From 730a43cdcbc2f923db9f9845f79b80994ed1f5bf Mon Sep 17 00:00:00 2001 From: Evan Miller Date: Wed, 11 Mar 2020 17:50:28 -0700 Subject: [PATCH 01/50] HoloLens Kiosk, serious overhaul MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit This is a LARGE change to this page. I've been wanting to do this for some time now. I've discussed with Yannis and Sarah and how it needed it. So I took the time to finally go about doing the work and making the changes. @yannisle @scooley As subject matter experts I'd like to review any information I've added and verify it's correct. @Teresa-Motiv I'm sure I've got several rough edges here. Would you please help me with consistency? I'm sure my information is correct but I need to learn to phrase and present it uniformly. • Redo the SAK vs MAK chart. • Create a chart or paragraph detailing when each deployment method should be used, it’s benefits, and limitations. • Add some examples for clarity • Move the Start layout XML stuff to the bottom as it’s optional now for MDM. Pointing to it as needed. • ACTUAL instructions for Kiosk Mode via Intune. • Reduce “Windows 10, version 1803” terminology. And make it less prominent in headers. • Reduce provisioning section and instead update the page we linked to. • Update the recommendations at the bottom. • Get rid of Bloom references. --- devices/hololens/hololens-kiosk.md | 275 ++++++++++++++++++++--------- 1 file changed, 194 insertions(+), 81 deletions(-) diff --git a/devices/hololens/hololens-kiosk.md b/devices/hololens/hololens-kiosk.md index aab93e1b8a..5c23e398b7 100644 --- a/devices/hololens/hololens-kiosk.md +++ b/devices/hololens/hololens-kiosk.md @@ -20,97 +20,162 @@ appliesto: # Set up HoloLens as a kiosk for specific applications -In Windows 10, version 1803, you can configure your HoloLens devices to run as multi-app or single-app kiosks. You can also configure guest access for a HoloLens kiosk device by [designating a SpecialGroup account in your XML file.](#add-guest-access-to-the-kiosk-configuration-optional) +A convenient feature many choose to use as a solution for focusing on business apps, or using to show an app demo is Kiosk mode. There are two different types of kiosks, and three methods of deploying them. +- All HoloLens 2 devices are Kiosk mode capable. +- In order to use Kiosk Mode with HoloLens (1st Gen) you’ll need to be updated to at least Windows 10, version 1803 which released April 2018. If you have recovered your HoloLens (1st gen) device with Windows Device Recovery Tool using the default build, or have taken the most recent updates then you are ready. -When HoloLens is configured as a multi-app kiosk, only the allowed apps are available to the user. The benefit of a multi-app kiosk, or fixed-purpose device, is to provide an easy-to-understand experience for individuals by putting in front of them only the things they need to use, and removing from their view the things they don't need to access. +# Picking a Kiosk Mode +When HoloLens is configured as a multi-app kiosk, only the allowed apps are available to the user. The benefit of a multi-app kiosk, or fixed-purpose device, is to provide an easy-to-understand experience for individuals by putting in front of them only the things they need to use, and removing from their view the things they don’t need to access. -Single-app kiosk mode starts the specified app when the user signs in, and restricts the user's ability to launch new apps or change the running app. When single-app kiosk mode is enabled for HoloLens, the [start gestures](https://docs.microsoft.com/hololens/hololens2-basic-usage#start-gesture) (including [Bloom](https://docs.microsoft.com/hololens/hololens1-basic-usage) on HoloLens (1st Gen)) and Cortana are disabled, and placed apps aren't shown in the user's surroundings. - -The following table lists the device capabilities in the different kiosk modes. - -Kiosk mode | Voice and Bloom commands | Quick actions menu | Camera and video | Miracast ---- | --- | --- | --- | --- -Single-app kiosk | ![no](images/crossmark.png) | ![no](images/crossmark.png) | ![no](images/crossmark.png) | ![no](images/crossmark.png) -Multi-app kiosk | ![yes](images/checkmark.png) | ![yes](images/checkmark.png) with **Home** and **Volume** (default)

Photo and video buttons shown in Quick actions menu if the Camera app is enabled in the kiosk configuration.

Miracast is shown if the Camera app and device picker app are enabled in the kiosk configuration. | ![yes](images/checkmark.png) if the Camera app is enabled in the kiosk configuration. | ![yes](images/checkmark.png) if the Camera app and device picker app are enabled in the kiosk configuration. - -> [!NOTE] -> Use the Application User Model ID (AUMID) to allow apps in your kiosk configuration. The Camera app AUMID is `HoloCamera_cw5n1h2txyewy!HoloCamera`. The device picker app AUMID is `HoloDevicesFlow_cw5n1h2txyewy!HoloDevicesFlow`. - -The [AssignedAccess Configuration Service Provider (CSP)](https://docs.microsoft.com/windows/client-management/mdm/assignedaccess-csp) enables kiosk configuration. +Single-app kiosk mode starts the specified app when the user signs in, and restricts the user's ability to launch new apps or change the running app. When single-app kiosk mode is enabled for HoloLens, the [start gestures](https://docs.microsoft.com/hololens/hololens2-basic-usage#start-gesture) (including [Bloom](https://docs.microsoft.com/hololens/hololens1-basic-usage) on HoloLens (1st Gen)) and Cortana are disabled, and placed apps aren't shown in the user's surroundings. > [!WARNING] > The assigned access feature which enables kiosk mode is intended for corporate-owned fixed-purpose devices. When the multi-app assigned access configuration is applied on the device, certain policies are enforced system-wide, and will impact other users on the device. Deleting the multi-app configuration will remove the assigned access lockdown profiles associated with the users, but it cannot revert all [the enforced policies](https://docs.microsoft.com/windows/configuration/lock-down-windows-10-to-specific-apps#policies-set-by-multi-app-kiosk-configuration). A factory reset is needed to clear all the policies enforced via assigned access. > > Be aware that voice commands are enabled for kiosk mode configured in Microsoft Intune or provisioning packages, even if the Cortana app is not selected as a kiosk app. -For HoloLens devices running Windows 10, version 1803, there are three methods that you can use to configure the device as a kiosk: -- You can use [Microsoft Intune or other mobile device management (MDM) service](#set-up-kiosk-mode-using-microsoft-intune-or-mdm-windows-10-version-1803) to configure single-app and multi-app kiosks. -- You can [use a provisioning package](#set-up-kiosk-mode-using-a-provisioning-package-windows-10-version-1803) to configure single-app and multi-app kiosks. -- You can [use the Windows Device Portal](#set-up-kiosk-mode-using-the-windows-device-portal-windows-10-version-1607-and-version-1803) to configure single-app kiosks. This method is recommended only for demonstrations, as it requires that developer mode be enabled on the device. -For HoloLens devices running Windows 10, version 1607, you can [use the Windows Device Portal](#set-up-kiosk-mode-using-the-windows-device-portal-windows-10-version-1607-and-version-1803) to configure single-app kiosks. +The following table lists the device capabilities in the different kiosk modes. -## Start layout for HoloLens +| | Start Gesture / Pins Panel | Quick Actions Menu | Camera and Video | Miracast | Supported User Types | Auto Login | Can distinguish different users to use Kiosk mode or full access | +|------------------|----------------------------|--------------------|------------------|----------|----------------------|------------|------------------------------------------------------------------| +| Single-app kiosk | No | No | No* | No | MSA or Local | Yes | No | +| Multi-app kiosk | Yes | Yes* | Yes* | Yes* | AAD | No | Yes | -If you use [MDM, Microsoft Intune](#set-up-kiosk-mode-using-microsoft-intune-or-mdm-windows-10-version-1803), or a [provisioning package](#set-up-kiosk-mode-using-a-provisioning-package-windows-10-version-1803) to configure a multi-app kiosk, the procedure requires a Start layout. Start layout customization isn't supported in Holographic for Business, so you'll need to use a placeholder Start layout. +While camera and video voice commands and UI are disabled by default the button commands can still be used. +To enable the camera, device picker, or Miracast on the system menu include the AUMIDs below in your Multi-app kiosk. > [!NOTE] -> Because a single-app kiosk launches the kiosk app when a user signs in, there is no Start screen displayed. +> Use the Application User Model ID (AUMID) to allow apps in your kiosk configuration. The Camera app AUMID is `HoloCamera_cw5n1h2txyewy!HoloCamera`. The device picker app AUMID is `HoloDevicesFlow_cw5n1h2txyewy!HoloDevicesFlow`. -### Start layout file for MDM (Intune and others) +The [AssignedAccess Configuration Service Provider (CSP)](https://docs.microsoft.com/windows/client-management/mdm/assignedaccess-csp) enables kiosk configuration. -Save the following sample as an XML file. You can use this file when you configure the multi-app kiosk in Microsoft Intune (or in another MDM service that provides a kiosk profile). +One Device can easily be set up to have one Kiosk set up for it. If you opt for Multi-app Kiosk then not you don’t need to require all users to use the Kiosk. +Examples scenarios of when to use which Kiosk: +- A device dedicated to Guides to help new hires: Single-app kiosk +- A device that has both Guides and Remote Assist for a range of employees: Multi-app kiosk +- You have a custom app and only allow access to it: Single-app kiosk +- You want a device the majority of your users can only use custom App, but that one user group can use your custom app, Remote Assist, Feedback Hub, and Settings if needed: Multi-app Kiosk mode (With only your custom app in the Kiosk, and the one user group has full access to Windows Holographic.) -> [!NOTE] -> If you need to use a custom setting and full XML configuration to set up a kiosk in your MDM service, use the [Start layout instructions for a provisioning package](#start-layout-for-a-provisioning-package). +# Picking a Deployment Method -```xml - - - - - - - - - -``` +There are three methods that you can use to configure the device as a kiosk: +- You can use [Microsoft Intune or other mobile device management (MDM) service](https://docs.microsoft.com/hololens/hololens-kiosk#set-up-kiosk-mode-using-microsoft-intune-or-mdm) to configure single-app and multi-app kiosks. +- You can [use a provisioning package](https://docs.microsoft.com/en-us/hololens/hololens-kiosk#set-up-kiosk-mode-using-a-provisioning-package) to configure single-app and multi-app kiosks. +- You can [use the Windows Device Portal](https://docs.microsoft.com/en-us/hololens/hololens-kiosk#set-up-kiosk-mode-using-the-windows-device-portal) to configure single-app kiosks. This method is recommended only for demonstrations, as it requires that developer mode be enabled on the device. -### Start layout for a provisioning package +| | Device Portal | Provisioning Package | MDM | +|------------------------------|---------------|----------------------|------| +| Single-app kiosk available | Yes | Yes | Yes | +| Multi-app kiosk available | No | Yes | Yes | +| Need device locally to apply | Yes | Yes | No | +| Need developer mode | Yes | No | No | +| Need AAD | No | No | Yes | +| Automatically deploy | No | No | Yes | +| Speed | Fastest | Fast | Slow | +| Recommended for scale | No | No | Yes | -You will [create an XML file](#set-up-kiosk-mode-using-a-provisioning-package-windows-10-version-1803) to define the kiosk configuration to be included in a provisioning package. Use the following sample in the `StartLayout` section of your XML file. -```xml - - - - - - - - - - - - - - - ]]> - - -``` +## Set up kiosk mode using Microsoft Intune or MDM -## Set up kiosk mode using Microsoft Intune or MDM (Windows 10, version 1803) +Process: +1. Create a Device Configuration Policy +1. Select the settings you want to see in your Kiosk +1. Assign the Policy to the group to receive the policy +1. Set up the device + 1. Single app Kiosk + 1. Multi app Kiosk + +## Create a Device configuration policy + +Navigate to https://portal.azure.com/ and sign in to your Intune administrator account. +Select **Microsoft Intune > Device configuration - Profiles > + Create profile** +Walk through the steps setting a name, **Platform** as **Windows 10 and later**, and **Profile** type as **Kiosk**. +Your next settings after this will be different depending on if you pick Single app kiosk or Multi app kiosk. +For full details creating a device profile for Kiosk mode check out [Kiosk settings]( https://docs.microsoft.com/intune/configuration/kiosk-settings). + +## Select the settings you want to see in your Kiosk. + +### Single-app kiosk +Select **Single-app kiosk**, then select **Local user account**. You’ll need to enter either the name of your local user, or your Microsoft Account you intend to be logged onto the device. +Finally you’ll select the one app you want to be used in your kiosk. Ideally this should be a store app. +For full details visit [here](https://docs.microsoft.com/intune/configuration/kiosk-settings-holographic#single-full-screen-app-kiosks). + +### Multi App Kiosk +**Target Windows 10 in S mode devices**: Choose **No**. S mode isn't supported on Windows Holographic for Business. +For **User logon type**: Add one or more user accounts that can use the apps you add. Your options that work with Windows Holographic are : **Azure AD user or group** or **HoloLens visitor**. + +It’s important that the group or groups you choose includes users you want to use the Kiosk, if a user signs in with an account not included in this list they will not have a Kiosk experience. + +Now you choose which Apps to include in your kiosk. You may choose to add just one or add many. + +To choose an app you’ve uploaded as a **Line of business app** choose the **Add store app** option. You many also choose to add an app via it’s **Application user model ID** by selecting **Add by AUMID**. +Some common in-box apps you may wish to use are: + +| App Name | AUMID | +|---------------|----------------------------------------------------------------------| +| Remote Assist | Microsoft.MicrosoftRemoteAssist_8wekyb3d8bbwe!Microsoft.RemoteAssist | +| Guides | Microsoft.Dynamics365.Guides_8wekyb3d8bbwe!MicrosoftGuides | +| Camera | HoloCamera_cw5n1h2txyewy!HoloCamera | +| Device picker | HoloDevicesFlow_cw5n1h2txyewy!HoloDevicesFlow | +| Feedback Hub | Microsoft.WindowsFeedbackHub_8wekyb3d8bbwe!App | + +For more information on settings for both modes of Kiosk visit [here](https://docs.microsoft.com/en-us/intune/configuration/kiosk-settings-holographic). + +## Assign the Policy to the group to receive the policy +Once you have created and saved your Kiosk mode policy you must assign it to the group(s) that you want it deployed to, or your devices will never receive it. +Click assignments and add the group(s) that you want the Kiosk mode policy deployed to. + + +> [! IMPORTANT] +> If two more or more different Kiosk polices target a device they will conflict and the device will receive neither. Other policies such as device restrictions do not conflict with Kiosk mode or additional device restrictions. + +For more information on group type, and group assignments please visit [here](https://docs.microsoft.com/en-us/intune/configuration/device-profile-assign). + +There is an important distinction between the **User logon type** and the **Assignments**. Assignments is how the deployment of the Kiosk to a device is determined. Once a Kiosk policy is on the device, it uses the User logon type to determine which users should be using the Kiosk. + +Examples: +- You have a single group that you use for both logon type and assignments. Users A B and C are in both groups. No matter which user the device is first set up for they will join the tenant in this group and the kiosk policy will deploy. Also each user is in the logon group so users A B and C will all experience the Kiosk. + +- You have an assignment group with users A, B and C in it. The logon group is different with users B and C. Even if user A sets up the device and joins the tenant with the device the Kiosk policy will still deploy. Users B and C will still be logged in to the Kiosk, but user A can still log in if troubleshooting, changing of settings or any other need for full access to windows is needed. + +- You have devices you contract out to two different vendors. Instead of user groups you have device groups. Each device group needs a different Kiosk. Those devices when joined receive policy for their own respective Kiosk. The logon user group may include users from both sites, and thus each regional area’s device would allow kiosks for both sets of users. + + +## Set up the device +Now it’s time to set up the device to both receive the policy and log into the account the policy has enabled for kiosk mode. + +### Single-app kiosk + +Since Single-app kiosk mode targets a local user or Microsoft account you need to take a few extra steps to [enroll the HoloLens in MDM](https://docs.microsoft.com/hololens/hololens-enroll-mdm ), but sign in will be easy and can be automatic. + +During OOBE sign into your **Microsoft Account** specified as a **Logon User Account**. +Then enroll the device so that your **device is enrolled in a group** for a group selected under the Kiosk mode policy’s **assignment**. +Give your store app a short amount time to download as well as policy to be applied, once it is restart the device. Once your account is signed in your Kiosk mode will be enabled and your app should automatically launch. + +If you’re not seeing your Kiosk mode yet, make sure to [check the assignment status]( https://docs.microsoft.com/intune/configuration/device-profile-monitor). + +### Multi app Kiosk +For multi app Kiosk you’ll be using a device that you Azure AD join to your tenant during OOBE. + +If you’re targeting a user group. you’ll want to sign in to an account that is a member of a group that’s also a group that the Kiosk is assigned to. + +Once you’ve completed OOBE, if you have apps you need to manually install via sideloading or the Microsoft store please do so. If your apps are going to install automatically, such as being a [required app](https://docs.microsoft.com/mem/intune/apps/apps-deploy#assign-an-app) for the same group that the Kiosk mode is assigned to, then it will become a part of your kiosk even if you enter the kiosk before it finishes downloading. + +To enable Kiosk mode simply **sign out** of your account and **sign in** to a profile that is a member of a group targeted by the Logon user account setting. (This may be the same user.) + +If you’re not seeing your Kiosk mode yet, make sure to [check the assignment status]( https://docs.microsoft.com/en-us/intune/configuration/device-profile-monitor). + + +Additional information: For HoloLens devices that are managed by Microsoft Intune, directions can be found [here](hololens-commercial-infrastructure.md#how-to-configure-kiosk-mode-using-microsoft-intune). For other MDM services, check your provider's documentation for instructions. If you need to use a custom setting and full XML configuration to set up a kiosk in your MDM service, [create an XML file that defines the kiosk configuration](#create-a-kiosk-configuration-xml-file), and make sure to include the [Start layout](#start-layout-for-a-provisioning-package) in the XML file. -## Set up kiosk mode using a provisioning package (Windows 10, version 1803) +## Set up kiosk mode using a provisioning package + +As part of creating your Provisioning package, you’ll need to create a [start layout](https://docs.microsoft.com/hololens/hololens-kiosk#start-layout-for-hololens). Process: 1. [Create an XML file that defines the kiosk configuration.](#create-a-kiosk-configuration-xml-file) @@ -170,25 +235,16 @@ Use the following snippet in your kiosk configuration XML to enable the **Guest* ### Apply the provisioning package to HoloLens -1. Connect HoloLens via USB to a PC and start the device, but do not continue past the **Fit** page of OOBE (the first page with the blue box). +You can intially [apply a provisioning package to HoloLens during setup](https://docs.microsoft.com/hololens/hololens-provisioning#apply-a-provisioning-package-to-hololens-during-setup). -3. HoloLens will show up as a device in File Explorer on the PC. +You can also [apply a provisioning package to HoloLens after setup](https://docs.microsoft.com/hololens/hololens-provisioning#4-apply-a-provisioning-package-to-hololens-after-setup). -4. In File Explorer, drag and drop the provisioning package (.ppkg) onto the device storage. - -5. Briefly press and release the **Volume Down** and **Power** buttons simultaneously again while on the **fit** page. - -6. The device will ask you if you trust the package and would like to apply it. Confirm that you trust the package. - -7. You will see whether the package was applied successfully or not. If it failed, you can fix your package and try again. If it succeeded, proceed with OOBE. - - -## Set up kiosk mode using the Windows Device Portal (Windows 10, version 1607 and version 1803) +## Set up kiosk mode using the Windows Device Portal 1. [Set up the HoloLens to use the Windows Device Portal](https://developer.microsoft.com/windows/mixed-reality/using_the_windows_device_portal#setting_up_hololens_to_use_windows_device_portal). The Device Portal is a web server on your HoloLens that you can connect to from a web browser on your PC. > [!IMPORTANT] - > When you set up HoloLens to use the Device Portal, you must enable **Developer Mode** on the device. **Developer Mode** on a device that has been upgraded to Windows Holographic for Business enables side-loading of apps, which risks the installation of apps that have not been certified by the Microsoft Store. Administrators can block the ability to enable **Developer Mode** using the **ApplicationManagement/AllowDeveloper Unlock** setting in the [Policy CSP](https://msdn.microsoft.com/library/windows/hardware/dn904962.aspx). [Learn more about Developer Mode.](https://msdn.microsoft.com/windows/uwp/get-started/enable-your-device-for-development#developer-mode) + > When you set up HoloLens to use the Device Portal, you must enable **Developer Mode** on the device. **Developer Mode** on a device that has Windows Holographic for Business enables side-loading of apps, which risks the installation of apps that have not been certified by the Microsoft Store. Administrators can block the ability to enable **Developer Mode** using the **ApplicationManagement/AllowDeveloper Unlock** setting in the [Policy CSP](https://msdn.microsoft.com/library/windows/hardware/dn904962.aspx). [Learn more about Developer Mode.](https://msdn.microsoft.com/windows/uwp/get-started/enable-your-device-for-development#developer-mode) 2. On a PC, connect to the HoloLens using [Wi-Fi](https://developer.microsoft.com/windows/mixed-reality/Using_the_Windows_Device_Portal.html#connecting_over_wi-fi) or [USB](https://developer.microsoft.com/windows/mixed-reality/Using_the_Windows_Device_Portal.html#connecting_over_usb). @@ -202,16 +258,73 @@ Use the following snippet in your kiosk configuration XML to enable the **Guest* ![Kiosk Mode](images/kiosk.png) > [!NOTE] - > The kiosk mode option will be available if the device is [enrolled in device management](hololens-enroll-mdm.md) and has a [license to upgrade to Windows Holographic for Business](hololens1-upgrade-enterprise.md). + > The kiosk mode option will be available if the device has [Windows Holographic for Business](hololens1-upgrade-enterprise.md). 5. Select **Enable Kiosk Mode**, choose an app to run when the device starts, and click **Save**. +6. Reboot the HoloLens. If you still have your Device Portal page open you can use the **Power** option in the top right and click **Restart.** + +## Start layout for HoloLens + +If you use [MDM, Microsoft Intune](#set-up-kiosk-mode-using-microsoft-intune-or-mdm-windows-10-version-1803), or a [provisioning package](#set-up-kiosk-mode-using-a-provisioning-package-windows-10-version-1803) to configure a multi-app kiosk, the procedure requires a Start layout. Start layout customization isn't supported in Holographic for Business, so you'll need to use a placeholder Start layout. + +> [!NOTE] +> Because a single-app kiosk launches the kiosk app when a user signs in, there is no Start screen displayed. + +### Start layout file for MDM (Intune and others) + +Save the following sample as an XML file. You can use this file when you configure the multi-app kiosk in Microsoft Intune (or in another MDM service that provides a kiosk profile). + +> [!NOTE] +> If you need to use a custom setting and full XML configuration to set up a kiosk in your MDM service, use the [Start layout instructions for a provisioning package](#start-layout-for-a-provisioning-package). + +```xml + + + + + + + + + +``` + +### Start layout for a provisioning package + +You will [create an XML file](#set-up-kiosk-mode-using-a-provisioning-package-windows-10-version-1803) to define the kiosk configuration to be included in a provisioning package. Use the following sample in the `StartLayout` section of your XML file. + +```xml + + + + + + + + + + + + + + + ]]> + + +``` + ## Kiosk app recommendations -- You cannot select Microsoft Edge, Microsoft Store, or the Shell app as a kiosk app. -- We recommend that you do **not** select the Settings app and the File Explorer app as a kiosk app. +- You cannot select the Shell app as a kiosk app. +- We recommend that you do **not** select the Settings app, Microsoft Edge, Microsoft Store, and the File Explorer app as a kiosk app. - You can select Cortana as a kiosk app. - To enable photo or video capture, the HoloCamera app must be enabled as a kiosk app. +- While Kiosk mode adds several restrictions, we suggest also considering additional policies such as turning off USB connectivity, or checking your flight ring settings to set when automatic updates occur as to not happen during business hours. ## More information From a223b23afca71e6d3e026f5ec1bb57ce7689c188 Mon Sep 17 00:00:00 2001 From: "v-tea@microsoft.com" <46357187+Teresa-Motiv@users.noreply.github.com> Date: Thu, 12 Mar 2020 13:26:10 -0700 Subject: [PATCH 02/50] Prelim cleanup --- devices/hololens/hololens-kiosk.md | 75 ++++++++++++++++-------------- 1 file changed, 41 insertions(+), 34 deletions(-) diff --git a/devices/hololens/hololens-kiosk.md b/devices/hololens/hololens-kiosk.md index 5c23e398b7..c9585b911c 100644 --- a/devices/hololens/hololens-kiosk.md +++ b/devices/hololens/hololens-kiosk.md @@ -7,8 +7,9 @@ author: dansimp ms.author: dansimp ms.topic: article ms.localizationpriority: medium -ms.date: 11/13/2018 +ms.date: 03/12/2020 ms.custom: +- CI 115262 - CI 111456 - CSSTroubleshooting ms.reviewer: @@ -20,46 +21,50 @@ appliesto: # Set up HoloLens as a kiosk for specific applications -A convenient feature many choose to use as a solution for focusing on business apps, or using to show an app demo is Kiosk mode. There are two different types of kiosks, and three methods of deploying them. -- All HoloLens 2 devices are Kiosk mode capable. -- In order to use Kiosk Mode with HoloLens (1st Gen) you’ll need to be updated to at least Windows 10, version 1803 which released April 2018. If you have recovered your HoloLens (1st gen) device with Windows Device Recovery Tool using the default build, or have taken the most recent updates then you are ready. +A convenient feature many choose to use as a solution for focusing on business apps, or using to show an app demo is Kiosk mode. There are two different types of kiosks, and three methods of deploying them. -# Picking a Kiosk Mode +- All HoloLens 2 devices are Kiosk mode capable. +- In order to use Kiosk Mode with HoloLens (1st Gen) you’ll need to be updated to at least Windows 10, version 1803 which released April 2018. If you have recovered your HoloLens (1st gen) device with Windows Device Recovery Tool using the default build, or have taken the most recent updates then you are ready. + +## Select a kiosk mode When HoloLens is configured as a multi-app kiosk, only the allowed apps are available to the user. The benefit of a multi-app kiosk, or fixed-purpose device, is to provide an easy-to-understand experience for individuals by putting in front of them only the things they need to use, and removing from their view the things they don’t need to access. Single-app kiosk mode starts the specified app when the user signs in, and restricts the user's ability to launch new apps or change the running app. When single-app kiosk mode is enabled for HoloLens, the [start gestures](https://docs.microsoft.com/hololens/hololens2-basic-usage#start-gesture) (including [Bloom](https://docs.microsoft.com/hololens/hololens1-basic-usage) on HoloLens (1st Gen)) and Cortana are disabled, and placed apps aren't shown in the user's surroundings. -> [!WARNING] +> [!WARNING] > The assigned access feature which enables kiosk mode is intended for corporate-owned fixed-purpose devices. When the multi-app assigned access configuration is applied on the device, certain policies are enforced system-wide, and will impact other users on the device. Deleting the multi-app configuration will remove the assigned access lockdown profiles associated with the users, but it cannot revert all [the enforced policies](https://docs.microsoft.com/windows/configuration/lock-down-windows-10-to-specific-apps#policies-set-by-multi-app-kiosk-configuration). A factory reset is needed to clear all the policies enforced via assigned access. -> +> > Be aware that voice commands are enabled for kiosk mode configured in Microsoft Intune or provisioning packages, even if the Cortana app is not selected as a kiosk app. The following table lists the device capabilities in the different kiosk modes. -| | Start Gesture / Pins Panel | Quick Actions Menu | Camera and Video | Miracast | Supported User Types | Auto Login | Can distinguish different users to use Kiosk mode or full access | -|------------------|----------------------------|--------------------|------------------|----------|----------------------|------------|------------------------------------------------------------------| -| Single-app kiosk | No | No | No* | No | MSA or Local | Yes | No | -| Multi-app kiosk | Yes | Yes* | Yes* | Yes* | AAD | No | Yes | +|   |Start gesture/pins panel |Quick Actions menu |Camera and video |Miracast |Supported user types | Auto sign-in | Can distinguish different users to use Kiosk mode or full access | +| --- | --- | --- | --- | --- | --- | --- | --- | +|Single-app kiosk |No |No |No* |No |MSA or local |Yes |No | +|Multi-app kiosk |Yes |Yes* |Yes* |Yes* |AAD |No |Yes | While camera and video voice commands and UI are disabled by default the button commands can still be used. To enable the camera, device picker, or Miracast on the system menu include the AUMIDs below in your Multi-app kiosk. -> [!NOTE] +> [!NOTE] > Use the Application User Model ID (AUMID) to allow apps in your kiosk configuration. The Camera app AUMID is `HoloCamera_cw5n1h2txyewy!HoloCamera`. The device picker app AUMID is `HoloDevicesFlow_cw5n1h2txyewy!HoloDevicesFlow`. The [AssignedAccess Configuration Service Provider (CSP)](https://docs.microsoft.com/windows/client-management/mdm/assignedaccess-csp) enables kiosk configuration. One Device can easily be set up to have one Kiosk set up for it. If you opt for Multi-app Kiosk then not you don’t need to require all users to use the Kiosk. + Examples scenarios of when to use which Kiosk: + - A device dedicated to Guides to help new hires: Single-app kiosk - A device that has both Guides and Remote Assist for a range of employees: Multi-app kiosk - You have a custom app and only allow access to it: Single-app kiosk - You want a device the majority of your users can only use custom App, but that one user group can use your custom app, Remote Assist, Feedback Hub, and Settings if needed: Multi-app Kiosk mode (With only your custom app in the Kiosk, and the one user group has full access to Windows Holographic.) -# Picking a Deployment Method +## Select a deployment method There are three methods that you can use to configure the device as a kiosk: + - You can use [Microsoft Intune or other mobile device management (MDM) service](https://docs.microsoft.com/hololens/hololens-kiosk#set-up-kiosk-mode-using-microsoft-intune-or-mdm) to configure single-app and multi-app kiosks. - You can [use a provisioning package](https://docs.microsoft.com/en-us/hololens/hololens-kiosk#set-up-kiosk-mode-using-a-provisioning-package) to configure single-app and multi-app kiosks. - You can [use the Windows Device Portal](https://docs.microsoft.com/en-us/hololens/hololens-kiosk#set-up-kiosk-mode-using-the-windows-device-portal) to configure single-app kiosks. This method is recommended only for demonstrations, as it requires that developer mode be enabled on the device. @@ -75,33 +80,36 @@ There are three methods that you can use to configure the device as a kiosk: | Speed | Fastest | Fast | Slow | | Recommended for scale | No | No | Yes | +## Set up kiosk mode by using Microsoft Intune or MDM -## Set up kiosk mode using Microsoft Intune or MDM +Process: -Process: -1. Create a Device Configuration Policy -1. Select the settings you want to see in your Kiosk -1. Assign the Policy to the group to receive the policy -1. Set up the device - 1. Single app Kiosk - 1. Multi app Kiosk +1. [Create a Device Configuration Policy](#create-a-device-configuration-policy). +1. [Select the settings that you want to see in your kiosk](#select-the-settings-that-you-want-to-see-in-your-kiosk). +1. Assign the Policy to the group to receive the policy. +1. Set up the device. + - Single app Kiosk. + - Multi app Kiosk. -## Create a Device configuration policy +### Create a device configuration policy + +1. Navigate to https://portal.azure.com/ and sign in to your Intune administrator account. +1. Select **Microsoft Intune** > **Device configuration - Profiles** > **Create profile** +1. Walk through the steps setting a name, **Platform** as **Windows 10 and later**, and **Profile** type as **Kiosk**. -Navigate to https://portal.azure.com/ and sign in to your Intune administrator account. -Select **Microsoft Intune > Device configuration - Profiles > + Create profile** -Walk through the steps setting a name, **Platform** as **Windows 10 and later**, and **Profile** type as **Kiosk**. Your next settings after this will be different depending on if you pick Single app kiosk or Multi app kiosk. + For full details creating a device profile for Kiosk mode check out [Kiosk settings]( https://docs.microsoft.com/intune/configuration/kiosk-settings). -## Select the settings you want to see in your Kiosk. +### Select the settings that you want to see in your kiosk + +#### Configure a single-app kiosk -### Single-app kiosk Select **Single-app kiosk**, then select **Local user account**. You’ll need to enter either the name of your local user, or your Microsoft Account you intend to be logged onto the device. Finally you’ll select the one app you want to be used in your kiosk. Ideally this should be a store app. For full details visit [here](https://docs.microsoft.com/intune/configuration/kiosk-settings-holographic#single-full-screen-app-kiosks). -### Multi App Kiosk +#### Configure a multi-app kiosk **Target Windows 10 in S mode devices**: Choose **No**. S mode isn't supported on Windows Holographic for Business. For **User logon type**: Add one or more user accounts that can use the apps you add. Your options that work with Windows Holographic are : **Azure AD user or group** or **HoloLens visitor**. @@ -122,26 +130,25 @@ Some common in-box apps you may wish to use are: For more information on settings for both modes of Kiosk visit [here](https://docs.microsoft.com/en-us/intune/configuration/kiosk-settings-holographic). -## Assign the Policy to the group to receive the policy +## Assign the policy to the group to receive the policy Once you have created and saved your Kiosk mode policy you must assign it to the group(s) that you want it deployed to, or your devices will never receive it. Click assignments and add the group(s) that you want the Kiosk mode policy deployed to. - -> [! IMPORTANT] -> If two more or more different Kiosk polices target a device they will conflict and the device will receive neither. Other policies such as device restrictions do not conflict with Kiosk mode or additional device restrictions. +> [!IMPORTANT] +> If two more or more different kiosk polices target a device they will conflict and the device will receive neither. Other policies such as device restrictions do not conflict with Kiosk mode or additional device restrictions. For more information on group type, and group assignments please visit [here](https://docs.microsoft.com/en-us/intune/configuration/device-profile-assign). There is an important distinction between the **User logon type** and the **Assignments**. Assignments is how the deployment of the Kiosk to a device is determined. Once a Kiosk policy is on the device, it uses the User logon type to determine which users should be using the Kiosk. -Examples: +**Examples:** + - You have a single group that you use for both logon type and assignments. Users A B and C are in both groups. No matter which user the device is first set up for they will join the tenant in this group and the kiosk policy will deploy. Also each user is in the logon group so users A B and C will all experience the Kiosk. - You have an assignment group with users A, B and C in it. The logon group is different with users B and C. Even if user A sets up the device and joins the tenant with the device the Kiosk policy will still deploy. Users B and C will still be logged in to the Kiosk, but user A can still log in if troubleshooting, changing of settings or any other need for full access to windows is needed. - You have devices you contract out to two different vendors. Instead of user groups you have device groups. Each device group needs a different Kiosk. Those devices when joined receive policy for their own respective Kiosk. The logon user group may include users from both sites, and thus each regional area’s device would allow kiosks for both sets of users. - ## Set up the device Now it’s time to set up the device to both receive the policy and log into the account the policy has enabled for kiosk mode. From 05cf6869e87006ecfaa3f6c4a063fce4aa4e6336 Mon Sep 17 00:00:00 2001 From: "v-tea@microsoft.com" <46357187+Teresa-Motiv@users.noreply.github.com> Date: Thu, 12 Mar 2020 14:00:17 -0700 Subject: [PATCH 03/50] Prelim cleanup --- devices/hololens/hololens-kiosk.md | 28 ++++++++++++++++------------ 1 file changed, 16 insertions(+), 12 deletions(-) diff --git a/devices/hololens/hololens-kiosk.md b/devices/hololens/hololens-kiosk.md index c9585b911c..e388f7b9bc 100644 --- a/devices/hololens/hololens-kiosk.md +++ b/devices/hololens/hololens-kiosk.md @@ -84,12 +84,14 @@ There are three methods that you can use to configure the device as a kiosk: Process: -1. [Create a Device Configuration Policy](#create-a-device-configuration-policy). -1. [Select the settings that you want to see in your kiosk](#select-the-settings-that-you-want-to-see-in-your-kiosk). -1. Assign the Policy to the group to receive the policy. +1. [Create a device configuration policy](#create-a-device-configuration-policy). +1. Select the settings that you want to see in your kiosk. + - [Configure the settings for a single-app kiosk](#configure-the-settings-for-a-single-app-kiosk). + - [Configure the settings for a multi-app kiosk](#configure-the-settings-for-a-multi-app-kiosk). +1. [Assign the policy to the group to receive the policy](#assign-the-policy-to-the-group-to-receive-the-policy). 