know if you found this helpful.
Thanks for reading! 🙂