deepblue/windows-itpro-docs
1
0
Fork 0
mirror of https://github.com/MicrosoftDocs/windows-itpro-docs.git synced 2025-05-29 05:37:22 +00:00
Code Issues Actions 3 Packages Projects Releases Wiki Activity

Merge pull request #2388 from Teresa-Motiv/v-tea-update

Browse Source 
V tea update
This commit is contained in:
v-tea@microsoft.com 2020-03-26 13:36:56 -07:00 committed by GitHub
commit 6de91a025c
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
1 changed files with 39 additions and 21 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

60
devices/hololens/hololens-kiosk.md
View File

@ -19,9 +19,11 @@ appliesto:
- HoloLens 2
---
# Set up HoloLens as a kiosk for specific applications
# Set up HoloLens as a kiosk
Kiosk mode is a convenient feature that you can use to focus the HoloLens device on business apps, or to use the HoloLens device in an app demo. You can use kiosk mode in two configurations (single-app kiosk or multi-app kiosk) and you can choose one of three processes to set up and deploy the kiosk configuration.
Kiosk mode is a convenient feature that you can use to focus the HoloLens device on business apps, or to use the HoloLens device in an app demo. You can use kiosk mode in two configurations (single-app kiosk or multi-app kiosk) and you can use one of three processes to set up and deploy the kiosk configuration.
This article provides information about aspects of configuring kiosks that are specific to HoloLens devices. For general information about types of Windows-based kiosks and how to configure them, see [Configure kiosks and digital signs on Windows desktop editions](https://docs.microsoft.com/windows/configuration/kiosk-methods).
## Kiosk mode requirements
@ -31,18 +33,21 @@ To configure a HoloLens (1st gen) device to use kiosk mode, you must first make
## Select a kiosk mode
When HoloLens is configured as a multi-app kiosk, only the allowed apps are available to the user. The benefit of a multi-app kiosk, or fixed-purpose device, is to provide an easy-to-understand experience for individuals by putting in front of them only the things they need to use, and removing from their view the things they don't need to access.
When HoloLens is configured as a multi-app kiosk, only the allowed apps are available to the user in the startup tiles user experience. The benefit of a multi-app kiosk, or fixed-purpose device, is to provide an easy-to-understand experience for individuals by putting in front of them only the things they need to use, and removing from their view the things they don't need to access.
Single-app kiosk mode starts the specified app when the user signs in, and restricts the user's ability to launch new apps or change the running app. When single-app kiosk mode is enabled for HoloLens, the [start gestures](hololens2-basic-usage.md#start-gesture) (including [bloom](hololens1-basic-usage.md) on HoloLens (1st gen)) and Cortana are disabled, and placed apps aren't shown in the user's surroundings.
> [!NOTE]
> Kiosk mode on Hololens is to ensure specified apps are shown in startup tiles user experience. If those apps launch other apps, they are not stopped. In order to block any other app / process from launching please use [Windows Defender Application Control (WDAC) CSP.](https://docs.microsoft.com/windows/client-management/mdm/applicationcontrol-csp)
> [!WARNING]
> The assigned access feature which enables kiosk mode is intended for corporate-owned fixed-purpose devices. When the multi-app assigned access configuration is applied on the device, certain policies are enforced system-wide, and will impact other users on the device. Deleting the multi-app configuration will remove the assigned access lockdown profiles associated with the users, but it cannot revert all [the enforced policies](https://docs.microsoft.com/windows/configuration/lock-down-windows-10-to-specific-apps#policies-set-by-multi-app-kiosk-configuration). A factory reset is needed to clear all the policies enforced via assigned access.
> The assigned access feature which enables kiosk mode is intended for corporate-owned fixed-purpose devices. When the multi-app assigned access configuration is applied on the device, certain policies are enforced system-wide, and will impact other users on the device. Deleting the multi-app configuration will remove the assigned access lockdown profiles associated with the users, but it cannot revert all [the enforced policies](https://docs.microsoft.com/windows/configuration/lock-down-windows-10-to-specific-apps#mdm-policy). A factory reset is needed to clear all the policies enforced via assigned access.