1. Set up the device. - - Single app Kiosk. - - Multi app Kiosk. + - [Set up a single-app kiosk](#set-up-a-single-app-kiosk). + - [Set up a multi-app kiosk](#set-up-a-multi-app-kiosk). ### Create a device configuration policy @@ -103,15 +105,15 @@ For full details creating a device profile for Kiosk mode check out [Kiosk setti ### Select the settings that you want to see in your kiosk -#### Configure a single-app kiosk +#### Configure the settings for a single-app kiosk Select **Single-app kiosk**, then select **Local user account**. You’ll need to enter either the name of your local user, or your Microsoft Account you intend to be logged onto the device. Finally you’ll select the one app you want to be used in your kiosk. Ideally this should be a store app. For full details visit [here](https://docs.microsoft.com/intune/configuration/kiosk-settings-holographic#single-full-screen-app-kiosks). -#### Configure a multi-app kiosk +#### Configure the settings for a multi-app kiosk **Target Windows 10 in S mode devices**: Choose **No**. S mode isn't supported on Windows Holographic for Business. -For **User logon type**: Add one or more user accounts that can use the apps you add. Your options that work with Windows Holographic are : **Azure AD user or group** or **HoloLens visitor**. +For **User logon type**: Add one or more user accounts that can use the apps you add. Your options that work with Windows Holographic are: **Azure AD user or group** or **HoloLens visitor**. It’s important that the group or groups you choose includes users you want to use the Kiosk, if a user signs in with an account not included in this list they will not have a Kiosk experience. @@ -152,9 +154,9 @@ There is an important distinction between the **User logon type** and the **Assi ## Set up the device Now it’s time to set up the device to both receive the policy and log into the account the policy has enabled for kiosk mode. -### Single-app kiosk +### Set up a single-app kiosk -Since Single-app kiosk mode targets a local user or Microsoft account you need to take a few extra steps to [enroll the HoloLens in MDM](https://docs.microsoft.com/hololens/hololens-enroll-mdm ), but sign in will be easy and can be automatic. +Since Single-app kiosk mode targets a local user or Microsoft account you need to take a few extra steps to [enroll the HoloLens in MDM](hololens-enroll-mdm.md), but sign in will be easy and can be automatic. During OOBE sign into your **Microsoft Account** specified as a **Logon User Account**. Then enroll the device so that your **device is enrolled in a group** for a group selected under the Kiosk mode policy’s **assignment**. @@ -162,7 +164,8 @@ Give your store app a short amount time to download as well as policy to be appl If you’re not seeing your Kiosk mode yet, make sure to [check the assignment status]( https://docs.microsoft.com/intune/configuration/device-profile-monitor). -### Multi app Kiosk +### Set up a multi-app kiosk + For multi app Kiosk you’ll be using a device that you Azure AD join to your tenant during OOBE. If you’re targeting a user group. you’ll want to sign in to an account that is a member of a group that’s also a group that the Kiosk is assigned to. @@ -180,11 +183,12 @@ For HoloLens devices that are managed by Microsoft Intune, directions can be fou For other MDM services, check your provider's documentation for instructions. If you need to use a custom setting and full XML configuration to set up a kiosk in your MDM service, [create an XML file that defines the kiosk configuration](#create-a-kiosk-configuration-xml-file), and make sure to include the [Start layout](#start-layout-for-a-provisioning-package) in the XML file. -## Set up kiosk mode using a provisioning package +## Set up kiosk mode by using a provisioning package As part of creating your Provisioning package, you’ll need to create a [start layout](https://docs.microsoft.com/hololens/hololens-kiosk#start-layout-for-hololens). Process: + 1. [Create an XML file that defines the kiosk configuration.](#create-a-kiosk-configuration-xml-file) 2. [Add the XML file to a provisioning package.](#add-the-kiosk-configuration-xml-file-to-a-provisioning-package) 3. [Apply the provisioning package to HoloLens.](#apply-the-provisioning-package-to-hololens) From d6377d6d51c5d23fddb2c162dd65b996ac281584 Mon Sep 17 00:00:00 2001 From: Teresa-Motiv Date: Fri, 13 Mar 2020 09:54:46 -0700 Subject: [PATCH 04/50] Cleanup --- devices/hololens/hololens-kiosk.md | 90 ++++++++++++++++-------------- 1 file changed, 47 insertions(+), 43 deletions(-) diff --git a/devices/hololens/hololens-kiosk.md b/devices/hololens/hololens-kiosk.md index e388f7b9bc..e0157408b0 100644 --- a/devices/hololens/hololens-kiosk.md +++ b/devices/hololens/hololens-kiosk.md @@ -23,19 +23,19 @@ appliesto: A convenient feature many choose to use as a solution for focusing on business apps, or using to show an app demo is Kiosk mode. There are two different types of kiosks, and three methods of deploying them. -- All HoloLens 2 devices are Kiosk mode capable. -- In order to use Kiosk Mode with HoloLens (1st Gen) you’ll need to be updated to at least Windows 10, version 1803 which released April 2018. If you have recovered your HoloLens (1st gen) device with Windows Device Recovery Tool using the default build, or have taken the most recent updates then you are ready. +- All HoloLens 2 devices are Kiosk-mode capable. +- In order to use Kiosk Mode with HoloLens (1st gen) you'll need to be updated to at least Windows 10, version 1803 which released April 2018. If you have recovered your HoloLens (1st gen) device with Windows Device Recovery Tool using the default build, or have taken the most recent updates then you are ready. ## Select a kiosk mode -When HoloLens is configured as a multi-app kiosk, only the allowed apps are available to the user. The benefit of a multi-app kiosk, or fixed-purpose device, is to provide an easy-to-understand experience for individuals by putting in front of them only the things they need to use, and removing from their view the things they don’t need to access. -Single-app kiosk mode starts the specified app when the user signs in, and restricts the user's ability to launch new apps or change the running app. When single-app kiosk mode is enabled for HoloLens, the [start gestures](https://docs.microsoft.com/hololens/hololens2-basic-usage#start-gesture) (including [Bloom](https://docs.microsoft.com/hololens/hololens1-basic-usage) on HoloLens (1st Gen)) and Cortana are disabled, and placed apps aren't shown in the user's surroundings. +When HoloLens is configured as a multi-app kiosk, only the allowed apps are available to the user. The benefit of a multi-app kiosk, or fixed-purpose device, is to provide an easy-to-understand experience for individuals by putting in front of them only the things they need to use, and removing from their view the things they don't need to access. + +Single-app kiosk mode starts the specified app when the user signs in, and restricts the user's ability to launch new apps or change the running app. When single-app kiosk mode is enabled for HoloLens, the [start gestures](hololens2-basic-usage.md#start-gesture) (including [bloom](hololens1-basic-usage.md) on HoloLens (1st gen)) and Cortana are disabled, and placed apps aren't shown in the user's surroundings. > [!WARNING] > The assigned access feature which enables kiosk mode is intended for corporate-owned fixed-purpose devices. When the multi-app assigned access configuration is applied on the device, certain policies are enforced system-wide, and will impact other users on the device. Deleting the multi-app configuration will remove the assigned access lockdown profiles associated with the users, but it cannot revert all [the enforced policies](https://docs.microsoft.com/windows/configuration/lock-down-windows-10-to-specific-apps#policies-set-by-multi-app-kiosk-configuration). A factory reset is needed to clear all the policies enforced via assigned access. > -> Be aware that voice commands are enabled for kiosk mode configured in Microsoft Intune or provisioning packages, even if the Cortana app is not selected as a kiosk app. - +> Be aware that voice commands are enabled for kiosk mode configured in Microsoft Intune or provisioning packages, even if the Cortana app is not selected as a kiosk app. The following table lists the device capabilities in the different kiosk modes. @@ -44,17 +44,18 @@ The following table lists the device capabilities in the different kiosk modes. |Single-app kiosk |No |No |No* |No |MSA or local |Yes |No | |Multi-app kiosk |Yes |Yes* |Yes* |Yes* |AAD |No |Yes | -While camera and video voice commands and UI are disabled by default the button commands can still be used. +While camera and video voice commands and UI are disabled by default the button commands can still be used. + To enable the camera, device picker, or Miracast on the system menu include the AUMIDs below in your Multi-app kiosk. > [!NOTE] > Use the Application User Model ID (AUMID) to allow apps in your kiosk configuration. The Camera app AUMID is `HoloCamera_cw5n1h2txyewy!HoloCamera`. The device picker app AUMID is `HoloDevicesFlow_cw5n1h2txyewy!HoloDevicesFlow`. -The [AssignedAccess Configuration Service Provider (CSP)](https://docs.microsoft.com/windows/client-management/mdm/assignedaccess-csp) enables kiosk configuration. +The [AssignedAccess Configuration Service Provider (CSP)](https://docs.microsoft.com/windows/client-management/mdm/assignedaccess-csp) enables kiosk configuration. -One Device can easily be set up to have one Kiosk set up for it. If you opt for Multi-app Kiosk then not you don’t need to require all users to use the Kiosk. +One device can easily be set up to have one kiosk set up for it. If you opt for multi-app kiosk then not you don't need to require all users to use the Kiosk. -Examples scenarios of when to use which Kiosk: +Examples scenarios of when to use which kiosk: - A device dedicated to Guides to help new hires: Single-app kiosk - A device that has both Guides and Remote Assist for a range of employees: Multi-app kiosk @@ -65,9 +66,9 @@ Examples scenarios of when to use which Kiosk: There are three methods that you can use to configure the device as a kiosk: -- You can use [Microsoft Intune or other mobile device management (MDM) service](https://docs.microsoft.com/hololens/hololens-kiosk#set-up-kiosk-mode-using-microsoft-intune-or-mdm) to configure single-app and multi-app kiosks. -- You can [use a provisioning package](https://docs.microsoft.com/en-us/hololens/hololens-kiosk#set-up-kiosk-mode-using-a-provisioning-package) to configure single-app and multi-app kiosks. -- You can [use the Windows Device Portal](https://docs.microsoft.com/en-us/hololens/hololens-kiosk#set-up-kiosk-mode-using-the-windows-device-portal) to configure single-app kiosks. This method is recommended only for demonstrations, as it requires that developer mode be enabled on the device. +- You can use [Microsoft Intune or other mobile device management (MDM) service](#set-up-kiosk-mode-by-using-microsoft-intune-or-mdm) to configure single-app and multi-app kiosks. +- You can [use a provisioning package](#set-up-kiosk-mode-using-a-provisioning-package) to configure single-app and multi-app kiosks. +- You can [use the Windows Device Portal](#set-up-kiosk-mode-using-the-windows-device-portal) to configure single-app kiosks. This method is recommended only for demonstrations, as it requires that developer mode be enabled on the device. | | Device Portal | Provisioning Package | MDM | |------------------------------|---------------|----------------------|------| @@ -107,19 +108,20 @@ For full details creating a device profile for Kiosk mode check out [Kiosk setti #### Configure the settings for a single-app kiosk -Select **Single-app kiosk**, then select **Local user account**. You’ll need to enter either the name of your local user, or your Microsoft Account you intend to be logged onto the device. -Finally you’ll select the one app you want to be used in your kiosk. Ideally this should be a store app. +Select **Single-app kiosk**, then select **Local user account**. You'll need to enter either the name of your local user, or your Microsoft Account you intend to be logged onto the device. +Finally you'll select the one app you want to be used in your kiosk. Ideally this should be a store app. For full details visit [here](https://docs.microsoft.com/intune/configuration/kiosk-settings-holographic#single-full-screen-app-kiosks). #### Configure the settings for a multi-app kiosk + **Target Windows 10 in S mode devices**: Choose **No**. S mode isn't supported on Windows Holographic for Business. For **User logon type**: Add one or more user accounts that can use the apps you add. Your options that work with Windows Holographic are: **Azure AD user or group** or **HoloLens visitor**. -It’s important that the group or groups you choose includes users you want to use the Kiosk, if a user signs in with an account not included in this list they will not have a Kiosk experience. +It's important that the group or groups you choose includes users you want to use the Kiosk, if a user signs in with an account not included in this list they will not have a Kiosk experience. Now you choose which Apps to include in your kiosk. You may choose to add just one or add many. -To choose an app you’ve uploaded as a **Line of business app** choose the **Add store app** option. You many also choose to add an app via it’s **Application user model ID** by selecting **Add by AUMID**. +To choose an app you've uploaded as a **Line of business app** choose the **Add store app** option. You many also choose to add an app via it's **Application user model ID** by selecting **Add by AUMID**. Some common in-box apps you may wish to use are: | App Name | AUMID | @@ -130,16 +132,17 @@ Some common in-box apps you may wish to use are: | Device picker | HoloDevicesFlow_cw5n1h2txyewy!HoloDevicesFlow | | Feedback Hub | Microsoft.WindowsFeedbackHub_8wekyb3d8bbwe!App | -For more information on settings for both modes of Kiosk visit [here](https://docs.microsoft.com/en-us/intune/configuration/kiosk-settings-holographic). +For more information on settings for both modes of Kiosk visit [here](https://docs.microsoft.com/intune/configuration/kiosk-settings-holographic). ## Assign the policy to the group to receive the policy + Once you have created and saved your Kiosk mode policy you must assign it to the group(s) that you want it deployed to, or your devices will never receive it. Click assignments and add the group(s) that you want the Kiosk mode policy deployed to. > [!IMPORTANT] > If two more or more different kiosk polices target a device they will conflict and the device will receive neither. Other policies such as device restrictions do not conflict with Kiosk mode or additional device restrictions. -For more information on group type, and group assignments please visit [here](https://docs.microsoft.com/en-us/intune/configuration/device-profile-assign). +For more information on group type, and group assignments please visit [here](https://docs.microsoft.com/intune/configuration/device-profile-assign). There is an important distinction between the **User logon type** and the **Assignments**. Assignments is how the deployment of the Kiosk to a device is determined. Once a Kiosk policy is on the device, it uses the User logon type to determine which users should be using the Kiosk. @@ -149,33 +152,35 @@ There is an important distinction between the **User logon type** and the **Assi - You have an assignment group with users A, B and C in it. The logon group is different with users B and C. Even if user A sets up the device and joins the tenant with the device the Kiosk policy will still deploy. Users B and C will still be logged in to the Kiosk, but user A can still log in if troubleshooting, changing of settings or any other need for full access to windows is needed. -- You have devices you contract out to two different vendors. Instead of user groups you have device groups. Each device group needs a different Kiosk. Those devices when joined receive policy for their own respective Kiosk. The logon user group may include users from both sites, and thus each regional area’s device would allow kiosks for both sets of users. +- You have devices you contract out to two different vendors. Instead of user groups you have device groups. Each device group needs a different Kiosk. Those devices when joined receive policy for their own respective Kiosk. The logon user group may include users from both sites, and thus each regional area's device would allow kiosks for both sets of users. ## Set up the device -Now it’s time to set up the device to both receive the policy and log into the account the policy has enabled for kiosk mode. + +Now it's time to set up the device to both receive the policy and log into the account the policy has enabled for kiosk mode. ### Set up a single-app kiosk Since Single-app kiosk mode targets a local user or Microsoft account you need to take a few extra steps to [enroll the HoloLens in MDM](hololens-enroll-mdm.md), but sign in will be easy and can be automatic. -During OOBE sign into your **Microsoft Account** specified as a **Logon User Account**. -Then enroll the device so that your **device is enrolled in a group** for a group selected under the Kiosk mode policy’s **assignment**. -Give your store app a short amount time to download as well as policy to be applied, once it is restart the device. Once your account is signed in your Kiosk mode will be enabled and your app should automatically launch. +During OOBE sign into your **Microsoft Account** specified as a **Logon User Account**. -If you’re not seeing your Kiosk mode yet, make sure to [check the assignment status]( https://docs.microsoft.com/intune/configuration/device-profile-monitor). +Then enroll the device so that your **device is enrolled in a group** for a group selected under the Kiosk mode policy's **assignment**. + +Give your store app a short amount time to download as well as policy to be applied, once it is restart the device. Once your account is signed in your Kiosk mode will be enabled and your app should automatically launch. + +If you're not seeing your Kiosk mode yet, make sure to [check the assignment status](https://docs.microsoft.com/intune/configuration/device-profile-monitor). ### Set up a multi-app kiosk -For multi app Kiosk you’ll be using a device that you Azure AD join to your tenant during OOBE. +For multi app Kiosk you'll be using a device that you Azure AD join to your tenant during OOBE. -If you’re targeting a user group. you’ll want to sign in to an account that is a member of a group that’s also a group that the Kiosk is assigned to. +If you're targeting a user group. you'll want to sign in to an account that is a member of a group that's also a group that the Kiosk is assigned to. -Once you’ve completed OOBE, if you have apps you need to manually install via sideloading or the Microsoft store please do so. If your apps are going to install automatically, such as being a [required app](https://docs.microsoft.com/mem/intune/apps/apps-deploy#assign-an-app) for the same group that the Kiosk mode is assigned to, then it will become a part of your kiosk even if you enter the kiosk before it finishes downloading. +Once you've completed OOBE, if you have apps you need to manually install via sideloading or the Microsoft store please do so. If your apps are going to install automatically, such as being a [required app](https://docs.microsoft.com/mem/intune/apps/apps-deploy#assign-an-app) for the same group that the Kiosk mode is assigned to, then it will become a part of your kiosk even if you enter the kiosk before it finishes downloading. To enable Kiosk mode simply **sign out** of your account and **sign in** to a profile that is a member of a group targeted by the Logon user account setting. (This may be the same user.) -If you’re not seeing your Kiosk mode yet, make sure to [check the assignment status]( https://docs.microsoft.com/en-us/intune/configuration/device-profile-monitor). - +If you're not seeing your Kiosk mode yet, make sure to [check the assignment status](https://docs.microsoft.com/intune/configuration/device-profile-monitor). Additional information: @@ -185,7 +190,7 @@ For other MDM services, check your provider's documentation for instructions. If ## Set up kiosk mode by using a provisioning package -As part of creating your Provisioning package, you’ll need to create a [start layout](https://docs.microsoft.com/hololens/hololens-kiosk#start-layout-for-hololens). +As part of creating your Provisioning package, you'll need to create a [start layout](https://docs.microsoft.com/hololens/hololens-kiosk#start-layout-for-hololens). Process: @@ -208,11 +213,11 @@ Use the following snippet in your kiosk configuration XML to enable the **Guest* ```xml - - - - - + + + + + ``` ### Add the kiosk configuration XML file to a provisioning package @@ -227,7 +232,7 @@ Use the following snippet in your kiosk configuration XML to enable the **Guest* ![Screenshot of the MultiAppAssignedAccessSettings field in Windows Configuration Designer](images/multiappassignedaccesssettings.png) -8. (**Optional**: If you want to apply the provisioning package after device initial setup and there is an admin user already available on the kiosk device, skip this step.) Create an admin user account in **Runtime settings** > **Accounts** > **Users**. Provide a **UserName** and **Password**, and select **UserGroup** as **Administrators**. With this account, you can view the provisioning status and logs if needed. +8. (**Optional**: If you want to apply the provisioning package after device initial setup and there is an admin user already available on the kiosk device, skip this step.) Create an admin user account in **Runtime settings** > **Accounts** > **Users**. Provide a **UserName** and **Password**, and select **UserGroup** as **Administrators**. With this account, you can view the provisioning status and logs if needed. 9. (**Optional**: If you already have a non-admin account on the kiosk device, skip this step.) Create a local standard user account in **Runtime settings** > **Accounts** > **Users**. Make sure the **UserName** is the same as the account that you specify in the configuration XML. Select **UserGroup** as **Standard Users**. 10. On the **File** menu, select **Save.** 11. On the **Export** menu, select **Provisioning package**. @@ -243,14 +248,13 @@ Use the following snippet in your kiosk configuration XML to enable the **Guest* 16. Click **Build** to start building the package. The provisioning package doesn't take long to build. The project information is displayed in the build page and the progress bar indicates the build status. - ### Apply the provisioning package to HoloLens -You can intially [apply a provisioning package to HoloLens during setup](https://docs.microsoft.com/hololens/hololens-provisioning#apply-a-provisioning-package-to-hololens-during-setup). +You can intially [apply a provisioning package to HoloLens during setup](hololens-provisioning.md#apply-a-provisioning-package-to-hololens-during-setup). -You can also [apply a provisioning package to HoloLens after setup](https://docs.microsoft.com/hololens/hololens-provisioning#4-apply-a-provisioning-package-to-hololens-after-setup). +You can also [apply a provisioning package to HoloLens after setup](hololens-provisioning.md#4-apply-a-provisioning-package-to-hololens-after-setup). -## Set up kiosk mode using the Windows Device Portal +## Set up kiosk mode using the Windows Device Portal 1. [Set up the HoloLens to use the Windows Device Portal](https://developer.microsoft.com/windows/mixed-reality/using_the_windows_device_portal#setting_up_hololens_to_use_windows_device_portal). The Device Portal is a web server on your HoloLens that you can connect to from a web browser on your PC. @@ -262,7 +266,7 @@ You can also [apply a provisioning package to HoloLens after setup](https://docs 3. [Create a user name and password](https://developer.microsoft.com/windows/mixed-reality/Using_the_Windows_Device_Portal.html#creating_a_username_and_password) if this is the first time you connect to the Windows Device Portal, or enter the user name and password that you previously set up. > [!TIP] - > If you see a certificate error in the browser, follow [these troubleshooting steps](https://developer.microsoft.com/windows/mixed-reality/Using_the_Windows_Device_Portal.html#security_certificate). + > If you see a certificate error in the browser, follow [these troubleshooting steps](https://developer.microsoft.com/windows/mixed-reality/Using_the_Windows_Device_Portal.html#security_certificate). 4. In the Windows Device Portal, click **Kiosk Mode**. @@ -277,7 +281,7 @@ You can also [apply a provisioning package to HoloLens after setup](https://docs ## Start layout for HoloLens -If you use [MDM, Microsoft Intune](#set-up-kiosk-mode-using-microsoft-intune-or-mdm-windows-10-version-1803), or a [provisioning package](#set-up-kiosk-mode-using-a-provisioning-package-windows-10-version-1803) to configure a multi-app kiosk, the procedure requires a Start layout. Start layout customization isn't supported in Holographic for Business, so you'll need to use a placeholder Start layout. +If you use [MDM, Microsoft Intune](#set-up-kiosk-mode-by-using-microsoft-intune-or-mdm), or a [provisioning package](#set-up-kiosk-mode-using-a-provisioning-package) to configure a multi-app kiosk, the procedure requires a Start layout. Start layout customization isn't supported in Holographic for Business, so you'll need to use a placeholder Start layout. > [!NOTE] > Because a single-app kiosk launches the kiosk app when a user signs in, there is no Start screen displayed. From abf352a841b22c34a399eedaddec32959b250922 Mon Sep 17 00:00:00 2001 From: Teresa-Motiv Date: Fri, 13 Mar 2020 11:06:37 -0700 Subject: [PATCH 05/50] link fixes --- devices/hololens/hololens-kiosk.md | 14 +++++++------- devices/hololens/hololens-provisioning.md | 4 ++-- devices/hololens/hololens-requirements.md | 2 +- 3 files changed, 10 insertions(+), 10 deletions(-) diff --git a/devices/hololens/hololens-kiosk.md b/devices/hololens/hololens-kiosk.md index e0157408b0..975a5898f3 100644 --- a/devices/hololens/hololens-kiosk.md +++ b/devices/hololens/hololens-kiosk.md @@ -24,7 +24,7 @@ appliesto: A convenient feature many choose to use as a solution for focusing on business apps, or using to show an app demo is Kiosk mode. There are two different types of kiosks, and three methods of deploying them. - All HoloLens 2 devices are Kiosk-mode capable. -- In order to use Kiosk Mode with HoloLens (1st gen) you'll need to be updated to at least Windows 10, version 1803 which released April 2018. If you have recovered your HoloLens (1st gen) device with Windows Device Recovery Tool using the default build, or have taken the most recent updates then you are ready. +- In order to use Kiosk Mode with HoloLens (1st gen) you'll need to be updated to at least Windows 10, version 1803 which released April 2018. If you have recovered your HoloLens (1st gen) device with Windows Device Recovery Tool using the default build, or have taken the most recent updates then you are ready. ## Select a kiosk mode @@ -250,7 +250,7 @@ Use the following snippet in your kiosk configuration XML to enable the **Guest* ### Apply the provisioning package to HoloLens -You can intially [apply a provisioning package to HoloLens during setup](hololens-provisioning.md#apply-a-provisioning-package-to-hololens-during-setup). +You can initially [apply a provisioning package to HoloLens during setup](hololens-provisioning.md#apply-a-provisioning-package-to-hololens-during-setup). You can also [apply a provisioning package to HoloLens after setup](hololens-provisioning.md#4-apply-a-provisioning-package-to-hololens-after-setup). @@ -260,7 +260,7 @@ You can also [apply a provisioning package to HoloLens after setup](hololens-pro > [!IMPORTANT] > When you set up HoloLens to use the Device Portal, you must enable **Developer Mode** on the device. **Developer Mode** on a device that has Windows Holographic for Business enables side-loading of apps, which risks the installation of apps that have not been certified by the Microsoft Store. Administrators can block the ability to enable **Developer Mode** using the **ApplicationManagement/AllowDeveloper Unlock** setting in the [Policy CSP](https://msdn.microsoft.com/library/windows/hardware/dn904962.aspx). [Learn more about Developer Mode.](https://msdn.microsoft.com/windows/uwp/get-started/enable-your-device-for-development#developer-mode) - + 2. On a PC, connect to the HoloLens using [Wi-Fi](https://developer.microsoft.com/windows/mixed-reality/Using_the_Windows_Device_Portal.html#connecting_over_wi-fi) or [USB](https://developer.microsoft.com/windows/mixed-reality/Using_the_Windows_Device_Portal.html#connecting_over_usb). 3. [Create a user name and password](https://developer.microsoft.com/windows/mixed-reality/Using_the_Windows_Device_Portal.html#creating_a_username_and_password) if this is the first time you connect to the Windows Device Portal, or enter the user name and password that you previously set up. @@ -311,7 +311,7 @@ Save the following sample as an XML file. You can use this file when you configu ### Start layout for a provisioning package -You will [create an XML file](#set-up-kiosk-mode-using-a-provisioning-package-windows-10-version-1803) to define the kiosk configuration to be included in a provisioning package. Use the following sample in the `StartLayout` section of your XML file. +You will [create an XML file](#set-up-kiosk-mode-by-using-a-provisioning-package) to define the kiosk configuration to be included in a provisioning package. Use the following sample in the `StartLayout` section of your XML file. ```xml @@ -335,11 +335,11 @@ You will [create an XML file](#set-up-kiosk-mode-using-a-provisioning-package-wi ## Kiosk app recommendations -- You cannot select the Shell app as a kiosk app. -- We recommend that you do **not** select the Settings app, Microsoft Edge, Microsoft Store, and the File Explorer app as a kiosk app. +- You cannot select the Shell app as a kiosk app. +- We recommend that you do **not** select the Settings app, Microsoft Edge, Microsoft Store, or the File Explorer app as kiosk apps. - You can select Cortana as a kiosk app. - To enable photo or video capture, the HoloCamera app must be enabled as a kiosk app. -- While Kiosk mode adds several restrictions, we suggest also considering additional policies such as turning off USB connectivity, or checking your flight ring settings to set when automatic updates occur as to not happen during business hours. +- While Kiosk mode adds several restrictions, we suggest also considering additional policies such as turning off USB connectivity, or checking your flight ring settings to set when automatic updates occur as to not happen during business hours. ## More information diff --git a/devices/hololens/hololens-provisioning.md b/devices/hololens/hololens-provisioning.md index c350d951eb..bba98361ac 100644 --- a/devices/hololens/hololens-provisioning.md +++ b/devices/hololens/hololens-provisioning.md @@ -29,7 +29,7 @@ Some of the HoloLens configurations that you can apply in a provisioning package - Set up a Wi-Fi connection - Apply certificates to the device - Enable Developer Mode -- Configure Kiosk mode (Detailed instructions for configuring kiosk mode can be found [here](hololens-kiosk.md#set-up-kiosk-mode-using-a-provisioning-package-windows-10-version-1803). +- Configure kiosk mode (Detailed instructions for configuring kiosk mode can be found [here](hololens-kiosk.md#set-up-kiosk-mode-by-using-a-provisioning-package). ## Provisioning package HoloLens wizard @@ -45,7 +45,7 @@ The HoloLens wizard helps you configure the following settings in a provisioning - Enroll device in Azure Active Directory or create a local account - Add certificates - Enable Developer Mode -- Configure kiosk mode. (Detailed instructions for configuring kiosk mode can be found [here](hololens-kiosk.md#set-up-kiosk-mode-using-a-provisioning-package-windows-10-version-1803)). +- Configure kiosk mode. (Detailed instructions for configuring kiosk mode can be found [here](hololens-kiosk.md#set-up-kiosk-mode-by-using-a-provisioning-package)). > [!WARNING] > You must run Windows Configuration Designer on Windows 10 to configure Azure Active Directory enrollment using any of the wizards. diff --git a/devices/hololens/hololens-requirements.md b/devices/hololens/hololens-requirements.md index 6cfcb281b0..7a97637124 100644 --- a/devices/hololens/hololens-requirements.md +++ b/devices/hololens/hololens-requirements.md @@ -66,7 +66,7 @@ There are two types of Kiosk Modes: Single app and multi-app. Single app kiosk m **How to Configure Kiosk Mode:** -There are two main ways ([provisioning packages](hololens-kiosk.md#set-up-kiosk-mode-using-a-provisioning-package-windows-10-version-1803) and [MDM](hololens-kiosk.md#set-up-kiosk-mode-using-microsoft-intune-or-mdm-windows-10-version-1803)) to deploy kiosk mode for HoloLens. These options will be discussed later in the document; however, you can use the links above to jump to the respective sections in this doc. +There are two main ways ([provisioning packages](hololens-kiosk.md#set-up-kiosk-mode-by-using-a-provisioning-package) and [MDM](hololens-kiosk.md#set-up-kiosk-mode-by-using-microsoft-intune-or-mdm)) to deploy kiosk mode for HoloLens. These options will be discussed later in the document; however, you can use the links above to jump to the respective sections in this doc. ### Apps and App Specific Scenarios From ef57582e23f68e30018d79e03809fe7424864a29 Mon Sep 17 00:00:00 2001 From: Teresa-Motiv Date: Fri, 13 Mar 2020 11:10:35 -0700 Subject: [PATCH 06/50] Cleanup --- devices/hololens/hololens-kiosk.md | 9 +++++---- 1 file changed, 5 insertions(+), 4 deletions(-) diff --git a/devices/hololens/hololens-kiosk.md b/devices/hololens/hololens-kiosk.md index 975a5898f3..cb145ac7c3 100644 --- a/devices/hololens/hololens-kiosk.md +++ b/devices/hololens/hololens-kiosk.md @@ -121,7 +121,8 @@ It's important that the group or groups you choose includes users you want to us Now you choose which Apps to include in your kiosk. You may choose to add just one or add many. -To choose an app you've uploaded as a **Line of business app** choose the **Add store app** option. You many also choose to add an app via it's **Application user model ID** by selecting **Add by AUMID**. +To choose an app you've uploaded as a **Line of business app** choose the **Add store app** option. You many also choose to add an app via it's **Application user model ID** by selecting **Add by AUMID**. + Some common in-box apps you may wish to use are: | App Name | AUMID | @@ -140,7 +141,7 @@ Once you have created and saved your Kiosk mode policy you must assign it to the Click assignments and add the group(s) that you want the Kiosk mode policy deployed to. > [!IMPORTANT] -> If two more or more different kiosk polices target a device they will conflict and the device will receive neither. Other policies such as device restrictions do not conflict with Kiosk mode or additional device restrictions. +> If two more or more different kiosk polices target a device they will conflict and the device will receive neither. Other policies such as device restrictions do not conflict with Kiosk mode or additional device restrictions. For more information on group type, and group assignments please visit [here](https://docs.microsoft.com/intune/configuration/device-profile-assign). @@ -281,7 +282,7 @@ You can also [apply a provisioning package to HoloLens after setup](hololens-pro ## Start layout for HoloLens -If you use [MDM, Microsoft Intune](#set-up-kiosk-mode-by-using-microsoft-intune-or-mdm), or a [provisioning package](#set-up-kiosk-mode-using-a-provisioning-package) to configure a multi-app kiosk, the procedure requires a Start layout. Start layout customization isn't supported in Holographic for Business, so you'll need to use a placeholder Start layout. +If you use [MDM, Microsoft Intune](#set-up-kiosk-mode-by-using-microsoft-intune-or-mdm), or a [provisioning package](#set-up-kiosk-mode-using-a-provisioning-package) to configure a multi-app kiosk, the procedure requires a Start layout. Start layout customization isn't supported in Holographic for Business, so you'll need to use a placeholder Start layout. > [!NOTE] > Because a single-app kiosk launches the kiosk app when a user signs in, there is no Start screen displayed. @@ -303,7 +304,7 @@ Save the following sample as an XML file. You can use this file when you configu - + From a46ad93ffde37318e0843e6b5f67792df0ea1fc7 Mon Sep 17 00:00:00 2001 From: Teresa-Motiv Date: Fri, 13 Mar 2020 11:36:33 -0700 Subject: [PATCH 07/50] link fixes --- devices/hololens/hololens-kiosk.md | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/devices/hololens/hololens-kiosk.md b/devices/hololens/hololens-kiosk.md index cb145ac7c3..5c214f7da2 100644 --- a/devices/hololens/hololens-kiosk.md +++ b/devices/hololens/hololens-kiosk.md @@ -67,8 +67,8 @@ Examples scenarios of when to use which kiosk: There are three methods that you can use to configure the device as a kiosk: - You can use [Microsoft Intune or other mobile device management (MDM) service](#set-up-kiosk-mode-by-using-microsoft-intune-or-mdm) to configure single-app and multi-app kiosks. -- You can [use a provisioning package](#set-up-kiosk-mode-using-a-provisioning-package) to configure single-app and multi-app kiosks. -- You can [use the Windows Device Portal](#set-up-kiosk-mode-using-the-windows-device-portal) to configure single-app kiosks. This method is recommended only for demonstrations, as it requires that developer mode be enabled on the device. +- You can [use a provisioning package](#set-up-kiosk-mode-by-using-a-provisioning-package) to configure single-app and multi-app kiosks. +- You can [use the Windows Device Portal](#set-up-kiosk-mode-by-using-the-windows-device-portal) to configure single-app kiosks. This method is recommended only for demonstrations, as it requires that developer mode be enabled on the device. | | Device Portal | Provisioning Package | MDM | |------------------------------|---------------|----------------------|------| @@ -255,7 +255,7 @@ You can initially [apply a provisioning package to HoloLens during setup](holole You can also [apply a provisioning package to HoloLens after setup](hololens-provisioning.md#4-apply-a-provisioning-package-to-hololens-after-setup). -## Set up kiosk mode using the Windows Device Portal +## Set up kiosk mode by using the Windows Device Portal 1. [Set up the HoloLens to use the Windows Device Portal](https://developer.microsoft.com/windows/mixed-reality/using_the_windows_device_portal#setting_up_hololens_to_use_windows_device_portal). The Device Portal is a web server on your HoloLens that you can connect to from a web browser on your PC. @@ -282,7 +282,7 @@ You can also [apply a provisioning package to HoloLens after setup](hololens-pro ## Start layout for HoloLens -If you use [MDM, Microsoft Intune](#set-up-kiosk-mode-by-using-microsoft-intune-or-mdm), or a [provisioning package](#set-up-kiosk-mode-using-a-provisioning-package) to configure a multi-app kiosk, the procedure requires a Start layout. Start layout customization isn't supported in Holographic for Business, so you'll need to use a placeholder Start layout. +If you use [MDM, Microsoft Intune](#set-up-kiosk-mode-by-using-microsoft-intune-or-mdm), or a [provisioning package](#set-up-kiosk-mode-by-using-a-provisioning-package) to configure a multi-app kiosk, the procedure requires a Start layout. Start layout customization isn't supported in Holographic for Business, so you'll need to use a placeholder Start layout. > [!NOTE] > Because a single-app kiosk launches the kiosk app when a user signs in, there is no Start screen displayed. From 7ec55541a967447ecb162c9dfcae28a4fad09db1 Mon Sep 17 00:00:00 2001 From: "v-tea@microsoft.com" <46357187+Teresa-Motiv@users.noreply.github.com> Date: Fri, 13 Mar 2020 11:58:11 -0700 Subject: [PATCH 08/50] Revert "HW-update" --- devices/hololens/hololens-kiosk.md | 29 +++++++++++------------ devices/hololens/hololens-provisioning.md | 4 ++-- devices/hololens/hololens-requirements.md | 2 +- 3 files changed, 17 insertions(+), 18 deletions(-) diff --git a/devices/hololens/hololens-kiosk.md b/devices/hololens/hololens-kiosk.md index 5c214f7da2..e0157408b0 100644 --- a/devices/hololens/hololens-kiosk.md +++ b/devices/hololens/hololens-kiosk.md @@ -24,7 +24,7 @@ appliesto: A convenient feature many choose to use as a solution for focusing on business apps, or using to show an app demo is Kiosk mode. There are two different types of kiosks, and three methods of deploying them. - All HoloLens 2 devices are Kiosk-mode capable. -- In order to use Kiosk Mode with HoloLens (1st gen) you'll need to be updated to at least Windows 10, version 1803 which released April 2018. If you have recovered your HoloLens (1st gen) device with Windows Device Recovery Tool using the default build, or have taken the most recent updates then you are ready. +- In order to use Kiosk Mode with HoloLens (1st gen) you'll need to be updated to at least Windows 10, version 1803 which released April 2018. If you have recovered your HoloLens (1st gen) device with Windows Device Recovery Tool using the default build, or have taken the most recent updates then you are ready. ## Select a kiosk mode @@ -67,8 +67,8 @@ Examples scenarios of when to use which kiosk: There are three methods that you can use to configure the device as a kiosk: - You can use [Microsoft Intune or other mobile device management (MDM) service](#set-up-kiosk-mode-by-using-microsoft-intune-or-mdm) to configure single-app and multi-app kiosks. -- You can [use a provisioning package](#set-up-kiosk-mode-by-using-a-provisioning-package) to configure single-app and multi-app kiosks. -- You can [use the Windows Device Portal](#set-up-kiosk-mode-by-using-the-windows-device-portal) to configure single-app kiosks. This method is recommended only for demonstrations, as it requires that developer mode be enabled on the device. +- You can [use a provisioning package](#set-up-kiosk-mode-using-a-provisioning-package) to configure single-app and multi-app kiosks. +- You can [use the Windows Device Portal](#set-up-kiosk-mode-using-the-windows-device-portal) to configure single-app kiosks. This method is recommended only for demonstrations, as it requires that developer mode be enabled on the device. | | Device Portal | Provisioning Package | MDM | |------------------------------|---------------|----------------------|------| @@ -121,8 +121,7 @@ It's important that the group or groups you choose includes users you want to us Now you choose which Apps to include in your kiosk. You may choose to add just one or add many. -To choose an app you've uploaded as a **Line of business app** choose the **Add store app** option. You many also choose to add an app via it's **Application user model ID** by selecting **Add by AUMID**. - +To choose an app you've uploaded as a **Line of business app** choose the **Add store app** option. You many also choose to add an app via it's **Application user model ID** by selecting **Add by AUMID**. Some common in-box apps you may wish to use are: | App Name | AUMID | @@ -141,7 +140,7 @@ Once you have created and saved your Kiosk mode policy you must assign it to the Click assignments and add the group(s) that you want the Kiosk mode policy deployed to. > [!IMPORTANT] -> If two more or more different kiosk polices target a device they will conflict and the device will receive neither. Other policies such as device restrictions do not conflict with Kiosk mode or additional device restrictions. +> If two more or more different kiosk polices target a device they will conflict and the device will receive neither. Other policies such as device restrictions do not conflict with Kiosk mode or additional device restrictions. For more information on group type, and group assignments please visit [here](https://docs.microsoft.com/intune/configuration/device-profile-assign). @@ -251,17 +250,17 @@ Use the following snippet in your kiosk configuration XML to enable the **Guest* ### Apply the provisioning package to HoloLens -You can initially [apply a provisioning package to HoloLens during setup](hololens-provisioning.md#apply-a-provisioning-package-to-hololens-during-setup). +You can intially [apply a provisioning package to HoloLens during setup](hololens-provisioning.md#apply-a-provisioning-package-to-hololens-during-setup). You can also [apply a provisioning package to HoloLens after setup](hololens-provisioning.md#4-apply-a-provisioning-package-to-hololens-after-setup). -## Set up kiosk mode by using the Windows Device Portal +## Set up kiosk mode using the Windows Device Portal 1. [Set up the HoloLens to use the Windows Device Portal](https://developer.microsoft.com/windows/mixed-reality/using_the_windows_device_portal#setting_up_hololens_to_use_windows_device_portal). The Device Portal is a web server on your HoloLens that you can connect to from a web browser on your PC. > [!IMPORTANT] > When you set up HoloLens to use the Device Portal, you must enable **Developer Mode** on the device. **Developer Mode** on a device that has Windows Holographic for Business enables side-loading of apps, which risks the installation of apps that have not been certified by the Microsoft Store. Administrators can block the ability to enable **Developer Mode** using the **ApplicationManagement/AllowDeveloper Unlock** setting in the [Policy CSP](https://msdn.microsoft.com/library/windows/hardware/dn904962.aspx). [Learn more about Developer Mode.](https://msdn.microsoft.com/windows/uwp/get-started/enable-your-device-for-development#developer-mode) - + 2. On a PC, connect to the HoloLens using [Wi-Fi](https://developer.microsoft.com/windows/mixed-reality/Using_the_Windows_Device_Portal.html#connecting_over_wi-fi) or [USB](https://developer.microsoft.com/windows/mixed-reality/Using_the_Windows_Device_Portal.html#connecting_over_usb). 3. [Create a user name and password](https://developer.microsoft.com/windows/mixed-reality/Using_the_Windows_Device_Portal.html#creating_a_username_and_password) if this is the first time you connect to the Windows Device Portal, or enter the user name and password that you previously set up. @@ -282,7 +281,7 @@ You can also [apply a provisioning package to HoloLens after setup](hololens-pro ## Start layout for HoloLens -If you use [MDM, Microsoft Intune](#set-up-kiosk-mode-by-using-microsoft-intune-or-mdm), or a [provisioning package](#set-up-kiosk-mode-by-using-a-provisioning-package) to configure a multi-app kiosk, the procedure requires a Start layout. Start layout customization isn't supported in Holographic for Business, so you'll need to use a placeholder Start layout. +If you use [MDM, Microsoft Intune](#set-up-kiosk-mode-by-using-microsoft-intune-or-mdm), or a [provisioning package](#set-up-kiosk-mode-using-a-provisioning-package) to configure a multi-app kiosk, the procedure requires a Start layout. Start layout customization isn't supported in Holographic for Business, so you'll need to use a placeholder Start layout. > [!NOTE] > Because a single-app kiosk launches the kiosk app when a user signs in, there is no Start screen displayed. @@ -304,7 +303,7 @@ Save the following sample as an XML file. You can use this file when you configu - + @@ -312,7 +311,7 @@ Save the following sample as an XML file. You can use this file when you configu ### Start layout for a provisioning package -You will [create an XML file](#set-up-kiosk-mode-by-using-a-provisioning-package) to define the kiosk configuration to be included in a provisioning package. Use the following sample in the `StartLayout` section of your XML file. +You will [create an XML file](#set-up-kiosk-mode-using-a-provisioning-package-windows-10-version-1803) to define the kiosk configuration to be included in a provisioning package. Use the following sample in the `StartLayout` section of your XML file. ```xml @@ -336,11 +335,11 @@ You will [create an XML file](#set-up-kiosk-mode-by-using-a-provisioning-package ## Kiosk app recommendations -- You cannot select the Shell app as a kiosk app. -- We recommend that you do **not** select the Settings app, Microsoft Edge, Microsoft Store, or the File Explorer app as kiosk apps. +- You cannot select the Shell app as a kiosk app. +- We recommend that you do **not** select the Settings app, Microsoft Edge, Microsoft Store, and the File Explorer app as a kiosk app. - You can select Cortana as a kiosk app. - To enable photo or video capture, the HoloCamera app must be enabled as a kiosk app. -- While Kiosk mode adds several restrictions, we suggest also considering additional policies such as turning off USB connectivity, or checking your flight ring settings to set when automatic updates occur as to not happen during business hours. +- While Kiosk mode adds several restrictions, we suggest also considering additional policies such as turning off USB connectivity, or checking your flight ring settings to set when automatic updates occur as to not happen during business hours. ## More information diff --git a/devices/hololens/hololens-provisioning.md b/devices/hololens/hololens-provisioning.md index bba98361ac..c350d951eb 100644 --- a/devices/hololens/hololens-provisioning.md +++ b/devices/hololens/hololens-provisioning.md @@ -29,7 +29,7 @@ Some of the HoloLens configurations that you can apply in a provisioning package - Set up a Wi-Fi connection - Apply certificates to the device - Enable Developer Mode -- Configure kiosk mode (Detailed instructions for configuring kiosk mode can be found [here](hololens-kiosk.md#set-up-kiosk-mode-by-using-a-provisioning-package). +- Configure Kiosk mode (Detailed instructions for configuring kiosk mode can be found [here](hololens-kiosk.md#set-up-kiosk-mode-using-a-provisioning-package-windows-10-version-1803). ## Provisioning package HoloLens wizard @@ -45,7 +45,7 @@ The HoloLens wizard helps you configure the following settings in a provisioning - Enroll device in Azure Active Directory or create a local account - Add certificates - Enable Developer Mode -- Configure kiosk mode. (Detailed instructions for configuring kiosk mode can be found [here](hololens-kiosk.md#set-up-kiosk-mode-by-using-a-provisioning-package)). +- Configure kiosk mode. (Detailed instructions for configuring kiosk mode can be found [here](hololens-kiosk.md#set-up-kiosk-mode-using-a-provisioning-package-windows-10-version-1803)). > [!WARNING] > You must run Windows Configuration Designer on Windows 10 to configure Azure Active Directory enrollment using any of the wizards. diff --git a/devices/hololens/hololens-requirements.md b/devices/hololens/hololens-requirements.md index 7a97637124..6cfcb281b0 100644 --- a/devices/hololens/hololens-requirements.md +++ b/devices/hololens/hololens-requirements.md @@ -66,7 +66,7 @@ There are two types of Kiosk Modes: Single app and multi-app. Single app kiosk m **How to Configure Kiosk Mode:** -There are two main ways ([provisioning packages](hololens-kiosk.md#set-up-kiosk-mode-by-using-a-provisioning-package) and [MDM](hololens-kiosk.md#set-up-kiosk-mode-by-using-microsoft-intune-or-mdm)) to deploy kiosk mode for HoloLens. These options will be discussed later in the document; however, you can use the links above to jump to the respective sections in this doc. +There are two main ways ([provisioning packages](hololens-kiosk.md#set-up-kiosk-mode-using-a-provisioning-package-windows-10-version-1803) and [MDM](hololens-kiosk.md#set-up-kiosk-mode-using-microsoft-intune-or-mdm-windows-10-version-1803)) to deploy kiosk mode for HoloLens. These options will be discussed later in the document; however, you can use the links above to jump to the respective sections in this doc. ### Apps and App Specific Scenarios From daabd2e4ef36aea51bf586205ef2ccacc344e259 Mon Sep 17 00:00:00 2001 From: "v-tea@microsoft.com" <46357187+Teresa-Motiv@users.noreply.github.com> Date: Fri, 13 Mar 2020 12:33:21 -0700 Subject: [PATCH 09/50] Link fixes --- devices/hololens/hololens-kiosk.md | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/devices/hololens/hololens-kiosk.md b/devices/hololens/hololens-kiosk.md index e0157408b0..316597854b 100644 --- a/devices/hololens/hololens-kiosk.md +++ b/devices/hololens/hololens-kiosk.md @@ -67,8 +67,8 @@ Examples scenarios of when to use which kiosk: There are three methods that you can use to configure the device as a kiosk: - You can use [Microsoft Intune or other mobile device management (MDM) service](#set-up-kiosk-mode-by-using-microsoft-intune-or-mdm) to configure single-app and multi-app kiosks. -- You can [use a provisioning package](#set-up-kiosk-mode-using-a-provisioning-package) to configure single-app and multi-app kiosks. -- You can [use the Windows Device Portal](#set-up-kiosk-mode-using-the-windows-device-portal) to configure single-app kiosks. This method is recommended only for demonstrations, as it requires that developer mode be enabled on the device. +- You can [use a provisioning package](#set-up-kiosk-mode-by-using-a-provisioning-package) to configure single-app and multi-app kiosks. +- You can [use the Windows Device Portal](#set-up-kiosk-mode-by-using-the-windows-device-portal) to configure single-app kiosks. This method is recommended only for demonstrations, as it requires that developer mode be enabled on the device. | | Device Portal | Provisioning Package | MDM | |------------------------------|---------------|----------------------|------| @@ -254,7 +254,7 @@ You can intially [apply a provisioning package to HoloLens during setup](hololen You can also [apply a provisioning package to HoloLens after setup](hololens-provisioning.md#4-apply-a-provisioning-package-to-hololens-after-setup). -## Set up kiosk mode using the Windows Device Portal +## Set up kiosk mode by using the Windows Device Portal 1. [Set up the HoloLens to use the Windows Device Portal](https://developer.microsoft.com/windows/mixed-reality/using_the_windows_device_portal#setting_up_hololens_to_use_windows_device_portal). The Device Portal is a web server on your HoloLens that you can connect to from a web browser on your PC. @@ -281,7 +281,7 @@ You can also [apply a provisioning package to HoloLens after setup](hololens-pro ## Start layout for HoloLens -If you use [MDM, Microsoft Intune](#set-up-kiosk-mode-by-using-microsoft-intune-or-mdm), or a [provisioning package](#set-up-kiosk-mode-using-a-provisioning-package) to configure a multi-app kiosk, the procedure requires a Start layout. Start layout customization isn't supported in Holographic for Business, so you'll need to use a placeholder Start layout. +If you use [MDM, Microsoft Intune](#set-up-kiosk-mode-by-using-microsoft-intune-or-mdm), or a [provisioning package](#set-up-kiosk-mode-by-using-a-provisioning-package) to configure a multi-app kiosk, the procedure requires a Start layout. Start layout customization isn't supported in Holographic for Business, so you'll need to use a placeholder Start layout. > [!NOTE] > Because a single-app kiosk launches the kiosk app when a user signs in, there is no Start screen displayed. From 111324075aeb6897dbae38838446a35eef69f174 Mon Sep 17 00:00:00 2001 From: Teresa-Motiv Date: Fri, 13 Mar 2020 12:55:19 -0700 Subject: [PATCH 10/50] Link fixes --- .../hololens/hololens-commercial-infrastructure.md | 14 +++++++------- devices/hololens/hololens-kiosk.md | 2 +- devices/hololens/hololens-provisioning.md | 4 ++-- devices/hololens/hololens-requirements.md | 2 +- 4 files changed, 11 insertions(+), 11 deletions(-) diff --git a/devices/hololens/hololens-commercial-infrastructure.md b/devices/hololens/hololens-commercial-infrastructure.md index 98ec5c6e06..69cc524581 100644 --- a/devices/hololens/hololens-commercial-infrastructure.md +++ b/devices/hololens/hololens-commercial-infrastructure.md @@ -56,7 +56,7 @@ Make sure that [this list](hololens-offline.md) of endpoints are allowed on your ### Remote Assist Specific Network Requirements 1. The recommended bandwidth for optimal performance of Remote Assist is 1.5Mbps. Detailed network requirements and additional information can be found [here](https://docs.microsoft.com/MicrosoftTeams/prepare-network). -**(Please note, if you don’t network have network speeds of at least 1.5Mbps, Remote Assist will still work. However, quality may suffer).