When deploying public-facing computers in a retail environment, hotel lobby, or hospital reception desk, administrators must lock down the user experience to prevent unauthorised access to the underlying operating system. The most effective way to achieve this on Windows 11 devices managed via Microsoft Intune is by configuring Microsoft Edge Chromium in Kiosk Mode.
While basic Kiosk Mode can be configured via the graphical Intune portal, advanced deployments often require configuring specific Edge policies that are not exposed in the standard user interface. To achieve full control over the browser’s behaviour, administrators must utilise Custom Configuration Profiles containing Open Mobile Alliance Uniform Resource Identifier (OMA-URI) settings.
Understanding Microsoft Edge Kiosk Modes
Microsoft Edge supports two distinct Kiosk Mode experiences. The first is Digital Signage/Interactive Display mode, which runs the browser in a locked, full-screen state displaying a single website, with no user interface controls available. The second is Public Browsing mode, which provides a limited multi-tab experience with a locked-down interface, automatically clearing browsing data upon closure.
Deploying these modes via Intune requires configuring the AssignedAccess CSP (Configuration Service Provider) alongside specific Edge ADMX-backed policies.
Configuring the AssignedAccess OMA-URI
To lock the Windows device to the Microsoft Edge application, you must push a custom XML configuration using the AssignedAccess CSP. Log into the Microsoft Intune admin centre, navigate to Devices, Configuration Profiles, and create a new Custom profile for Windows 10 and later.
Add a new OMA-URI setting with the following parameters:
- Name: Edge Kiosk Configuration
- OMA-URI:
./Device/Vendor/MSFT/AssignedAccess/Configuration - Data type: String (XML file)
In the XML payload, define the user account that will trigger the kiosk experience and specify the AppUserModelID (AUMID) for Microsoft Edge.
<AssignedAccessConfiguration>
<Profiles>
<Profile Id="{9A2A490F-10F6-4764-974A-43B19E722C23}">
<AllAppsList>
<AllowedApps>
<App AppUserModelId="Microsoft.MicrosoftEdge.Stable_8wekyb3d8bbwe!App" />
</AllowedApps>
</AllAppsList>
<Rs5BehaviorConfiguration rs5:WindowsKeyAction="ReturnToWelcomeScreen" />
</Profile>
</Profiles>
<Configs>
<Config>
<Account rs5:AutoLogonAccount="testkioskuser" />
<DefaultProfile Id="{9A2A490F-10F6-4764-974A-43B19E722C23}" />
</Config>
</Configs>
</AssignedAccessConfiguration>Defining Edge Behaviour via OMA-URI
Once the device is locked to Microsoft Edge, you must configure how the browser behaves within that locked state. Add another OMA-URI row to your Custom profile to define the specific Kiosk Mode type.
- Name: Edge Kiosk Mode Type
- OMA-URI:
./Device/Vendor/MSFT/Policy/Config/Edge~Policy~microsoft_edge/ConfigureKioskMode - Data type: String
- Value:
<enabled/><data id="ConfigureKioskMode" value="1"/>
A value of 1 enforces the Digital Signage mode. A value of 0 enforces the Public Browsing mode.
Setting the Kiosk Startup URL
Finally, you must explicitly define the website that Microsoft Edge will load when the kiosk account automatically logs in. Without this setting, the browser will launch to a blank page or the default New Tab page.
- Name: Edge Kiosk Startup URL
- OMA-URI:
./Device/Vendor/MSFT/Policy/Config/Edge~Policy~microsoft_edge/RestoreOnStartupURLs - Data type: String
- Value:
<enabled/><data id="RestoreOnStartupURLsDesc" value="1https://digitash.com"/>
After saving and assigning this Custom profile to your target device group, Intune will push the OMA-URI settings. Upon the next reboot, the device will automatically log in using the specified account, launch Microsoft Edge in a locked-down state, and load your designated web application, creating a secure and reliable public kiosk experience.