>
> Be aware that voice commands are enabled for kiosk mode configured in Microsoft Intune or provisioning packages, even if the Cortana app is not selected as a kiosk app.
The following table lists the device capabilities in the different kiosk modes.
|   |Start gesture/pins panel |Quick Actions menu |Camera and video |Miracast |Supported user types | Auto sign-in | Can distinguish different users to use Kiosk mode or full access |
|   |Start gesture/pins panel |Quick Actions menu |Camera and video |Miracast |Supported user types | Accounts may sign-in automatically | Can distinguish different users to use Kiosk mode or full access |
| --- | --- | --- | --- | --- | --- | --- | --- |
|Single-app kiosk |No |No |No* |No |MSA or local |Yes |No |
|Multi-app kiosk |Yes |Yes* |Yes* |Yes* |AAD |No |Yes |
@ -50,9 +55,14 @@ The following table lists the device capabilities in the different kiosk modes.
While camera and video voice commands and UI are disabled by default the button commands can still be used.
To enable the camera, device picker, or Miracast on the system menu include the AUMIDs below in your Multi-app kiosk.
Also while enabling the camera allows on to take pictures or video, you may also wish to include a method of interacting or retreving your pictures, such as Photos, Mail, or OneDrive.
> [!NOTE]
> Use the Application User Model ID (AUMID) to allow apps in your kiosk configuration. The Camera app AUMID is `HoloCamera_cw5n1h2txyewy!HoloCamera`. The device picker app AUMID is `HoloDevicesFlow_cw5n1h2txyewy!HoloDevicesFlow`.
> When you configure assigned access to associate users with specific apps, use the following [Application User Model IDs (AUMIDs)](https://docs.microsoft.com/windows/configuration/find-the-application-user-model-id-of-an-installed-app):
>
> - **Camera app AUMID**: `HoloCamera_cw5n1h2txyewy!HoloCamera`
> - **Device picker app AUMID**: `HoloDevicesFlow_cw5n1h2txyewy!HoloDevicesFlow`
> For general information about using AUMIDs, see [Guidelines for choosing an app for assigned access (kiosk mode)](https://docs.microsoft.com/windows/configuration/guidelines-for-assigned-access-app).
The [AssignedAccess Configuration Service Provider (CSP)](https://docs.microsoft.com/windows/client-management/mdm/assignedaccess-csp) enables kiosk configuration.
@ -70,19 +80,26 @@ Examples scenarios of when to use which kiosk:
There are three methods that you can use to configure the device as a kiosk:
- You can use [Microsoft Intune or other mobile device management (MDM) service](#set-up-kiosk-mode-by-using-microsoft-intune-or-mdm) to configure single-app and multi-app kiosks.
- You can [use a provisioning package](#set-up-kiosk-mode-by-using-a-provisioning-package) to configure single-app and multi-app kiosks.
- You can [use the Windows Device Portal](#set-up-kiosk-mode-by-using-the-windows-device-portal) to configure single-app kiosks. This method is recommended only for demonstrations, as it requires that developer mode be enabled on the device.
| | Device Portal | Provisioning Package | MDM |
|------------------------------|---------------|----------------------|------|
| Single-app kiosk available | Yes | Yes | Yes |
| Multi-app kiosk available | No | Yes | Yes |
| Need device locally to apply | Yes | Yes | No |
| Need developer mode | Yes | No | No |
| Need AAD | No | No | Yes |
| Automatically deploy | No | No | Yes |
| Speed | Fastest | Fast | Slow |
| Recommended for scale | No | No | Yes |
- You can [use a provisioning package](#set-up-kiosk-mode-by-using-a-provisioning-package) to configure single-app and multi-app kiosks.