** +**(Please note, if you don't network have network speeds of at least 1.5Mbps, Remote Assist will still work. However, quality may suffer).** 1. Make sure that these ports and URLs are allowed on your network firewall. This will enable Microsoft Teams to function. The latest list can be found [here](https://docs.microsoft.com/office365/enterprise/urls-and-ip-address-ranges#skype-for-business-online-and-microsoft-teams). ### Guides Specific Network Requirements @@ -73,18 +73,18 @@ Please [HoloLens Licenses Requirements](hololens-licenses-requirements.md) for a 1. If you plan on using Auto Enrollment, you will have to [Configure Azure AD enrollment.](https://docs.microsoft.com/intune/deploy-use/.set-up-windows-device-management-with-microsoft-intune#azure-active-directory-enrollment) -1. Ensure that your company’s users are in Azure Active Directory (Azure AD). +1. Ensure that your company's users are in Azure Active Directory (Azure AD). Instructions for adding users can be found [here](https://docs.microsoft.com/azure/active-directory/fundamentals/add-users-azure-active-directory). 1. We suggest that users who need similar licenses are added to the same group. 1. [Create a Group](https://docs.microsoft.com/azure/active-directory/fundamentals/active-directory-groups-create-azure-portal) 1. [Add users to groups](https://docs.microsoft.com/azure/active-directory/fundamentals/active-directory-groups-members-azure-portal) -1. Ensure that your company’s users (or group of users) are assigned the necessary licenses. +1. Ensure that your company's users (or group of users) are assigned the necessary licenses. Directions for assigning licenses can be found [here](https://docs.microsoft.com/azure/active-directory/fundamentals/license-users-groups). 1. Only do this step if users are expected to enroll their HoloLens/Mobile device into you (There are three options) -These steps ensure that your company’s users (or a group of users) can add devices. +These steps ensure that your company's users (or a group of users) can add devices. 1. **Option 1:** Give all users permission to join devices to Azure AD. **Sign in to the Azure portal as an administrator** > **Azure Active Directory** > **Devices** > **Device Settings** > **Set Users may join devices to Azure AD to *All*** @@ -163,7 +163,7 @@ Directions for upgrading to the commercial suite can be found [here](https://doc 1. Check your app settings 1. Log into your Microsoft Store Business account - 1. **Manage > Products and Services > Apps and Software > Select the app you want to sync > Private Store Availability > Select “Everyone” or “Specific Groups”** + 1. **Manage > Products and Services > Apps and Software > Select the app you want to sync > Private Store Availability > Select "Everyone" or "Specific Groups"** >[!NOTE] >If you don't see the app you want, you will have to "get" the app by searching the store for your app. **Click the "Search" bar in the upper right-hand corner > type in the name of the app > click on the app > select "Get"**. 1. If you do not see your apps in **Intune > Client Apps > Apps** , you may have to [sync your apps](https://docs.microsoft.com/intune/apps/windows-store-for-business#synchronize-apps) again. @@ -171,11 +171,11 @@ Directions for upgrading to the commercial suite can be found [here](https://doc 1. [Create a device profile for Kiosk mode](https://docs.microsoft.com/intune/configuration/kiosk-settings#create-the-profile) > [!NOTE] -> You can configure different users to have different Kiosk Mode experiences by using “Azure AD” as the “User logon type”. However, this option is only available in Multi-App kiosk mode. Multi-App kiosk mode will work with only one app as well as multiple apps. +> You can configure different users to have different Kiosk Mode experiences by using "Azure AD" as the "User logon type". However, this option is only available in Multi-App kiosk mode. Multi-App kiosk mode will work with only one app as well as multiple apps. ![Image that shows Configuration of Kiosk Mode in Intune](images/aad-kioskmode.png) -For other MDM services, check your provider's documentation for instructions. If you need to use a custom setting and full XML configuration to set up a kiosk in your MDM service, additional directions can be found [here](hololens-kiosk.md#set-up-kiosk-mode-using-microsoft-intune-or-mdm-windows-10-version-1803) +For other MDM services, check your provider's documentation for instructions. If you need to use a custom setting and full XML configuration to set up a kiosk in your MDM service, additional directions can be found [here](hololens-kiosk.md#set-up-kiosk-mode-by-using-microsoft-intune-or-mdm) ## Certificates and Authentication diff --git a/devices/hololens/hololens-kiosk.md b/devices/hololens/hololens-kiosk.md index 316597854b..7f34527d0d 100644 --- a/devices/hololens/hololens-kiosk.md +++ b/devices/hololens/hololens-kiosk.md @@ -311,7 +311,7 @@ Save the following sample as an XML file. You can use this file when you configu ### Start layout for a provisioning package -You will [create an XML file](#set-up-kiosk-mode-using-a-provisioning-package-windows-10-version-1803) to define the kiosk configuration to be included in a provisioning package. Use the following sample in the `StartLayout` section of your XML file. +You will [create an XML file](#set-up-kiosk-mode-by-using-a-provisioning-package) to define the kiosk configuration to be included in a provisioning package. Use the following sample in the `StartLayout` section of your XML file. ```xml diff --git a/devices/hololens/hololens-provisioning.md b/devices/hololens/hololens-provisioning.md index c350d951eb..a0978a7caa 100644 --- a/devices/hololens/hololens-provisioning.md +++ b/devices/hololens/hololens-provisioning.md @@ -29,7 +29,7 @@ Some of the HoloLens configurations that you can apply in a provisioning package - Set up a Wi-Fi connection - Apply certificates to the device - Enable Developer Mode -- Configure Kiosk mode (Detailed instructions for configuring kiosk mode can be found [here](hololens-kiosk.md#set-up-kiosk-mode-using-a-provisioning-package-windows-10-version-1803). +- Configure Kiosk mode (Detailed instructions for configuring kiosk mode can be found [here](hololens-kiosk.md#set-up-kiosk-mode-by-using-a-provisioning-package). ## Provisioning package HoloLens wizard @@ -45,7 +45,7 @@ The HoloLens wizard helps you configure the following settings in a provisioning - Enroll device in Azure Active Directory or create a local account - Add certificates - Enable Developer Mode -- Configure kiosk mode. (Detailed instructions for configuring kiosk mode can be found [here](hololens-kiosk.md#set-up-kiosk-mode-using-a-provisioning-package-windows-10-version-1803)). +- Configure kiosk mode. (Detailed instructions for configuring kiosk mode can be found [here](hololens-kiosk.md#set-up-kiosk-mode-by-using-a-provisioning-package)). > [!WARNING] > You must run Windows Configuration Designer on Windows 10 to configure Azure Active Directory enrollment using any of the wizards. diff --git a/devices/hololens/hololens-requirements.md b/devices/hololens/hololens-requirements.md index 6cfcb281b0..7a97637124 100644 --- a/devices/hololens/hololens-requirements.md +++ b/devices/hololens/hololens-requirements.md @@ -66,7 +66,7 @@ There are two types of Kiosk Modes: Single app and multi-app. Single app kiosk m **How to Configure Kiosk Mode:** -There are two main ways ([provisioning packages](hololens-kiosk.md#set-up-kiosk-mode-using-a-provisioning-package-windows-10-version-1803) and [MDM](hololens-kiosk.md#set-up-kiosk-mode-using-microsoft-intune-or-mdm-windows-10-version-1803)) to deploy kiosk mode for HoloLens. These options will be discussed later in the document; however, you can use the links above to jump to the respective sections in this doc. +There are two main ways ([provisioning packages](hololens-kiosk.md#set-up-kiosk-mode-by-using-a-provisioning-package) and [MDM](hololens-kiosk.md#set-up-kiosk-mode-by-using-microsoft-intune-or-mdm)) to deploy kiosk mode for HoloLens. These options will be discussed later in the document; however, you can use the links above to jump to the respective sections in this doc. ### Apps and App Specific Scenarios From 796aa4f928ea4ef103925af43e3e7642dd727d95 Mon Sep 17 00:00:00 2001 From: "v-tea@microsoft.com" <46357187+Teresa-Motiv@users.noreply.github.com> Date: Fri, 13 Mar 2020 14:49:56 -0700 Subject: [PATCH 11/50] Smallcommit --- devices/hololens/hololens-kiosk.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/devices/hololens/hololens-kiosk.md b/devices/hololens/hololens-kiosk.md index 7f34527d0d..ce33c8bcb8 100644 --- a/devices/hololens/hololens-kiosk.md +++ b/devices/hololens/hololens-kiosk.md @@ -275,7 +275,7 @@ You can also [apply a provisioning package to HoloLens after setup](hololens-pro > [!NOTE] > The kiosk mode option will be available if the device has [Windows Holographic for Business](hololens1-upgrade-enterprise.md). -5. Select **Enable Kiosk Mode**, choose an app to run when the device starts, and click **Save**. +5. Select **Enable Kiosk Mode**, select an app to run when the device starts, and then select **Save**. 6. Reboot the HoloLens. If you still have your Device Portal page open you can use the **Power** option in the top right and click **Restart.** From 5a90807964ea482711bd72ac353012bebd387fba Mon Sep 17 00:00:00 2001 From: "v-tea@microsoft.com" <46357187+Teresa-Motiv@users.noreply.github.com> Date: Fri, 13 Mar 2020 14:58:21 -0700 Subject: [PATCH 12/50] Revert "HW-update" --- .../hololens/hololens-commercial-infrastructure.md | 14 +++++++------- devices/hololens/hololens-kiosk.md | 2 +- devices/hololens/hololens-provisioning.md | 4 ++-- devices/hololens/hololens-requirements.md | 2 +- 4 files changed, 11 insertions(+), 11 deletions(-) diff --git a/devices/hololens/hololens-commercial-infrastructure.md b/devices/hololens/hololens-commercial-infrastructure.md index 69cc524581..98ec5c6e06 100644 --- a/devices/hololens/hololens-commercial-infrastructure.md +++ b/devices/hololens/hololens-commercial-infrastructure.md @@ -56,7 +56,7 @@ Make sure that [this list](hololens-offline.md) of endpoints are allowed on your ### Remote Assist Specific Network Requirements 1. The recommended bandwidth for optimal performance of Remote Assist is 1.5Mbps. Detailed network requirements and additional information can be found [here](https://docs.microsoft.com/MicrosoftTeams/prepare-network). -**(Please note, if you don't network have network speeds of at least 1.5Mbps, Remote Assist will still work. However, quality may suffer).** +**(Please note, if you don’t network have network speeds of at least 1.5Mbps, Remote Assist will still work. However, quality may suffer).** 1. Make sure that these ports and URLs are allowed on your network firewall. This will enable Microsoft Teams to function. The latest list can be found [here](https://docs.microsoft.com/office365/enterprise/urls-and-ip-address-ranges#skype-for-business-online-and-microsoft-teams). ### Guides Specific Network Requirements @@ -73,18 +73,18 @@ Please [HoloLens Licenses Requirements](hololens-licenses-requirements.md) for a 1. If you plan on using Auto Enrollment, you will have to [Configure Azure AD enrollment.](https://docs.microsoft.com/intune/deploy-use/.set-up-windows-device-management-with-microsoft-intune#azure-active-directory-enrollment) -1. Ensure that your company's users are in Azure Active Directory (Azure AD). +1. Ensure that your company’s users are in Azure Active Directory (Azure AD). Instructions for adding users can be found [here](https://docs.microsoft.com/azure/active-directory/fundamentals/add-users-azure-active-directory). 1. We suggest that users who need similar licenses are added to the same group. 1. [Create a Group](https://docs.microsoft.com/azure/active-directory/fundamentals/active-directory-groups-create-azure-portal) 1. [Add users to groups](https://docs.microsoft.com/azure/active-directory/fundamentals/active-directory-groups-members-azure-portal) -1. Ensure that your company's users (or group of users) are assigned the necessary licenses. +1. Ensure that your company’s users (or group of users) are assigned the necessary licenses. Directions for assigning licenses can be found [here](https://docs.microsoft.com/azure/active-directory/fundamentals/license-users-groups). 1. Only do this step if users are expected to enroll their HoloLens/Mobile device into you (There are three options) -These steps ensure that your company's users (or a group of users) can add devices. +These steps ensure that your company’s users (or a group of users) can add devices. 1. **Option 1:** Give all users permission to join devices to Azure AD. **Sign in to the Azure portal as an administrator** > **Azure Active Directory** > **Devices** > **Device Settings** > **Set Users may join devices to Azure AD to *All*** @@ -163,7 +163,7 @@ Directions for upgrading to the commercial suite can be found [here](https://doc 1. Check your app settings 1. Log into your Microsoft Store Business account - 1. **Manage > Products and Services > Apps and Software > Select the app you want to sync > Private Store Availability > Select "Everyone" or "Specific Groups"** + 1. **Manage > Products and Services > Apps and Software > Select the app you want to sync > Private Store Availability > Select “Everyone” or “Specific Groups”** >[!NOTE] >If you don't see the app you want, you will have to "get" the app by searching the store for your app. **Click the "Search" bar in the upper right-hand corner > type in the name of the app > click on the app > select "Get"**. 1. If you do not see your apps in **Intune > Client Apps > Apps** , you may have to [sync your apps](https://docs.microsoft.com/intune/apps/windows-store-for-business#synchronize-apps) again. @@ -171,11 +171,11 @@ Directions for upgrading to the commercial suite can be found [here](https://doc 1. [Create a device profile for Kiosk mode](https://docs.microsoft.com/intune/configuration/kiosk-settings#create-the-profile) > [!NOTE] -> You can configure different users to have different Kiosk Mode experiences by using "Azure AD" as the "User logon type". However, this option is only available in Multi-App kiosk mode. Multi-App kiosk mode will work with only one app as well as multiple apps. +> You can configure different users to have different Kiosk Mode experiences by using “Azure AD” as the “User logon type”. However, this option is only available in Multi-App kiosk mode. Multi-App kiosk mode will work with only one app as well as multiple apps. ![Image that shows Configuration of Kiosk Mode in Intune](images/aad-kioskmode.png) -For other MDM services, check your provider's documentation for instructions. If you need to use a custom setting and full XML configuration to set up a kiosk in your MDM service, additional directions can be found [here](hololens-kiosk.md#set-up-kiosk-mode-by-using-microsoft-intune-or-mdm) +For other MDM services, check your provider's documentation for instructions. If you need to use a custom setting and full XML configuration to set up a kiosk in your MDM service, additional directions can be found [here](hololens-kiosk.md#set-up-kiosk-mode-using-microsoft-intune-or-mdm-windows-10-version-1803) ## Certificates and Authentication diff --git a/devices/hololens/hololens-kiosk.md b/devices/hololens/hololens-kiosk.md index ce33c8bcb8..eabcdbfb87 100644 --- a/devices/hololens/hololens-kiosk.md +++ b/devices/hololens/hololens-kiosk.md @@ -311,7 +311,7 @@ Save the following sample as an XML file. You can use this file when you configu ### Start layout for a provisioning package -You will [create an XML file](#set-up-kiosk-mode-by-using-a-provisioning-package) to define the kiosk configuration to be included in a provisioning package. Use the following sample in the `StartLayout` section of your XML file. +You will [create an XML file](#set-up-kiosk-mode-using-a-provisioning-package-windows-10-version-1803) to define the kiosk configuration to be included in a provisioning package. Use the following sample in the `StartLayout` section of your XML file. ```xml diff --git a/devices/hololens/hololens-provisioning.md b/devices/hololens/hololens-provisioning.md index a0978a7caa..c350d951eb 100644 --- a/devices/hololens/hololens-provisioning.md +++ b/devices/hololens/hololens-provisioning.md @@ -29,7 +29,7 @@ Some of the HoloLens configurations that you can apply in a provisioning package - Set up a Wi-Fi connection - Apply certificates to the device - Enable Developer Mode -- Configure Kiosk mode (Detailed instructions for configuring kiosk mode can be found [here](hololens-kiosk.md#set-up-kiosk-mode-by-using-a-provisioning-package). +- Configure Kiosk mode (Detailed instructions for configuring kiosk mode can be found [here](hololens-kiosk.md#set-up-kiosk-mode-using-a-provisioning-package-windows-10-version-1803). ## Provisioning package HoloLens wizard @@ -45,7 +45,7 @@ The HoloLens wizard helps you configure the following settings in a provisioning - Enroll device in Azure Active Directory or create a local account - Add certificates - Enable Developer Mode -- Configure kiosk mode. (Detailed instructions for configuring kiosk mode can be found [here](hololens-kiosk.md#set-up-kiosk-mode-by-using-a-provisioning-package)). +- Configure kiosk mode. (Detailed instructions for configuring kiosk mode can be found [here](hololens-kiosk.md#set-up-kiosk-mode-using-a-provisioning-package-windows-10-version-1803)). > [!WARNING] > You must run Windows Configuration Designer on Windows 10 to configure Azure Active Directory enrollment using any of the wizards. diff --git a/devices/hololens/hololens-requirements.md b/devices/hololens/hololens-requirements.md index 7a97637124..6cfcb281b0 100644 --- a/devices/hololens/hololens-requirements.md +++ b/devices/hololens/hololens-requirements.md @@ -66,7 +66,7 @@ There are two types of Kiosk Modes: Single app and multi-app. Single app kiosk m **How to Configure Kiosk Mode:** -There are two main ways ([provisioning packages](hololens-kiosk.md#set-up-kiosk-mode-by-using-a-provisioning-package) and [MDM](hololens-kiosk.md#set-up-kiosk-mode-by-using-microsoft-intune-or-mdm)) to deploy kiosk mode for HoloLens. These options will be discussed later in the document; however, you can use the links above to jump to the respective sections in this doc. +There are two main ways ([provisioning packages](hololens-kiosk.md#set-up-kiosk-mode-using-a-provisioning-package-windows-10-version-1803) and [MDM](hololens-kiosk.md#set-up-kiosk-mode-using-microsoft-intune-or-mdm-windows-10-version-1803)) to deploy kiosk mode for HoloLens. These options will be discussed later in the document; however, you can use the links above to jump to the respective sections in this doc. ### Apps and App Specific Scenarios From 7b3ae68a4564ab3f16e90e35c9513f58f7fcc96f Mon Sep 17 00:00:00 2001 From: Teresa-Motiv Date: Fri, 13 Mar 2020 15:46:57 -0700 Subject: [PATCH 13/50] Link fixes --- .../hololens/hololens-commercial-infrastructure.md | 14 +++++++------- devices/hololens/hololens-provisioning.md | 4 ++-- devices/hololens/hololens-requirements.md | 2 +- 3 files changed, 10 insertions(+), 10 deletions(-) diff --git a/devices/hololens/hololens-commercial-infrastructure.md b/devices/hololens/hololens-commercial-infrastructure.md index 98ec5c6e06..69cc524581 100644 --- a/devices/hololens/hololens-commercial-infrastructure.md +++ b/devices/hololens/hololens-commercial-infrastructure.md @@ -56,7 +56,7 @@ Make sure that [this list](hololens-offline.md) of endpoints are allowed on your ### Remote Assist Specific Network Requirements 1. The recommended bandwidth for optimal performance of Remote Assist is 1.5Mbps. Detailed network requirements and additional information can be found [here](https://docs.microsoft.com/MicrosoftTeams/prepare-network). -**(Please note, if you don’t network have network speeds of at least 1.5Mbps, Remote Assist will still work. However, quality may suffer).** +**(Please note, if you don't network have network speeds of at least 1.5Mbps, Remote Assist will still work. However, quality may suffer).** 1. Make sure that these ports and URLs are allowed on your network firewall. This will enable Microsoft Teams to function. The latest list can be found [here](https://docs.microsoft.com/office365/enterprise/urls-and-ip-address-ranges#skype-for-business-online-and-microsoft-teams). ### Guides Specific Network Requirements @@ -73,18 +73,18 @@ Please [HoloLens Licenses Requirements](hololens-licenses-requirements.md) for a 1. If you plan on using Auto Enrollment, you will have to [Configure Azure AD enrollment.](https://docs.microsoft.com/intune/deploy-use/.set-up-windows-device-management-with-microsoft-intune#azure-active-directory-enrollment) -1. Ensure that your company’s users are in Azure Active Directory (Azure AD). +1. Ensure that your company's users are in Azure Active Directory (Azure AD). Instructions for adding users can be found [here](https://docs.microsoft.com/azure/active-directory/fundamentals/add-users-azure-active-directory). 1. We suggest that users who need similar licenses are added to the same group. 1. [Create a Group](https://docs.microsoft.com/azure/active-directory/fundamentals/active-directory-groups-create-azure-portal) 1. [Add users to groups](https://docs.microsoft.com/azure/active-directory/fundamentals/active-directory-groups-members-azure-portal) -1. Ensure that your company’s users (or group of users) are assigned the necessary licenses. +1. Ensure that your company's users (or group of users) are assigned the necessary licenses. Directions for assigning licenses can be found [here](https://docs.microsoft.com/azure/active-directory/fundamentals/license-users-groups). 1. Only do this step if users are expected to enroll their HoloLens/Mobile device into you (There are three options) -These steps ensure that your company’s users (or a group of users) can add devices. +These steps ensure that your company's users (or a group of users) can add devices. 1. **Option 1:** Give all users permission to join devices to Azure AD. **Sign in to the Azure portal as an administrator** > **Azure Active Directory** > **Devices** > **Device Settings** > **Set Users may join devices to Azure AD to *All*** @@ -163,7 +163,7 @@ Directions for upgrading to the commercial suite can be found [here](https://doc 1. Check your app settings 1. Log into your Microsoft Store Business account - 1. **Manage > Products and Services > Apps and Software > Select the app you want to sync > Private Store Availability > Select “Everyone” or “Specific Groups”** + 1. **Manage > Products and Services > Apps and Software > Select the app you want to sync > Private Store Availability > Select "Everyone" or "Specific Groups"** >[!NOTE] >If you don't see the app you want, you will have to "get" the app by searching the store for your app. **Click the "Search" bar in the upper right-hand corner > type in the name of the app > click on the app > select "Get"**. 1. If you do not see your apps in **Intune > Client Apps > Apps** , you may have to [sync your apps](https://docs.microsoft.com/intune/apps/windows-store-for-business#synchronize-apps) again. @@ -171,11 +171,11 @@ Directions for upgrading to the commercial suite can be found [here](https://doc 1. [Create a device profile for Kiosk mode](https://docs.microsoft.com/intune/configuration/kiosk-settings#create-the-profile) > [!NOTE] -> You can configure different users to have different Kiosk Mode experiences by using “Azure AD” as the “User logon type”. However, this option is only available in Multi-App kiosk mode. Multi-App kiosk mode will work with only one app as well as multiple apps. +> You can configure different users to have different Kiosk Mode experiences by using "Azure AD" as the "User logon type". However, this option is only available in Multi-App kiosk mode. Multi-App kiosk mode will work with only one app as well as multiple apps. ![Image that shows Configuration of Kiosk Mode in Intune](images/aad-kioskmode.png) -For other MDM services, check your provider's documentation for instructions. If you need to use a custom setting and full XML configuration to set up a kiosk in your MDM service, additional directions can be found [here](hololens-kiosk.md#set-up-kiosk-mode-using-microsoft-intune-or-mdm-windows-10-version-1803) +For other MDM services, check your provider's documentation for instructions. If you need to use a custom setting and full XML configuration to set up a kiosk in your MDM service, additional directions can be found [here](hololens-kiosk.md#set-up-kiosk-mode-by-using-microsoft-intune-or-mdm) ## Certificates and Authentication diff --git a/devices/hololens/hololens-provisioning.md b/devices/hololens/hololens-provisioning.md index dc85d351a4..f91fb8a234 100644 --- a/devices/hololens/hololens-provisioning.md +++ b/devices/hololens/hololens-provisioning.md @@ -33,7 +33,7 @@ Some of the HoloLens configurations that you can apply in a provisioning package - Set up a Wi-Fi connection - Apply certificates to the device - Enable Developer Mode -- Configure Kiosk mode (Detailed instructions for configuring kiosk mode can be found [here](hololens-kiosk.md#set-up-kiosk-mode-using-a-provisioning-package-windows-10-version-1803). +- Configure Kiosk mode (Detailed instructions for configuring kiosk mode can be found [here](hololens-kiosk.md#set-up-kiosk-mode-by-using-a-provisioning-package). ## Provisioning package HoloLens wizard @@ -49,7 +49,7 @@ The HoloLens wizard helps you configure the following settings in a provisioning - Enroll the device in Azure Active Directory, or create a local account - Add certificates - Enable Developer Mode -- Configure kiosk mode. (Detailed instructions for configuring kiosk mode can be found [here](hololens-kiosk.md#set-up-kiosk-mode-using-a-provisioning-package-windows-10-version-1803)). +- Configure kiosk mode. (Detailed instructions for configuring kiosk mode can be found [here](hololens-kiosk.md#set-up-kiosk-mode-by-using-a-provisioning-package)). > [!WARNING] > You must run Windows Configuration Designer on Windows 10 to configure Azure Active Directory enrollment using any of the wizards. diff --git a/devices/hololens/hololens-requirements.md b/devices/hololens/hololens-requirements.md index 6cfcb281b0..7a97637124 100644 --- a/devices/hololens/hololens-requirements.md +++ b/devices/hololens/hololens-requirements.md @@ -66,7 +66,7 @@ There are two types of Kiosk Modes: Single app and multi-app. Single app kiosk m **How to Configure Kiosk Mode:** -There are two main ways ([provisioning packages](hololens-kiosk.md#set-up-kiosk-mode-using-a-provisioning-package-windows-10-version-1803) and [MDM](hololens-kiosk.md#set-up-kiosk-mode-using-microsoft-intune-or-mdm-windows-10-version-1803)) to deploy kiosk mode for HoloLens. These options will be discussed later in the document; however, you can use the links above to jump to the respective sections in this doc. +There are two main ways ([provisioning packages](hololens-kiosk.md#set-up-kiosk-mode-by-using-a-provisioning-package) and [MDM](hololens-kiosk.md#set-up-kiosk-mode-by-using-microsoft-intune-or-mdm)) to deploy kiosk mode for HoloLens. These options will be discussed later in the document; however, you can use the links above to jump to the respective sections in this doc. ### Apps and App Specific Scenarios From c6ecd83fe207649decc6a65d7fffc5a90e061661 Mon Sep 17 00:00:00 2001 From: Teresa-Motiv Date: Fri, 13 Mar 2020 16:01:48 -0700 Subject: [PATCH 14/50] Link fixes & checks --- devices/hololens/hololens-kiosk.md | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-) diff --git a/devices/hololens/hololens-kiosk.md b/devices/hololens/hololens-kiosk.md index eabcdbfb87..adc9a6f657 100644 --- a/devices/hololens/hololens-kiosk.md +++ b/devices/hololens/hololens-kiosk.md @@ -190,7 +190,7 @@ For other MDM services, check your provider's documentation for instructions. If ## Set up kiosk mode by using a provisioning package -As part of creating your Provisioning package, you'll need to create a [start layout](https://docs.microsoft.com/hololens/hololens-kiosk#start-layout-for-hololens). +As part of creating your Provisioning package, you'll need to create a [start layout](#start-layout-for-hololens). Process: @@ -259,14 +259,14 @@ You can also [apply a provisioning package to HoloLens after setup](hololens-pro 1. [Set up the HoloLens to use the Windows Device Portal](https://developer.microsoft.com/windows/mixed-reality/using_the_windows_device_portal#setting_up_hololens_to_use_windows_device_portal). The Device Portal is a web server on your HoloLens that you can connect to from a web browser on your PC. > [!IMPORTANT] - > When you set up HoloLens to use the Device Portal, you must enable **Developer Mode** on the device. **Developer Mode** on a device that has Windows Holographic for Business enables side-loading of apps, which risks the installation of apps that have not been certified by the Microsoft Store. Administrators can block the ability to enable **Developer Mode** using the **ApplicationManagement/AllowDeveloper Unlock** setting in the [Policy CSP](https://msdn.microsoft.com/library/windows/hardware/dn904962.aspx). [Learn more about Developer Mode.](https://msdn.microsoft.com/windows/uwp/get-started/enable-your-device-for-development#developer-mode) + > When you set up HoloLens to use the Device Portal, you must enable **Developer Mode** on the device. **Developer Mode** on a device that has Windows Holographic for Business enables side-loading of apps, which risks the installation of apps that have not been certified by the Microsoft Store. Administrators can block the ability to enable **Developer Mode** using the **ApplicationManagement/AllowDeveloper Unlock** setting in the [Policy CSP](https://docs.microsoft.com/windows/client-management/mdm/policy-configuration-service-provider). [Learn more about Developer Mode.](https://docs.microsoft.com/windows/uwp/get-started/enable-your-device-for-development#developer-mode) -2. On a PC, connect to the HoloLens using [Wi-Fi](https://developer.microsoft.com/windows/mixed-reality/Using_the_Windows_Device_Portal.html#connecting_over_wi-fi) or [USB](https://developer.microsoft.com/windows/mixed-reality/Using_the_Windows_Device_Portal.html#connecting_over_usb). +2. On a PC, connect to the HoloLens using [Wi-Fi](https://developer.microsoft.com/windows/mixed-reality/Using_the_Windows_Device_Portal.html#connecting_over_wi-fi){broken} or [USB](https://developer.microsoft.com/windows/mixed-reality/Using_the_Windows_Device_Portal.html#connecting_over_usb){broken}. -3. [Create a user name and password](https://developer.microsoft.com/windows/mixed-reality/Using_the_Windows_Device_Portal.html#creating_a_username_and_password) if this is the first time you connect to the Windows Device Portal, or enter the user name and password that you previously set up. +3. [Create a user name and password](https://developer.microsoft.com/windows/mixed-reality/Using_the_Windows_Device_Portal.html#creating_a_username_and_password){broken} if this is the first time you connect to the Windows Device Portal, or enter the user name and password that you previously set up. > [!TIP] - > If you see a certificate error in the browser, follow [these troubleshooting steps](https://developer.microsoft.com/windows/mixed-reality/Using_the_Windows_Device_Portal.html#security_certificate). + > If you see a certificate error in the browser, follow [these troubleshooting steps](https://developer.microsoft.com/windows/mixed-reality/Using_the_Windows_Device_Portal.html#security_certificate){broken}. 4. In the Windows Device Portal, click **Kiosk Mode**. @@ -311,7 +311,7 @@ Save the following sample as an XML file. You can use this file when you configu ### Start layout for a provisioning package -You will [create an XML file](#set-up-kiosk-mode-using-a-provisioning-package-windows-10-version-1803) to define the kiosk configuration to be included in a provisioning package. Use the following sample in the `StartLayout` section of your XML file. +You will [create an XML file](#set-up-kiosk-mode-by-using-a-provisioning-package) to define the kiosk configuration to be included in a provisioning package. Use the following sample in the `StartLayout` section of your XML file. ```xml From f10bf86869eb491adfd468a6dad492dbe252897e Mon Sep 17 00:00:00 2001 From: Teresa-Motiv Date: Fri, 13 Mar 2020 16:47:53 -0700 Subject: [PATCH 15/50] edits --- devices/hololens/hololens-kiosk.md | 29 +++++++++++++++++------------ 1 file changed, 17 insertions(+), 12 deletions(-) diff --git a/devices/hololens/hololens-kiosk.md b/devices/hololens/hololens-kiosk.md index adc9a6f657..9e311d3bc1 100644 --- a/devices/hololens/hololens-kiosk.md +++ b/devices/hololens/hololens-kiosk.md @@ -21,10 +21,13 @@ appliesto: # Set up HoloLens as a kiosk for specific applications -A convenient feature many choose to use as a solution for focusing on business apps, or using to show an app demo is Kiosk mode. There are two different types of kiosks, and three methods of deploying them. +Kiosk mode is a convenient feature that you can use to focus the HoloLens device on business apps, or to use the HoloLens device in an app demo. You can use kiosk mode in two configurations (single-app kiosk or multi-app kiosk) and you can choose one of three processes to set up and deploy the kiosk configuration. -- All HoloLens 2 devices are Kiosk-mode capable. -- In order to use Kiosk Mode with HoloLens (1st gen) you'll need to be updated to at least Windows 10, version 1803 which released April 2018. If you have recovered your HoloLens (1st gen) device with Windows Device Recovery Tool using the default build, or have taken the most recent updates then you are ready. +## Kiosk mode requirements + +You can configure any HoloLens 2 device to use kiosk mode. + +To configure a HoloLens (1st gen) device to use kiosk mode, you must first make sure that the device runs Windows 10, version 1803, or a newer version. If you have used the Windows Device Recovery Tool to recover your HoloLens (1st gen) device to its default build, or if you have installed the most recent updates, then your device is ready. ## Select a kiosk mode @@ -83,7 +86,7 @@ There are three methods that you can use to configure the device as a kiosk: ## Set up kiosk mode by using Microsoft Intune or MDM -Process: +To set up kiosk mode by using Microsoft Intune or another MDM system, follow these steps. 1. [Create a device configuration policy](#create-a-device-configuration-policy). 1. Select the settings that you want to see in your kiosk. @@ -134,7 +137,7 @@ Some common in-box apps you may wish to use are: For more information on settings for both modes of Kiosk visit [here](https://docs.microsoft.com/intune/configuration/kiosk-settings-holographic). -## Assign the policy to the group to receive the policy +### Assign the policy to the group to receive the policy Once you have created and saved your Kiosk mode policy you must assign it to the group(s) that you want it deployed to, or your devices will never receive it. Click assignments and add the group(s) that you want the Kiosk mode policy deployed to. @@ -154,11 +157,11 @@ There is an important distinction between the **User logon type** and the **Assi - You have devices you contract out to two different vendors. Instead of user groups you have device groups. Each device group needs a different Kiosk. Those devices when joined receive policy for their own respective Kiosk. The logon user group may include users from both sites, and thus each regional area's device would allow kiosks for both sets of users. -## Set up the device +### Set up the device Now it's time to set up the device to both receive the policy and log into the account the policy has enabled for kiosk mode. -### Set up a single-app kiosk +#### Set up a single-app kiosk Since Single-app kiosk mode targets a local user or Microsoft account you need to take a few extra steps to [enroll the HoloLens in MDM](hololens-enroll-mdm.md), but sign in will be easy and can be automatic. @@ -170,7 +173,7 @@ Give your store app a short amount time to download as well as policy to be appl If you're not seeing your Kiosk mode yet, make sure to [check the assignment status](https://docs.microsoft.com/intune/configuration/device-profile-monitor). -### Set up a multi-app kiosk +#### Set up a multi-app kiosk For multi app Kiosk you'll be using a device that you Azure AD join to your tenant during OOBE. @@ -192,7 +195,7 @@ For other MDM services, check your provider's documentation for instructions. If As part of creating your Provisioning package, you'll need to create a [start layout](#start-layout-for-hololens). -Process: +To set up kiosk mode by using a provisioning package, follow these steps. 1. [Create an XML file that defines the kiosk configuration.](#create-a-kiosk-configuration-xml-file) 2. [Add the XML file to a provisioning package.](#add-the-kiosk-configuration-xml-file-to-a-provisioning-package) @@ -256,6 +259,8 @@ You can also [apply a provisioning package to HoloLens after setup](hololens-pro ## Set up kiosk mode by using the Windows Device Portal +To set up kiosk mode by using the Windows Device Portal, follow these steps. + 1. [Set up the HoloLens to use the Windows Device Portal](https://developer.microsoft.com/windows/mixed-reality/using_the_windows_device_portal#setting_up_hololens_to_use_windows_device_portal). The Device Portal is a web server on your HoloLens that you can connect to from a web browser on your PC. > [!IMPORTANT] @@ -303,7 +308,7 @@ Save the following sample as an XML file. You can use this file when you configu - + @@ -333,10 +338,10 @@ You will [create an XML file](#set-up-kiosk-mode-by-using-a-provisioning-package ``` -## Kiosk app recommendations +## Recommendations for selecting kiosk apps - You cannot select the Shell app as a kiosk app. -- We recommend that you do **not** select the Settings app, Microsoft Edge, Microsoft Store, and the File Explorer app as a kiosk app. +- We recommend that you do **not** select the Settings app, Microsoft Edge, Microsoft Store, and the File Explorer app as a kiosk app. - You can select Cortana as a kiosk app. - To enable photo or video capture, the HoloCamera app must be enabled as a kiosk app. - While Kiosk mode adds several restrictions, we suggest also considering additional policies such as turning off USB connectivity, or checking your flight ring settings to set when automatic updates occur as to not happen during business hours. From bced257a566dd019b37f54e56b49101e1dbb9b59 Mon Sep 17 00:00:00 2001 From: Teresa-Motiv Date: Sun, 15 Mar 2020 18:00:35 -0700 Subject: [PATCH 16/50] Revisions --- devices/hololens/hololens-kiosk.md | 43 +++++++++++++++++++----------- 1 file changed, 28 insertions(+), 15 deletions(-) diff --git a/devices/hololens/hololens-kiosk.md b/devices/hololens/hololens-kiosk.md index 9e311d3bc1..81b7cd49f2 100644 --- a/devices/hololens/hololens-kiosk.md +++ b/devices/hololens/hololens-kiosk.md @@ -19,9 +19,11 @@ appliesto: - HoloLens 2 --- -# Set up HoloLens as a kiosk for specific applications +# Set up HoloLens as a kiosk -Kiosk mode is a convenient feature that you can use to focus the HoloLens device on business apps, or to use the HoloLens device in an app demo. You can use kiosk mode in two configurations (single-app kiosk or multi-app kiosk) and you can choose one of three processes to set up and deploy the kiosk configuration. +Kiosk mode is a convenient feature that you can use to focus the HoloLens device on business apps, or to use the HoloLens device in an app demo. You can use kiosk mode in two configurations (single-app kiosk or multi-app kiosk) and you can use one of three processes to set up and deploy the kiosk configuration. + +This article provides information about aspects of configuring kiosks that are specific to HoloLens devices. For general information about types of Windows-based kiosks and how to configure them, see [Configure kiosks and digital signs on Windows desktop editions](https://docs.microsoft.com/en-us/windows/configuration/kiosk-methods). ## Kiosk mode requirements @@ -52,7 +54,11 @@ While camera and video voice commands and UI are disabled by default the button To enable the camera, device picker, or Miracast on the system menu include the AUMIDs below in your Multi-app kiosk. > [!NOTE] -> Use the Application User Model ID (AUMID) to allow apps in your kiosk configuration. The Camera app AUMID is `HoloCamera_cw5n1h2txyewy!HoloCamera`. The device picker app AUMID is `HoloDevicesFlow_cw5n1h2txyewy!HoloDevicesFlow`. +> When you configure assigned access to associate users with specific apps, use the following [Application User Model IDs (AUMIDs)](https://docs.microsoft.com/windows/configuration/find-the-application-user-model-id-of-an-installed-app): +> +> - **Camera app AUMID**: `HoloCamera_cw5n1h2txyewy!HoloCamera` +> - **Device picker app AUMID**: `HoloDevicesFlow_cw5n1h2txyewy!HoloDevicesFlow` +> For general information about using AUMIDs, see [Guidelines for choosing an app for assigned access (kiosk mode)](https://docs.microsoft.com/windows/configuration/guidelines-for-assigned-access-app). The [AssignedAccess Configuration Service Provider (CSP)](https://docs.microsoft.com/windows/client-management/mdm/assignedaccess-csp) enables kiosk configuration. @@ -70,19 +76,26 @@ Examples scenarios of when to use which kiosk: There are three methods that you can use to configure the device as a kiosk: - You can use [Microsoft Intune or other mobile device management (MDM) service](#set-up-kiosk-mode-by-using-microsoft-intune-or-mdm) to configure single-app and multi-app kiosks. -- You can [use a provisioning package](#set-up-kiosk-mode-by-using-a-provisioning-package) to configure single-app and multi-app kiosks. -- You can [use the Windows Device Portal](#set-up-kiosk-mode-by-using-the-windows-device-portal) to configure single-app kiosks. This method is recommended only for demonstrations, as it requires that developer mode be enabled on the device. -| | Device Portal | Provisioning Package | MDM | -|------------------------------|---------------|----------------------|------| -| Single-app kiosk available | Yes | Yes | Yes | -| Multi-app kiosk available | No | Yes | Yes | -| Need device locally to apply | Yes | Yes | No | -| Need developer mode | Yes | No | No | -| Need AAD | No | No | Yes | -| Automatically deploy | No | No | Yes | -| Speed | Fastest | Fast | Slow | -| Recommended for scale | No | No | Yes | +- You can [use a provisioning package](#set-up-kiosk-mode-by-using-a-provisioning-package) to configure single-app and multi-app kiosks. + +- You can [use the Windows Device Portal](#set-up-kiosk-mode-by-using-the-windows-device-portal) to configure single-app kiosks. + + > [!NOTE] + > Because this method requires that developer mode be enabled on the device, we recommend that you use it only for demonstrations. + +The following table lists the capabilities and benefits of each of the three deployment methods. + +|   |Deploy by using Windows Device Portal |Deploy by using a provisioning package |Deploy by using MDM | +| --------------------------- | ------------- | -------------------- | ---- | +|Deploy single-app kiosks | Yes | Yes | Yes | +|Deploy multi-app kiosks | No | Yes | Yes | +|Deploy to local devices only | Yes | Yes | No | +|Deploy by using developer mode |Required | Not required | Not required | +|Deploy by using Azure Active Directory (AAD) | Not required | Not required | Required | +|Deploy automatically | No | No | Yes | +|Deployment speed | Fastest | Fast | Slow | +|Deploy at scale | Not recommended | Not recommended | Recommended | ## Set up kiosk mode by using Microsoft Intune or MDM From d7a12452b2e318899ec6e9303639564d81b2d4d0 Mon Sep 17 00:00:00 2001 From: Evan Miller Date: Thu, 26 Mar 2020 12:01:13 -0700 Subject: [PATCH 17/50] Feedback changes to Kiosk Adding Lavinder's feedback to the Kiosk doc. @Teresa-Motiv --- devices/hololens/hololens-kiosk.md | 17 +++++++++++------ 1 file changed, 11 insertions(+), 6 deletions(-) diff --git a/devices/hololens/hololens-kiosk.md b/devices/hololens/hololens-kiosk.md index 81b7cd49f2..ca615c8f6c 100644 --- a/devices/hololens/hololens-kiosk.md +++ b/devices/hololens/hololens-kiosk.md @@ -33,18 +33,21 @@ To configure a HoloLens (1st gen) device to use kiosk mode, you must first make ## Select a kiosk mode -When HoloLens is configured as a multi-app kiosk, only the allowed apps are available to the user. The benefit of a multi-app kiosk, or fixed-purpose device, is to provide an easy-to-understand experience for individuals by putting in front of them only the things they need to use, and removing from their view the things they don't need to access. +When HoloLens is configured as a multi-app kiosk, only the allowed apps are available to the user in the startup tiles user experience. The benefit of a multi-app kiosk, or fixed-purpose device, is to provide an easy-to-understand experience for individuals by putting in front of them only the things they need to use, and removing from their view the things they don't need to access. Single-app kiosk mode starts the specified app when the user signs in, and restricts the user's ability to launch new apps or change the running app. When single-app kiosk mode is enabled for HoloLens, the [start gestures](hololens2-basic-usage.md#start-gesture) (including [bloom](hololens1-basic-usage.md) on HoloLens (1st gen)) and Cortana are disabled, and placed apps aren't shown in the user's surroundings. +> [!NOTE] +> Kiosk mode on Hololens is to ensure specified apps are shown in startup tiles user experience. If those apps launch other apps, they are not stopped. In order to block any other app / process from launching please use [Windows Defender Application Control (WDAC) CSP.](https://docs.microsoft.com/windows/client-management/mdm/applicationcontrol-csp) + > [!WARNING] -> The assigned access feature which enables kiosk mode is intended for corporate-owned fixed-purpose devices. When the multi-app assigned access configuration is applied on the device, certain policies are enforced system-wide, and will impact other users on the device. Deleting the multi-app configuration will remove the assigned access lockdown profiles associated with the users, but it cannot revert all [the enforced policies](https://docs.microsoft.com/windows/configuration/lock-down-windows-10-to-specific-apps#policies-set-by-multi-app-kiosk-configuration). A factory reset is needed to clear all the policies enforced via assigned access. +> The assigned access feature which enables kiosk mode is intended for corporate-owned fixed-purpose devices. When the multi-app assigned access configuration is applied on the device, certain policies are enforced system-wide, and will impact other users on the device. Deleting the multi-app configuration will remove the assigned access lockdown profiles associated with the users, but it cannot revert all [the enforced policies](https://docs.microsoft.com/windows/configuration/lock-down-windows-10-to-specific-apps#mdm-policy). A factory reset is needed to clear all the policies enforced via assigned access. > > Be aware that voice commands are enabled for kiosk mode configured in Microsoft Intune or provisioning packages, even if the Cortana app is not selected as a kiosk app. The following table lists the device capabilities in the different kiosk modes. -|   |Start gesture/pins panel |Quick Actions menu |Camera and video |Miracast |Supported user types | Auto sign-in | Can distinguish different users to use Kiosk mode or full access | +|   |Start gesture/pins panel |Quick Actions menu |Camera and video |Miracast |Supported user types | Accounts may sign-in automatically | Can distinguish different users to use Kiosk mode or full access | | --- | --- | --- | --- | --- | --- | --- | --- | |Single-app kiosk |No |No |No* |No |MSA or local |Yes |No | |Multi-app kiosk |Yes |Yes* |Yes* |Yes* |AAD |No |Yes | @@ -52,6 +55,7 @@ The following table lists the device capabilities in the different kiosk modes. While camera and video voice commands and UI are disabled by default the button commands can still be used. To enable the camera, device picker, or Miracast on the system menu include the AUMIDs below in your Multi-app kiosk. +Also while enabling the camera allows on to take pictures or video, you may also wish to include a method of interacting or retreving your pictures, such as Photos, Mail, or OneDrive. > [!NOTE] > When you configure assigned access to associate users with specific apps, use the following [Application User Model IDs (AUMIDs)](https://docs.microsoft.com/windows/configuration/find-the-application-user-model-id-of-an-installed-app): @@ -147,6 +151,7 @@ Some common in-box apps you may wish to use are: | Camera | HoloCamera_cw5n1h2txyewy!HoloCamera | | Device picker | HoloDevicesFlow_cw5n1h2txyewy!HoloDevicesFlow | | Feedback Hub | Microsoft.WindowsFeedbackHub_8wekyb3d8bbwe!App | +| Settings | HolographicSystemSettings_cw5n1h2txyewy!App | For more information on settings for both modes of Kiosk visit [here](https://docs.microsoft.com/intune/configuration/kiosk-settings-holographic). @@ -164,9 +169,9 @@ There is an important distinction between the **User logon type** and the **Assi **Examples:** -- You have a single group that you use for both logon type and assignments. Users A B and C are in both groups. No matter which user the device is first set up for they will join the tenant in this group and the kiosk policy will deploy. Also each user is in the logon group so users A B and C will all experience the Kiosk. +- You have a single group that you use for both logon type and assignments. Users A B and C are in both groups. No matter which user the device is first set up for they will join the tenant in this group and the kiosk policy will deploy. Also each user is in the group used for logon type so users A B and C will all experience the Kiosk. -- You have an assignment group with users A, B and C in it. The logon group is different with users B and C. Even if user A sets up the device and joins the tenant with the device the Kiosk policy will still deploy. Users B and C will still be logged in to the Kiosk, but user A can still log in if troubleshooting, changing of settings or any other need for full access to windows is needed. +- You have an assignment group with users A, B and C in it. The group used for logon type is different with users B and C. Even if user A sets up the device and joins the tenant with the device the Kiosk policy will still deploy. Users B and C will still be logged in to the Kiosk, but user A can still log in if troubleshooting, changing of settings or any other need for full access to windows is needed. - You have devices you contract out to two different vendors. Instead of user groups you have device groups. Each device group needs a different Kiosk. Those devices when joined receive policy for their own respective Kiosk. The logon user group may include users from both sites, and thus each regional area's device would allow kiosks for both sets of users. @@ -354,7 +359,7 @@ You will [create an XML file](#set-up-kiosk-mode-by-using-a-provisioning-package ## Recommendations for selecting kiosk apps - You cannot select the Shell app as a kiosk app. -- We recommend that you do **not** select the Settings app, Microsoft Edge, Microsoft Store, and the File Explorer app as a kiosk app. +- We recommend that you do **not** select the Microsoft Edge, Microsoft Store, and the File Explorer app as a kiosk app. - You can select Cortana as a kiosk app. - To enable photo or video capture, the HoloCamera app must be enabled as a kiosk app. - While Kiosk mode adds several restrictions, we suggest also considering additional policies such as turning off USB connectivity, or checking your flight ring settings to set when automatic updates occur as to not happen during business hours. From 62285cab860d8630f68659caa7c38fc574a7aeb4 Mon Sep 17 00:00:00 2001 From: "v-tea@microsoft.com" <46357187+Teresa-Motiv@users.noreply.github.com> Date: Thu, 26 Mar 2020 13:08:01 -0700 Subject: [PATCH 18/50] Link fix --- devices/hololens/hololens-kiosk.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/devices/hololens/hololens-kiosk.md b/devices/hololens/hololens-kiosk.md index ca615c8f6c..6bff0bc2ac 100644 --- a/devices/hololens/hololens-kiosk.md +++ b/devices/hololens/hololens-kiosk.md @@ -23,7 +23,7 @@ appliesto: Kiosk mode is a convenient feature that you can use to focus the HoloLens device on business apps, or to use the HoloLens device in an app demo. You can use kiosk mode in two configurations (single-app kiosk or multi-app kiosk) and you can use one of three processes to set up and deploy the kiosk configuration. -This article provides information about aspects of configuring kiosks that are specific to HoloLens devices. For general information about types of Windows-based kiosks and how to configure them, see [Configure kiosks and digital signs on Windows desktop editions](https://docs.microsoft.com/en-us/windows/configuration/kiosk-methods). +This article provides information about aspects of configuring kiosks that are specific to HoloLens devices. For general information about types of Windows-based kiosks and how to configure them, see [Configure kiosks and digital signs on Windows desktop editions](https://docs.microsoft.com/windows/configuration/kiosk-methods). ## Kiosk mode requirements From 8fb3a255bf0185c92e4cd7a82c2bcb6fd240982c Mon Sep 17 00:00:00 2001 From: Evan Miller Date: Fri, 27 Mar 2020 09:12:03 -0700 Subject: [PATCH 19/50] UI and Security note, Full AUMID List @Teresa-Motiv --- devices/hololens/hololens-kiosk.md | 35 ++++++++++++++++++++---------- 1 file changed, 23 insertions(+), 12 deletions(-) diff --git a/devices/hololens/hololens-kiosk.md b/devices/hololens/hololens-kiosk.md index 6bff0bc2ac..8045db06c4 100644 --- a/devices/hololens/hololens-kiosk.md +++ b/devices/hololens/hololens-kiosk.md @@ -25,6 +25,9 @@ Kiosk mode is a convenient feature that you can use to focus the HoloLens device This article provides information about aspects of configuring kiosks that are specific to HoloLens devices. For general information about types of Windows-based kiosks and how to configure them, see [Configure kiosks and digital signs on Windows desktop editions](https://docs.microsoft.com/windows/configuration/kiosk-methods). +> [!IMPORTANT] +> Kiosk mode on Hololens is to ensure specified apps are shown in startup tiles user experience. While Kiosk modes are very useful in setting up a desired and limited user interface, it should not be considered a security limitation but instead a tool for a focused user interface for your apps. If those apps launch other apps, they are not stopped. In order to block any other app / process from launching please use [Windows Defender Application Control (WDAC) CSP.](https://docs.microsoft.com/windows/client-management/mdm/applicationcontrol-csp) + ## Kiosk mode requirements You can configure any HoloLens 2 device to use kiosk mode. @@ -37,9 +40,6 @@ When HoloLens is configured as a multi-app kiosk, only the allowed apps are avai Single-app kiosk mode starts the specified app when the user signs in, and restricts the user's ability to launch new apps or change the running app. When single-app kiosk mode is enabled for HoloLens, the [start gestures](hololens2-basic-usage.md#start-gesture) (including [bloom](hololens1-basic-usage.md) on HoloLens (1st gen)) and Cortana are disabled, and placed apps aren't shown in the user's surroundings. -> [!NOTE] -> Kiosk mode on Hololens is to ensure specified apps are shown in startup tiles user experience. If those apps launch other apps, they are not stopped. In order to block any other app / process from launching please use [Windows Defender Application Control (WDAC) CSP.](https://docs.microsoft.com/windows/client-management/mdm/applicationcontrol-csp) - > [!WARNING] > The assigned access feature which enables kiosk mode is intended for corporate-owned fixed-purpose devices. When the multi-app assigned access configuration is applied on the device, certain policies are enforced system-wide, and will impact other users on the device. Deleting the multi-app configuration will remove the assigned access lockdown profiles associated with the users, but it cannot revert all [the enforced policies](https://docs.microsoft.com/windows/configuration/lock-down-windows-10-to-specific-apps#mdm-policy). A factory reset is needed to clear all the policies enforced via assigned access. > @@ -142,16 +142,27 @@ It's important that the group or groups you choose includes users you want to us Now you choose which Apps to include in your kiosk. You may choose to add just one or add many. To choose an app you've uploaded as a **Line of business app** choose the **Add store app** option. You many also choose to add an app via it's **Application user model ID** by selecting **Add by AUMID**. -Some common in-box apps you may wish to use are: +In-box apps you may wish to use are: -| App Name | AUMID | -|---------------|----------------------------------------------------------------------| -| Remote Assist | Microsoft.MicrosoftRemoteAssist_8wekyb3d8bbwe!Microsoft.RemoteAssist | -| Guides | Microsoft.Dynamics365.Guides_8wekyb3d8bbwe!MicrosoftGuides | -| Camera | HoloCamera_cw5n1h2txyewy!HoloCamera | -| Device picker | HoloDevicesFlow_cw5n1h2txyewy!HoloDevicesFlow | -| Feedback Hub | Microsoft.WindowsFeedbackHub_8wekyb3d8bbwe!App | -| Settings | HolographicSystemSettings_cw5n1h2txyewy!App | +| App Name | AUMID | +|----------------------------|----------------------------------------------------------------------------------| +| 3D Viewer | Microsoft.Microsoft3DViewer_8wekyb3d8bbwe!Microsoft.Microsoft3DViewer | +| Calendar | microsoft.windowscommunicationsapps_8wekyb3d8bbwe!microsoft.windowslive.calendar | +| Cortana | Microsoft.549981C3F5F10_8wekyb3d8bbwe!App | +| Dynamics 365 Guides | Microsoft.Dynamics365.Guides_8wekyb3d8bbwe!MicrosoftGuides | +| Dynamics 365 Remote Assist | Microsoft.MicrosoftRemoteAssist_8wekyb3d8bbwe!Microsoft.RemoteAssist | +| Feedback Hub | Microsoft.WindowsFeedbackHub_8wekyb3d8bbwe!App | +| File Explorer | microsoft.windowscommunicationsapps_8wekyb3d8bbwe!microsoft.windowslive.mail | +| Mail | c5e2524a-ea46-4f67-841f-6a9465d9d515_cw5n1h2txyewy!App | +| Microsoft Edge | Microsoft.MicrosoftEdge_8wekyb3d8bbwe!MicrosoftEdge | +| Microsoft Store | Microsoft.WindowsStore_8wekyb3d8bbwe!App | +| Movies & TV | Microsoft.ZuneVideo_8wekyb3d8bbwe!Microsoft.ZuneVideo | +| OneDrive | microsoft.microsoftskydrive_8wekyb3d8bbwe!App | +| Photos | Microsoft.Windows.Photos_8wekyb3d8bbwe!App | +| Settings | HolographicSystemSettings_cw5n1h2txyewy!App | +| Tips | Microsoft.HoloLensTips_8wekyb3d8bbwe!HoloLensTips | +| Camera | HoloCamera_cw5n1h2txyewy!HoloCamera | +| Device Picker | HoloDevicesFlow_cw5n1h2txyewy!HoloDevicesFlow | For more information on settings for both modes of Kiosk visit [here](https://docs.microsoft.com/intune/configuration/kiosk-settings-holographic). From fa3c6c86bf0bb4854a5eb46eb4a822dbf8217216 Mon Sep 17 00:00:00 2001 From: Teresa-Motiv Date: Fri, 27 Mar 2020 16:27:22 -0700 Subject: [PATCH 20/50] Cleanup --- devices/hololens/hololens-kiosk.md | 27 ++++++++++++++------------- 1 file changed, 14 insertions(+), 13 deletions(-) diff --git a/devices/hololens/hololens-kiosk.md b/devices/hololens/hololens-kiosk.md index 8045db06c4..c5fbfc557e 100644 --- a/devices/hololens/hololens-kiosk.md +++ b/devices/hololens/hololens-kiosk.md @@ -23,10 +23,10 @@ appliesto: Kiosk mode is a convenient feature that you can use to focus the HoloLens device on business apps, or to use the HoloLens device in an app demo. You can use kiosk mode in two configurations (single-app kiosk or multi-app kiosk) and you can use one of three processes to set up and deploy the kiosk configuration. -This article provides information about aspects of configuring kiosks that are specific to HoloLens devices. For general information about types of Windows-based kiosks and how to configure them, see [Configure kiosks and digital signs on Windows desktop editions](https://docs.microsoft.com/windows/configuration/kiosk-methods). +This article provides information about aspects of configuring kiosks that are specific to HoloLens devices. For general information about types of Windows-based kiosks and how to configure them, see [Configure kiosks and digital signs on Windows desktop editions](https://docs.microsoft.com/windows/configuration/kiosk-methods). > [!IMPORTANT] -> Kiosk mode on Hololens is to ensure specified apps are shown in startup tiles user experience. While Kiosk modes are very useful in setting up a desired and limited user interface, it should not be considered a security limitation but instead a tool for a focused user interface for your apps. If those apps launch other apps, they are not stopped. In order to block any other app / process from launching please use [Windows Defender Application Control (WDAC) CSP.](https://docs.microsoft.com/windows/client-management/mdm/applicationcontrol-csp) +> Kiosk mode on Hololens is to ensure specified apps are shown in startup tiles user experience. While Kiosk modes are very useful in setting up a desired and limited user interface, it should not be considered a security limitation but instead a tool for a focused user interface for your apps. If those apps launch other apps, they are not stopped. In order to block any other app / process from launching please use [Windows Defender Application Control (WDAC) CSP.](https://docs.microsoft.com/windows/client-management/mdm/applicationcontrol-csp) ## Kiosk mode requirements @@ -83,7 +83,7 @@ There are three methods that you can use to configure the device as a kiosk: - You can [use a provisioning package](#set-up-kiosk-mode-by-using-a-provisioning-package) to configure single-app and multi-app kiosks. -- You can [use the Windows Device Portal](#set-up-kiosk-mode-by-using-the-windows-device-portal) to configure single-app kiosks. +- You can [use the Windows Device Portal](#set-up-kiosk-mode-by-using-the-windows-device-portal) to configure single-app kiosks. > [!NOTE] > Because this method requires that developer mode be enabled on the device, we recommend that you use it only for demonstrations. @@ -116,7 +116,7 @@ To set up kiosk mode by using Microsoft Intune or another MDM system, follow the ### Create a device configuration policy -1. Navigate to https://portal.azure.com/ and sign in to your Intune administrator account. +1. Navigate to https://portal.azure.com/ and sign in to your Intune administrator account. 1. Select **Microsoft Intune** > **Device configuration - Profiles** > **Create profile** 1. Walk through the steps setting a name, **Platform** as **Windows 10 and later**, and **Profile** type as **Kiosk**. @@ -139,9 +139,9 @@ For **User logon type**: Add one or more user accounts that can use the apps you It's important that the group or groups you choose includes users you want to use the Kiosk, if a user signs in with an account not included in this list they will not have a Kiosk experience. -Now you choose which Apps to include in your kiosk. You may choose to add just one or add many. +Now you choose which Apps to include in your kiosk. You may choose to add just one or add many. -To choose an app you've uploaded as a **Line of business app** choose the **Add store app** option. You many also choose to add an app via it's **Application user model ID** by selecting **Add by AUMID**. +To choose an app you've uploaded as a **Line of business app** choose the **Add store app** option. You many also choose to add an app via it's **Application user model ID** by selecting **Add by AUMID**. In-box apps you may wish to use are: | App Name | AUMID | @@ -169,10 +169,11 @@ For more information on settings for both modes of Kiosk visit [here](https://do ### Assign the policy to the group to receive the policy Once you have created and saved your Kiosk mode policy you must assign it to the group(s) that you want it deployed to, or your devices will never receive it. + Click assignments and add the group(s) that you want the Kiosk mode policy deployed to. > [!IMPORTANT] -> If two more or more different kiosk polices target a device they will conflict and the device will receive neither. Other policies such as device restrictions do not conflict with Kiosk mode or additional device restrictions. +> If two more or more different kiosk polices target a device they will conflict and the device will receive neither. Other policies such as device restrictions do not conflict with Kiosk mode or additional device restrictions. For more information on group type, and group assignments please visit [here](https://docs.microsoft.com/intune/configuration/device-profile-assign). @@ -184,7 +185,7 @@ There is an important distinction between the **User logon type** and the **Assi - You have an assignment group with users A, B and C in it. The group used for logon type is different with users B and C. Even if user A sets up the device and joins the tenant with the device the Kiosk policy will still deploy. Users B and C will still be logged in to the Kiosk, but user A can still log in if troubleshooting, changing of settings or any other need for full access to windows is needed. -- You have devices you contract out to two different vendors. Instead of user groups you have device groups. Each device group needs a different Kiosk. Those devices when joined receive policy for their own respective Kiosk. The logon user group may include users from both sites, and thus each regional area's device would allow kiosks for both sets of users. +- You have devices you contract out to two different vendors. Instead of user groups you have device groups. Each device group needs a different Kiosk. Those devices when joined receive policy for their own respective Kiosk. The logon user group may include users from both sites, and thus each regional area's device would allow kiosks for both sets of users. ### Set up the device @@ -192,7 +193,7 @@ Now it's time to set up the device to both receive the policy and log into the a #### Set up a single-app kiosk -Since Single-app kiosk mode targets a local user or Microsoft account you need to take a few extra steps to [enroll the HoloLens in MDM](hololens-enroll-mdm.md), but sign in will be easy and can be automatic. +Since Single-app kiosk mode targets a local user or Microsoft account you need to take a few extra steps to [enroll the HoloLens in MDM](hololens-enroll-mdm.md), but sign in will be easy and can be automatic. During OOBE sign into your **Microsoft Account** specified as a **Logon User Account**. @@ -282,7 +283,7 @@ Use the following snippet in your kiosk configuration XML to enable the **Guest* ### Apply the provisioning package to HoloLens -You can intially [apply a provisioning package to HoloLens during setup](hololens-provisioning.md#apply-a-provisioning-package-to-hololens-during-setup). +You can initially [apply a provisioning package to HoloLens during setup](hololens-provisioning.md#apply-a-provisioning-package-to-hololens-during-setup). You can also [apply a provisioning package to HoloLens after setup](hololens-provisioning.md#4-apply-a-provisioning-package-to-hololens-after-setup). @@ -317,7 +318,7 @@ To set up kiosk mode by using the Windows Device Portal, follow these steps. If you use [MDM, Microsoft Intune](#set-up-kiosk-mode-by-using-microsoft-intune-or-mdm), or a [provisioning package](#set-up-kiosk-mode-by-using-a-provisioning-package) to configure a multi-app kiosk, the procedure requires a Start layout. Start layout customization isn't supported in Holographic for Business, so you'll need to use a placeholder Start layout. -> [!NOTE] +> [!NOTE] > Because a single-app kiosk launches the kiosk app when a user signs in, there is no Start screen displayed. ### Start layout file for MDM (Intune and others) @@ -369,11 +370,11 @@ You will [create an XML file](#set-up-kiosk-mode-by-using-a-provisioning-package ## Recommendations for selecting kiosk apps -- You cannot select the Shell app as a kiosk app. +- You cannot select the Shell app as a kiosk app. - We recommend that you do **not** select the Microsoft Edge, Microsoft Store, and the File Explorer app as a kiosk app. - You can select Cortana as a kiosk app. - To enable photo or video capture, the HoloCamera app must be enabled as a kiosk app. -- While Kiosk mode adds several restrictions, we suggest also considering additional policies such as turning off USB connectivity, or checking your flight ring settings to set when automatic updates occur as to not happen during business hours. +- While Kiosk mode adds several restrictions, we suggest also considering additional policies such as turning off USB connectivity, or checking your flight ring settings to set when automatic updates occur as to not happen during business hours. ## More information From fe23996d8691dfc0480cadc38459304fcac3eda9 Mon Sep 17 00:00:00 2001 From: Teresa-Motiv Date: Tue, 31 Mar 2020 13:55:07 -0700 Subject: [PATCH 21/50] Revisions --- devices/hololens/hololens-kiosk.md | 266 ++++++++++++++++++----------- 1 file changed, 167 insertions(+), 99 deletions(-) diff --git a/devices/hololens/hololens-kiosk.md b/devices/hololens/hololens-kiosk.md index c5fbfc557e..0c51860a98 100644 --- a/devices/hololens/hololens-kiosk.md +++ b/devices/hololens/hololens-kiosk.md @@ -21,36 +21,52 @@ appliesto: # Set up HoloLens as a kiosk -Kiosk mode is a convenient feature that you can use to focus the HoloLens device on business apps, or to use the HoloLens device in an app demo. You can use kiosk mode in two configurations (single-app kiosk or multi-app kiosk) and you can use one of three processes to set up and deploy the kiosk configuration. +You can configure a HoloLens device to function as a fixed-purpose device, also called a *kiosk*, by configuring the device to run in kiosk mode. Kiosk mode limits the applications (or users) that are available on the device. Kiosk mode is a convenient feature that you can use to dedicate a HoloLens device to business apps, or to use the HoloLens device in an app demo. This article provides information about aspects of configuring kiosks that are specific to HoloLens devices. For general information about types of Windows-based kiosks and how to configure them, see [Configure kiosks and digital signs on Windows desktop editions](https://docs.microsoft.com/windows/configuration/kiosk-methods). > [!IMPORTANT] -> Kiosk mode on Hololens is to ensure specified apps are shown in startup tiles user experience. While Kiosk modes are very useful in setting up a desired and limited user interface, it should not be considered a security limitation but instead a tool for a focused user interface for your apps. If those apps launch other apps, they are not stopped. In order to block any other app / process from launching please use [Windows Defender Application Control (WDAC) CSP.](https://docs.microsoft.com/windows/client-management/mdm/applicationcontrol-csp) +> Kiosk mode determines which apps are available when a user signs in to the device. However, kiosk mode is not a security limitation. It does not stop an "allowed" app from launching an app that is not allowed. In order to block apps or processes from launching, use [Windows Defender Application Control (WDAC) CSP](https://docs.microsoft.com/windows/client-management/mdm/applicationcontrol-csp) to create appropriate policies. -## Kiosk mode requirements +You can use kiosk mode in one of two configurations (single-app kiosk or multi-app kiosk), and you can use select one of three processes to set up and deploy the kiosk configuration. + +## Plan the kiosk deployment + +### Kiosk mode requirements You can configure any HoloLens 2 device to use kiosk mode. To configure a HoloLens (1st gen) device to use kiosk mode, you must first make sure that the device runs Windows 10, version 1803, or a newer version. If you have used the Windows Device Recovery Tool to recover your HoloLens (1st gen) device to its default build, or if you have installed the most recent updates, then your device is ready. -## Select a kiosk mode +### Decide between a single-app kiosk or a multi-app kiosk -When HoloLens is configured as a multi-app kiosk, only the allowed apps are available to the user in the startup tiles user experience. The benefit of a multi-app kiosk, or fixed-purpose device, is to provide an easy-to-understand experience for individuals by putting in front of them only the things they need to use, and removing from their view the things they don't need to access. +A single-app kiosk starts the specified app when the user signs in to the device. The Start menu is disabled, as is Cortana. A HoloLens 2 device does not respond to the [Start](hololens2-basic-usage.md#start-gesture) gesture. A HoloLens (1st gen) device does not respond to the [bloom](hololens1-basic-usage.md) gesture. Because only one app can run, the user cannot place other apps. -Single-app kiosk mode starts the specified app when the user signs in, and restricts the user's ability to launch new apps or change the running app. When single-app kiosk mode is enabled for HoloLens, the [start gestures](hololens2-basic-usage.md#start-gesture) (including [bloom](hololens1-basic-usage.md) on HoloLens (1st gen)) and Cortana are disabled, and placed apps aren't shown in the user's surroundings. +A multi-app kiosk displays the start menu when the user signs in to the device. The kiosk configuration determines what apps are available on the Start menu. You can use a multi-app kiosk to provide an easy-to-understand experience for users by putting in front of them only the things they need to use, and removing from their view the things they don't need to access. -> [!WARNING] -> The assigned access feature which enables kiosk mode is intended for corporate-owned fixed-purpose devices. When the multi-app assigned access configuration is applied on the device, certain policies are enforced system-wide, and will impact other users on the device. Deleting the multi-app configuration will remove the assigned access lockdown profiles associated with the users, but it cannot revert all [the enforced policies](https://docs.microsoft.com/windows/configuration/lock-down-windows-10-to-specific-apps#mdm-policy). A factory reset is needed to clear all the policies enforced via assigned access. -> -> Be aware that voice commands are enabled for kiosk mode configured in Microsoft Intune or provisioning packages, even if the Cortana app is not selected as a kiosk app. +The following table lists the feature capabilities in the different kiosk modes. -The following table lists the device capabilities in the different kiosk modes. - -|   |Start gesture/pins panel |Quick Actions menu |Camera and video |Miracast |Supported user types | Accounts may sign-in automatically | Can distinguish different users to use Kiosk mode or full access | +|   |Start gesture/pins panel |Quick Actions menu |Camera and video |Miracast | | --- | --- | --- | --- | --- | --- | --- | --- | -|Single-app kiosk |No |No |No* |No |MSA or local |Yes |No | -|Multi-app kiosk |Yes |Yes* |Yes* |Yes* |AAD |No |Yes | +|Single-app kiosk |No |No |No* |No | +|Multi-app kiosk |Yes |Yes* |Yes* |Yes* | +\* For more information about how to configure these features, see [Select kiosk apps](#select-kiosk-apps). + +The following table lists the user capabilities in the different kiosk modes. + +|   |Supported user types | Automatic sign-in | Multiple access levels | +| --- | --- | --- | --- | +|Single-app kiosk |Managed Service Account (MSA) in Azure Active Directory (AAD) or local account |Yes |No | +|Multi-app kiosk |AAD account |No |Yes | + +For a better idea of how to use these capabilities, see the following table: + +|Use a single-app kiosk for: |Use a multi-app kiosk for: | +| --- | --- | +|A device that runs only a guide for new hires. |A device that runs both guides and Remote Assist for a range of employees. | +|A device that runs only a custom app. |A device that functions as a kiosk for the majority of users (running only a custom app), but functions as a normal device for a specific group of users. | + +### Select kiosk apps and features While camera and video voice commands and UI are disabled by default the button commands can still be used. @@ -65,17 +81,50 @@ Also while enabling the camera allows on to take pictures or video, you may also > For general information about using AUMIDs, see [Guidelines for choosing an app for assigned access (kiosk mode)](https://docs.microsoft.com/windows/configuration/guidelines-for-assigned-access-app). The [AssignedAccess Configuration Service Provider (CSP)](https://docs.microsoft.com/windows/client-management/mdm/assignedaccess-csp) enables kiosk configuration. +> [!WARNING] +> The assigned access feature which enables kiosk mode is intended for corporate-owned fixed-purpose devices. When the multi-app assigned access configuration is applied on the device, certain policies are enforced system-wide, and will impact other users on the device. Deleting the multi-app configuration will remove the assigned access lockdown profiles associated with the users, but it cannot revert all [the enforced policies](https://docs.microsoft.com/windows/configuration/lock-down-windows-10-to-specific-apps#mdm-policy). A factory reset is needed to clear all the policies enforced via assigned access. +> +> Be aware that voice commands are enabled for kiosk mode configured in Microsoft Intune or provisioning packages, even if the Cortana app is not selected as a kiosk app. + +- You cannot select the Shell app as a kiosk app. +- We recommend that you do **not** select the Microsoft Edge, Microsoft Store, and the File Explorer app as a kiosk app. +- You can select Cortana as a kiosk app. +- To enable photo or video capture, the HoloCamera app must be enabled as a kiosk app. +- While Kiosk mode adds several restrictions, we suggest also considering additional policies such as turning off USB connectivity, or checking your flight ring settings to set when automatic updates occur as to not happen during business hours. + +### Plan access control One device can easily be set up to have one kiosk set up for it. If you opt for multi-app kiosk then not you don't need to require all users to use the Kiosk. -Examples scenarios of when to use which kiosk: +Assign the policy to the group to receive the policy -- A device dedicated to Guides to help new hires: Single-app kiosk -- A device that has both Guides and Remote Assist for a range of employees: Multi-app kiosk -- You have a custom app and only allow access to it: Single-app kiosk -- You want a device the majority of your users can only use custom App, but that one user group can use your custom app, Remote Assist, Feedback Hub, and Settings if needed: Multi-app Kiosk mode (With only your custom app in the Kiosk, and the one user group has full access to Windows Holographic.) +Once you have created and saved your Kiosk mode policy you must assign it to the group(s) that you want it deployed to, or your devices will never receive it. -## Select a deployment method +Click assignments and add the group(s) that you want the Kiosk mode policy deployed to. + +> [!IMPORTANT] +> If two more or more different kiosk polices target a device they will conflict and the device will receive neither. Other policies such as device restrictions do not conflict with Kiosk mode or additional device restrictions. + +For more information on group type, and group assignments please visit [here](https://docs.microsoft.com/intune/configuration/device-profile-assign). + +There is an important distinction between the **User logon type** and the **Assignments**. Assignments is how the deployment of the Kiosk to a device is determined. Once a Kiosk policy is on the device, it uses the User logon type to determine which users should be using the Kiosk. + +**Examples:** + +- You have a single group that you use for both logon type and assignments. Users A B and C are in both groups. No matter which user the device is first set up for they will join the tenant in this group and the kiosk policy will deploy. Also each user is in the group used for logon type so users A B and C will all experience the Kiosk. + +- You have an assignment group with users A, B and C in it. The group used for logon type is different with users B and C. Even if user A sets up the device and joins the tenant with the device the Kiosk policy will still deploy. Users B and C will still be logged in to the Kiosk, but user A can still log in if troubleshooting, changing of settings or any other need for full access to windows is needed. + +- You have devices you contract out to two different vendors. Instead of user groups you have device groups. Each device group needs a different Kiosk. Those devices when joined receive policy for their own respective Kiosk. The logon user group may include users from both sites, and thus each regional area's device would allow kiosks for both sets of users. + + +### Select a deployment method + +What are you deploying: + +- Single-app kiosk +- Simple multi-app kiosk +- Fully-customized multi-app kiosk There are three methods that you can use to configure the device as a kiosk: @@ -101,6 +150,82 @@ The following table lists the capabilities and benefits of each of the three dep |Deployment speed | Fastest | Fast | Slow | |Deploy at scale | Not recommended | Not recommended | Recommended | +### Create a kiosk configuration XML file + +Follow [the instructions for creating a kiosk configuration XML file for desktop](https://docs.microsoft.com/windows/configuration/lock-down-windows-10-to-specific-apps#configure-a-kiosk-using-a-provisioning-package), with the following exceptions: + +- Do not include Classic Windows applications (Win32) since they aren't supported on HoloLens. +- Use the [placeholder Start XML](#start-layout-for-hololens) for HoloLens. + +#### Add guest access to the kiosk configuration (optional) + +In the [Configs section of the XML file](https://docs.microsoft.com/windows/configuration/lock-down-windows-10-to-specific-apps#configs), you can configure a special group named **Visitor** to allow guests to use the kiosk. When the kiosk is configured with the **Visitor** special group, a "**Guest**" option is added to the sign-in page. The **Guest** account does not require a password, and any data associated with the account is deleted when the account signs out. + +Use the following snippet in your kiosk configuration XML to enable the **Guest** account: + +```xml + + + + + + +``` + +## Start layout for HoloLens + +If you use [MDM, Microsoft Intune](#set-up-kiosk-mode-by-using-microsoft-intune-or-mdm), or a [provisioning package](#set-up-kiosk-mode-by-using-a-provisioning-package) to configure a multi-app kiosk, the procedure requires a Start layout. Start layout customization isn't supported in Holographic for Business, so you'll need to use a placeholder Start layout. + +> [!NOTE] +> Because a single-app kiosk launches the kiosk app when a user signs in, there is no Start screen displayed. + +### Start layout file for MDM (Intune and others) + +Save the following sample as an XML file. You can use this file when you configure the multi-app kiosk in Microsoft Intune (or in another MDM service that provides a kiosk profile). + +> [!NOTE] +> If you need to use a custom setting and full XML configuration to set up a kiosk in your MDM service, use the [Start layout instructions for a provisioning package](#start-layout-for-a-provisioning-package). + +```xml + + + + + + + + + +``` + +### Create a start layout for a customized multi-app kiosk + +You will [create an XML file](#set-up-kiosk-mode-by-using-a-provisioning-package) to define the kiosk configuration to be included in a provisioning package. Use the following sample in the `StartLayout` section of your XML file. + +```xml + + + + + + + + + + + + + + + ]]> + + +``` + ## Set up kiosk mode by using Microsoft Intune or MDM To set up kiosk mode by using Microsoft Intune or another MDM system, follow these steps. @@ -114,7 +239,7 @@ To set up kiosk mode by using Microsoft Intune or another MDM system, follow the - [Set up a single-app kiosk](#set-up-a-single-app-kiosk). - [Set up a multi-app kiosk](#set-up-a-multi-app-kiosk). -### Create a device configuration policy +### [MDM] 1. Create a device configuration policy 1. Navigate to https://portal.azure.com/ and sign in to your Intune administrator account. 1. Select **Microsoft Intune** > **Device configuration - Profiles** > **Create profile** @@ -122,17 +247,23 @@ To set up kiosk mode by using Microsoft Intune or another MDM system, follow the Your next settings after this will be different depending on if you pick Single app kiosk or Multi app kiosk. -For full details creating a device profile for Kiosk mode check out [Kiosk settings]( https://docs.microsoft.com/intune/configuration/kiosk-settings). +For full details creating a device profile for Kiosk mode check out [Kiosk settings](https://docs.microsoft.com/intune/configuration/kiosk-settings). ### Select the settings that you want to see in your kiosk -#### Configure the settings for a single-app kiosk +#### [MDM] 2. Configure the settings for a single-app kiosk Select **Single-app kiosk**, then select **Local user account**. You'll need to enter either the name of your local user, or your Microsoft Account you intend to be logged onto the device. Finally you'll select the one app you want to be used in your kiosk. Ideally this should be a store app. For full details visit [here](https://docs.microsoft.com/intune/configuration/kiosk-settings-holographic#single-full-screen-app-kiosks). -#### Configure the settings for a multi-app kiosk +#### [MDM] 2. Configure the settings for a multi-app kiosk + +Additional information: + +- For HoloLens devices that are managed by Microsoft Intune, directions can be found [here](hololens-commercial-infrastructure.md#how-to-configure-kiosk-mode-using-microsoft-intune). + +- For other MDM services, check your provider's documentation for instructions. If you need to use a custom setting and full XML configuration to set up a kiosk in your MDM service, [create an XML file that defines the kiosk configuration](#create-a-kiosk-configuration-xml-file), and make sure to include the [Start layout](#start-layout-for-a-provisioning-package) in the XML file. **Target Windows 10 in S mode devices**: Choose **No**. S mode isn't supported on Windows Holographic for Business. For **User logon type**: Add one or more user accounts that can use the apps you add. Your options that work with Windows Holographic are: **Azure AD user or group** or **HoloLens visitor**. @@ -166,7 +297,7 @@ In-box apps you may wish to use are: For more information on settings for both modes of Kiosk visit [here](https://docs.microsoft.com/intune/configuration/kiosk-settings-holographic). -### Assign the policy to the group to receive the policy +### [MDM] 3. Assign the policy to the group to receive the policy Once you have created and saved your Kiosk mode policy you must assign it to the group(s) that you want it deployed to, or your devices will never receive it. @@ -191,7 +322,7 @@ There is an important distinction between the **User logon type** and the **Assi Now it's time to set up the device to both receive the policy and log into the account the policy has enabled for kiosk mode. -#### Set up a single-app kiosk +#### [MDM] 4. Set up a single-app kiosk Since Single-app kiosk mode targets a local user or Microsoft account you need to take a few extra steps to [enroll the HoloLens in MDM](hololens-enroll-mdm.md), but sign in will be easy and can be automatic. @@ -203,7 +334,7 @@ Give your store app a short amount time to download as well as policy to be appl If you're not seeing your Kiosk mode yet, make sure to [check the assignment status](https://docs.microsoft.com/intune/configuration/device-profile-monitor). -#### Set up a multi-app kiosk +#### [MDM] 4. Set up a multi-app kiosk For multi app Kiosk you'll be using a device that you Azure AD join to your tenant during OOBE. @@ -215,13 +346,9 @@ To enable Kiosk mode simply **sign out** of your account and **sign in** to a pr If you're not seeing your Kiosk mode yet, make sure to [check the assignment status](https://docs.microsoft.com/intune/configuration/device-profile-monitor). -Additional information: -For HoloLens devices that are managed by Microsoft Intune, directions can be found [here](hololens-commercial-infrastructure.md#how-to-configure-kiosk-mode-using-microsoft-intune). -For other MDM services, check your provider's documentation for instructions. If you need to use a custom setting and full XML configuration to set up a kiosk in your MDM service, [create an XML file that defines the kiosk configuration](#create-a-kiosk-configuration-xml-file), and make sure to include the [Start layout](#start-layout-for-a-provisioning-package) in the XML file. - -## Set up kiosk mode by using a provisioning package +## Use a provisioning package to set up a single-app or muti-app kiosk As part of creating your Provisioning package, you'll need to create a [start layout](#start-layout-for-hololens). @@ -231,7 +358,7 @@ To set up kiosk mode by using a provisioning package, follow these steps. 