- You can [use the Windows Device Portal](#set-up-kiosk-mode-by-using-the-windows-device-portal) to configure single-app kiosks.
> [!NOTE]
> Because this method requires that developer mode be enabled on the device, we recommend that you use it only for demonstrations.
The following table lists the capabilities and benefits of each of the three deployment methods.
|   |Deploy by using Windows Device Portal |Deploy by using a provisioning package |Deploy by using MDM |
| --------------------------- | ------------- | -------------------- | ---- |
|Deploy single-app kiosks | Yes | Yes | Yes |
|Deploy multi-app kiosks | No | Yes | Yes |
|Deploy to local devices only | Yes | Yes | No |
|Deploy by using developer mode |Required | Not required | Not required |
|Deploy by using Azure Active Directory (AAD) | Not required | Not required | Required |
|Deploy automatically | No | No | Yes |
|Deployment speed | Fastest | Fast | Slow |
|Deploy at scale | Not recommended | Not recommended | Recommended |
## Set up kiosk mode by using Microsoft Intune or MDM
@ -134,6 +151,7 @@ Some common in-box apps you may wish to use are:
| Camera | HoloCamera_cw5n1h2txyewy!HoloCamera |
| Device picker | HoloDevicesFlow_cw5n1h2txyewy!HoloDevicesFlow |
| Feedback Hub | Microsoft.WindowsFeedbackHub_8wekyb3d8bbwe!App |
| Settings | HolographicSystemSettings_cw5n1h2txyewy!App |
For more information on settings for both modes of Kiosk visit [here](https://docs.microsoft.com/intune/configuration/kiosk-settings-holographic).
@ -151,9 +169,9 @@ There is an important distinction between the **User logon type** and the **Assi
**Examples:**
- You have a single group that you use for both logon type and assignments. Users A B and C are in both groups. No matter which user the device is first set up for they will join the tenant in this group and the kiosk policy will deploy. Also each user is in the logon group so users A B and C will all experience the Kiosk.
- You have a single group that you use for both logon type and assignments. Users A B and C are in both groups. No matter which user the device is first set up for they will join the tenant in this group and the kiosk policy will deploy. Also each user is in the group used for logon type so users A B and C will all experience the Kiosk.
- You have an assignment group with users A, B and C in it. The logon group is different with users B and C. Even if user A sets up the device and joins the tenant with the device the Kiosk policy will still deploy. Users B and C will still be logged in to the Kiosk, but user A can still log in if troubleshooting, changing of settings or any other need for full access to windows is needed.
- You have an assignment group with users A, B and C in it. The group used for logon type is different with users B and C. Even if user A sets up the device and joins the tenant with the device the Kiosk policy will still deploy. Users B and C will still be logged in to the Kiosk, but user A can still log in if troubleshooting, changing of settings or any other need for full access to windows is needed.
- You have devices you contract out to two different vendors. Instead of user groups you have device groups. Each device group needs a different Kiosk. Those devices when joined receive policy for their own respective Kiosk. The logon user group may include users from both sites, and thus each regional area's device would allow kiosks for both sets of users.
@ -341,7 +359,7 @@ You will [create an XML file](#set-up-kiosk-mode-by-using-a-provisioning-package
## Recommendations for selecting kiosk apps
- You cannot select the Shell app as a kiosk app.
- We recommend that you do **not** select the Settings app, Microsoft Edge, Microsoft Store, and the File Explorer app as a kiosk app.
- We recommend that you do **not** select the Microsoft Edge, Microsoft Store, and the File Explorer app as a kiosk app.
- You can select Cortana as a kiosk app.
- To enable photo or video capture, the HoloCamera app must be enabled as a kiosk app.
- While Kiosk mode adds several restrictions, we suggest also considering additional policies such as turning off USB connectivity, or checking your flight ring settings to set when automatic updates occur as to not happen during business hours.