2. [Add the XML file to a provisioning package.](#add-the-kiosk-configuration-xml-file-to-a-provisioning-package) 3. [Apply the provisioning package to HoloLens.](#apply-the-provisioning-package-to-hololens) -### Create a kiosk configuration XML file +### [PP] 1. Create a kiosk configuration XML file Follow [the instructions for creating a kiosk configuration XML file for desktop](https://docs.microsoft.com/windows/configuration/lock-down-windows-10-to-specific-apps#configure-a-kiosk-using-a-provisioning-package), with the following exceptions: @@ -253,7 +380,7 @@ Use the following snippet in your kiosk configuration XML to enable the **Guest* ``` -### Add the kiosk configuration XML file to a provisioning package +### [PP] 2. Add the kiosk configuration XML file to a provisioning package 1. Open [Windows Configuration Designer](https://www.microsoft.com/store/apps/9nblggh4tx22). 2. Choose **Advanced provisioning**. @@ -281,13 +408,13 @@ Use the following snippet in your kiosk configuration XML to enable the **Guest* 16. Click **Build** to start building the package. The provisioning package doesn't take long to build. The project information is displayed in the build page and the progress bar indicates the build status. -### Apply the provisioning package to HoloLens +### [PP] 3. Apply the provisioning package to HoloLens You can initially [apply a provisioning package to HoloLens during setup](hololens-provisioning.md#apply-a-provisioning-package-to-hololens-during-setup). You can also [apply a provisioning package to HoloLens after setup](hololens-provisioning.md#4-apply-a-provisioning-package-to-hololens-after-setup). -## Set up kiosk mode by using the Windows Device Portal +## Use the Windows Device Portal to set up a single-app kiosk To set up kiosk mode by using the Windows Device Portal, follow these steps. @@ -296,12 +423,12 @@ To set up kiosk mode by using the Windows Device Portal, follow these steps. > [!IMPORTANT] > When you set up HoloLens to use the Device Portal, you must enable **Developer Mode** on the device. **Developer Mode** on a device that has Windows Holographic for Business enables side-loading of apps, which risks the installation of apps that have not been certified by the Microsoft Store. Administrators can block the ability to enable **Developer Mode** using the **ApplicationManagement/AllowDeveloper Unlock** setting in the [Policy CSP](https://docs.microsoft.com/windows/client-management/mdm/policy-configuration-service-provider). [Learn more about Developer Mode.](https://docs.microsoft.com/windows/uwp/get-started/enable-your-device-for-development#developer-mode) -2. On a PC, connect to the HoloLens using [Wi-Fi](https://developer.microsoft.com/windows/mixed-reality/Using_the_Windows_Device_Portal.html#connecting_over_wi-fi){broken} or [USB](https://developer.microsoft.com/windows/mixed-reality/Using_the_Windows_Device_Portal.html#connecting_over_usb){broken}. +2. On a PC, connect to the HoloLens using [Wi-Fi](https://developer.microsoft.com/windows/mixed-reality/Using_the_Windows_Device_Portal#connecting_over_wi-fi) or [USB](https://developer.microsoft.com/windows/mixed-reality/Using_the_Windows_Device_Portal#connecting_over_usb). -3. [Create a user name and password](https://developer.microsoft.com/windows/mixed-reality/Using_the_Windows_Device_Portal.html#creating_a_username_and_password){broken} if this is the first time you connect to the Windows Device Portal, or enter the user name and password that you previously set up. +3. [Create a user name and password](https://developer.microsoft.com/windows/mixed-reality/Using_the_Windows_Device_Portal#creating_a_username_and_password) if this is the first time you connect to the Windows Device Portal, or enter the user name and password that you previously set up. > [!TIP] - > If you see a certificate error in the browser, follow [these troubleshooting steps](https://developer.microsoft.com/windows/mixed-reality/Using_the_Windows_Device_Portal.html#security_certificate){broken}. + > If you see a certificate error in the browser, follow [these troubleshooting steps](https://developer.microsoft.com/windows/mixed-reality/Using_the_Windows_Device_Portal#security_certificate). 4. In the Windows Device Portal, click **Kiosk Mode**. @@ -314,67 +441,8 @@ To set up kiosk mode by using the Windows Device Portal, follow these steps. 6. Reboot the HoloLens. If you still have your Device Portal page open you can use the **Power** option in the top right and click **Restart.** -## Start layout for HoloLens -If you use [MDM, Microsoft Intune](#set-up-kiosk-mode-by-using-microsoft-intune-or-mdm), or a [provisioning package](#set-up-kiosk-mode-by-using-a-provisioning-package) to configure a multi-app kiosk, the procedure requires a Start layout. Start layout customization isn't supported in Holographic for Business, so you'll need to use a placeholder Start layout. -> [!NOTE] -> Because a single-app kiosk launches the kiosk app when a user signs in, there is no Start screen displayed. - -### Start layout file for MDM (Intune and others) - -Save the following sample as an XML file. You can use this file when you configure the multi-app kiosk in Microsoft Intune (or in another MDM service that provides a kiosk profile). - -> [!NOTE] -> If you need to use a custom setting and full XML configuration to set up a kiosk in your MDM service, use the [Start layout instructions for a provisioning package](#start-layout-for-a-provisioning-package). - -```xml - - - - - - - - - -``` - -### Start layout for a provisioning package - -You will [create an XML file](#set-up-kiosk-mode-by-using-a-provisioning-package) to define the kiosk configuration to be included in a provisioning package. Use the following sample in the `StartLayout` section of your XML file. - -```xml - - - - - - - - - - - - - - - ]]> - - -``` - -## Recommendations for selecting kiosk apps - -- You cannot select the Shell app as a kiosk app. -- We recommend that you do **not** select the Microsoft Edge, Microsoft Store, and the File Explorer app as a kiosk app. -- You can select Cortana as a kiosk app. -- To enable photo or video capture, the HoloCamera app must be enabled as a kiosk app. -- While Kiosk mode adds several restrictions, we suggest also considering additional policies such as turning off USB connectivity, or checking your flight ring settings to set when automatic updates occur as to not happen during business hours. ## More information From 6719e19444fbbda1c9fca64875c621bd6e0a15bd Mon Sep 17 00:00:00 2001 From: Teresa-Motiv Date: Tue, 31 Mar 2020 16:32:48 -0700 Subject: [PATCH 22/50] Revisions in progress (to be continued) --- devices/hololens/hololens-kiosk.md | 84 ++++++++++++++++++++++++++---- 1 file changed, 73 insertions(+), 11 deletions(-) diff --git a/devices/hololens/hololens-kiosk.md b/devices/hololens/hololens-kiosk.md index 0c51860a98..1284f45cae 100644 --- a/devices/hololens/hololens-kiosk.md +++ b/devices/hololens/hololens-kiosk.md @@ -46,11 +46,12 @@ A multi-app kiosk displays the start menu when the user signs in to the device. The following table lists the feature capabilities in the different kiosk modes. -|   |Start gesture/pins panel |Quick Actions menu |Camera and video |Miracast | -| --- | --- | --- | --- | --- | --- | --- | --- | -|Single-app kiosk |No |No |No* |No | -|Multi-app kiosk |Yes |Yes* |Yes* |Yes* | -\* For more information about how to configure these features, see [Select kiosk apps](#select-kiosk-apps). +|   |Start menu/pins panel |Quick Actions menu |Camera and video |Miracast |Cortana | +| --- | --- | --- | --- | --- | --- | --- | --- | --- | +|Single-app kiosk |No |No |No1 |No |No1, 2 | +|Multi-app kiosk |Yes |Yes1 |Yes1 |Yes1 |Yes1 | +>1 For more information about how to configure these features, see [Select kiosk apps](#select-kiosk-apps). +>2 Even if Cortana is disabled, the built-in voice commands are available. The following table lists the user capabilities in the different kiosk modes. @@ -66,12 +67,26 @@ For a better idea of how to use these capabilities, see the following table: |A device that runs only a guide for new hires. |A device that runs both guides and Remote Assist for a range of employees. | |A device that runs only a custom app. |A device that functions as a kiosk for the majority of users (running only a custom app), but functions as a normal device for a specific group of users. | -### Select kiosk apps and features +### Select kiosk apps + +For general information about selecting kiosk apps, see [Guidelines for choosing an app for assigned access (kiosk mode)](https://docs.microsoft.com/windows/configuration/guidelines-for-assigned-access-app). + +If you use an MDM system or a provisioning package to configure kiosk mode, you use the [AssignedAccess Configuration Service Provider (CSP)](https://docs.microsoft.com/windows/client-management/mdm/assignedaccess-csp) to specify applications. If you use the Windows Device Portal to configure kiosk mode, you select the app to run during the setup process. + + + +While camera and video voice commands and UI are disabled by default the button + + + +For more information on settings for both modes of Kiosk visit [here](https://docs.microsoft.com/intune/configuration/kiosk-settings-holographic). +[Windows Holographic for Business device settings to run as a kiosk in Intune](https://docs.microsoft.com/mem/intune/configuration/kiosk-settings-holographic) + +[Windows 10 and Windows Holographic for Business device settings to run as a dedicated kiosk using Intune](https://docs.microsoft.com/mem/intune/configuration/kiosk-settings) -While camera and video voice commands and UI are disabled by default the button commands can still be used. To enable the camera, device picker, or Miracast on the system menu include the AUMIDs below in your Multi-app kiosk. -Also while enabling the camera allows on to take pictures or video, you may also wish to include a method of interacting or retreving your pictures, such as Photos, Mail, or OneDrive. +Also while enabling the camera allows on to take pictures or video, you may also wish to include a method of interacting or retrieving your pictures, such as Photos, Mail, or OneDrive. > [!NOTE] > When you configure assigned access to associate users with specific apps, use the following [Application User Model IDs (AUMIDs)](https://docs.microsoft.com/windows/configuration/find-the-application-user-model-id-of-an-installed-app): @@ -80,20 +95,67 @@ Also while enabling the camera allows on to take pictures or video, you may also > - **Device picker app AUMID**: `HoloDevicesFlow_cw5n1h2txyewy!HoloDevicesFlow` > For general information about using AUMIDs, see [Guidelines for choosing an app for assigned access (kiosk mode)](https://docs.microsoft.com/windows/configuration/guidelines-for-assigned-access-app). -The [AssignedAccess Configuration Service Provider (CSP)](https://docs.microsoft.com/windows/client-management/mdm/assignedaccess-csp) enables kiosk configuration. + > [!WARNING] > The assigned access feature which enables kiosk mode is intended for corporate-owned fixed-purpose devices. When the multi-app assigned access configuration is applied on the device, certain policies are enforced system-wide, and will impact other users on the device. Deleting the multi-app configuration will remove the assigned access lockdown profiles associated with the users, but it cannot revert all [the enforced policies](https://docs.microsoft.com/windows/configuration/lock-down-windows-10-to-specific-apps#mdm-policy). A factory reset is needed to clear all the policies enforced via assigned access. > -> Be aware that voice commands are enabled for kiosk mode configured in Microsoft Intune or provisioning packages, even if the Cortana app is not selected as a kiosk app. +> Be aware that voice commands are enabled for kiosk mode configured in Microsoft Intune or provisioning packages, even if the Cortana app is not selected as a kiosk app. - You cannot select the Shell app as a kiosk app. -- We recommend that you do **not** select the Microsoft Edge, Microsoft Store, and the File Explorer app as a kiosk app. + - You can select Cortana as a kiosk app. - To enable photo or video capture, the HoloCamera app must be enabled as a kiosk app. - While Kiosk mode adds several restrictions, we suggest also considering additional policies such as turning off USB connectivity, or checking your flight ring settings to set when automatic updates occur as to not happen during business hours. +> [!CAUTION] +> We recommend that you do **not** select the Microsoft Edge, Microsoft Store, or the File Explorer app as a kiosk app. + +In-box apps you may wish to use are: + +| App Name | AUMID | +|----------------------------|----------------------------------------------------------------------------------| +| 3D Viewer | Microsoft.Microsoft3DViewer_8wekyb3d8bbwe!Microsoft.Microsoft3DViewer | +| Calendar | microsoft.windowscommunicationsapps_8wekyb3d8bbwe!microsoft.windowslive.calendar | +| Camera | HoloCamera_cw5n1h2txyewy!HoloCamera | +| Cortana | Microsoft.549981C3F5F10_8wekyb3d8bbwe!App | +| Device Picker | HoloDevicesFlow_cw5n1h2txyewy!HoloDevicesFlow | +| Dynamics 365 Guides | Microsoft.Dynamics365.Guides_8wekyb3d8bbwe!MicrosoftGuides | +| Dynamics 365 Remote Assist | Microsoft.MicrosoftRemoteAssist_8wekyb3d8bbwe!Microsoft.RemoteAssist | +| Feedback Hub | Microsoft.WindowsFeedbackHub_8wekyb3d8bbwe!App | +| Mail | c5e2524a-ea46-4f67-841f-6a9465d9d515_cw5n1h2txyewy!App | +| Movies & TV | Microsoft.ZuneVideo_8wekyb3d8bbwe!Microsoft.ZuneVideo | +| OneDrive | microsoft.microsoftskydrive_8wekyb3d8bbwe!App | +| Photos | Microsoft.Windows.Photos_8wekyb3d8bbwe!App | +| Settings | HolographicSystemSettings_cw5n1h2txyewy!App | +| Tips | Microsoft.HoloLensTips_8wekyb3d8bbwe!HoloLensTips | + + + +### [MDM] 3. Assign the policy to the group to receive the policy + +Once you have created and saved your Kiosk mode policy you must assign it to the group(s) that you want it deployed to, or your devices will never receive it. + +Click assignments and add the group(s) that you want the Kiosk mode policy deployed to. + +> [!IMPORTANT] +> If two more or more different kiosk polices target a device they will conflict and the device will receive neither. Other policies such as device restrictions do not conflict with Kiosk mode or additional device restrictions. + +For more information on group type, and group assignments please visit [here](https://docs.microsoft.com/intune/configuration/device-profile-assign). + +There is an important distinction between the **User logon type** and the **Assignments**. Assignments is how the deployment of the Kiosk to a device is determined. Once a Kiosk policy is on the device, it uses the User logon type to determine which users should be using the Kiosk. + +**Examples:** + +- You have a single group that you use for both logon type and assignments. Users A B and C are in both groups. No matter which user the device is first set up for they will join the tenant in this group and the kiosk policy will deploy. Also each user is in the group used for logon type so users A B and C will all experience the Kiosk. + +- You have an assignment group with users A, B and C in it. The group used for logon type is different with users B and C. Even if user A sets up the device and joins the tenant with the device the Kiosk policy will still deploy. Users B and C will still be logged in to the Kiosk, but user A can still log in if troubleshooting, changing of settings or any other need for full access to windows is needed. + +- You have devices you contract out to two different vendors. Instead of user groups you have device groups. Each device group needs a different Kiosk. Those devices when joined receive policy for their own respective Kiosk. The logon user group may include users from both sites, and thus each regional area's device would allow kiosks for both sets of users. + ### Plan access control +It's important that the group or groups you choose includes users you want to use the Kiosk, if a user signs in with an account not included in this list they will not have a Kiosk experience. + One device can easily be set up to have one kiosk set up for it. If you opt for multi-app kiosk then not you don't need to require all users to use the Kiosk. Assign the policy to the group to receive the policy From d73fa1a7d64652eac8b2a3e549f92a73eedf9a47 Mon Sep 17 00:00:00 2001 From: Teresa-Motiv Date: Thu, 2 Apr 2020 13:12:26 -0700 Subject: [PATCH 23/50] Revisions --- devices/hololens/hololens-kiosk.md | 83 +++++++++++++++--------------- 1 file changed, 42 insertions(+), 41 deletions(-) diff --git a/devices/hololens/hololens-kiosk.md b/devices/hololens/hololens-kiosk.md index 1284f45cae..63ba1b8546 100644 --- a/devices/hololens/hololens-kiosk.md +++ b/devices/hololens/hololens-kiosk.md @@ -46,21 +46,23 @@ A multi-app kiosk displays the start menu when the user signs in to the device. The following table lists the feature capabilities in the different kiosk modes. -|   |Start menu/pins panel |Quick Actions menu |Camera and video |Miracast |Cortana | -| --- | --- | --- | --- | --- | --- | --- | --- | --- | -|Single-app kiosk |No |No |No1 |No |No1, 2 | -|Multi-app kiosk |Yes |Yes1 |Yes1 |Yes1 |Yes1 | ->1 For more information about how to configure these features, see [Select kiosk apps](#select-kiosk-apps). ->2 Even if Cortana is disabled, the built-in voice commands are available. +|   |Start menu/pins panel |Quick Actions menu |Camera and video |Miracast |Cortana |Built-in voice commands | +| --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | +|Single-app kiosk |Disabled |Disabled |Disabled |Disabled |Disabled |Enabled1 | +|Multi-app kiosk |Enabled |Enabled2 |Available2 |Available2 |Available2, 3 |Enabled1 | -The following table lists the user capabilities in the different kiosk modes. +> 1 Voice commands that relate to disabled features do not function. +> 2 For more information about how to configure these features, see [Select kiosk apps](#select-kiosk-apps). +> 3 Even if Cortana is disabled, the built-in voice commands are enabled. + +The following table lists the user support features of the different kiosk modes. |   |Supported user types | Automatic sign-in | Multiple access levels | | --- | --- | --- | --- | |Single-app kiosk |Managed Service Account (MSA) in Azure Active Directory (AAD) or local account |Yes |No | |Multi-app kiosk |AAD account |No |Yes | -For a better idea of how to use these capabilities, see the following table: +For examples of how to use these capabilities, see the following table. |Use a single-app kiosk for: |Use a multi-app kiosk for: | | --- | --- | @@ -71,67 +73,56 @@ For a better idea of how to use these capabilities, see the following table: For general information about selecting kiosk apps, see [Guidelines for choosing an app for assigned access (kiosk mode)](https://docs.microsoft.com/windows/configuration/guidelines-for-assigned-access-app). -If you use an MDM system or a provisioning package to configure kiosk mode, you use the [AssignedAccess Configuration Service Provider (CSP)](https://docs.microsoft.com/windows/client-management/mdm/assignedaccess-csp) to specify applications. If you use the Windows Device Portal to configure kiosk mode, you select the app to run during the setup process. - - - -While camera and video voice commands and UI are disabled by default the button - - - -For more information on settings for both modes of Kiosk visit [here](https://docs.microsoft.com/intune/configuration/kiosk-settings-holographic). -[Windows Holographic for Business device settings to run as a kiosk in Intune](https://docs.microsoft.com/mem/intune/configuration/kiosk-settings-holographic) - -[Windows 10 and Windows Holographic for Business device settings to run as a dedicated kiosk using Intune](https://docs.microsoft.com/mem/intune/configuration/kiosk-settings) - - -To enable the camera, device picker, or Miracast on the system menu include the AUMIDs below in your Multi-app kiosk. -Also while enabling the camera allows on to take pictures or video, you may also wish to include a method of interacting or retrieving your pictures, such as Photos, Mail, or OneDrive. - -> [!NOTE] -> When you configure assigned access to associate users with specific apps, use the following [Application User Model IDs (AUMIDs)](https://docs.microsoft.com/windows/configuration/find-the-application-user-model-id-of-an-installed-app): -> -> - **Camera app AUMID**: `HoloCamera_cw5n1h2txyewy!HoloCamera` -> - **Device picker app AUMID**: `HoloDevicesFlow_cw5n1h2txyewy!HoloDevicesFlow` -> For general information about using AUMIDs, see [Guidelines for choosing an app for assigned access (kiosk mode)](https://docs.microsoft.com/windows/configuration/guidelines-for-assigned-access-app). +If you use the Windows Device Portal to configure a single-app kiosk, you select the app during the setup process. +If you use an MDM system or a provisioning package to configure kiosk mode, you use the [AssignedAccess Configuration Service Provider (CSP)](https://docs.microsoft.com/windows/client-management/mdm/assignedaccess-csp) to specify applications. > [!WARNING] -> The assigned access feature which enables kiosk mode is intended for corporate-owned fixed-purpose devices. When the multi-app assigned access configuration is applied on the device, certain policies are enforced system-wide, and will impact other users on the device. Deleting the multi-app configuration will remove the assigned access lockdown profiles associated with the users, but it cannot revert all [the enforced policies](https://docs.microsoft.com/windows/configuration/lock-down-windows-10-to-specific-apps#mdm-policy). A factory reset is needed to clear all the policies enforced via assigned access. +> The assigned access feature that enables kiosk mode is intended for corporate-owned fixed-purpose devices. When the multi-app assigned access configuration is applied on the device, certain policies are enforced system-wide. These policies impact other users on the device. > -> Be aware that voice commands are enabled for kiosk mode configured in Microsoft Intune or provisioning packages, even if the Cortana app is not selected as a kiosk app. +> Deleting the multi-app configuration removes the user lockdown profiles that the assigned access feature put in place. However, it does not revert all of the policy changes. +To revert these policies, you have to reset the device to the factory settings. + +[the enforced policies](https://docs.microsoft.com/windows/configuration/lock-down-windows-10-to-specific-apps#mdm-policy). -- You cannot select the Shell app as a kiosk app. -- You can select Cortana as a kiosk app. -- To enable photo or video capture, the HoloCamera app must be enabled as a kiosk app. -- While Kiosk mode adds several restrictions, we suggest also considering additional policies such as turning off USB connectivity, or checking your flight ring settings to set when automatic updates occur as to not happen during business hours. > [!CAUTION] -> We recommend that you do **not** select the Microsoft Edge, Microsoft Store, or the File Explorer app as a kiosk app. +> You cannot select the Shell app as a kiosk app. In addition, we recommend that you do **not** select the Microsoft Edge, Microsoft Store, or the File Explorer app as kiosk apps. +[Application User Model IDs (AUMIDs)](https://docs.microsoft.com/windows/configuration/find-the-application-user-model-id-of-an-installed-app): In-box apps you may wish to use are: | App Name | AUMID | |----------------------------|----------------------------------------------------------------------------------| | 3D Viewer | Microsoft.Microsoft3DViewer_8wekyb3d8bbwe!Microsoft.Microsoft3DViewer | | Calendar | microsoft.windowscommunicationsapps_8wekyb3d8bbwe!microsoft.windowslive.calendar | -| Camera | HoloCamera_cw5n1h2txyewy!HoloCamera | -| Cortana | Microsoft.549981C3F5F10_8wekyb3d8bbwe!App | +| Camera1, 2 | HoloCamera_cw5n1h2txyewy!HoloCamera | +| Cortana2 | Microsoft.549981C3F5F10_8wekyb3d8bbwe!App | | Device Picker | HoloDevicesFlow_cw5n1h2txyewy!HoloDevicesFlow | | Dynamics 365 Guides | Microsoft.Dynamics365.Guides_8wekyb3d8bbwe!MicrosoftGuides | | Dynamics 365 Remote Assist | Microsoft.MicrosoftRemoteAssist_8wekyb3d8bbwe!Microsoft.RemoteAssist | | Feedback Hub | Microsoft.WindowsFeedbackHub_8wekyb3d8bbwe!App | | Mail | c5e2524a-ea46-4f67-841f-6a9465d9d515_cw5n1h2txyewy!App | +| Miracast3 | | | Movies & TV | Microsoft.ZuneVideo_8wekyb3d8bbwe!Microsoft.ZuneVideo | | OneDrive | microsoft.microsoftskydrive_8wekyb3d8bbwe!App | | Photos | Microsoft.Windows.Photos_8wekyb3d8bbwe!App | | Settings | HolographicSystemSettings_cw5n1h2txyewy!App | | Tips | Microsoft.HoloLensTips_8wekyb3d8bbwe!HoloLensTips | +> 1 To enable photo or video capture, you have to enable the Camera app as a kiosk app. +> 2 When you enable the Camera app, be aware of the following: +> - The Quick Actions menu includes the Photo and Video buttons. +> - You should also enable an app that can interact with or retrieve pictures (such as Photos, Mail, or OneDrive). +> +> 3 Even if you do not enable Cortana as a kiosk app, built-in voice commands are enabled. +> 4 To enable Miracast as a kiosk app, enable the Camera app and the Device Picker app. -### [MDM] 3. Assign the policy to the group to receive the policy +While camera and video voice commands and UI are disabled by default the button + +[MDM] 3. Assign the policy to the group to receive the policy Once you have created and saved your Kiosk mode policy you must assign it to the group(s) that you want it deployed to, or your devices will never receive it. @@ -182,6 +173,10 @@ There is an important distinction between the **User logon type** and the **Assi ### Select a deployment method + +While Kiosk mode adds several restrictions, we suggest also considering additional policies such as turning off USB connectivity, or checking your flight ring settings to set when automatic updates occur as to not happen during business hours. + + What are you deploying: - Single-app kiosk @@ -212,6 +207,12 @@ The following table lists the capabilities and benefits of each of the three dep |Deployment speed | Fastest | Fast | Slow | |Deploy at scale | Not recommended | Not recommended | Recommended | + +For more information on settings for both modes of Kiosk visit [here](https://docs.microsoft.com/intune/configuration/kiosk-settings-holographic). +[Windows Holographic for Business device settings to run as a kiosk in Intune](https://docs.microsoft.com/mem/intune/configuration/kiosk-settings-holographic) + +[Windows 10 and Windows Holographic for Business device settings to run as a dedicated kiosk using Intune](https://docs.microsoft.com/mem/intune/configuration/kiosk-settings) + ### Create a kiosk configuration XML file Follow [the instructions for creating a kiosk configuration XML file for desktop](https://docs.microsoft.com/windows/configuration/lock-down-windows-10-to-specific-apps#configure-a-kiosk-using-a-provisioning-package), with the following exceptions: From 5e1e5596a1d3d12deac38f376efc778f4bd545e8 Mon Sep 17 00:00:00 2001 From: Teresa-Motiv Date: Fri, 3 Apr 2020 16:46:04 -0700 Subject: [PATCH 24/50] Revisions --- devices/hololens/hololens-kiosk.md | 52 ++++++------------------------ 1 file changed, 10 insertions(+), 42 deletions(-) diff --git a/devices/hololens/hololens-kiosk.md b/devices/hololens/hololens-kiosk.md index 63ba1b8546..80514d9c93 100644 --- a/devices/hololens/hololens-kiosk.md +++ b/devices/hololens/hololens-kiosk.md @@ -30,6 +30,11 @@ This article provides information about aspects of configuring kiosks that are s You can use kiosk mode in one of two configurations (single-app kiosk or multi-app kiosk), and you can use select one of three processes to set up and deploy the kiosk configuration. +> [!WARNING] +> The assigned access feature that enables kiosk mode is intended for corporate-owned fixed-purpose devices. When the multi-app assigned access configuration is applied on the device, [certain policies](https://docs.microsoft.com/windows/configuration/lock-down-windows-10-to-specific-apps#mdm-policy) are enforced system-wide. These policies impact other users on the device. +> +> Deleting the multi-app configuration removes the user lockdown profiles that the assigned access feature put in place. However, it does not revert all of the policy changes. To revert these policies, you have to reset the device to the factory settings. + ## Plan the kiosk deployment ### Kiosk mode requirements @@ -69,42 +74,29 @@ For examples of how to use these capabilities, see the following table. |A device that runs only a guide for new hires. |A device that runs both guides and Remote Assist for a range of employees. | |A device that runs only a custom app. |A device that functions as a kiosk for the majority of users (running only a custom app), but functions as a normal device for a specific group of users. | -### Select kiosk apps +### Plan kiosk apps For general information about selecting kiosk apps, see [Guidelines for choosing an app for assigned access (kiosk mode)](https://docs.microsoft.com/windows/configuration/guidelines-for-assigned-access-app). If you use the Windows Device Portal to configure a single-app kiosk, you select the app during the setup process. -If you use an MDM system or a provisioning package to configure kiosk mode, you use the [AssignedAccess Configuration Service Provider (CSP)](https://docs.microsoft.com/windows/client-management/mdm/assignedaccess-csp) to specify applications. - -> [!WARNING] -> The assigned access feature that enables kiosk mode is intended for corporate-owned fixed-purpose devices. When the multi-app assigned access configuration is applied on the device, certain policies are enforced system-wide. These policies impact other users on the device. -> -> Deleting the multi-app configuration removes the user lockdown profiles that the assigned access feature put in place. However, it does not revert all of the policy changes. -To revert these policies, you have to reset the device to the factory settings. - -[the enforced policies](https://docs.microsoft.com/windows/configuration/lock-down-windows-10-to-specific-apps#mdm-policy). - - +If you use an MDM system or a provisioning package to configure kiosk mode, you use the [AssignedAccess Configuration Service Provider (CSP)](https://docs.microsoft.com/windows/client-management/mdm/assignedaccess-csp) to specify applications. The CSP uses [Application User Model IDs (AUMIDs)](https://docs.microsoft.com/windows/configuration/find-the-application-user-model-id-of-an-installed-app) to identify applications. The following table lists the AUMIDs of some in-box applications that you can use in a multi-app kiosk. > [!CAUTION] > You cannot select the Shell app as a kiosk app. In addition, we recommend that you do **not** select the Microsoft Edge, Microsoft Store, or the File Explorer app as kiosk apps. -[Application User Model IDs (AUMIDs)](https://docs.microsoft.com/windows/configuration/find-the-application-user-model-id-of-an-installed-app): -In-box apps you may wish to use are: - | App Name | AUMID | |----------------------------|----------------------------------------------------------------------------------| | 3D Viewer | Microsoft.Microsoft3DViewer_8wekyb3d8bbwe!Microsoft.Microsoft3DViewer | | Calendar | microsoft.windowscommunicationsapps_8wekyb3d8bbwe!microsoft.windowslive.calendar | | Camera1, 2 | HoloCamera_cw5n1h2txyewy!HoloCamera | -| Cortana2 | Microsoft.549981C3F5F10_8wekyb3d8bbwe!App | +| Cortana3 | Microsoft.549981C3F5F10_8wekyb3d8bbwe!App | | Device Picker | HoloDevicesFlow_cw5n1h2txyewy!HoloDevicesFlow | | Dynamics 365 Guides | Microsoft.Dynamics365.Guides_8wekyb3d8bbwe!MicrosoftGuides | | Dynamics 365 Remote Assist | Microsoft.MicrosoftRemoteAssist_8wekyb3d8bbwe!Microsoft.RemoteAssist | | Feedback Hub | Microsoft.WindowsFeedbackHub_8wekyb3d8bbwe!App | | Mail | c5e2524a-ea46-4f67-841f-6a9465d9d515_cw5n1h2txyewy!App | -| Miracast3 | | +| Miracast4 | | | Movies & TV | Microsoft.ZuneVideo_8wekyb3d8bbwe!Microsoft.ZuneVideo | | OneDrive | microsoft.microsoftskydrive_8wekyb3d8bbwe!App | | Photos | Microsoft.Windows.Photos_8wekyb3d8bbwe!App | @@ -116,33 +108,9 @@ In-box apps you may wish to use are: > - The Quick Actions menu includes the Photo and Video buttons. > - You should also enable an app that can interact with or retrieve pictures (such as Photos, Mail, or OneDrive). > -> 3 Even if you do not enable Cortana as a kiosk app, built-in voice commands are enabled. +> 3 Even if you do not enable Cortana as a kiosk app, built-in voice commands are enabled. However, commands that are related to disabled features have no effect. > 4 To enable Miracast as a kiosk app, enable the Camera app and the Device Picker app. - -While camera and video voice commands and UI are disabled by default the button - -[MDM] 3. Assign the policy to the group to receive the policy - -Once you have created and saved your Kiosk mode policy you must assign it to the group(s) that you want it deployed to, or your devices will never receive it. - -Click assignments and add the group(s) that you want the Kiosk mode policy deployed to. - -> [!IMPORTANT] -> If two more or more different kiosk polices target a device they will conflict and the device will receive neither. Other policies such as device restrictions do not conflict with Kiosk mode or additional device restrictions. - -For more information on group type, and group assignments please visit [here](https://docs.microsoft.com/intune/configuration/device-profile-assign). - -There is an important distinction between the **User logon type** and the **Assignments**. Assignments is how the deployment of the Kiosk to a device is determined. Once a Kiosk policy is on the device, it uses the User logon type to determine which users should be using the Kiosk. - -**Examples:** - -- You have a single group that you use for both logon type and assignments. Users A B and C are in both groups. No matter which user the device is first set up for they will join the tenant in this group and the kiosk policy will deploy. Also each user is in the group used for logon type so users A B and C will all experience the Kiosk. - -- You have an assignment group with users A, B and C in it. The group used for logon type is different with users B and C. Even if user A sets up the device and joins the tenant with the device the Kiosk policy will still deploy. Users B and C will still be logged in to the Kiosk, but user A can still log in if troubleshooting, changing of settings or any other need for full access to windows is needed. - -- You have devices you contract out to two different vendors. Instead of user groups you have device groups. Each device group needs a different Kiosk. Those devices when joined receive policy for their own respective Kiosk. The logon user group may include users from both sites, and thus each regional area's device would allow kiosks for both sets of users. - ### Plan access control It's important that the group or groups you choose includes users you want to use the Kiosk, if a user signs in with an account not included in this list they will not have a Kiosk experience. From 8cbe1e136394ffa9f86f8f7abe9df2a73f8e20b5 Mon Sep 17 00:00:00 2001 From: Teresa-Motiv Date: Wed, 22 Apr 2020 17:41:19 -0700 Subject: [PATCH 25/50] Revisions --- devices/hololens/hololens-kiosk.md | 9 ++++++--- 1 file changed, 6 insertions(+), 3 deletions(-) diff --git a/devices/hololens/hololens-kiosk.md b/devices/hololens/hololens-kiosk.md index c114270ae2..ab4ab88f47 100644 --- a/devices/hololens/hololens-kiosk.md +++ b/devices/hololens/hololens-kiosk.md @@ -25,7 +25,7 @@ You can configure a HoloLens device to function as a fixed-purpose device, also This article provides information about aspects of configuring kiosks that are specific to HoloLens devices. For general information about types of Windows-based kiosks and how to configure them, see [Configure kiosks and digital signs on Windows desktop editions](https://docs.microsoft.com/windows/configuration/kiosk-methods). -> [!IMPORTANT] +> [!IMPORTANT] > Kiosk mode determines which apps are available when a user signs in to the device. However, kiosk mode is not a security limitation. It does not stop an "allowed" app from launching an app that is not allowed. In order to block apps or processes from launching, use [Windows Defender Application Control (WDAC) CSP](https://docs.microsoft.com/windows/client-management/mdm/applicationcontrol-csp) to create appropriate policies. You can use kiosk mode in one of two configurations (single-app kiosk or multi-app kiosk), and you can use select one of three processes to set up and deploy the kiosk configuration. @@ -43,6 +43,9 @@ You can configure any HoloLens 2 device to use kiosk mode. To configure a HoloLens (1st gen) device to use kiosk mode, you must first make sure that the device runs Windows 10, version 1803, or a newer version. If you have used the Windows Device Recovery Tool to recover your HoloLens (1st gen) device to its default build, or if you have installed the most recent updates, then your device is ready. +> [!IMPORTANT] +> To help protect devices that run in kiosk mode, consider adding device management policies that turn off features such as USB connectivity. Additionally, check your update ring settings to make sure that automatic updates do not occur during business hours. + ### Decide between a single-app kiosk or a multi-app kiosk A single-app kiosk starts the specified app when the user signs in to the device. The Start menu is disabled, as is Cortana. A HoloLens 2 device does not respond to the [Start](hololens2-basic-usage.md#start-gesture) gesture. A HoloLens (1st gen) device does not respond to the [bloom](hololens1-basic-usage.md) gesture. Because only one app can run, the user cannot place other apps. @@ -56,7 +59,7 @@ The following table lists the feature capabilities in the different kiosk modes. |Single-app kiosk |Disabled |Disabled |Disabled |Disabled |Disabled |Enabled1 | |Multi-app kiosk |Enabled |Enabled2 |Available2 |Available2 |Available2, 3 |Enabled1 | -> 1 Voice commands that relate to disabled features do not function. +> 1 Voice commands that relate to disabled features do not function. > 2 For more information about how to configure these features, see [Select kiosk apps](#select-kiosk-apps). > 3 Even if Cortana is disabled, the built-in voice commands are enabled. @@ -78,7 +81,7 @@ For examples of how to use these capabilities, see the following table. For general information about selecting kiosk apps, see [Guidelines for choosing an app for assigned access (kiosk mode)](https://docs.microsoft.com/windows/configuration/guidelines-for-assigned-access-app). -If you use the Windows Device Portal to configure a single-app kiosk, you select the app during the setup process. +If you use the Windows Device Portal to configure a single-app kiosk, you select the app during the setup process. If you use an MDM system or a provisioning package to configure kiosk mode, you use the [AssignedAccess Configuration Service Provider (CSP)](https://docs.microsoft.com/windows/client-management/mdm/assignedaccess-csp) to specify applications. The CSP uses [Application User Model IDs (AUMIDs)](https://docs.microsoft.com/windows/configuration/find-the-application-user-model-id-of-an-installed-app) to identify applications. The following table lists the AUMIDs of some in-box applications that you can use in a multi-app kiosk. From 6f6c565f903025ff82f7bb9b49c27ca67c2c3d74 Mon Sep 17 00:00:00 2001 From: Teresa-Motiv Date: Wed, 22 Apr 2020 18:04:20 -0700 Subject: [PATCH 26/50] Revisions --- devices/hololens/hololens-kiosk.md | 10 ++++++---- 1 file changed, 6 insertions(+), 4 deletions(-) diff --git a/devices/hololens/hololens-kiosk.md b/devices/hololens/hololens-kiosk.md index ab4ab88f47..7602c26e6e 100644 --- a/devices/hololens/hololens-kiosk.md +++ b/devices/hololens/hololens-kiosk.md @@ -114,9 +114,13 @@ If you use an MDM system or a provisioning package to configure kiosk mode, you > 3 Even if you do not enable Cortana as a kiosk app, built-in voice commands are enabled. However, commands that are related to disabled features have no effect. > 4 To enable Miracast as a kiosk app, enable the Camera app and the Device Picker app. -### Plan access control +### Plan user and device groups + +In an MDM environment, you use user groups and device groups to manage device configurations and user access. For a full discussion of the roles of user groups and device groups in Intune, see [Assign user and device profiles in Microsoft Intune: User groups vs. device groups](https://docs.microsoft.com/intune/configuration/device-profile-assign). + +In short, you configure assignments to deploy the kiosk configuration to devices and you configure user groups (sometimes called user logon types) to determine which users can use the kiosk devices. If a user signs in by using an account that is not included in the appropriate group, that user does not have a Kiosk experience. + -It's important that the group or groups you choose includes users you want to use the Kiosk, if a user signs in with an account not included in this list they will not have a Kiosk experience. One device can easily be set up to have one kiosk set up for it. If you opt for multi-app kiosk then not you don't need to require all users to use the Kiosk. @@ -129,9 +133,7 @@ Click assignments and add the group(s) that you want the Kiosk mode policy deplo > [!IMPORTANT] > If two more or more different kiosk polices target a device they will conflict and the device will receive neither. Other policies such as device restrictions do not conflict with Kiosk mode or additional device restrictions. -For more information on group type, and group assignments please visit [here](https://docs.microsoft.com/intune/configuration/device-profile-assign). -There is an important distinction between the **User logon type** and the **Assignments**. Assignments is how the deployment of the Kiosk to a device is determined. Once a Kiosk policy is on the device, it uses the User logon type to determine which users should be using the Kiosk. **Examples:** From b90b5e6cf16fd6ac10c56fa8982c62367a3299c3 Mon Sep 17 00:00:00 2001 From: Teresa-Motiv Date: Thu, 23 Apr 2020 10:00:37 -0700 Subject: [PATCH 27/50] Revisions --- devices/hololens/hololens-kiosk.md | 29 +++++++++++++++-------------- 1 file changed, 15 insertions(+), 14 deletions(-) diff --git a/devices/hololens/hololens-kiosk.md b/devices/hololens/hololens-kiosk.md index 7602c26e6e..39986a9f07 100644 --- a/devices/hololens/hololens-kiosk.md +++ b/devices/hololens/hololens-kiosk.md @@ -118,31 +118,32 @@ If you use an MDM system or a provisioning package to configure kiosk mode, you In an MDM environment, you use user groups and device groups to manage device configurations and user access. For a full discussion of the roles of user groups and device groups in Intune, see [Assign user and device profiles in Microsoft Intune: User groups vs. device groups](https://docs.microsoft.com/intune/configuration/device-profile-assign). -In short, you configure assignments to deploy the kiosk configuration to devices and you configure user groups (sometimes called user logon types) to determine which users can use the kiosk devices. If a user signs in by using an account that is not included in the appropriate group, that user does not have a Kiosk experience. +In short, you assign kiosk configuration profiles to device groups, and you configure user groups (sometimes called user logon types) to determine which users can use the kiosk devices. If a user signs in by using an account that is not included in the appropriate group, that user does not have a kiosk experience. Similarly, if a device does not belong to a device group that has an assigned kiosk configuration, that device does not provide a kiosk experience for any user. +#### User-dependent experiences +When you configure a HoloLens device as a single-app kiosk, all of the users who sign on to that device see the kiosk experience. Users who do not belong to an appropriately configured user group cannot use the device. -One device can easily be set up to have one kiosk set up for it. If you opt for multi-app kiosk then not you don't need to require all users to use the Kiosk. +When you configure a HoloLens device as a multi-app kiosk, the device can provide a kiosk experience to one group of users and a non-kiosk experience to another group of users. In other words, it can function as a kiosk or as a normal HoloLens device, depending on who signs in. -Assign the policy to the group to receive the policy +#### Profile conflicts -Once you have created and saved your Kiosk mode policy you must assign it to the group(s) that you want it deployed to, or your devices will never receive it. +If two or more kiosk configuration profiles target the same device, they conflict. In the case of Intune-managed devices, Intune does not apply any of the conflicting profiles. -Click assignments and add the group(s) that you want the Kiosk mode policy deployed to. +Other types of profiles and policies, such as device restrictions that are not related to the kiosk configuration profile, do not conflict with the kiosk configuration profile. -> [!IMPORTANT] -> If two more or more different kiosk polices target a device they will conflict and the device will receive neither. Other policies such as device restrictions do not conflict with Kiosk mode or additional device restrictions. +#### Examples of how to use groups +- You use a single group for both devices and users. One device and users A, B, and C are members of this group. No matter which user signs on to the device first (and goes through the Out-of-Box Experience, or OOBE), the kiosk configuration deploys to the device. Users A, B, and C can all sign in to the device and get the kiosk experience. +- You use a device group and a user group. Users A, B, and C are members of the device group. Users B and C are also members of the user group (user A is not a member). No matter which user signs on to the device first, the kiosk configuration deploys to the device. However, after that the user experiences differ as follows: -**Examples:** - -- You have a single group that you use for both logon type and assignments. Users A B and C are in both groups. No matter which user the device is first set up for they will join the tenant in this group and the kiosk policy will deploy. Also each user is in the group used for logon type so users A B and C will all experience the Kiosk. - -- You have an assignment group with users A, B and C in it. The group used for logon type is different with users B and C. Even if user A sets up the device and joins the tenant with the device the Kiosk policy will still deploy. Users B and C will still be logged in to the Kiosk, but user A can still log in if troubleshooting, changing of settings or any other need for full access to windows is needed. - -- You have devices you contract out to two different vendors. Instead of user groups you have device groups. Each device group needs a different Kiosk. Those devices when joined receive policy for their own respective Kiosk. The logon user group may include users from both sites, and thus each regional area's device would allow kiosks for both sets of users. + - Users B and C can sign in to the device, and they get the kiosk experience. + - User A can sign in to the device, but does not get the kiosk experience. If the device is a multi-app kiosk, user A can use the device as a typical non-kiosk device. +- You contract devices out to two different vendors who need different kiosk experiences. Each vendor's devices belong to a unique device group. You create a different kiosk configuration profile for each vendor, and assign each vendor's profile to its device group. + + You use a single user group that includes users from both vendors. As a result, any user can sign in to any device and get a kiosk experience. The specific kiosk experience the user gets depends on the vendor that is associated with the device. ### Select a deployment method From f264152d3400cde485db89dcb6bf1112748ca468 Mon Sep 17 00:00:00 2001 From: Teresa-Motiv Date: Thu, 23 Apr 2020 10:58:42 -0700 Subject: [PATCH 28/50] Revisions --- devices/hololens/hololens-kiosk.md | 313 ++++++++++++----------------- 1 file changed, 123 insertions(+), 190 deletions(-) diff --git a/devices/hololens/hololens-kiosk.md b/devices/hololens/hololens-kiosk.md index 39986a9f07..134b8595f0 100644 --- a/devices/hololens/hololens-kiosk.md +++ b/devices/hololens/hololens-kiosk.md @@ -116,9 +116,9 @@ If you use an MDM system or a provisioning package to configure kiosk mode, you ### Plan user and device groups -In an MDM environment, you use user groups and device groups to manage device configurations and user access. For a full discussion of the roles of user groups and device groups in Intune, see [Assign user and device profiles in Microsoft Intune: User groups vs. device groups](https://docs.microsoft.com/intune/configuration/device-profile-assign). +In an MDM environment, you use user groups and device groups to manage device configurations and user access. For a full discussion of the roles of user groups and device groups in Intune, see [Assign user and device profiles in Microsoft Intune: User groups vs. device groups](https://docs.microsoft.com/intune/configuration/device-profile-assign). Because these groups are security groups (for example, Azure Active Directory, or Azure AD, security groups) you can use a single group for devices and users. Separate groups are typically easier to manage. -In short, you assign kiosk configuration profiles to device groups, and you configure user groups (sometimes called user logon types) to determine which users can use the kiosk devices. If a user signs in by using an account that is not included in the appropriate group, that user does not have a kiosk experience. Similarly, if a device does not belong to a device group that has an assigned kiosk configuration, that device does not provide a kiosk experience for any user. +In short, you assign a user group to a kiosk configuration profile, and you assign the profile to a device group. If a user signs in by using an account that is not included in the appropriate group, that user does not have a kiosk experience. Similarly, if a device does not belong to a device group that has an assigned kiosk configuration, that device does not provide a kiosk experience for any user. #### User-dependent experiences @@ -143,27 +143,17 @@ Other types of profiles and policies, such as device restrictions that are not r - You contract devices out to two different vendors who need different kiosk experiences. Each vendor's devices belong to a unique device group. You create a different kiosk configuration profile for each vendor, and assign each vendor's profile to its device group. - You use a single user group that includes users from both vendors. As a result, any user can sign in to any device and get a kiosk experience. The specific kiosk experience the user gets depends on the vendor that is associated with the device. + You use a single user group that includes users from both vendors, and you assign that group to both profiles. As a result, any user can sign in to any device and get a kiosk experience. The specific kiosk experience the user gets depends on the vendor that is associated with the device. ### Select a deployment method +You can select one of three methods to deploy kiosk configurations: -While Kiosk mode adds several restrictions, we suggest also considering additional policies such as turning off USB connectivity, or checking your flight ring settings to set when automatic updates occur as to not happen during business hours. +- [Microsoft Intune or other mobile device management (MDM) service](#set-up-kiosk-mode-by-using-microsoft-intune-or-mdm) +- [Provisioning package](#set-up-kiosk-mode-by-using-a-provisioning-package) -What are you deploying: - -- Single-app kiosk -- Simple multi-app kiosk -- Fully-customized multi-app kiosk - -There are three methods that you can use to configure the device as a kiosk: - -- You can use [Microsoft Intune or other mobile device management (MDM) service](#set-up-kiosk-mode-by-using-microsoft-intune-or-mdm) to configure single-app and multi-app kiosks. - -- You can [use a provisioning package](#set-up-kiosk-mode-by-using-a-provisioning-package) to configure single-app and multi-app kiosks. - -- You can [use the Windows Device Portal](#set-up-kiosk-mode-by-using-the-windows-device-portal) to configure single-app kiosks. +- [Windows Device Portal](#set-up-kiosk-mode-by-using-the-windows-device-portal) > [!NOTE] > Because this method requires that developer mode be enabled on the device, we recommend that you use it only for demonstrations. @@ -181,17 +171,111 @@ The following table lists the capabilities and benefits of each of the three dep |Deployment speed | Fastest | Fast | Slow | |Deploy at scale | Not recommended | Not recommended | Recommended | +## Set up kiosk mode by using Microsoft Intune or MDM + +To set up kiosk mode by using Microsoft Intune or another MDM system, follow these steps. + +1. [Create a kiosk configuration profile](#create-a-kiosk-configuration-profile). +1. Select the settings that you want to see in your kiosk. + - [Configure the settings for a single-app kiosk](#mdmconfigsingle). + - [Configure the settings for a multi-app kiosk](#mdmconfigmulti). +1. [Assign the kiosk configuration profile to the device group](#mdmassign). +1. Deploy the devices. + - [Deploy a single-app kiosk](#mdmsingledeploy). + - [Deploy a multi-app kiosk](#mdmmultideploy). + +### [MDM] 1. Create a kiosk configuration profile + +1. Navigate to https://portal.azure.com/ and sign in to your Intune administrator account. +1. Select **Microsoft Intune** > **Device configuration - Profiles** > **Create profile** +1. Walk through the steps setting a name, **Platform** as **Windows 10 and later**, and **Profile** type as **Kiosk**. + +Your next settings after this will be different depending on if you pick Single app kiosk or Multi app kiosk. + +For full details creating a device profile for Kiosk mode check out [Kiosk settings](https://docs.microsoft.com/intune/configuration/kiosk-settings). + +### Select the settings for your kiosk + For more information on settings for both modes of Kiosk visit [here](https://docs.microsoft.com/intune/configuration/kiosk-settings-holographic). [Windows Holographic for Business device settings to run as a kiosk in Intune](https://docs.microsoft.com/mem/intune/configuration/kiosk-settings-holographic) [Windows 10 and Windows Holographic for Business device settings to run as a dedicated kiosk using Intune](https://docs.microsoft.com/mem/intune/configuration/kiosk-settings) +#### [MDM] 2. Configure the settings for a single-app kiosk + +Select **Single-app kiosk**, then select **Local user account**. You'll need to enter either the name of your local user, or your Microsoft Account you intend to be logged onto the device. +Finally you'll select the one app you want to be used in your kiosk. Ideally this should be a store app. +For full details visit [here](https://docs.microsoft.com/intune/configuration/kiosk-settings-holographic#single-full-screen-app-kiosks). + +#### [MDM] 2. Configure the settings for a multi-app kiosk + +Additional information: + +- You can optionally use a custom Start layout. For more information, see [Start layout file for MDM (Intune and others)](#start-layout-file-for-mdm-intune-and-others). +- For HoloLens devices that are managed by Microsoft Intune, directions can be found [here](hololens-commercial-infrastructure.md#how-to-configure-kiosk-mode-using-microsoft-intune). + +- For other MDM services, check your provider's documentation for instructions. If you need to use a custom setting and full XML configuration to set up a kiosk in your MDM service, [create an XML file that defines the kiosk configuration](#create-a-kiosk-configuration-xml-file), and make sure to include the [Start layout](#start-layout-for-a-provisioning-package) in the XML file. + +**Target Windows 10 in S mode devices**: Choose **No**. S mode isn't supported on Windows Holographic for Business. +For **User logon type**: Add one or more user accounts that can use the apps you add. Your options that work with Windows Holographic are: **Azure AD user or group** or **HoloLens visitor**. + +It's important that the group or groups you choose includes users you want to use the Kiosk, if a user signs in with an account not included in this list they will not have a Kiosk experience. + +Now you choose which Apps to include in your kiosk. You may choose to add just one or add many. + +To choose an app you've uploaded as a **Line of business app** choose the **Add store app** option. You many also choose to add an app via it's **Application user model ID** by selecting **Add by AUMID**. + +### [MDM] 3. Assign the kiosk configuration profile to the device group + +Once you have created and saved your Kiosk mode policy you must assign it to the group(s) that you want it deployed to, or your devices will never receive it. + +Click assignments and add the group(s) that you want the Kiosk mode policy deployed to. + +### Deploy the devices + +Now it's time to set up the device to both receive the policy and log into the account the policy has enabled for kiosk mode. + +#### [MDM] 4. Deploy a single-app kiosk + +Since Single-app kiosk mode targets a local user or Microsoft account you need to take a few extra steps to [enroll the HoloLens in MDM](hololens-enroll-mdm.md), but sign in will be easy and can be automatic. + +During OOBE sign into your **Microsoft Account** specified as a **Logon User Account**. + +Then enroll the device so that your **device is enrolled in a group** for a group selected under the Kiosk mode policy's **assignment**. + +Give your store app a short amount time to download as well as policy to be applied, once it is restart the device. Once your account is signed in your Kiosk mode will be enabled and your app should automatically launch. + +If you're not seeing your Kiosk mode yet, make sure to [check the assignment status](https://docs.microsoft.com/intune/configuration/device-profile-monitor). + +#### [MDM] 4. Deploy a multi-app kiosk + +For multi app Kiosk you'll be using a device that you Azure AD join to your tenant during OOBE. + +If you're targeting a user group. you'll want to sign in to an account that is a member of a group that's also a group that the Kiosk is assigned to. + +Once you've completed OOBE, if you have apps you need to manually install via sideloading or the Microsoft store please do so. If your apps are going to install automatically, such as being a [required app](https://docs.microsoft.com/mem/intune/apps/apps-deploy#assign-an-app) for the same group that the Kiosk mode is assigned to, then it will become a part of your kiosk even if you enter the kiosk before it finishes downloading. + +To enable Kiosk mode simply **sign out** of your account and **sign in** to a profile that is a member of a group targeted by the Logon user account setting. (This may be the same user.) + +If you're not seeing your Kiosk mode yet, make sure to [check the assignment status](https://docs.microsoft.com/intune/configuration/device-profile-monitor). + +## Use a provisioning package to set up a single-app or muti-app kiosk + +As part of creating your Provisioning package, you'll need to create a [start layout](#start-layout-for-hololens). + +To set up kiosk mode by using a provisioning package, follow these steps. + +1. [Create an XML file that defines the kiosk configuration.](#create-a-kiosk-configuration-xml-file) +2. [Add the XML file to a provisioning package.](#add-the-kiosk-configuration-xml-file-to-a-provisioning-package) +3. [Apply the provisioning package to HoloLens.](#apply-the-provisioning-package-to-hololens) + + ### Create a kiosk configuration XML file Follow [the instructions for creating a kiosk configuration XML file for desktop](https://docs.microsoft.com/windows/configuration/lock-down-windows-10-to-specific-apps#configure-a-kiosk-using-a-provisioning-package), with the following exceptions: -- Do not include Classic Windows applications (Win32) since they aren't supported on HoloLens. +- Do not include Classic Windows applications (Win32). HoloLens does not support these applications. - Use the [placeholder Start XML](#start-layout-for-hololens) for HoloLens. #### Add guest access to the kiosk configuration (optional) @@ -211,33 +295,13 @@ Use the following snippet in your kiosk configuration XML to enable the **Guest* ## Start layout for HoloLens -If you use [MDM, Microsoft Intune](#set-up-kiosk-mode-by-using-microsoft-intune-or-mdm), or a [provisioning package](#set-up-kiosk-mode-by-using-a-provisioning-package) to configure a multi-app kiosk, the procedure requires a Start layout. Start layout customization isn't supported in Holographic for Business, so you'll need to use a placeholder Start layout. +If you use a [provisioning package](#set-up-kiosk-mode-by-using-a-provisioning-package) to configure a multi-app kiosk, the procedure requires a Start layout. Start layout customization isn't supported in Windows Holographic for Business, so you'll need to use a placeholder Start layout. > [!NOTE] -> Because a single-app kiosk launches the kiosk app when a user signs in, there is no Start screen displayed. +> Because a single-app kiosk launches the kiosk app when a user signs in, it does not use a Start screen and does not need a Start layout. -### Start layout file for MDM (Intune and others) - -Save the following sample as an XML file. You can use this file when you configure the multi-app kiosk in Microsoft Intune (or in another MDM service that provides a kiosk profile). - -> [!NOTE] -> If you need to use a custom setting and full XML configuration to set up a kiosk in your MDM service, use the [Start layout instructions for a provisioning package](#start-layout-for-a-provisioning-package). - -```xml - - - - - - - - - -``` +> [!NOTE] +> If you use [MDM](#set-up-kiosk-mode-by-using-microsoft-intune-or-mdm) to set up a multi-app kiosk, you can optionally use a Start layout. For more information, see [Start layout file for MDM (Intune and others)](#start-layout-file-for-mdm-intune-and-others). ### Create a start layout for a customized multi-app kiosk @@ -263,158 +327,27 @@ You will [create an XML file](#set-up-kiosk-mode-by-using-a-provisioning-package ``` -## Set up kiosk mode by using Microsoft Intune or MDM +### Start layout file for MDM (Intune and others) -To set up kiosk mode by using Microsoft Intune or another MDM system, follow these steps. +Save the following sample as an XML file. You can use this file when you configure the multi-app kiosk in Microsoft Intune (or in another MDM service that provides a kiosk profile). -1. [Create a device configuration policy](#create-a-device-configuration-policy). -1. Select the settings that you want to see in your kiosk. - - [Configure the settings for a single-app kiosk](#configure-the-settings-for-a-single-app-kiosk). - - [Configure the settings for a multi-app kiosk](#configure-the-settings-for-a-multi-app-kiosk). -1. [Assign the policy to the group to receive the policy](#assign-the-policy-to-the-group-to-receive-the-policy). -1. Set up the device. - - [Set up a single-app kiosk](#set-up-a-single-app-kiosk). - - [Set up a multi-app kiosk](#set-up-a-multi-app-kiosk). - -### [MDM] 1. Create a device configuration policy - -1. Navigate to https://portal.azure.com/ and sign in to your Intune administrator account. -1. Select **Microsoft Intune** > **Device configuration - Profiles** > **Create profile** -1. Walk through the steps setting a name, **Platform** as **Windows 10 and later**, and **Profile** type as **Kiosk**. - -Your next settings after this will be different depending on if you pick Single app kiosk or Multi app kiosk. - -For full details creating a device profile for Kiosk mode check out [Kiosk settings](https://docs.microsoft.com/intune/configuration/kiosk-settings). - -### Select the settings that you want to see in your kiosk - -#### [MDM] 2. Configure the settings for a single-app kiosk - -Select **Single-app kiosk**, then select **Local user account**. You'll need to enter either the name of your local user, or your Microsoft Account you intend to be logged onto the device. -Finally you'll select the one app you want to be used in your kiosk. Ideally this should be a store app. -For full details visit [here](https://docs.microsoft.com/intune/configuration/kiosk-settings-holographic#single-full-screen-app-kiosks). - -#### [MDM] 2. Configure the settings for a multi-app kiosk - -Additional information: - -- For HoloLens devices that are managed by Microsoft Intune, directions can be found [here](hololens-commercial-infrastructure.md#how-to-configure-kiosk-mode-using-microsoft-intune). - -- For other MDM services, check your provider's documentation for instructions. If you need to use a custom setting and full XML configuration to set up a kiosk in your MDM service, [create an XML file that defines the kiosk configuration](#create-a-kiosk-configuration-xml-file), and make sure to include the [Start layout](#start-layout-for-a-provisioning-package) in the XML file. - -**Target Windows 10 in S mode devices**: Choose **No**. S mode isn't supported on Windows Holographic for Business. -For **User logon type**: Add one or more user accounts that can use the apps you add. Your options that work with Windows Holographic are: **Azure AD user or group** or **HoloLens visitor**. - -It's important that the group or groups you choose includes users you want to use the Kiosk, if a user signs in with an account not included in this list they will not have a Kiosk experience. - -Now you choose which Apps to include in your kiosk. You may choose to add just one or add many. - -To choose an app you've uploaded as a **Line of business app** choose the **Add store app** option. You many also choose to add an app via it's **Application user model ID** by selecting **Add by AUMID**. -In-box apps you may wish to use are: - -| App Name | AUMID | -|----------------------------|----------------------------------------------------------------------------------| -| 3D Viewer | Microsoft.Microsoft3DViewer_8wekyb3d8bbwe!Microsoft.Microsoft3DViewer | -| Calendar | microsoft.windowscommunicationsapps_8wekyb3d8bbwe!microsoft.windowslive.calendar | -| Cortana | Microsoft.549981C3F5F10_8wekyb3d8bbwe!App | -| Dynamics 365 Guides | Microsoft.Dynamics365.Guides_8wekyb3d8bbwe!MicrosoftGuides | -| Dynamics 365 Remote Assist | Microsoft.MicrosoftRemoteAssist_8wekyb3d8bbwe!Microsoft.RemoteAssist | -| Feedback Hub | Microsoft.WindowsFeedbackHub_8wekyb3d8bbwe!App | -| File Explorer | microsoft.windowscommunicationsapps_8wekyb3d8bbwe!microsoft.windowslive.mail | -| Mail | c5e2524a-ea46-4f67-841f-6a9465d9d515_cw5n1h2txyewy!App | -| Microsoft Edge | Microsoft.MicrosoftEdge_8wekyb3d8bbwe!MicrosoftEdge | -| Microsoft Store | Microsoft.WindowsStore_8wekyb3d8bbwe!App | -| Movies & TV | Microsoft.ZuneVideo_8wekyb3d8bbwe!Microsoft.ZuneVideo | -| OneDrive | microsoft.microsoftskydrive_8wekyb3d8bbwe!App | -| Photos | Microsoft.Windows.Photos_8wekyb3d8bbwe!App | -| Settings | HolographicSystemSettings_cw5n1h2txyewy!App | -| Tips | Microsoft.HoloLensTips_8wekyb3d8bbwe!HoloLensTips | -| Camera | HoloCamera_cw5n1h2txyewy!HoloCamera | -| Device Picker | HoloDevicesFlow_cw5n1h2txyewy!HoloDevicesFlow | - -For more information on settings for both modes of Kiosk visit [here](https://docs.microsoft.com/intune/configuration/kiosk-settings-holographic). - -### [MDM] 3. Assign the policy to the group to receive the policy - -Once you have created and saved your Kiosk mode policy you must assign it to the group(s) that you want it deployed to, or your devices will never receive it. - -Click assignments and add the group(s) that you want the Kiosk mode policy deployed to. - -> [!IMPORTANT] -> If two more or more different kiosk polices target a device they will conflict and the device will receive neither. Other policies such as device restrictions do not conflict with Kiosk mode or additional device restrictions. - -For more information on group type, and group assignments please visit [here](https://docs.microsoft.com/intune/configuration/device-profile-assign). - -There is an important distinction between the **User logon type** and the **Assignments**. Assignments is how the deployment of the Kiosk to a device is determined. Once a Kiosk policy is on the device, it uses the User logon type to determine which users should be using the Kiosk. - -**Examples:** - -- You have a single group that you use for both logon type and assignments. Users A B and C are in both groups. No matter which user the device is first set up for they will join the tenant in this group and the kiosk policy will deploy. Also each user is in the group used for logon type so users A B and C will all experience the Kiosk. - -- You have an assignment group with users A, B and C in it. The group used for logon type is different with users B and C. Even if user A sets up the device and joins the tenant with the device the Kiosk policy will still deploy. Users B and C will still be logged in to the Kiosk, but user A can still log in if troubleshooting, changing of settings or any other need for full access to windows is needed. - -- You have devices you contract out to two different vendors. Instead of user groups you have device groups. Each device group needs a different Kiosk. Those devices when joined receive policy for their own respective Kiosk. The logon user group may include users from both sites, and thus each regional area's device would allow kiosks for both sets of users. - -### Set up the device - -Now it's time to set up the device to both receive the policy and log into the account the policy has enabled for kiosk mode. - -#### [MDM] 4. Set up a single-app kiosk - -Since Single-app kiosk mode targets a local user or Microsoft account you need to take a few extra steps to [enroll the HoloLens in MDM](hololens-enroll-mdm.md), but sign in will be easy and can be automatic. - -During OOBE sign into your **Microsoft Account** specified as a **Logon User Account**. - -Then enroll the device so that your **device is enrolled in a group** for a group selected under the Kiosk mode policy's **assignment**. - -Give your store app a short amount time to download as well as policy to be applied, once it is restart the device. Once your account is signed in your Kiosk mode will be enabled and your app should automatically launch. - -If you're not seeing your Kiosk mode yet, make sure to [check the assignment status](https://docs.microsoft.com/intune/configuration/device-profile-monitor). - -#### [MDM] 4. Set up a multi-app kiosk - -For multi app Kiosk you'll be using a device that you Azure AD join to your tenant during OOBE. - -If you're targeting a user group. you'll want to sign in to an account that is a member of a group that's also a group that the Kiosk is assigned to. - -Once you've completed OOBE, if you have apps you need to manually install via sideloading or the Microsoft store please do so. If your apps are going to install automatically, such as being a [required app](https://docs.microsoft.com/mem/intune/apps/apps-deploy#assign-an-app) for the same group that the Kiosk mode is assigned to, then it will become a part of your kiosk even if you enter the kiosk before it finishes downloading. - -To enable Kiosk mode simply **sign out** of your account and **sign in** to a profile that is a member of a group targeted by the Logon user account setting. (This may be the same user.) - -If you're not seeing your Kiosk mode yet, make sure to [check the assignment status](https://docs.microsoft.com/intune/configuration/device-profile-monitor). - - - -## Use a provisioning package to set up a single-app or muti-app kiosk - -As part of creating your Provisioning package, you'll need to create a [start layout](#start-layout-for-hololens). - -To set up kiosk mode by using a provisioning package, follow these steps. - -1. [Create an XML file that defines the kiosk configuration.](#create-a-kiosk-configuration-xml-file) -2. [Add the XML file to a provisioning package.](#add-the-kiosk-configuration-xml-file-to-a-provisioning-package) -3. [Apply the provisioning package to HoloLens.](#apply-the-provisioning-package-to-hololens) - -### [PP] 1. Create a kiosk configuration XML file - -Follow [the instructions for creating a kiosk configuration XML file for desktop](https://docs.microsoft.com/windows/configuration/lock-down-windows-10-to-specific-apps#configure-a-kiosk-using-a-provisioning-package), with the following exceptions: - -- Do not include Classic Windows applications (Win32) since they aren't supported on HoloLens. -- Use the [placeholder Start XML](#start-layout-for-hololens) for HoloLens. - -#### Add guest access to the kiosk configuration (optional) - -In the [Configs section of the XML file](https://docs.microsoft.com/windows/configuration/lock-down-windows-10-to-specific-apps#configs), you can configure a special group named **Visitor** to allow guests to use the kiosk. When the kiosk is configured with the **Visitor** special group, a "**Guest**" option is added to the sign-in page. The **Guest** account does not require a password, and any data associated with the account is deleted when the account signs out. - -Use the following snippet in your kiosk configuration XML to enable the **Guest** account: +> [!NOTE] +> If you need to use a custom setting and full XML configuration to set up a kiosk in your MDM service, use the [Start layout instructions for a provisioning package](#start-layout-for-a-provisioning-package). ```xml - - - - - - + + + + + + + + + ``` ### [PP] 2. Add the kiosk configuration XML file to a provisioning package From e4eede7b1fc6848dd0275faf6a40b18ba53a9b84 Mon Sep 17 00:00:00 2001 From: Teresa-Motiv Date: Thu, 23 Apr 2020 11:40:19 -0700 Subject: [PATCH 29/50] Revisions --- devices/hololens/hololens-kiosk.md | 43 ++++++++++++++++-------------- 1 file changed, 23 insertions(+), 20 deletions(-) diff --git a/devices/hololens/hololens-kiosk.md b/devices/hololens/hololens-kiosk.md index 134b8595f0..bcfab903dc 100644 --- a/devices/hololens/hololens-kiosk.md +++ b/devices/hololens/hololens-kiosk.md @@ -192,39 +192,42 @@ To set up kiosk mode by using Microsoft Intune or another MDM system, follow the Your next settings after this will be different depending on if you pick Single app kiosk or Multi app kiosk. -For full details creating a device profile for Kiosk mode check out [Kiosk settings](https://docs.microsoft.com/intune/configuration/kiosk-settings). +For full details about creating a kiosk configuration profile, see [Windows 10 and Windows Holographic for Business device settings to run as a dedicated kiosk using Intune](https://docs.microsoft.com/intune/configuration/kiosk-settings). -### Select the settings for your kiosk +### [MDM] 2. Configure the settings for a single-app kiosk +This section summarizes the settings that a single-app kiosk requires. For more detailed information, see the following locations: -For more information on settings for both modes of Kiosk visit [here](https://docs.microsoft.com/intune/configuration/kiosk-settings-holographic). -[Windows Holographic for Business device settings to run as a kiosk in Intune](https://docs.microsoft.com/mem/intune/configuration/kiosk-settings-holographic) +- For information about how to configure a kiosk configuration profile in Intune, see [How to Configure Kiosk Mode Using Microsoft Intune](hololens-commercial-infrastructure.md#how-to-configure-kiosk-mode-using-microsoft-intune). +- For more information about the available settings for single-app kiosks in Intune, see [Single full-screen app kiosks](https://docs.microsoft.com/intune/configuration/kiosk-settings-holographic#single-full-screen-app-kiosks) +- For other MDM services, check your provider's documentation for instructions. If you need to use a custom setting and full XML configuration to set up a kiosk in your MDM service, [create an XML file that defines the kiosk configuration](#create-a-kiosk-configuration-xml-file). -[Windows 10 and Windows Holographic for Business device settings to run as a dedicated kiosk using Intune](https://docs.microsoft.com/mem/intune/configuration/kiosk-settings) +Configure the following settings in the kiosk configuration profile: -#### [MDM] 2. Configure the settings for a single-app kiosk +- **Local user account**. You'll need to enter either the name of your local user, or your Microsoft Account you intend to be logged onto the device. +- **User logon type**.** Select **Local user account** to enter the local (to the device) user account, or a Microsoft Account (MSA) account that is associated with the kiosk app. **Autologon** user account types aren't supported on Windows Holographic for Business. +- **Application type**. Select **Store app**, and then select an app from the list. -Select **Single-app kiosk**, then select **Local user account**. You'll need to enter either the name of your local user, or your Microsoft Account you intend to be logged onto the device. -Finally you'll select the one app you want to be used in your kiosk. Ideally this should be a store app. -For full details visit [here](https://docs.microsoft.com/intune/configuration/kiosk-settings-holographic#single-full-screen-app-kiosks). +### [MDM] 2. Configure the settings for a multi-app kiosk -#### [MDM] 2. Configure the settings for a multi-app kiosk - -Additional information: - -- You can optionally use a custom Start layout. For more information, see [Start layout file for MDM (Intune and others)](#start-layout-file-for-mdm-intune-and-others). -- For HoloLens devices that are managed by Microsoft Intune, directions can be found [here](hololens-commercial-infrastructure.md#how-to-configure-kiosk-mode-using-microsoft-intune). +This section summarizes the settings that a multi-app kiosk requires. For more detailed information, see the following locations: +- For information about how to configure a kiosk configuration profile in Intune, see [How to Configure Kiosk Mode Using Microsoft Intune](hololens-commercial-infrastructure.md#how-to-configure-kiosk-mode-using-microsoft-intune). +- For more information about the available settings for multi-app kiosks in Intune, see [Multi-app kiosks](https://docs.microsoft.com/mem/intune/configuration/kiosk-settings-holographic#multi-app-kiosks) - For other MDM services, check your provider's documentation for instructions. If you need to use a custom setting and full XML configuration to set up a kiosk in your MDM service, [create an XML file that defines the kiosk configuration](#create-a-kiosk-configuration-xml-file), and make sure to include the [Start layout](#start-layout-for-a-provisioning-package) in the XML file. +- You can optionally use a custom Start layout with Intune or other MDM services. For more information, see [Start layout file for MDM (Intune and others)](#start-layout-file-for-mdm-intune-and-others). -**Target Windows 10 in S mode devices**: Choose **No**. S mode isn't supported on Windows Holographic for Business. -For **User logon type**: Add one or more user accounts that can use the apps you add. Your options that work with Windows Holographic are: **Azure AD user or group** or **HoloLens visitor**. +Configure the following settings in the kiosk configuration profile: -It's important that the group or groups you choose includes users you want to use the Kiosk, if a user signs in with an account not included in this list they will not have a Kiosk experience. +- **Target Windows 10 in S mode devices**. Select **No**. S mode isn't supported on Windows Holographic for Business. +- **User logon type**. Select **Azure AD user or group** or **HoloLens visitor**, and then add one or more user groups or accounts. + + Only users that belong to the groups or accounts that you specify in **User logon type** can use the kiosk experience. -Now you choose which Apps to include in your kiosk. You may choose to add just one or add many. +- Apps. You may choose to add just one or add many apps. You can use the following options to add apps: -To choose an app you've uploaded as a **Line of business app** choose the **Add store app** option. You many also choose to add an app via it's **Application user model ID** by selecting **Add by AUMID**. + - To add an uploaded line of business app, select **Add store app**. + - To add an app by specifying its AUMID, select **Add by AUMID**. ### [MDM] 3. Assign the kiosk configuration profile to the device group From 49060a8cf17641e4d775cc2123efd08cd72c9254 Mon Sep 17 00:00:00 2001 From: Teresa-Motiv Date: Thu, 23 Apr 2020 17:05:00 -0700 Subject: [PATCH 30/50] Revisions (TBC) --- devices/hololens/hololens-kiosk.md | 37 +++++++++++++++++++----------- 1 file changed, 23 insertions(+), 14 deletions(-) diff --git a/devices/hololens/hololens-kiosk.md b/devices/hololens/hololens-kiosk.md index bcfab903dc..d9de3fedf8 100644 --- a/devices/hololens/hololens-kiosk.md +++ b/devices/hololens/hololens-kiosk.md @@ -116,15 +116,21 @@ If you use an MDM system or a provisioning package to configure kiosk mode, you ### Plan user and device groups -In an MDM environment, you use user groups and device groups to manage device configurations and user access. For a full discussion of the roles of user groups and device groups in Intune, see [Assign user and device profiles in Microsoft Intune: User groups vs. device groups](https://docs.microsoft.com/intune/configuration/device-profile-assign). Because these groups are security groups (for example, Azure Active Directory, or Azure AD, security groups) you can use a single group for devices and users. Separate groups are typically easier to manage. +In an MDM environment, you use user groups and device groups to manage device configurations and user access. For a full discussion of the roles of user groups and device groups in Intune, see [Assign user and device profiles in Microsoft Intune: User groups vs. device groups](https://docs.microsoft.com/intune/configuration/device-profile-assign). + +The kiosk configuration profile includes the **User logon type** setting. **User logon type** identifies the user (or group that contains the users) who can use the app (or apps) that you add. If a user signs in by using an account that is not included in the configuration profile, that user cannot use apps on the kiosk. Similarly, if a device does not belong to a group that has an assigned kiosk configuration, that device does not provide a kiosk experience for any user. + +> [!NOTE] +> The **User logon type** of a single-app kiosk specifies a single user account. This is the user context under which the kiosk runs. The **User logon type** of a multi-app kiosk can specify one or more user accounts or groups that can use the kiosk. + +In addition, you assign the configuration profile to a group. This group can be the same as that specified by **User logon type**, or a different group. These settings provide flexibility in how you manage user access and device behavior: + +- To associate the kiosk configuration with the users who sign on to devices, assign the kiosk configuration profile to the group that contains the users. +- To associate the kiosk configuration with specific devices, assign the kiosk configuration profile to a group that contains the devices (such groups can include dynamically-generated groups that automatically enroll devices that meet certain criteria). -In short, you assign a user group to a kiosk configuration profile, and you assign the profile to a device group. If a user signs in by using an account that is not included in the appropriate group, that user does not have a kiosk experience. Similarly, if a device does not belong to a device group that has an assigned kiosk configuration, that device does not provide a kiosk experience for any user. -#### User-dependent experiences -When you configure a HoloLens device as a single-app kiosk, all of the users who sign on to that device see the kiosk experience. Users who do not belong to an appropriately configured user group cannot use the device. -When you configure a HoloLens device as a multi-app kiosk, the device can provide a kiosk experience to one group of users and a non-kiosk experience to another group of users. In other words, it can function as a kiosk or as a normal HoloLens device, depending on who signs in. #### Profile conflicts @@ -132,14 +138,17 @@ If two or more kiosk configuration profiles target the same device, they conflic Other types of profiles and policies, such as device restrictions that are not related to the kiosk configuration profile, do not conflict with the kiosk configuration profile. + + + #### Examples of how to use groups - You use a single group for both devices and users. One device and users A, B, and C are members of this group. No matter which user signs on to the device first (and goes through the Out-of-Box Experience, or OOBE), the kiosk configuration deploys to the device. Users A, B, and C can all sign in to the device and get the kiosk experience. -- You use a device group and a user group. Users A, B, and C are members of the device group. Users B and C are also members of the user group (user A is not a member). No matter which user signs on to the device first, the kiosk configuration deploys to the device. However, after that the user experiences differ as follows: +- You use multiple groups. Users A, B, and C are members of Group 1. The HoloLens device is also a member of Group 1. Users B and C are also members of Group 2 (user A is not a member). No matter which user signs on to the device first, the kiosk configuration deploys to the device. However, after that the user experiences differ as follows: - Users B and C can sign in to the device, and they get the kiosk experience. - - User A can sign in to the device, but does not get the kiosk experience. If the device is a multi-app kiosk, user A can use the device as a typical non-kiosk device. + - User A can sign in to the device, but does not get the kiosk experience. User A can use the device as a typical non-kiosk device. - You contract devices out to two different vendors who need different kiosk experiences. Each vendor's devices belong to a unique device group. You create a different kiosk configuration profile for each vendor, and assign each vendor's profile to its device group. @@ -180,6 +189,7 @@ To set up kiosk mode by using Microsoft Intune or another MDM system, follow the - [Configure the settings for a single-app kiosk](#mdmconfigsingle). - [Configure the settings for a multi-app kiosk](#mdmconfigmulti). 1. [Assign the kiosk configuration profile to the device group](#mdmassign). +1. [Prepare to enroll the devices](#mdmenroll) 1. Deploy the devices. - [Deploy a single-app kiosk](#mdmsingledeploy). - [Deploy a multi-app kiosk](#mdmmultideploy). @@ -204,8 +214,7 @@ This section summarizes the settings that a single-app kiosk requires. For more Configure the following settings in the kiosk configuration profile: -- **Local user account**. You'll need to enter either the name of your local user, or your Microsoft Account you intend to be logged onto the device. -- **User logon type**.** Select **Local user account** to enter the local (to the device) user account, or a Microsoft Account (MSA) account that is associated with the kiosk app. **Autologon** user account types aren't supported on Windows Holographic for Business. +- **User logon type** Select **Local user account** to enter the local (to the device) user account, or a Microsoft Account (MSA) account that is associated with the kiosk app. **Autologon** user account types aren't supported on Windows Holographic for Business. - **Application type**. Select **Store app**, and then select an app from the list. ### [MDM] 2. Configure the settings for a multi-app kiosk @@ -231,15 +240,15 @@ Configure the following settings in the kiosk configuration profile: ### [MDM] 3. Assign the kiosk configuration profile to the device group -Once you have created and saved your Kiosk mode policy you must assign it to the group(s) that you want it deployed to, or your devices will never receive it. +Use the **Assignments** page of the kiosk configuration profile to assign the profile to one or more device groups. -Click assignments and add the group(s) that you want the Kiosk mode policy deployed to. +### [MDM] 4. Prepare to enroll the devices -### Deploy the devices +You can configure your MDM system to enroll HoloLens devices automatically when the user first signs in, or have users enroll devices manually. For more information about enrolling the devices, see [Enroll HoloLens in MDM](hololens-enroll-mdm.md) and [Intune enrollment methods for Windows devices](https://docs.microsoft.com/mem/intune/enrollment/windows-enrollment-methods). -Now it's time to set up the device to both receive the policy and log into the account the policy has enabled for kiosk mode. +### [MDM] 4. Deploy a single-app kiosk -#### [MDM] 4. Deploy a single-app kiosk +When you use an MDM system, you can enroll the device in MDM during OOBE. If appropriate, provide the information that's required for enrollment to the users for the OOBE process. Since Single-app kiosk mode targets a local user or Microsoft account you need to take a few extra steps to [enroll the HoloLens in MDM](hololens-enroll-mdm.md), but sign in will be easy and can be automatic. From 0a9e776ec6eaedf0fefd637f1ab76ecc182e4383 Mon Sep 17 00:00:00 2001 From: Teresa-Motiv Date: Fri, 24 Apr 2020 09:38:25 -0700 Subject: [PATCH 31/50] Revisions --- devices/hololens/hololens-kiosk.md | 98 +++++++++++++++--------------- 1 file changed, 49 insertions(+), 49 deletions(-) diff --git a/devices/hololens/hololens-kiosk.md b/devices/hololens/hololens-kiosk.md index d9de3fedf8..ee917f8b5d 100644 --- a/devices/hololens/hololens-kiosk.md +++ b/devices/hololens/hololens-kiosk.md @@ -262,37 +262,38 @@ If you're not seeing your Kiosk mode yet, make sure to [check the assignment sta #### [MDM] 4. Deploy a multi-app kiosk + +When you use an MDM system, you can enroll the device in MDM during OOBE. If appropriate, provide the information that's required for enrollment to the users for the OOBE process. For multi app Kiosk you'll be using a device that you Azure AD join to your tenant during OOBE. If you're targeting a user group. you'll want to sign in to an account that is a member of a group that's also a group that the Kiosk is assigned to. Once you've completed OOBE, if you have apps you need to manually install via sideloading or the Microsoft store please do so. If your apps are going to install automatically, such as being a [required app](https://docs.microsoft.com/mem/intune/apps/apps-deploy#assign-an-app) for the same group that the Kiosk mode is assigned to, then it will become a part of your kiosk even if you enter the kiosk before it finishes downloading. -To enable Kiosk mode simply **sign out** of your account and **sign in** to a profile that is a member of a group targeted by the Logon user account setting. (This may be the same user.) +To enable Kiosk mode, simply sign out of your account and sign in to a profile that is a member of a group targeted by the **User logon type** setting. (This may be the same user.) If you're not seeing your Kiosk mode yet, make sure to [check the assignment status](https://docs.microsoft.com/intune/configuration/device-profile-monitor). ## Use a provisioning package to set up a single-app or muti-app kiosk -As part of creating your Provisioning package, you'll need to create a [start layout](#start-layout-for-hololens). +As part of creating your Provisioning package, you'll need to create a [Start layout](#start-layout-for-hololens). To set up kiosk mode by using a provisioning package, follow these steps. -1. [Create an XML file that defines the kiosk configuration.](#create-a-kiosk-configuration-xml-file) +1. [Create an XML file that defines the kiosk configuration.](#ppkioskconfig) 2. [Add the XML file to a provisioning package.](#add-the-kiosk-configuration-xml-file-to-a-provisioning-package) 3. [Apply the provisioning package to HoloLens.](#apply-the-provisioning-package-to-hololens) - -### Create a kiosk configuration XML file +### [PP] 1. Create a kiosk configuration XML file Follow [the instructions for creating a kiosk configuration XML file for desktop](https://docs.microsoft.com/windows/configuration/lock-down-windows-10-to-specific-apps#configure-a-kiosk-using-a-provisioning-package), with the following exceptions: - Do not include Classic Windows applications (Win32). HoloLens does not support these applications. - Use the [placeholder Start XML](#start-layout-for-hololens) for HoloLens. -#### Add guest access to the kiosk configuration (optional) +#### Add guest access to the kiosk configuration (optional) -In the [Configs section of the XML file](https://docs.microsoft.com/windows/configuration/lock-down-windows-10-to-specific-apps#configs), you can configure a special group named **Visitor** to allow guests to use the kiosk. When the kiosk is configured with the **Visitor** special group, a "**Guest**" option is added to the sign-in page. The **Guest** account does not require a password, and any data associated with the account is deleted when the account signs out. +In the [**Configs** section of the XML file](https://docs.microsoft.com/windows/configuration/lock-down-windows-10-to-specific-apps#configs), you can configure a special group named **Visitor** to allow guests to use the kiosk. When the kiosk is configured with the **Visitor** special group, a "**Guest**" option is added to the sign-in page. The **Guest** account does not require a password, and any data associated with the account is deleted when the account signs out. Use the following snippet in your kiosk configuration XML to enable the **Guest** account: @@ -305,7 +306,7 @@ Use the following snippet in your kiosk configuration XML to enable the **Guest* ``` -## Start layout for HoloLens +#### Start layout for HoloLens If you use a [provisioning package](#set-up-kiosk-mode-by-using-a-provisioning-package) to configure a multi-app kiosk, the procedure requires a Start layout. Start layout customization isn't supported in Windows Holographic for Business, so you'll need to use a placeholder Start layout. @@ -339,7 +340,7 @@ You will [create an XML file](#set-up-kiosk-mode-by-using-a-provisioning-package ``` -### Start layout file for MDM (Intune and others) +#### Start layout file for MDM (Intune and others) Save the following sample as an XML file. You can use this file when you configure the multi-app kiosk in Microsoft Intune (or in another MDM service that provides a kiosk profile). @@ -365,66 +366,65 @@ Save the following sample as an XML file. You can use this file when you configu ### [PP] 2. Add the kiosk configuration XML file to a provisioning package 1. Open [Windows Configuration Designer](https://www.microsoft.com/store/apps/9nblggh4tx22). -2. Choose **Advanced provisioning**. -3. Name your project, and click **Next**. -4. Choose **Windows 10 Holographic** and click **Next**. -5. Select **Finish**. The workspace for your package opens. -6. Expand **Runtime settings** > **AssignedAccess** > **MultiAppAssignedAccessSettings**. -7. In the center pane, click **Browse** to locate and select the kiosk configuration XML file that you created. +1. Select **Advanced provisioning**. +1. Name your project, and then select **Next**. +1. Select **Windows 10 Holographic**, and then select **Next**. +1. Select **Finish**. The workspace for your package opens. +1. Select **Runtime settings** > **AssignedAccess** > **MultiAppAssignedAccessSettings**. +1. In the center pane, select **Browse** to locate and select the kiosk configuration XML file that you created. - ![Screenshot of the MultiAppAssignedAccessSettings field in Windows Configuration Designer](images/multiappassignedaccesssettings.png) + ![Screenshot of the MultiAppAssignedAccessSettings field in Windows Configuration Designer](./images/multiappassignedaccesssettings.png) -8. (**Optional**: If you want to apply the provisioning package after device initial setup and there is an admin user already available on the kiosk device, skip this step.) Create an admin user account in **Runtime settings** > **Accounts** > **Users**. Provide a **UserName** and **Password**, and select **UserGroup** as **Administrators**. With this account, you can view the provisioning status and logs if needed. -9. (**Optional**: If you already have a non-admin account on the kiosk device, skip this step.) Create a local standard user account in **Runtime settings** > **Accounts** > **Users**. Make sure the **UserName** is the same as the account that you specify in the configuration XML. Select **UserGroup** as **Standard Users**. -10. On the **File** menu, select **Save.** -11. On the **Export** menu, select **Provisioning package**. -12. Change **Owner** to **IT Admin**, which will set the precedence of this provisioning package higher than provisioning packages applied to this device from other sources, and then select **Next.** - -13. On the **Provisioning package security** page, do not select **Enable package encryption** or provisioning will fail on HoloLens. You can choose to enable package signing. - - - **Enable package signing** - If you select this option, you must select a valid certificate to use for signing the package. You can specify the certificate by clicking **Browse** and choosing the certificate you want to use to sign the package. - -14. Click **Next** to specify the output location where you want the provisioning package to go when it's built. By default, Windows Configuration Designer uses the project folder as the output location. Optionally, you can click **Browse** to change the default output location. - -15. Click **Next**. - -16. Click **Build** to start building the package. The provisioning package doesn't take long to build. The project information is displayed in the build page and the progress bar indicates the build status. +1. **Optional**. (If you want to apply the provisioning package after device initial setup and there is an admin user already available on the kiosk device, skip this step.) Create an admin user account in **Runtime settings** > **Accounts** > **Users**. Provide a **UserName** and **Password**, and select **UserGroup** as **Administrators**. By using this account, you can view the provisioning status and logs. +1. **Optional**. (If you already have a non-admin account on the kiosk device, skip this step.) Create a local standard user account in **Runtime settings** > **Accounts** > **Users**. Make sure the **UserName** is the same as the account that you specify in the configuration XML. For **UserGroup**, select **Standard Users**. +1. Select **File** > **Save**. +1. Select **Export** > **Provisioning package**, and then set **Owner** to **IT Admin**. This sets the precedence of this provisioning package higher than provisioning packages that are applied to this device from other sources. +1. Select **Next**. +1. On the **Provisioning package security** page, select a security option. + > [!IMPORTANT] + > If you select **Enable package signing**, you also have to select a valid certificate to use for signing the package. To do this, select **Browse** and select the certificate that you want to use to sign the package. + + > [!CAUTION] + > Do not select **Enable package encryption**. On HoloLens devices, this setting causes provisioning to fail. +1. Select **Next**. +1. Specify the output location where you want the provisioning package to go when it's built. By default, Windows Configuration Designer uses the project folder as the output location. If you want to change the output location, select **Browse**. When finished, select **Next**. +1. Select **Build** to start building the package. The provisioning package doesn't take long to build. The build page displays the project information, and the progress bar indicates the build status. ### [PP] 3. Apply the provisioning package to HoloLens -You can initially [apply a provisioning package to HoloLens during setup](hololens-provisioning.md#apply-a-provisioning-package-to-hololens-during-setup). +The "Configure HoloLens by using a provisioning package" article provides detailed instructions for applying the provisioning package under the following circumstances: -You can also [apply a provisioning package to HoloLens after setup](hololens-provisioning.md#4-apply-a-provisioning-package-to-hololens-after-setup). +- You can initially [apply a provisioning package to HoloLens during setup](hololens-provisioning.md#apply-a-provisioning-package-to-hololens-during-setup). + +- You can also [apply a provisioning package to HoloLens after setup](hololens-provisioning.md#4-apply-a-provisioning-package-to-hololens-after-setup). ## Use the Windows Device Portal to set up a single-app kiosk To set up kiosk mode by using the Windows Device Portal, follow these steps. -1. [Set up the HoloLens to use the Windows Device Portal](https://developer.microsoft.com/windows/mixed-reality/using_the_windows_device_portal#setting_up_hololens_to_use_windows_device_portal). The Device Portal is a web server on your HoloLens that you can connect to from a web browser on your PC. +> [!IMPORTANT] +> Kiosk mode is only available if the device has [Windows Holographic for Business](hololens1-upgrade-enterprise.md) installed. - > [!IMPORTANT] - > When you set up HoloLens to use the Device Portal, you must enable **Developer Mode** on the device. **Developer Mode** on a device that has Windows Holographic for Business enables side-loading of apps, which risks the installation of apps that have not been certified by the Microsoft Store. Administrators can block the ability to enable **Developer Mode** using the **ApplicationManagement/AllowDeveloper Unlock** setting in the [Policy CSP](https://docs.microsoft.com/windows/client-management/mdm/policy-configuration-service-provider). [Learn more about Developer Mode.](https://docs.microsoft.com/windows/uwp/get-started/enable-your-device-for-development#developer-mode) +1. [Set up the HoloLens device to use the Windows Device Portal](https://developer.microsoft.com/windows/mixed-reality/using_the_windows_device_portal#setting_up_hololens_to_use_windows_device_portal). The Device Portal is a web server on your HoloLens that you can connect to from a web browser on your PC. + + > [!CAUTION] + > When you set up HoloLens to use the Device Portal, you have to enable **Developer Mode** on the device. **Developer Mode** on a device that has Windows Holographic for Business enables you to side-load apps. However, this setting creates a risk that a user can install apps that have not been certified by the Microsoft Store. Administrators can block the ability to enable **Developer Mode** by using the **ApplicationManagement/AllowDeveloper Unlock** setting in the [Policy CSP](https://docs.microsoft.com/windows/client-management/mdm/policy-configuration-service-provider). [Learn more about Developer Mode.](https://docs.microsoft.com/windows/uwp/get-started/enable-your-device-for-development#developer-mode) -2. On a PC, connect to the HoloLens using [Wi-Fi](https://developer.microsoft.com/windows/mixed-reality/Using_the_Windows_Device_Portal#connecting_over_wi-fi) or [USB](https://developer.microsoft.com/windows/mixed-reality/Using_the_Windows_Device_Portal#connecting_over_usb). +1. On a computer, connect to the HoloLens by using [Wi-Fi](https://developer.microsoft.com/windows/mixed-reality/Using_the_Windows_Device_Portal#connecting_over_wi-fi) or [USB](https://developer.microsoft.com/windows/mixed-reality/Using_the_Windows_Device_Portal#connecting_over_usb). -3. [Create a user name and password](https://developer.microsoft.com/windows/mixed-reality/Using_the_Windows_Device_Portal#creating_a_username_and_password) if this is the first time you connect to the Windows Device Portal, or enter the user name and password that you previously set up. +1. Do one of the following: + - If you are connecting to the Windows Device Portal for the first time, [create a user name and password](https://developer.microsoft.com/windows/mixed-reality/Using_the_Windows_Device_Portal#creating_a_username_and_password) + - Enter the user name and password that you previously set up. > [!TIP] > If you see a certificate error in the browser, follow [these troubleshooting steps](https://developer.microsoft.com/windows/mixed-reality/Using_the_Windows_Device_Portal#security_certificate). -4. In the Windows Device Portal, click **Kiosk Mode**. +1. In the Windows Device Portal, select **Kiosk Mode**. + +1. Select **Enable Kiosk Mode**, select an app to run when the device starts, and then select **Save**. ![Kiosk Mode](images/kiosk.png) - - > [!NOTE] - > The kiosk mode option will be available if the device has [Windows Holographic for Business](hololens1-upgrade-enterprise.md). - -5. Select **Enable Kiosk Mode**, select an app to run when the device starts, and then select **Save**. - -6. Reboot the HoloLens. If you still have your Device Portal page open you can use the **Power** option in the top right and click **Restart.** - - - +1. Restart HoloLens. If you still have your Device Portal page open, you can select select **Restart** at the top of the page. ## More information From 51a324d7cb43060bb472017a701f48c33e8ef70d Mon Sep 17 00:00:00 2001 From: Teresa-Motiv Date: Fri, 24 Apr 2020 12:22:43 -0700 Subject: [PATCH 32/50] Revisions --- devices/hololens/hololens-kiosk.md | 88 +++++++++++++++++++++++------- 1 file changed, 67 insertions(+), 21 deletions(-) diff --git a/devices/hololens/hololens-kiosk.md b/devices/hololens/hololens-kiosk.md index ee917f8b5d..6a906f35a9 100644 --- a/devices/hololens/hololens-kiosk.md +++ b/devices/hololens/hololens-kiosk.md @@ -116,21 +116,83 @@ If you use an MDM system or a provisioning package to configure kiosk mode, you ### Plan user and device groups -In an MDM environment, you use user groups and device groups to manage device configurations and user access. For a full discussion of the roles of user groups and device groups in Intune, see [Assign user and device profiles in Microsoft Intune: User groups vs. device groups](https://docs.microsoft.com/intune/configuration/device-profile-assign). +In an MDM environment, you use groups to manage device configurations and user access. -The kiosk configuration profile includes the **User logon type** setting. **User logon type** identifies the user (or group that contains the users) who can use the app (or apps) that you add. If a user signs in by using an account that is not included in the configuration profile, that user cannot use apps on the kiosk. Similarly, if a device does not belong to a group that has an assigned kiosk configuration, that device does not provide a kiosk experience for any user. +The kiosk configuration profile includes the **User logon type** setting. **User logon type** identifies the user (or group that contains the users) who can use the app (or apps) that you add. If a user signs in by using an account that is not included in the configuration profile, that user cannot use apps on the kiosk. > [!NOTE] > The **User logon type** of a single-app kiosk specifies a single user account. This is the user context under which the kiosk runs. The **User logon type** of a multi-app kiosk can specify one or more user accounts or groups that can use the kiosk. -In addition, you assign the configuration profile to a group. This group can be the same as that specified by **User logon type**, or a different group. These settings provide flexibility in how you manage user access and device behavior: +Before you can deploy the kiosk configuration to a device, you have to *assign* the kiosk configuration profile to a group that contains the device or a user that can sign on to the device. This setting produces behavior such as the following. -- To associate the kiosk configuration with the users who sign on to devices, assign the kiosk configuration profile to the group that contains the users. -- To associate the kiosk configuration with specific devices, assign the kiosk configuration profile to a group that contains the devices (such groups can include dynamically-generated groups that automatically enroll devices that meet certain criteria). +- If the device is a member of the assigned group, the kiosk configuration deploys to the device the first time that any user signs in on the device. +- If the device is not a member of the assigned group, but a user who is a member of that group signs in, the kiosk configuration deploys to the device at that time. +For a full discussion of the effects of assigning configuration profiles in Intune, see [Assign user and device profiles in Microsoft Intune](https://docs.microsoft.com/intune/configuration/device-profile-assign). +**Example 1** +You use a single group (Group 1) for both devices and users. One device and users A, B, and C are members of this group. You configure the kiosk configuration profile as follows: +- **User logon type**: Group 1 +- **Assigned group**: Group 1 + +No matter which user signs on to the device first (and goes through the Out-of-Box Experience, or OOBE), the kiosk configuration deploys to the device. Users A, B, and C can all sign in to the device and get the kiosk experience. + +**Example 2** + +You use two groups that have the following members: + +- Group 1: + - User A + - User B +- Group 2: + - User A + - User B + - User C + - Device 1 + +You configure the kiosk configuration profile as follows: + +- **User logon type**: Group 1 +- **Assigned group**: Group 2 + +No matter which user signs on to the device first, the kiosk configuration deploys to the device. However, the user experiences differ as follows: + +- Users A and B can sign in to the device, and they get the kiosk experience. +- User C can sign in to the device, but does not get the kiosk experience. User C can use the device as a typical non-kiosk device. + +**Example 3** + +You contract devices out to two different vendors who need different kiosk experiences. Both vendors have users, and you want all of the users to have access to kiosks from both their own vendor and the other vendor. You configure groups as follows: + +- Device Group 1: + - Device 1 (Vendor 1) + - Device 2 (Vendor 1) + +- Device Group 2: + - Device 3 (Vendor 2) + - Device 4 (Vendor 2) + +- User Group: + - User A (Vendor 1) + - User B (Vendor 2) + +You create two kiosk configuration profiles that have the following settings: + +- Kiosk Profile 1: + - **User logon type**: User Group + - **Assigned group**: Device Group 1 + +- Kiosk Profile 2: + - **User logon type**: User Group + - **Assigned group**: Device Group 2 + +These configurations produce the following results: + +- When any user signs on to Device 1 or Device 2, Intune deploys Kiosk Profile 1 to that device. +- When any user signs on to Device 3 or Device 4, Intune deploys Kiosk Profile 2 to that device. +- User A and user B can sign in to any of the four devices. If they sign in to Device 1 or Device 2, they see Vendor 1's kiosk experience. If they sign in to Device 3 or Device 4, they see Vendor 2's kiosk experience. #### Profile conflicts @@ -138,22 +200,6 @@ If two or more kiosk configuration profiles target the same device, they conflic Other types of profiles and policies, such as device restrictions that are not related to the kiosk configuration profile, do not conflict with the kiosk configuration profile. - - - -#### Examples of how to use groups - -- You use a single group for both devices and users. One device and users A, B, and C are members of this group. No matter which user signs on to the device first (and goes through the Out-of-Box Experience, or OOBE), the kiosk configuration deploys to the device. Users A, B, and C can all sign in to the device and get the kiosk experience. - -- You use multiple groups. Users A, B, and C are members of Group 1. The HoloLens device is also a member of Group 1. Users B and C are also members of Group 2 (user A is not a member). No matter which user signs on to the device first, the kiosk configuration deploys to the device. However, after that the user experiences differ as follows: - - - Users B and C can sign in to the device, and they get the kiosk experience. - - User A can sign in to the device, but does not get the kiosk experience. User A can use the device as a typical non-kiosk device. - -- You contract devices out to two different vendors who need different kiosk experiences. Each vendor's devices belong to a unique device group. You create a different kiosk configuration profile for each vendor, and assign each vendor's profile to its device group. - - You use a single user group that includes users from both vendors, and you assign that group to both profiles. As a result, any user can sign in to any device and get a kiosk experience. The specific kiosk experience the user gets depends on the vendor that is associated with the device. - ### Select a deployment method You can select one of three methods to deploy kiosk configurations: From ebb463bbb5f5b32f312ab31189bd6f361a2782ba Mon Sep 17 00:00:00 2001 From: Teresa-Motiv Date: Fri, 24 Apr 2020 14:58:07 -0700 Subject: [PATCH 33/50] Revisions --- devices/hololens/hololens-kiosk.md | 140 ++++++++++++++++------------- 1 file changed, 80 insertions(+), 60 deletions(-) diff --git a/devices/hololens/hololens-kiosk.md b/devices/hololens/hololens-kiosk.md index 6a906f35a9..53196dcfdf 100644 --- a/devices/hololens/hololens-kiosk.md +++ b/devices/hololens/hololens-kiosk.md @@ -88,6 +88,7 @@ If you use an MDM system or a provisioning package to configure kiosk mode, you > [!CAUTION] > You cannot select the Shell app as a kiosk app. In addition, we recommend that you do **not** select the Microsoft Edge, Microsoft Store, or the File Explorer app as kiosk apps. + | App Name | AUMID | |----------------------------|----------------------------------------------------------------------------------| | 3D Viewer | Microsoft.Microsoft3DViewer_8wekyb3d8bbwe!Microsoft.Microsoft3DViewer | @@ -130,6 +131,9 @@ Before you can deploy the kiosk configuration to a device, you have to *assign* For a full discussion of the effects of assigning configuration profiles in Intune, see [Assign user and device profiles in Microsoft Intune](https://docs.microsoft.com/intune/configuration/device-profile-assign). +> [!NOTE] +> The following examples describe multi-app kiosks. Single-app kiosks behave in a similar manner, but only one user account gets the kiosk experience. + **Example 1** You use a single group (Group 1) for both devices and users. One device and users A, B, and C are members of this group. You configure the kiosk configuration profile as follows: @@ -230,118 +234,135 @@ The following table lists the capabilities and benefits of each of the three dep To set up kiosk mode by using Microsoft Intune or another MDM system, follow these steps. +1. [Prepare to enroll the devices](#mdmenroll). 1. [Create a kiosk configuration profile](#create-a-kiosk-configuration-profile). -1. Select the settings that you want to see in your kiosk. +1. Configure the kiosk. - [Configure the settings for a single-app kiosk](#mdmconfigsingle). - [Configure the settings for a multi-app kiosk](#mdmconfigmulti). -1. [Assign the kiosk configuration profile to the device group](#mdmassign). -1. [Prepare to enroll the devices](#mdmenroll) +1. [Assign the kiosk configuration profile to a group](#mdmassign). 1. Deploy the devices. - [Deploy a single-app kiosk](#mdmsingledeploy). - [Deploy a multi-app kiosk](#mdmmultideploy). -### [MDM] 1. Create a kiosk configuration profile -1. Navigate to https://portal.azure.com/ and sign in to your Intune administrator account. -1. Select **Microsoft Intune** > **Device configuration - Profiles** > **Create profile** -1. Walk through the steps setting a name, **Platform** as **Windows 10 and later**, and **Profile** type as **Kiosk**. +### [MDM] 1. Prepare to enroll the devices -Your next settings after this will be different depending on if you pick Single app kiosk or Multi app kiosk. +You can configure your MDM system to enroll HoloLens devices automatically when the user first signs in, or have users enroll devices manually. The devices also have to be joined to your Azure AD domain, and assigned to the appropriate groups. -For full details about creating a kiosk configuration profile, see [Windows 10 and Windows Holographic for Business device settings to run as a dedicated kiosk using Intune](https://docs.microsoft.com/intune/configuration/kiosk-settings). +For more information about enrolling the devices, see [Enroll HoloLens in MDM](hololens-enroll-mdm.md) and [Intune enrollment methods for Windows devices](https://docs.microsoft.com/mem/intune/enrollment/windows-enrollment-methods). -### [MDM] 2. Configure the settings for a single-app kiosk +### [MDM] 2. Create a kiosk configuration profile -This section summarizes the settings that a single-app kiosk requires. For more detailed information, see the following locations: +1. Open the [Azure](https://portal.azure.com/) portal and sign in to your Intune administrator account. +1. Select **Microsoft Intune** > **Device configuration - Profiles** > **Create profile**. +1. Enter a profile name. +1. Select **Platform** > **Windows 10 and later**, and then select **Profile type** >**Device restrictions**. +1. Select **Configure** > **Kiosk**, and then select one of the following: + - To create a single-app kiosk, select **Kiosk Mode** > **Single-app kiosk**. + - To create a multi-app kiosk, select **Kiosk Mode** > **Multi-app kiosk**. +1. To start configuring the kiosk, select **Add**. + +Your next steps differ depending on the type of kiosk that you want. For further information, select one of the following: +- [Single-app kiosk](#mdmconfigsingle) +- [Multi-app kiosk](#mdmconfigmulti) + +For more information about creating a kiosk configuration profile, see [Windows 10 and Windows Holographic for Business device settings to run as a dedicated kiosk using Intune](https://docs.microsoft.com/intune/configuration/kiosk-settings). + +### [MDM] 3. Configure the settings for a single-app kiosk + +This section summarizes the settings that a single-app kiosk requires. For more detailed information, see the following articles: - For information about how to configure a kiosk configuration profile in Intune, see [How to Configure Kiosk Mode Using Microsoft Intune](hololens-commercial-infrastructure.md#how-to-configure-kiosk-mode-using-microsoft-intune). - For more information about the available settings for single-app kiosks in Intune, see [Single full-screen app kiosks](https://docs.microsoft.com/intune/configuration/kiosk-settings-holographic#single-full-screen-app-kiosks) - For other MDM services, check your provider's documentation for instructions. If you need to use a custom setting and full XML configuration to set up a kiosk in your MDM service, [create an XML file that defines the kiosk configuration](#create-a-kiosk-configuration-xml-file). -Configure the following settings in the kiosk configuration profile: +1. Select **User logon type** > **Local user account**, and enter the user name of the local (device) account or Microsoft Account (MSA) that can sign in to the kiosk. + > [!NOTE] + > **Autologon** user account types aren't supported on Windows Holographic for Business. +1. Select **Application type** > **Store app**, and then select an app from the list. -- **User logon type** Select **Local user account** to enter the local (to the device) user account, or a Microsoft Account (MSA) account that is associated with the kiosk app. **Autologon** user account types aren't supported on Windows Holographic for Business. -- **Application type**. Select **Store app**, and then select an app from the list. +Your next step is to [assign](#mdmassign) the profile to a group. -### [MDM] 2. Configure the settings for a multi-app kiosk +### [MDM] 3. Configure the settings for a multi-app kiosk -This section summarizes the settings that a multi-app kiosk requires. For more detailed information, see the following locations: +This section summarizes the settings that a multi-app kiosk requires. For more detailed information, see the following articles: - For information about how to configure a kiosk configuration profile in Intune, see [How to Configure Kiosk Mode Using Microsoft Intune](hololens-commercial-infrastructure.md#how-to-configure-kiosk-mode-using-microsoft-intune). - For more information about the available settings for multi-app kiosks in Intune, see [Multi-app kiosks](https://docs.microsoft.com/mem/intune/configuration/kiosk-settings-holographic#multi-app-kiosks) - For other MDM services, check your provider's documentation for instructions. If you need to use a custom setting and full XML configuration to set up a kiosk in your MDM service, [create an XML file that defines the kiosk configuration](#create-a-kiosk-configuration-xml-file), and make sure to include the [Start layout](#start-layout-for-a-provisioning-package) in the XML file. - You can optionally use a custom Start layout with Intune or other MDM services. For more information, see [Start layout file for MDM (Intune and others)](#start-layout-file-for-mdm-intune-and-others). -Configure the following settings in the kiosk configuration profile: +1. Select **Target Windows 10 in S mode devices** > **No**. + >[!NOTE] + > S mode isn't supported on Windows Holographic for Business. +1. Select **User logon type** > **Azure AD user or group** or **User logon type** > **HoloLens visitor**, and then add one or more user groups or accounts. -- **Target Windows 10 in S mode devices**. Select **No**. S mode isn't supported on Windows Holographic for Business. -- **User logon type**. Select **Azure AD user or group** or **HoloLens visitor**, and then add one or more user groups or accounts. - - Only users that belong to the groups or accounts that you specify in **User logon type** can use the kiosk experience. + Only users that belong to the groups or accounts that you specify in **User logon type** can use the kiosk experience. -- Apps. You may choose to add just one or add many apps. You can use the following options to add apps: +1. Select one or more apps by using the following options: + - To add an uploaded line-of-business app, select **Add store app** and then select the app you want. + - To add an app by specifying its AUMID, select **Add by AUMID** and then enter the AUMID of the app. [See the list of available AUMIDs](#aumids) - - To add an uploaded line of business app, select **Add store app**. - - To add an app by specifying its AUMID, select **Add by AUMID**. +Your next step is to [assign](#mdmassign) the profile to a group. -### [MDM] 3. Assign the kiosk configuration profile to the device group +### [MDM] 4. Assign the kiosk configuration profile to a group -Use the **Assignments** page of the kiosk configuration profile to assign the profile to one or more device groups. +Use the **Assignments** page of the kiosk configuration profile to set where you want the kiosk configuration to deploy. In the simplest case, you assign the kiosk configuration profile to a group that will contain the HoloLens device when the device enrolls in MDM. -### [MDM] 4. Prepare to enroll the devices +### [MDM] 5. Deploy a single-app kiosk -You can configure your MDM system to enroll HoloLens devices automatically when the user first signs in, or have users enroll devices manually. For more information about enrolling the devices, see [Enroll HoloLens in MDM](hololens-enroll-mdm.md) and [Intune enrollment methods for Windows devices](https://docs.microsoft.com/mem/intune/enrollment/windows-enrollment-methods). +When you use an MDM system, you can enroll the device in MDM during OOBE. After OOBE finishes, device sign-in is easy. -### [MDM] 4. Deploy a single-app kiosk +During OOBE, follow these steps: -When you use an MDM system, you can enroll the device in MDM during OOBE. If appropriate, provide the information that's required for enrollment to the users for the OOBE process. +1. Sign in by using the account that you specified in the kiosk configuration profile. +1. Enroll the device. Make sure that the device is added to the group that the kiosk configuration profile is assigned to. +1. Wait for OOBE to finish, for the store app to download and install, and for policies to be applied. Then restart the device. -Since Single-app kiosk mode targets a local user or Microsoft account you need to take a few extra steps to [enroll the HoloLens in MDM](hololens-enroll-mdm.md), but sign in will be easy and can be automatic. +The next time you sign in to the device, the kiosk app should automatically launch. -During OOBE sign into your **Microsoft Account** specified as a **Logon User Account**. +If you're not seeing your Kiosk mode yet, [check the assignment status](https://docs.microsoft.com/intune/configuration/device-profile-monitor). -Then enroll the device so that your **device is enrolled in a group** for a group selected under the Kiosk mode policy's **assignment**. +### [MDM] 4. Deploy a multi-app kiosk -Give your store app a short amount time to download as well as policy to be applied, once it is restart the device. Once your account is signed in your Kiosk mode will be enabled and your app should automatically launch. +When you use an MDM system, you can join the device to your Azure AD tenant and enroll the device in MDM during OOBE. If appropriate, provide the information that's required for enrollment to the users for the OOBE process. -If you're not seeing your Kiosk mode yet, make sure to [check the assignment status](https://docs.microsoft.com/intune/configuration/device-profile-monitor). +> [!NOTE] +> If you have assigned the kiosk configuration profile to a group that contains users, make sure that one of those user accounts is the first account to sign in to the device. -#### [MDM] 4. Deploy a multi-app kiosk +During OOBE, follow these steps: +1. Sign in by using the account that belongs to the **User logon type** group. +1. Enroll the device. +1. Wait for any apps that are part of the kiosk configuration profile to download and install, and for policies to be applied. +1. After OOBE finishes, you can install additional apps from the Microsoft store or by sideloading. [Required apps](https://docs.microsoft.com/mem/intune/apps/apps-deploy#assign-an-app) for the group that the device belongs to install automatically. +1. Restart the device. -When you use an MDM system, you can enroll the device in MDM during OOBE. If appropriate, provide the information that's required for enrollment to the users for the OOBE process. -For multi app Kiosk you'll be using a device that you Azure AD join to your tenant during OOBE. +The next time you sign in to the device by using an account that belongs to the **User logon type**, the kiosk app should automatically launch. -If you're targeting a user group. you'll want to sign in to an account that is a member of a group that's also a group that the Kiosk is assigned to. - -Once you've completed OOBE, if you have apps you need to manually install via sideloading or the Microsoft store please do so. If your apps are going to install automatically, such as being a [required app](https://docs.microsoft.com/mem/intune/apps/apps-deploy#assign-an-app) for the same group that the Kiosk mode is assigned to, then it will become a part of your kiosk even if you enter the kiosk before it finishes downloading. - -To enable Kiosk mode, simply sign out of your account and sign in to a profile that is a member of a group targeted by the **User logon type** setting. (This may be the same user.) - -If you're not seeing your Kiosk mode yet, make sure to [check the assignment status](https://docs.microsoft.com/intune/configuration/device-profile-monitor). +If you're not seeing your Kiosk mode yet, [check the assignment status](https://docs.microsoft.com/intune/configuration/device-profile-monitor). ## Use a provisioning package to set up a single-app or muti-app kiosk -As part of creating your Provisioning package, you'll need to create a [Start layout](#start-layout-for-hololens). - To set up kiosk mode by using a provisioning package, follow these steps. -1. [Create an XML file that defines the kiosk configuration.](#ppkioskconfig) +1. [Create an XML file that defines the kiosk configuration.](#ppkioskconfig), including a [Start layout](#start-layout-for-hololens). 2. [Add the XML file to a provisioning package.](#add-the-kiosk-configuration-xml-file-to-a-provisioning-package) 3. [Apply the provisioning package to HoloLens.](#apply-the-provisioning-package-to-hololens) ### [PP] 1. Create a kiosk configuration XML file -Follow [the instructions for creating a kiosk configuration XML file for desktop](https://docs.microsoft.com/windows/configuration/lock-down-windows-10-to-specific-apps#configure-a-kiosk-using-a-provisioning-package), with the following exceptions: +Follow [the instructions for creating a kiosk configuration XML file for desktop](https://docs.microsoft.com/windows/configuration/lock-down-windows-10-to-specific-apps#configure-a-kiosk-using-a-provisioning-package), except for the following: - Do not include Classic Windows applications (Win32). HoloLens does not support these applications. - Use the [placeholder Start XML](#start-layout-for-hololens) for HoloLens. +- Optional: Add guest access to the kiosk configuration -#### Add guest access to the kiosk configuration (optional) +#### Optional: Add guest access to the kiosk configuration In the [**Configs** section of the XML file](https://docs.microsoft.com/windows/configuration/lock-down-windows-10-to-specific-apps#configs), you can configure a special group named **Visitor** to allow guests to use the kiosk. When the kiosk is configured with the **Visitor** special group, a "**Guest**" option is added to the sign-in page. The **Guest** account does not require a password, and any data associated with the account is deleted when the account signs out. -Use the following snippet in your kiosk configuration XML to enable the **Guest** account: +To enable the **Guest** account, add the following snippet to your kiosk configuration XML : ```xml @@ -357,14 +378,12 @@ Use the following snippet in your kiosk configuration XML to enable the **Guest* If you use a [provisioning package](#set-up-kiosk-mode-by-using-a-provisioning-package) to configure a multi-app kiosk, the procedure requires a Start layout. Start layout customization isn't supported in Windows Holographic for Business, so you'll need to use a placeholder Start layout. > [!NOTE] -> Because a single-app kiosk launches the kiosk app when a user signs in, it does not use a Start screen and does not need a Start layout. +> Because a single-app kiosk launches the kiosk app when a user signs in, it does not use a Start menu and does not need a Start layout. > [!NOTE] > If you use [MDM](#set-up-kiosk-mode-by-using-microsoft-intune-or-mdm) to set up a multi-app kiosk, you can optionally use a Start layout. For more information, see [Start layout file for MDM (Intune and others)](#start-layout-file-for-mdm-intune-and-others). -### Create a start layout for a customized multi-app kiosk - -You will [create an XML file](#set-up-kiosk-mode-by-using-a-provisioning-package) to define the kiosk configuration to be included in a provisioning package. Use the following sample in the `StartLayout` section of your XML file. +For the Start layout, add the following **StartLayout** section to the kiosk provisioning XML file: ```xml @@ -412,8 +431,7 @@ Save the following sample as an XML file. You can use this file when you configu ### [PP] 2. Add the kiosk configuration XML file to a provisioning package 1. Open [Windows Configuration Designer](https://www.microsoft.com/store/apps/9nblggh4tx22). -1. Select **Advanced provisioning**. -1. Name your project, and then select **Next**. +1. Select **Advanced provisioning**, enter a name for your project, and then select **Next**. 1. Select **Windows 10 Holographic**, and then select **Next**. 1. Select **Finish**. The workspace for your package opens. 1. Select **Runtime settings** > **AssignedAccess** > **MultiAppAssignedAccessSettings**. @@ -421,10 +439,12 @@ Save the following sample as an XML file. You can use this file when you configu ![Screenshot of the MultiAppAssignedAccessSettings field in Windows Configuration Designer](./images/multiappassignedaccesssettings.png) -1. **Optional**. (If you want to apply the provisioning package after device initial setup and there is an admin user already available on the kiosk device, skip this step.) Create an admin user account in **Runtime settings** > **Accounts** > **Users**. Provide a **UserName** and **Password**, and select **UserGroup** as **Administrators**. By using this account, you can view the provisioning status and logs. -1. **Optional**. (If you already have a non-admin account on the kiosk device, skip this step.) Create a local standard user account in **Runtime settings** > **Accounts** > **Users**. Make sure the **UserName** is the same as the account that you specify in the configuration XML. For **UserGroup**, select **Standard Users**. +1. **Optional**. (If you want to apply the provisioning package after device initial setup and there is an admin user already available on the kiosk device, skip this step.) Select **Runtime settings** > **Accounts** > **Users**, and then create a user account. Provide a user name and password, and then select **UserGroup** > **Administrators**. + + By using this account, you can view the provisioning status and logs. +1. **Optional**. (If you already have a non-admin account on the kiosk device, skip this step.) Select **Runtime settings** > **Accounts** > **Users**, and then create a local user account. Make sure the user name is the same as the account that you specify in the configuration XML. Select **UserGroup** > **Standard Users**. 1. Select **File** > **Save**. -1. Select **Export** > **Provisioning package**, and then set **Owner** to **IT Admin**. This sets the precedence of this provisioning package higher than provisioning packages that are applied to this device from other sources. +1. Select **Export** > **Provisioning package**, and then select **Owner** > **IT Admin**. This sets the precedence of this provisioning package higher than provisioning packages that are applied to this device from other sources. 1. Select **Next**. 1. On the **Provisioning package security** page, select a security option. > [!IMPORTANT] From 8ffd49e7451a0cdd76a35e01fe4bcd1a9fbda43c Mon Sep 17 00:00:00 2001 From: Teresa-Motiv Date: Fri, 24 Apr 2020 15:28:26 -0700 Subject: [PATCH 34/50] Link fixes --- devices/hololens/hololens-kiosk.md | 29 +++++++++++------------ devices/hololens/hololens-provisioning.md | 4 ++-- devices/hololens/hololens-requirements.md | 2 +- 3 files changed, 17 insertions(+), 18 deletions(-) diff --git a/devices/hololens/hololens-kiosk.md b/devices/hololens/hololens-kiosk.md index 53196dcfdf..5b25494c44 100644 --- a/devices/hololens/hololens-kiosk.md +++ b/devices/hololens/hololens-kiosk.md @@ -60,7 +60,7 @@ The following table lists the feature capabilities in the different kiosk modes. |Multi-app kiosk |Enabled |Enabled2 |Available2 |Available2 |Available2, 3 |Enabled1 | > 1 Voice commands that relate to disabled features do not function. -> 2 For more information about how to configure these features, see [Select kiosk apps](#select-kiosk-apps). +> 2 For more information about how to configure these features, see [Select kiosk apps](#plan-kiosk-apps). > 3 Even if Cortana is disabled, the built-in voice commands are enabled. The following table lists the user support features of the different kiosk modes. @@ -210,9 +210,9 @@ You can select one of three methods to deploy kiosk configurations: - [Microsoft Intune or other mobile device management (MDM) service](#set-up-kiosk-mode-by-using-microsoft-intune-or-mdm) -- [Provisioning package](#set-up-kiosk-mode-by-using-a-provisioning-package) +- [Provisioning package](#use-a-provisioning-package-to-set-up-a-single-app-or-multi-app-kiosk) -- [Windows Device Portal](#set-up-kiosk-mode-by-using-the-windows-device-portal) +- [Windows Device Portal](#use-the-windows-device-portal-to-set-up-a-single-app-kiosk) > [!NOTE] > Because this method requires that developer mode be enabled on the device, we recommend that you use it only for demonstrations. @@ -235,7 +235,7 @@ The following table lists the capabilities and benefits of each of the three dep To set up kiosk mode by using Microsoft Intune or another MDM system, follow these steps. 1. [Prepare to enroll the devices](#mdmenroll). -1. [Create a kiosk configuration profile](#create-a-kiosk-configuration-profile). +1. [Create a kiosk configuration profile](#mdm-2-create-a-kiosk-configuration-profile). 1. Configure the kiosk. - [Configure the settings for a single-app kiosk](#mdmconfigsingle). - [Configure the settings for a multi-app kiosk](#mdmconfigmulti). @@ -244,7 +244,6 @@ To set up kiosk mode by using Microsoft Intune or another MDM system, follow the - [Deploy a single-app kiosk](#mdmsingledeploy). - [Deploy a multi-app kiosk](#mdmmultideploy). - ### [MDM] 1. Prepare to enroll the devices You can configure your MDM system to enroll HoloLens devices automatically when the user first signs in, or have users enroll devices manually. The devices also have to be joined to your Azure AD domain, and assigned to the appropriate groups. @@ -274,7 +273,7 @@ This section summarizes the settings that a single-app kiosk requires. For more - For information about how to configure a kiosk configuration profile in Intune, see [How to Configure Kiosk Mode Using Microsoft Intune](hololens-commercial-infrastructure.md#how-to-configure-kiosk-mode-using-microsoft-intune). - For more information about the available settings for single-app kiosks in Intune, see [Single full-screen app kiosks](https://docs.microsoft.com/intune/configuration/kiosk-settings-holographic#single-full-screen-app-kiosks) -- For other MDM services, check your provider's documentation for instructions. If you need to use a custom setting and full XML configuration to set up a kiosk in your MDM service, [create an XML file that defines the kiosk configuration](#create-a-kiosk-configuration-xml-file). +- For other MDM services, check your provider's documentation for instructions. If you need to use a custom setting and full XML configuration to set up a kiosk in your MDM service, [create an XML file that defines the kiosk configuration](#ppkioskconfig). 1. Select **User logon type** > **Local user account**, and enter the user name of the local (device) account or Microsoft Account (MSA) that can sign in to the kiosk. > [!NOTE] @@ -289,7 +288,7 @@ This section summarizes the settings that a multi-app kiosk requires. For more d - For information about how to configure a kiosk configuration profile in Intune, see [How to Configure Kiosk Mode Using Microsoft Intune](hololens-commercial-infrastructure.md#how-to-configure-kiosk-mode-using-microsoft-intune). - For more information about the available settings for multi-app kiosks in Intune, see [Multi-app kiosks](https://docs.microsoft.com/mem/intune/configuration/kiosk-settings-holographic#multi-app-kiosks) -- For other MDM services, check your provider's documentation for instructions. If you need to use a custom setting and full XML configuration to set up a kiosk in your MDM service, [create an XML file that defines the kiosk configuration](#create-a-kiosk-configuration-xml-file), and make sure to include the [Start layout](#start-layout-for-a-provisioning-package) in the XML file. +- For other MDM services, check your provider's documentation for instructions. If you need to use a custom setting and full XML configuration to set up a kiosk in your MDM service, [create an XML file that defines the kiosk configuration](#ppkioskconfig), and make sure to include the [Start layout](#Start layout for HoloLens) in the XML file. - You can optionally use a custom Start layout with Intune or other MDM services. For more information, see [Start layout file for MDM (Intune and others)](#start-layout-file-for-mdm-intune-and-others). 1. Select **Target Windows 10 in S mode devices** > **No**. @@ -342,13 +341,13 @@ The next time you sign in to the device by using an account that belongs to the If you're not seeing your Kiosk mode yet, [check the assignment status](https://docs.microsoft.com/intune/configuration/device-profile-monitor). -## Use a provisioning package to set up a single-app or muti-app kiosk +## Use a provisioning package to set up a single-app or multi-app kiosk To set up kiosk mode by using a provisioning package, follow these steps. 1. [Create an XML file that defines the kiosk configuration.](#ppkioskconfig), including a [Start layout](#start-layout-for-hololens). -2. [Add the XML file to a provisioning package.](#add-the-kiosk-configuration-xml-file-to-a-provisioning-package) -3. [Apply the provisioning package to HoloLens.](#apply-the-provisioning-package-to-hololens) +2. [Add the XML file to a provisioning package.](#ppconfigadd) +3. [Apply the provisioning package to HoloLens.](#ppapply) ### [PP] 1. Create a kiosk configuration XML file @@ -375,7 +374,7 @@ To enable the **Guest** account, add the following snippet to your kiosk configu #### Start layout for HoloLens -If you use a [provisioning package](#set-up-kiosk-mode-by-using-a-provisioning-package) to configure a multi-app kiosk, the procedure requires a Start layout. Start layout customization isn't supported in Windows Holographic for Business, so you'll need to use a placeholder Start layout. +If you use a [provisioning package](##use-a-provisioning-package-to-set-up-a-single-app-or-multi-app-kiosk) to configure a multi-app kiosk, the procedure requires a Start layout. Start layout customization isn't supported in Windows Holographic for Business, so you'll need to use a placeholder Start layout. > [!NOTE] > Because a single-app kiosk launches the kiosk app when a user signs in, it does not use a Start menu and does not need a Start layout. @@ -383,7 +382,7 @@ If you use a [provisioning package](#set-up-kiosk-mode-by-using-a-provisioning-p > [!NOTE] > If you use [MDM](#set-up-kiosk-mode-by-using-microsoft-intune-or-mdm) to set up a multi-app kiosk, you can optionally use a Start layout. For more information, see [Start layout file for MDM (Intune and others)](#start-layout-file-for-mdm-intune-and-others). -For the Start layout, add the following **StartLayout** section to the kiosk provisioning XML file: +For the Start layout, add the following **StartLayout** section to the kiosk provisioning XML file: ```xml @@ -410,7 +409,7 @@ For the Start layout, add the following **StartLayout** section to the kiosk pro Save the following sample as an XML file. You can use this file when you configure the multi-app kiosk in Microsoft Intune (or in another MDM service that provides a kiosk profile). > [!NOTE] -> If you need to use a custom setting and full XML configuration to set up a kiosk in your MDM service, use the [Start layout instructions for a provisioning package](#start-layout-for-a-provisioning-package). +> If you need to use a custom setting and full XML configuration to set up a kiosk in your MDM service, use the [Start layout instructions for a provisioning package](#start-layout-for-hololens). ```xml ``` -### [PP] 2. Add the kiosk configuration XML file to a provisioning package +### [PP] 2. Add the kiosk configuration XML file to a provisioning package 1. Open [Windows Configuration Designer](https://www.microsoft.com/store/apps/9nblggh4tx22). 1. Select **Advanced provisioning**, enter a name for your project, and then select **Next**. @@ -456,7 +455,7 @@ Save the following sample as an XML file. You can use this file when you configu 1. Specify the output location where you want the provisioning package to go when it's built. By default, Windows Configuration Designer uses the project folder as the output location. If you want to change the output location, select **Browse**. When finished, select **Next**. 1. Select **Build** to start building the package. The provisioning package doesn't take long to build. The build page displays the project information, and the progress bar indicates the build status. -### [PP] 3. Apply the provisioning package to HoloLens +### [PP] 3. Apply the provisioning package to HoloLens The "Configure HoloLens by using a provisioning package" article provides detailed instructions for applying the provisioning package under the following circumstances: diff --git a/devices/hololens/hololens-provisioning.md b/devices/hololens/hololens-provisioning.md index aa636e08c1..6484efeabd 100644 --- a/devices/hololens/hololens-provisioning.md +++ b/devices/hololens/hololens-provisioning.md @@ -33,7 +33,7 @@ Some of the HoloLens configurations that you can apply in a provisioning package - Set up a Wi-Fi connection - Apply certificates to the device - Enable Developer Mode -- Configure Kiosk mode (Detailed instructions for configuring kiosk mode can be found [here](hololens-kiosk.md#set-up-kiosk-mode-by-using-a-provisioning-package). +- Configure Kiosk mode (Detailed instructions for configuring kiosk mode can be found [here](hololens-kiosk.md#use-a-provisioning-package-to-set-up-a-single-app-or-multi-app-kiosk). ## Provisioning package HoloLens wizard @@ -49,7 +49,7 @@ The HoloLens wizard helps you configure the following settings in a provisioning - Enroll the device in Azure Active Directory, or create a local account - Add certificates - Enable Developer Mode -- Configure kiosk mode. (Detailed instructions for configuring kiosk mode can be found [here](hololens-kiosk.md#set-up-kiosk-mode-by-using-a-provisioning-package)). +- Configure kiosk mode. (Detailed instructions for configuring kiosk mode can be found [here](hololens-kiosk.md##use-a-provisioning-package-to-set-up-a-single-app-or-multi-app-kiosk)). > [!WARNING] > You must run Windows Configuration Designer on Windows 10 to configure Azure Active Directory enrollment using any of the wizards. diff --git a/devices/hololens/hololens-requirements.md b/devices/hololens/hololens-requirements.md index 7a97637124..7c653de149 100644 --- a/devices/hololens/hololens-requirements.md +++ b/devices/hololens/hololens-requirements.md @@ -66,7 +66,7 @@ There are two types of Kiosk Modes: Single app and multi-app. Single app kiosk m **How to Configure Kiosk Mode:** -There are two main ways ([provisioning packages](hololens-kiosk.md#set-up-kiosk-mode-by-using-a-provisioning-package) and [MDM](hololens-kiosk.md#set-up-kiosk-mode-by-using-microsoft-intune-or-mdm)) to deploy kiosk mode for HoloLens. These options will be discussed later in the document; however, you can use the links above to jump to the respective sections in this doc. +There are two main ways ([provisioning packages](hololens-kiosk.md#use-a-provisioning-package-to-set-up-a-single-app-or-multi-app-kiosk) and [MDM](hololens-kiosk.md#set-up-kiosk-mode-by-using-microsoft-intune-or-mdm)) to deploy kiosk mode for HoloLens. These options will be discussed later in the document; however, you can use the links above to jump to the respective sections in this doc. ### Apps and App Specific Scenarios From 2c50d29fd068cfd819ff9a4fd9cbd4d6c71759a1 Mon Sep 17 00:00:00 2001 From: Teresa-Motiv Date: Fri, 24 Apr 2020 16:08:34 -0700 Subject: [PATCH 35/50] typos --- devices/hololens/hololens-kiosk.md | 13 +++++++------ 1 file changed, 7 insertions(+), 6 deletions(-) diff --git a/devices/hololens/hololens-kiosk.md b/devices/hololens/hololens-kiosk.md index 5b25494c44..fdc46ab8fd 100644 --- a/devices/hololens/hololens-kiosk.md +++ b/devices/hololens/hololens-kiosk.md @@ -1,5 +1,5 @@ --- -title: Set up HoloLens as a kiosk for specific applications +title: Set up HoloLens as a kiosk description: Use a kiosk configuration to lock down the apps on HoloLens. ms.prod: hololens ms.sitesec: library @@ -7,7 +7,7 @@ author: dansimp ms.author: dansimp ms.topic: article ms.localizationpriority: medium -ms.date: 03/12/2020 +ms.date: 04/27/2020 ms.custom: - CI 115262 - CI 111456 @@ -208,7 +208,7 @@ Other types of profiles and policies, such as device restrictions that are not r You can select one of three methods to deploy kiosk configurations: -- [Microsoft Intune or other mobile device management (MDM) service](#set-up-kiosk-mode-by-using-microsoft-intune-or-mdm) +- [Microsoft Intune or other mobile device management (MDM) service](#use-microsoft-intune-or-other-mdm-to-set-up-a-single-app-or-multi-app-kiosk) - [Provisioning package](#use-a-provisioning-package-to-set-up-a-single-app-or-multi-app-kiosk) @@ -230,7 +230,7 @@ The following table lists the capabilities and benefits of each of the three dep |Deployment speed | Fastest | Fast | Slow | |Deploy at scale | Not recommended | Not recommended | Recommended | -## Set up kiosk mode by using Microsoft Intune or MDM +## Use Microsoft Intune or other MDM to set up a single-app or multi-app kiosk To set up kiosk mode by using Microsoft Intune or another MDM system, follow these steps. @@ -262,6 +262,7 @@ For more information about enrolling the devices, see [Enroll HoloLens in MDM](h 1. To start configuring the kiosk, select **Add**. Your next steps differ depending on the type of kiosk that you want. For further information, select one of the following: + - [Single-app kiosk](#mdmconfigsingle) - [Multi-app kiosk](#mdmconfigmulti) @@ -361,7 +362,7 @@ Follow [the instructions for creating a kiosk configuration XML file for desktop In the [**Configs** section of the XML file](https://docs.microsoft.com/windows/configuration/lock-down-windows-10-to-specific-apps#configs), you can configure a special group named **Visitor** to allow guests to use the kiosk. When the kiosk is configured with the **Visitor** special group, a "**Guest**" option is added to the sign-in page. The **Guest** account does not require a password, and any data associated with the account is deleted when the account signs out. -To enable the **Guest** account, add the following snippet to your kiosk configuration XML : +To enable the **Guest** account, add the following snippet to your kiosk configuration XML: ```xml @@ -380,7 +381,7 @@ If you use a [provisioning package](##use-a-provisioning-package-to-set-up-a-sin > Because a single-app kiosk launches the kiosk app when a user signs in, it does not use a Start menu and does not need a Start layout. > [!NOTE] -> If you use [MDM](#set-up-kiosk-mode-by-using-microsoft-intune-or-mdm) to set up a multi-app kiosk, you can optionally use a Start layout. For more information, see [Start layout file for MDM (Intune and others)](#start-layout-file-for-mdm-intune-and-others). +> If you use [MDM](#use-microsoft-intune-or-other-mdm-to-set-up-a-single-app-or-multi-app-kiosk) to set up a multi-app kiosk, you can optionally use a Start layout. For more information, see [Start layout file for MDM (Intune and others)](#start-layout-file-for-mdm-intune-and-others). For the Start layout, add the following **StartLayout** section to the kiosk provisioning XML file: From 720a404170e7ac79eedd188d8a78ec4a52a1aaa4 Mon Sep 17 00:00:00 2001 From: Teresa-Motiv Date: Fri, 24 Apr 2020 16:23:23 -0700 Subject: [PATCH 36/50] Link fixes --- devices/hololens/hololens-commercial-infrastructure.md | 2 +- devices/hololens/hololens-requirements.md | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/devices/hololens/hololens-commercial-infrastructure.md b/devices/hololens/hololens-commercial-infrastructure.md index 69cc524581..ddeb2b11b2 100644 --- a/devices/hololens/hololens-commercial-infrastructure.md +++ b/devices/hololens/hololens-commercial-infrastructure.md @@ -175,7 +175,7 @@ Directions for upgrading to the commercial suite can be found [here](https://doc ![Image that shows Configuration of Kiosk Mode in Intune](images/aad-kioskmode.png) -For other MDM services, check your provider's documentation for instructions. If you need to use a custom setting and full XML configuration to set up a kiosk in your MDM service, additional directions can be found [here](hololens-kiosk.md#set-up-kiosk-mode-by-using-microsoft-intune-or-mdm) +For other MDM services, check your provider's documentation for instructions. If you need to use a custom setting and full XML configuration to set up a kiosk in your MDM service, additional directions can be found [here](hololens-kiosk.md#use-microsoft-intune-or-other-mdm-to-set-up-a-single-app-or-multi-app-kiosk) ## Certificates and Authentication diff --git a/devices/hololens/hololens-requirements.md b/devices/hololens/hololens-requirements.md index 7c653de149..c8be6947ae 100644 --- a/devices/hololens/hololens-requirements.md +++ b/devices/hololens/hololens-requirements.md @@ -66,7 +66,7 @@ There are two types of Kiosk Modes: Single app and multi-app. Single app kiosk m **How to Configure Kiosk Mode:** -There are two main ways ([provisioning packages](hololens-kiosk.md#use-a-provisioning-package-to-set-up-a-single-app-or-multi-app-kiosk) and [MDM](hololens-kiosk.md#set-up-kiosk-mode-by-using-microsoft-intune-or-mdm)) to deploy kiosk mode for HoloLens. These options will be discussed later in the document; however, you can use the links above to jump to the respective sections in this doc. +There are two main ways ([provisioning packages](hololens-kiosk.md#use-a-provisioning-package-to-set-up-a-single-app-or-multi-app-kiosk) and [MDM](hololens-kiosk.md#use-microsoft-intune-or-other-mdm-to-set-up-a-single-app-or-multi-app-kiosk)) to deploy kiosk mode for HoloLens. These options will be discussed later in the document; however, you can use the links above to jump to the respective sections in this doc. ### Apps and App Specific Scenarios From d41d3dcab0eab844524269e1c080a4b2ada060c9 Mon Sep 17 00:00:00 2001 From: Teresa-Motiv Date: Mon, 27 Apr 2020 08:47:07 -0700 Subject: [PATCH 37/50] Table formatting cleanup --- devices/hololens/hololens-kiosk.md | 34 +++++++++++++++--------------- 1 file changed, 17 insertions(+), 17 deletions(-) diff --git a/devices/hololens/hololens-kiosk.md b/devices/hololens/hololens-kiosk.md index fdc46ab8fd..6749505830 100644 --- a/devices/hololens/hololens-kiosk.md +++ b/devices/hololens/hololens-kiosk.md @@ -89,23 +89,23 @@ If you use an MDM system or a provisioning package to configure kiosk mode, you > You cannot select the Shell app as a kiosk app. In addition, we recommend that you do **not** select the Microsoft Edge, Microsoft Store, or the File Explorer app as kiosk apps. -| App Name | AUMID | -|----------------------------|----------------------------------------------------------------------------------| -| 3D Viewer | Microsoft.Microsoft3DViewer_8wekyb3d8bbwe!Microsoft.Microsoft3DViewer | -| Calendar | microsoft.windowscommunicationsapps_8wekyb3d8bbwe!microsoft.windowslive.calendar | -| Camera1, 2 | HoloCamera_cw5n1h2txyewy!HoloCamera | -| Cortana3 | Microsoft.549981C3F5F10_8wekyb3d8bbwe!App | -| Device Picker | HoloDevicesFlow_cw5n1h2txyewy!HoloDevicesFlow | -| Dynamics 365 Guides | Microsoft.Dynamics365.Guides_8wekyb3d8bbwe!MicrosoftGuides | -| Dynamics 365 Remote Assist | Microsoft.MicrosoftRemoteAssist_8wekyb3d8bbwe!Microsoft.RemoteAssist | -| Feedback Hub | Microsoft.WindowsFeedbackHub_8wekyb3d8bbwe!App | -| Mail | c5e2524a-ea46-4f67-841f-6a9465d9d515_cw5n1h2txyewy!App | -| Miracast4 | | -| Movies & TV | Microsoft.ZuneVideo_8wekyb3d8bbwe!Microsoft.ZuneVideo | -| OneDrive | microsoft.microsoftskydrive_8wekyb3d8bbwe!App | -| Photos | Microsoft.Windows.Photos_8wekyb3d8bbwe!App | -| Settings | HolographicSystemSettings_cw5n1h2txyewy!App | -| Tips | Microsoft.HoloLensTips_8wekyb3d8bbwe!HoloLensTips | +|App Name |AUMID | +| --- | --- | +|3D Viewer |Microsoft.Microsoft3DViewer_8wekyb3d8bbwe!Microsoft.Microsoft3DViewer | +|Calendar |microsoft.windowscommunicationsapps_8wekyb3d8bbwe!microsoft.windowslive.calendar | +|Camera1, 2 |HoloCamera_cw5n1h2txyewy!HoloCamera | +|Cortana3 |Microsoft.549981C3F5F10_8wekyb3d8bbwe!App | +|Device Picker |HoloDevicesFlow_cw5n1h2txyewy!HoloDevicesFlow | +|Dynamics 365 Guides |Microsoft.Dynamics365.Guides_8wekyb3d8bbwe!MicrosoftGuides | +|Dynamics 365 Remote Assist |Microsoft.MicrosoftRemoteAssist_8wekyb3d8bbwe!Microsoft.RemoteAssist | +|Feedback Hub |Microsoft.WindowsFeedbackHub_8wekyb3d8bbwe!App | +|Mail |c5e2524a-ea46-4f67-841f-6a9465d9d515_cw5n1h2txyewy!App | +|Miracast4 |  | +|Movies & TV |Microsoft.ZuneVideo_8wekyb3d8bbwe!Microsoft.ZuneVideo | +|OneDrive |microsoft.microsoftskydrive_8wekyb3d8bbwe!App | +|Photos |Microsoft.Windows.Photos_8wekyb3d8bbwe!App | +|Settings |HolographicSystemSettings_cw5n1h2txyewy!App | +|Tips |Microsoft.HoloLensTips_8wekyb3d8bbwe!HoloLensTips | > 1 To enable photo or video capture, you have to enable the Camera app as a kiosk app. > 2 When you enable the Camera app, be aware of the following: From f0d49fc76f79c60c85caa7be54cf8c4b925290a5 Mon Sep 17 00:00:00 2001 From: Teresa-Motiv Date: Mon, 27 Apr 2020 10:33:10 -0700 Subject: [PATCH 38/50] Escape apostrophes --- devices/hololens/hololens-kiosk.md | 28 ++++++++++++++-------------- 1 file changed, 14 insertions(+), 14 deletions(-) diff --git a/devices/hololens/hololens-kiosk.md b/devices/hololens/hololens-kiosk.md index 6749505830..d86fd07281 100644 --- a/devices/hololens/hololens-kiosk.md +++ b/devices/hololens/hololens-kiosk.md @@ -91,21 +91,21 @@ If you use an MDM system or a provisioning package to configure kiosk mode, you |App Name |AUMID | | --- | --- | -|3D Viewer |Microsoft.Microsoft3DViewer_8wekyb3d8bbwe!Microsoft.Microsoft3DViewer | -|Calendar |microsoft.windowscommunicationsapps_8wekyb3d8bbwe!microsoft.windowslive.calendar | -|Camera1, 2 |HoloCamera_cw5n1h2txyewy!HoloCamera | -|Cortana3 |Microsoft.549981C3F5F10_8wekyb3d8bbwe!App | -|Device Picker |HoloDevicesFlow_cw5n1h2txyewy!HoloDevicesFlow | -|Dynamics 365 Guides |Microsoft.Dynamics365.Guides_8wekyb3d8bbwe!MicrosoftGuides | -|Dynamics 365 Remote Assist |Microsoft.MicrosoftRemoteAssist_8wekyb3d8bbwe!Microsoft.RemoteAssist | -|Feedback Hub |Microsoft.WindowsFeedbackHub_8wekyb3d8bbwe!App | -|Mail |c5e2524a-ea46-4f67-841f-6a9465d9d515_cw5n1h2txyewy!App | +|3D Viewer |Microsoft.Microsoft3DViewer_8wekyb3d8bbwe\!Microsoft.Microsoft3DViewer | +|Calendar |microsoft.windowscommunicationsapps_8wekyb3d8bbwe\!microsoft.windowslive.calendar | +|Camera1, 2 |HoloCamera_cw5n1h2txyewy\!HoloCamera | +|Cortana3 |Microsoft.549981C3F5F10_8wekyb3d8bbwe\!App | +|Device Picker |HoloDevicesFlow_cw5n1h2txyewy\!HoloDevicesFlow | +|Dynamics 365 Guides |Microsoft.Dynamics365.Guides_8wekyb3d8bbwe\!MicrosoftGuides | +|Dynamics 365 Remote Assist |Microsoft.MicrosoftRemoteAssist_8wekyb3d8bbwe\!Microsoft.RemoteAssist | +|Feedback Hub |Microsoft.WindowsFeedbackHub_8wekyb3d8bbwe\!App | +|Mail |c5e2524a-ea46-4f67-841f-6a9465d9d515_cw5n1h2txyewy\!App | |Miracast4 |  | -|Movies & TV |Microsoft.ZuneVideo_8wekyb3d8bbwe!Microsoft.ZuneVideo | -|OneDrive |microsoft.microsoftskydrive_8wekyb3d8bbwe!App | -|Photos |Microsoft.Windows.Photos_8wekyb3d8bbwe!App | -|Settings |HolographicSystemSettings_cw5n1h2txyewy!App | -|Tips |Microsoft.HoloLensTips_8wekyb3d8bbwe!HoloLensTips | +|Movies & TV |Microsoft.ZuneVideo_8wekyb3d8bbwe\!Microsoft.ZuneVideo | +|OneDrive |microsoft.microsoftskydrive_8wekyb3d8bbwe\!App | +|Photos |Microsoft.Windows.Photos_8wekyb3d8bbwe\!App | +|Settings |HolographicSystemSettings_cw5n1h2txyewy\!App | +|Tips |Microsoft.HoloLensTips_8wekyb3d8bbwe\!HoloLensTips | > 1 To enable photo or video capture, you have to enable the Camera app as a kiosk app. > 2 When you enable the Camera app, be aware of the following: From ae0b57ae98d4eec420b721a38dd8c9919aee1841 Mon Sep 17 00:00:00 2001 From: Teresa-Motiv Date: Mon, 27 Apr 2020 10:54:49 -0700 Subject: [PATCH 39/50] Revisions --- devices/hololens/hololens-kiosk.md | 22 +++++++++++----------- 1 file changed, 11 insertions(+), 11 deletions(-) diff --git a/devices/hololens/hololens-kiosk.md b/devices/hololens/hololens-kiosk.md index d86fd07281..26b232e88b 100644 --- a/devices/hololens/hololens-kiosk.md +++ b/devices/hololens/hololens-kiosk.md @@ -244,13 +244,13 @@ To set up kiosk mode by using Microsoft Intune or another MDM system, follow the - [Deploy a single-app kiosk](#mdmsingledeploy). - [Deploy a multi-app kiosk](#mdmmultideploy). -### [MDM] 1. Prepare to enroll the devices +### MDM, step 1 – Prepare to enroll the devices You can configure your MDM system to enroll HoloLens devices automatically when the user first signs in, or have users enroll devices manually. The devices also have to be joined to your Azure AD domain, and assigned to the appropriate groups. For more information about enrolling the devices, see [Enroll HoloLens in MDM](hololens-enroll-mdm.md) and [Intune enrollment methods for Windows devices](https://docs.microsoft.com/mem/intune/enrollment/windows-enrollment-methods). -### [MDM] 2. Create a kiosk configuration profile +### MDM, step 2 – Create a kiosk configuration profile 1. Open the [Azure](https://portal.azure.com/) portal and sign in to your Intune administrator account. 1. Select **Microsoft Intune** > **Device configuration - Profiles** > **Create profile**. @@ -268,7 +268,7 @@ Your next steps differ depending on the type of kiosk that you want. For further For more information about creating a kiosk configuration profile, see [Windows 10 and Windows Holographic for Business device settings to run as a dedicated kiosk using Intune](https://docs.microsoft.com/intune/configuration/kiosk-settings). -### [MDM] 3. Configure the settings for a single-app kiosk +### MDM, step 3 (single-app) – Configure the settings for a single-app kiosk This section summarizes the settings that a single-app kiosk requires. For more detailed information, see the following articles: @@ -283,13 +283,13 @@ This section summarizes the settings that a single-app kiosk requires. For more Your next step is to [assign](#mdmassign) the profile to a group. -### [MDM] 3. Configure the settings for a multi-app kiosk +### MDM, step 3 (multi-app) – Configure the settings for a multi-app kiosk This section summarizes the settings that a multi-app kiosk requires. For more detailed information, see the following articles: - For information about how to configure a kiosk configuration profile in Intune, see [How to Configure Kiosk Mode Using Microsoft Intune](hololens-commercial-infrastructure.md#how-to-configure-kiosk-mode-using-microsoft-intune). - For more information about the available settings for multi-app kiosks in Intune, see [Multi-app kiosks](https://docs.microsoft.com/mem/intune/configuration/kiosk-settings-holographic#multi-app-kiosks) -- For other MDM services, check your provider's documentation for instructions. If you need to use a custom setting and full XML configuration to set up a kiosk in your MDM service, [create an XML file that defines the kiosk configuration](#ppkioskconfig), and make sure to include the [Start layout](#Start layout for HoloLens) in the XML file. +- For other MDM services, check your provider's documentation for instructions. If you need to use a custom setting and full XML configuration to set up a kiosk in your MDM service, [create an XML file that defines the kiosk configuration](#ppkioskconfig). If you use an XML file, make sure to include the [Start layout](#start-layout-for-hololens). - You can optionally use a custom Start layout with Intune or other MDM services. For more information, see [Start layout file for MDM (Intune and others)](#start-layout-file-for-mdm-intune-and-others). 1. Select **Target Windows 10 in S mode devices** > **No**. @@ -305,11 +305,11 @@ This section summarizes the settings that a multi-app kiosk requires. For more d Your next step is to [assign](#mdmassign) the profile to a group. -### [MDM] 4. Assign the kiosk configuration profile to a group +### MDM, step 4 – Assign the kiosk configuration profile to a group Use the **Assignments** page of the kiosk configuration profile to set where you want the kiosk configuration to deploy. In the simplest case, you assign the kiosk configuration profile to a group that will contain the HoloLens device when the device enrolls in MDM. -### [MDM] 5. Deploy a single-app kiosk +### MDM, step 5 (single-app) – Deploy a single-app kiosk When you use an MDM system, you can enroll the device in MDM during OOBE. After OOBE finishes, device sign-in is easy. @@ -323,7 +323,7 @@ The next time you sign in to the device, the kiosk app should automatically laun If you're not seeing your Kiosk mode yet, [check the assignment status](https://docs.microsoft.com/intune/configuration/device-profile-monitor). -### [MDM] 4. Deploy a multi-app kiosk +### MDM, step 5 (multi-app) – Deploy a multi-app kiosk When you use an MDM system, you can join the device to your Azure AD tenant and enroll the device in MDM during OOBE. If appropriate, provide the information that's required for enrollment to the users for the OOBE process. @@ -350,7 +350,7 @@ To set up kiosk mode by using a provisioning package, follow these steps. 2. [Add the XML file to a provisioning package.](#ppconfigadd) 3. [Apply the provisioning package to HoloLens.](#ppapply) -### [PP] 1. Create a kiosk configuration XML file +### Prov. package, step 1 – Create a kiosk configuration XML file Follow [the instructions for creating a kiosk configuration XML file for desktop](https://docs.microsoft.com/windows/configuration/lock-down-windows-10-to-specific-apps#configure-a-kiosk-using-a-provisioning-package), except for the following: @@ -428,7 +428,7 @@ Save the following sample as an XML file. You can use this file when you configu ``` -### [PP] 2. Add the kiosk configuration XML file to a provisioning package +### Prov. package, step 2 – Add the kiosk configuration XML file to a provisioning package 1. Open [Windows Configuration Designer](https://www.microsoft.com/store/apps/9nblggh4tx22). 1. Select **Advanced provisioning**, enter a name for your project, and then select **Next**. @@ -456,7 +456,7 @@ Save the following sample as an XML file. You can use this file when you configu 1. Specify the output location where you want the provisioning package to go when it's built. By default, Windows Configuration Designer uses the project folder as the output location. If you want to change the output location, select **Browse**. When finished, select **Next**. 1. Select **Build** to start building the package. The provisioning package doesn't take long to build. The build page displays the project information, and the progress bar indicates the build status. -### [PP] 3. Apply the provisioning package to HoloLens +### Prov. package, step 3 – Apply the provisioning package to HoloLens The "Configure HoloLens by using a provisioning package" article provides detailed instructions for applying the provisioning package under the following circumstances: From c05bbb1529e9e4889a92208d34272109db1eb059 Mon Sep 17 00:00:00 2001 From: Teresa-Motiv Date: Mon, 27 Apr 2020 11:38:53 -0700 Subject: [PATCH 40/50] Revision --- devices/hololens/hololens-kiosk.md | 4 +--- 1 file changed, 1 insertion(+), 3 deletions(-) diff --git a/devices/hololens/hololens-kiosk.md b/devices/hololens/hololens-kiosk.md index 26b232e88b..8b4117e2e3 100644 --- a/devices/hololens/hololens-kiosk.md +++ b/devices/hololens/hololens-kiosk.md @@ -30,9 +30,7 @@ This article provides information about aspects of configuring kiosks that are s You can use kiosk mode in one of two configurations (single-app kiosk or multi-app kiosk), and you can use select one of three processes to set up and deploy the kiosk configuration. -> [!WARNING] -> The assigned access feature that enables kiosk mode is intended for corporate-owned fixed-purpose devices. When the multi-app assigned access configuration is applied on the device, [certain policies](https://docs.microsoft.com/windows/configuration/lock-down-windows-10-to-specific-apps#mdm-policy) are enforced system-wide. These policies impact other users on the device. -> +> [!IMPORTANT] > Deleting the multi-app configuration removes the user lockdown profiles that the assigned access feature put in place. However, it does not revert all of the policy changes. To revert these policies, you have to reset the device to the factory settings. ## Plan the kiosk deployment From 12c4eb4b7fbf148747dd36bbcf5960cce834d757 Mon Sep 17 00:00:00 2001 From: Teresa-Motiv Date: Mon, 27 Apr 2020 11:51:34 -0700 Subject: [PATCH 41/50] Link fix --- devices/hololens/hololens-kiosk.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/devices/hololens/hololens-kiosk.md b/devices/hololens/hololens-kiosk.md index 8b4117e2e3..a7ef78c0fb 100644 --- a/devices/hololens/hololens-kiosk.md +++ b/devices/hololens/hololens-kiosk.md @@ -233,7 +233,7 @@ The following table lists the capabilities and benefits of each of the three dep To set up kiosk mode by using Microsoft Intune or another MDM system, follow these steps. 1. [Prepare to enroll the devices](#mdmenroll). -1. [Create a kiosk configuration profile](#mdm-2-create-a-kiosk-configuration-profile). +1. [Create a kiosk configuration profile](#mdmprofile). 1. Configure the kiosk. - [Configure the settings for a single-app kiosk](#mdmconfigsingle). - [Configure the settings for a multi-app kiosk](#mdmconfigmulti). @@ -248,7 +248,7 @@ You can configure your MDM system to enroll HoloLens devices automatically when For more information about enrolling the devices, see [Enroll HoloLens in MDM](hololens-enroll-mdm.md) and [Intune enrollment methods for Windows devices](https://docs.microsoft.com/mem/intune/enrollment/windows-enrollment-methods). -### MDM, step 2 – Create a kiosk configuration profile +### MDM, step 2 – Create a kiosk configuration profile 1. Open the [Azure](https://portal.azure.com/) portal and sign in to your Intune administrator account. 1. Select **Microsoft Intune** > **Device configuration - Profiles** > **Create profile**. From 8fa4f1193885344fc1a0e5667bf20ba395d0df58 Mon Sep 17 00:00:00 2001 From: Teresa-Motiv Date: Mon, 27 Apr 2020 12:23:44 -0700 Subject: [PATCH 42/50] Excape underscores --- devices/hololens/hololens-kiosk.md | 28 ++++++++++++++-------------- 1 file changed, 14 insertions(+), 14 deletions(-) diff --git a/devices/hololens/hololens-kiosk.md b/devices/hololens/hololens-kiosk.md index a7ef78c0fb..53136291e4 100644 --- a/devices/hololens/hololens-kiosk.md +++ b/devices/hololens/hololens-kiosk.md @@ -89,21 +89,21 @@ If you use an MDM system or a provisioning package to configure kiosk mode, you |App Name |AUMID | | --- | --- | -|3D Viewer |Microsoft.Microsoft3DViewer_8wekyb3d8bbwe\!Microsoft.Microsoft3DViewer | -|Calendar |microsoft.windowscommunicationsapps_8wekyb3d8bbwe\!microsoft.windowslive.calendar | -|Camera1, 2 |HoloCamera_cw5n1h2txyewy\!HoloCamera | -|Cortana3 |Microsoft.549981C3F5F10_8wekyb3d8bbwe\!App | -|Device Picker |HoloDevicesFlow_cw5n1h2txyewy\!HoloDevicesFlow | -|Dynamics 365 Guides |Microsoft.Dynamics365.Guides_8wekyb3d8bbwe\!MicrosoftGuides | -|Dynamics 365 Remote Assist |Microsoft.MicrosoftRemoteAssist_8wekyb3d8bbwe\!Microsoft.RemoteAssist | -|Feedback Hub |Microsoft.WindowsFeedbackHub_8wekyb3d8bbwe\!App | -|Mail |c5e2524a-ea46-4f67-841f-6a9465d9d515_cw5n1h2txyewy\!App | +|3D Viewer |Microsoft.Microsoft3DViewer\_8wekyb3d8bbwe\!Microsoft.Microsoft3DViewer | +|Calendar |microsoft.windowscommunicationsapps\_8wekyb3d8bbwe\!microsoft.windowslive.calendar | +|Camera1, 2 |HoloCamera\_cw5n1h2txyewy\!HoloCamera | +|Cortana3 |Microsoft.549981C3F5F10\_8wekyb3d8bbwe\!App | +|Device Picker |HoloDevicesFlow\_cw5n1h2txyewy\!HoloDevicesFlow | +|Dynamics 365 Guides |Microsoft.Dynamics365.Guides\_8wekyb3d8bbwe\!MicrosoftGuides | +|Dynamics 365 Remote Assist |Microsoft.MicrosoftRemoteAssist\_8wekyb3d8bbwe\!Microsoft.RemoteAssist | +|Feedback Hub |Microsoft.WindowsFeedbackHub\_8wekyb3d8bbwe\!App | +|Mail |c5e2524a-ea46-4f67-841f-6a9465d9d515\_cw5n1h2txyewy\!App | |Miracast4 |  | -|Movies & TV |Microsoft.ZuneVideo_8wekyb3d8bbwe\!Microsoft.ZuneVideo | -|OneDrive |microsoft.microsoftskydrive_8wekyb3d8bbwe\!App | -|Photos |Microsoft.Windows.Photos_8wekyb3d8bbwe\!App | -|Settings |HolographicSystemSettings_cw5n1h2txyewy\!App | -|Tips |Microsoft.HoloLensTips_8wekyb3d8bbwe\!HoloLensTips | +|Movies & TV |Microsoft.ZuneVideo\_8wekyb3d8bbwe\!Microsoft.ZuneVideo | +|OneDrive |microsoft.microsoftskydrive\_8wekyb3d8bbwe\!App | +|Photos |Microsoft.Windows.Photos\_8wekyb3d8bbwe\!App | +|Settings |HolographicSystemSettings\_cw5n1h2txyewy\!App | +|Tips |Microsoft.HoloLensTips\_8wekyb3d8bbwe\!HoloLensTips | > 1 To enable photo or video capture, you have to enable the Camera app as a kiosk app. > 2 When you enable the Camera app, be aware of the following: From 44b7bad458117bec94e5eb8f2ff38b97c39e7e9d Mon Sep 17 00:00:00 2001 From: Teresa-Motiv Date: Mon, 27 Apr 2020 15:06:19 -0700 Subject: [PATCH 43/50] Troubleshooting table --- devices/hololens/hololens-kiosk.md | 13 +++++++++++++ 1 file changed, 13 insertions(+) diff --git a/devices/hololens/hololens-kiosk.md b/devices/hololens/hololens-kiosk.md index 53136291e4..03ec36149b 100644 --- a/devices/hololens/hololens-kiosk.md +++ b/devices/hololens/hololens-kiosk.md @@ -87,18 +87,31 @@ If you use an MDM system or a provisioning package to configure kiosk mode, you > You cannot select the Shell app as a kiosk app. In addition, we recommend that you do **not** select the Microsoft Edge, Microsoft Store, or the File Explorer app as kiosk apps. + |App Name |AUMID | | --- | --- | |3D Viewer |Microsoft.Microsoft3DViewer\_8wekyb3d8bbwe\!Microsoft.Microsoft3DViewer | |Calendar |microsoft.windowscommunicationsapps\_8wekyb3d8bbwe\!microsoft.windowslive.calendar | + +|App Name |AUMID | +| --- | --- | |Camera1, 2 |HoloCamera\_cw5n1h2txyewy\!HoloCamera | |Cortana3 |Microsoft.549981C3F5F10\_8wekyb3d8bbwe\!App | + +|App Name |AUMID | +| --- | --- | |Device Picker |HoloDevicesFlow\_cw5n1h2txyewy\!HoloDevicesFlow | |Dynamics 365 Guides |Microsoft.Dynamics365.Guides\_8wekyb3d8bbwe\!MicrosoftGuides | |Dynamics 365 Remote Assist |Microsoft.MicrosoftRemoteAssist\_8wekyb3d8bbwe\!Microsoft.RemoteAssist | |Feedback Hub |Microsoft.WindowsFeedbackHub\_8wekyb3d8bbwe\!App | |Mail |c5e2524a-ea46-4f67-841f-6a9465d9d515\_cw5n1h2txyewy\!App | + +|App Name |AUMID | +| --- | --- | |Miracast4 |  | + +|App Name |AUMID | +| --- | --- | |Movies & TV |Microsoft.ZuneVideo\_8wekyb3d8bbwe\!Microsoft.ZuneVideo | |OneDrive |microsoft.microsoftskydrive\_8wekyb3d8bbwe\!App | |Photos |Microsoft.Windows.Photos\_8wekyb3d8bbwe\!App | From 55f3bd0d6990d89986bbeeeca3c1aa424a1b0fe1 Mon Sep 17 00:00:00 2001 From: Teresa-Motiv Date: Mon, 27 Apr 2020 15:21:00 -0700 Subject: [PATCH 44/50] Troubleshootin table --- devices/hololens/hololens-kiosk.md | 16 ++-------------- 1 file changed, 2 insertions(+), 14 deletions(-) diff --git a/devices/hololens/hololens-kiosk.md b/devices/hololens/hololens-kiosk.md index 03ec36149b..6719d870b6 100644 --- a/devices/hololens/hololens-kiosk.md +++ b/devices/hololens/hololens-kiosk.md @@ -92,26 +92,14 @@ If you use an MDM system or a provisioning package to configure kiosk mode, you | --- | --- | |3D Viewer |Microsoft.Microsoft3DViewer\_8wekyb3d8bbwe\!Microsoft.Microsoft3DViewer | |Calendar |microsoft.windowscommunicationsapps\_8wekyb3d8bbwe\!microsoft.windowslive.calendar | - -|App Name |AUMID | -| --- | --- | |Camera1, 2 |HoloCamera\_cw5n1h2txyewy\!HoloCamera | |Cortana3 |Microsoft.549981C3F5F10\_8wekyb3d8bbwe\!App | - -|App Name |AUMID | -| --- | --- | |Device Picker |HoloDevicesFlow\_cw5n1h2txyewy\!HoloDevicesFlow | |Dynamics 365 Guides |Microsoft.Dynamics365.Guides\_8wekyb3d8bbwe\!MicrosoftGuides | |Dynamics 365 Remote Assist |Microsoft.MicrosoftRemoteAssist\_8wekyb3d8bbwe\!Microsoft.RemoteAssist | |Feedback Hub |Microsoft.WindowsFeedbackHub\_8wekyb3d8bbwe\!App | |Mail |c5e2524a-ea46-4f67-841f-6a9465d9d515\_cw5n1h2txyewy\!App | - -|App Name |AUMID | -| --- | --- | |Miracast4 |  | - -|App Name |AUMID | -| --- | --- | |Movies & TV |Microsoft.ZuneVideo\_8wekyb3d8bbwe\!Microsoft.ZuneVideo | |OneDrive |microsoft.microsoftskydrive\_8wekyb3d8bbwe\!App | |Photos |Microsoft.Windows.Photos\_8wekyb3d8bbwe\!App | @@ -120,10 +108,10 @@ If you use an MDM system or a provisioning package to configure kiosk mode, you > 1 To enable photo or video capture, you have to enable the Camera app as a kiosk app. > 2 When you enable the Camera app, be aware of the following: -> - The Quick Actions menu includes the Photo and Video buttons. +> - The Quick Actions menu includes the Photo and Video buttons. > - You should also enable an app that can interact with or retrieve pictures (such as Photos, Mail, or OneDrive). > -> 3 Even if you do not enable Cortana as a kiosk app, built-in voice commands are enabled. However, commands that are related to disabled features have no effect. +> 3 Even if you do not enable Cortana as a kiosk app, built-in voice commands are enabled. However, commands that are related to disabled features have no effect. > 4 To enable Miracast as a kiosk app, enable the Camera app and the Device Picker app. ### Plan user and device groups From a8ec188c41d67449ea90d862a13cdc1648558496 Mon Sep 17 00:00:00 2001 From: Teresa-Motiv Date: Mon, 27 Apr 2020 15:55:43 -0700 Subject: [PATCH 45/50] Tabletweak --- devices/hololens/hololens-kiosk.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/devices/hololens/hololens-kiosk.md b/devices/hololens/hololens-kiosk.md index 6719d870b6..76a33a3064 100644 --- a/devices/hololens/hololens-kiosk.md +++ b/devices/hololens/hololens-kiosk.md @@ -97,7 +97,7 @@ If you use an MDM system or a provisioning package to configure kiosk mode, you |Device Picker |HoloDevicesFlow\_cw5n1h2txyewy\!HoloDevicesFlow | |Dynamics 365 Guides |Microsoft.Dynamics365.Guides\_8wekyb3d8bbwe\!MicrosoftGuides | |Dynamics 365 Remote Assist |Microsoft.MicrosoftRemoteAssist\_8wekyb3d8bbwe\!Microsoft.RemoteAssist | -|Feedback Hub |Microsoft.WindowsFeedbackHub\_8wekyb3d8bbwe\!App | +|Feedback Hub |Microsoft.WindowsFeedbackHub\_8wekyb3d8bbwe\!App | |Mail |c5e2524a-ea46-4f67-841f-6a9465d9d515\_cw5n1h2txyewy\!App | |Miracast4 |  | |Movies & TV |Microsoft.ZuneVideo\_8wekyb3d8bbwe\!Microsoft.ZuneVideo | From ffd466869c5604457b1c77fec296f8b125b24aaa Mon Sep 17 00:00:00 2001 From: Teresa-Motiv Date: Tue, 28 Apr 2020 09:14:23 -0700 Subject: [PATCH 46/50] Revision --- devices/hololens/hololens-kiosk.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/devices/hololens/hololens-kiosk.md b/devices/hololens/hololens-kiosk.md index 76a33a3064..10d45db90c 100644 --- a/devices/hololens/hololens-kiosk.md +++ b/devices/hololens/hololens-kiosk.md @@ -52,10 +52,10 @@ A multi-app kiosk displays the start menu when the user signs in to the device. The following table lists the feature capabilities in the different kiosk modes. -|   |Start menu/pins panel |Quick Actions menu |Camera and video |Miracast |Cortana |Built-in voice commands | +|   |Start menu |Quick Actions menu |Camera and video |Miracast |Cortana |Built-in voice commands | | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | |Single-app kiosk |Disabled |Disabled |Disabled |Disabled |Disabled |Enabled1 | -|Multi-app kiosk |Enabled |Enabled2 |Available2 |Available2 |Available2, 3 |Enabled1 | +|Multi-app kiosk |Enabled |Enabled2 |Available2 |Available2 |Available2, 3 |Enabled1 | > 1 Voice commands that relate to disabled features do not function. > 2 For more information about how to configure these features, see [Select kiosk apps](#plan-kiosk-apps). From 6724a11a055aaef5d03b44cef7958bc8c50a05e7 Mon Sep 17 00:00:00 2001 From: Teresa-Motiv Date: Tue, 28 Apr 2020 09:29:14 -0700 Subject: [PATCH 47/50] Revisions --- devices/hololens/hololens-kiosk.md | 25 +------------------------ 1 file changed, 1 insertion(+), 24 deletions(-) diff --git a/devices/hololens/hololens-kiosk.md b/devices/hololens/hololens-kiosk.md index 10d45db90c..51466aaea1 100644 --- a/devices/hololens/hololens-kiosk.md +++ b/devices/hololens/hololens-kiosk.md @@ -72,7 +72,7 @@ For examples of how to use these capabilities, see the following table. |Use a single-app kiosk for: |Use a multi-app kiosk for: | | --- | --- | -|A device that runs only a guide for new hires. |A device that runs both guides and Remote Assist for a range of employees. | +|A device that runs only a Dynamics 365 Guide for new hires. |A device that runs both Guides and Remote Assistance for a range of employees. | |A device that runs only a custom app. |A device that functions as a kiosk for the majority of users (running only a custom app), but functions as a normal device for a specific group of users. | ### Plan kiosk apps @@ -144,29 +144,6 @@ No matter which user signs on to the device first (and goes through the Out-of-B **Example 2** -You use two groups that have the following members: - -- Group 1: - - User A - - User B -- Group 2: - - User A - - User B - - User C - - Device 1 - -You configure the kiosk configuration profile as follows: - -- **User logon type**: Group 1 -- **Assigned group**: Group 2 - -No matter which user signs on to the device first, the kiosk configuration deploys to the device. However, the user experiences differ as follows: - -- Users A and B can sign in to the device, and they get the kiosk experience. -- User C can sign in to the device, but does not get the kiosk experience. User C can use the device as a typical non-kiosk device. - -**Example 3** - You contract devices out to two different vendors who need different kiosk experiences. Both vendors have users, and you want all of the users to have access to kiosks from both their own vendor and the other vendor. You configure groups as follows: - Device Group 1: From ea588f10f3758f9450e359a7b3cf600dfdad5a15 Mon Sep 17 00:00:00 2001 From: Teresa-Motiv Date: Tue, 28 Apr 2020 09:55:39 -0700 Subject: [PATCH 48/50] Revisions --- devices/hololens/hololens-kiosk.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/devices/hololens/hololens-kiosk.md b/devices/hololens/hololens-kiosk.md index 51466aaea1..482241ea7f 100644 --- a/devices/hololens/hololens-kiosk.md +++ b/devices/hololens/hololens-kiosk.md @@ -312,7 +312,7 @@ During OOBE, follow these steps: 1. Enroll the device. 1. Wait for any apps that are part of the kiosk configuration profile to download and install, and for policies to be applied. 1. After OOBE finishes, you can install additional apps from the Microsoft store or by sideloading. [Required apps](https://docs.microsoft.com/mem/intune/apps/apps-deploy#assign-an-app) for the group that the device belongs to install automatically. -1. Restart the device. +1. When finished, restart the device. The next time you sign in to the device by using an account that belongs to the **User logon type**, the kiosk app should automatically launch. From 43738897bb09fcaa1068303f08c622d499d5d109 Mon Sep 17 00:00:00 2001 From: Denise Vangel-MSFT Date: Wed, 29 Apr 2020 08:40:38 -0700 Subject: [PATCH 49/50] Update live-response.md --- .../threat-protection/microsoft-defender-atp/live-response.md | 1 - 1 file changed, 1 deletion(-) diff --git a/windows/security/threat-protection/microsoft-defender-atp/live-response.md b/windows/security/threat-protection/microsoft-defender-atp/live-response.md index 929b9ade09..3cac9327c0 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/live-response.md +++ b/windows/security/threat-protection/microsoft-defender-atp/live-response.md @@ -284,7 +284,6 @@ Each command is tracked with full details such as: - Large scale command execution is not supported. - A user can only initiate one session at a time. - A device can only be in one session at a time. -- There is a file size limit of 750mb when downloading files from a device. ## Related article - [Live response command examples](live-response-command-examples.md) From 2307dd3c116f660911c57fe99b63f76ae5ae86e8 Mon Sep 17 00:00:00 2001 From: Denise Vangel-MSFT Date: Wed, 29 Apr 2020 09:02:37 -0700 Subject: [PATCH 50/50] Update live-response.md --- .../threat-protection/microsoft-defender-atp/live-response.md | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/windows/security/threat-protection/microsoft-defender-atp/live-response.md b/windows/security/threat-protection/microsoft-defender-atp/live-response.md index 3cac9327c0..8ab5475888 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/live-response.md +++ b/windows/security/threat-protection/microsoft-defender-atp/live-response.md @@ -284,6 +284,10 @@ Each command is tracked with full details such as: - Large scale command execution is not supported. - A user can only initiate one session at a time. - A device can only be in one session at a time. +- The following file size limits apply: + - `getfile` limit: 3 GB + - `fileinfo` limit: 10 GB + - `library` limit: 250 MB ## Related article - [Live response command examples](live-response-command-examples.md)