mirror of
https://github.com/MicrosoftDocs/windows-itpro-docs.git
synced 2025-05-13 13:57:22 +00:00
Merge branch 'master' into edr-blocking
This commit is contained in:
Denise Vangel-MSFT
commit
b64ff7a174
@ -56,7 +56,7 @@ Make sure that [this list](hololens-offline.md) of endpoints are allowed on your
|
||||
### Remote Assist Specific Network Requirements
|
||||
|
||||
1. The recommended bandwidth for optimal performance of Remote Assist is 1.5Mbps. Detailed network requirements and additional information can be found [here](https://docs.microsoft.com/MicrosoftTeams/prepare-network).
|
||||
**(Please note, if you don’t network have network speeds of at least 1.5Mbps, Remote Assist will still work. However, quality may suffer).**
|
||||
**(Please note, if you don't network have network speeds of at least 1.5Mbps, Remote Assist will still work. However, quality may suffer).**
|
||||
1. Make sure that these ports and URLs are allowed on your network firewall. This will enable Microsoft Teams to function. The latest list can be found [here](https://docs.microsoft.com/office365/enterprise/urls-and-ip-address-ranges#skype-for-business-online-and-microsoft-teams).
|
||||
|
||||
### Guides Specific Network Requirements
|
||||
@ -73,18 +73,18 @@ Please [HoloLens Licenses Requirements](hololens-licenses-requirements.md) for a
|
||||
|
||||
1. If you plan on using Auto Enrollment, you will have to [Configure Azure AD enrollment.](https://docs.microsoft.com/intune/deploy-use/.set-up-windows-device-management-with-microsoft-intune#azure-active-directory-enrollment)
|
||||
|
||||
1. Ensure that your company’s users are in Azure Active Directory (Azure AD).
|
||||
1. Ensure that your company's users are in Azure Active Directory (Azure AD).
|
||||
Instructions for adding users can be found [here](https://docs.microsoft.com/azure/active-directory/fundamentals/add-users-azure-active-directory).
|
||||
|
||||
1. We suggest that users who need similar licenses are added to the same group.
|
||||
1. [Create a Group](https://docs.microsoft.com/azure/active-directory/fundamentals/active-directory-groups-create-azure-portal)
|
||||
1. [Add users to groups](https://docs.microsoft.com/azure/active-directory/fundamentals/active-directory-groups-members-azure-portal)
|
||||
|
||||
1. Ensure that your company’s users (or group of users) are assigned the necessary licenses.
|
||||
1. Ensure that your company's users (or group of users) are assigned the necessary licenses.
|
||||
Directions for assigning licenses can be found [here](https://docs.microsoft.com/azure/active-directory/fundamentals/license-users-groups).
|
||||
|
||||
1. Only do this step if users are expected to enroll their HoloLens/Mobile device into you (There are three options)
|
||||
These steps ensure that your company’s users (or a group of users) can add devices.
|
||||
These steps ensure that your company's users (or a group of users) can add devices.
|
||||
1. **Option 1:** Give all users permission to join devices to Azure AD.
|
||||
**Sign in to the Azure portal as an administrator** > **Azure Active Directory** > **Devices** > **Device Settings** >
|
||||
**Set Users may join devices to Azure AD to *All***
|
||||
@ -163,7 +163,7 @@ Directions for upgrading to the commercial suite can be found [here](https://doc
|
||||
|
||||
1. Check your app settings
|
||||
1. Log into your Microsoft Store Business account
|
||||
1. **Manage > Products and Services > Apps and Software > Select the app you want to sync > Private Store Availability > Select “Everyone” or “Specific Groups”**
|
||||
1. **Manage > Products and Services > Apps and Software > Select the app you want to sync > Private Store Availability > Select "Everyone" or "Specific Groups"**
|
||||
>[!NOTE]
|
||||
>If you don't see the app you want, you will have to "get" the app by searching the store for your app. **Click the "Search" bar in the upper right-hand corner > type in the name of the app > click on the app > select "Get"**.
|
||||
1. If you do not see your apps in **Intune > Client Apps > Apps** , you may have to [sync your apps](https://docs.microsoft.com/intune/apps/windows-store-for-business#synchronize-apps) again.
|
||||
@ -171,11 +171,11 @@ Directions for upgrading to the commercial suite can be found [here](https://doc
|
||||
1. [Create a device profile for Kiosk mode](https://docs.microsoft.com/intune/configuration/kiosk-settings#create-the-profile)
|
||||
|
||||
> [!NOTE]
|
||||
> You can configure different users to have different Kiosk Mode experiences by using “Azure AD” as the “User logon type”. However, this option is only available in Multi-App kiosk mode. Multi-App kiosk mode will work with only one app as well as multiple apps.
|
||||
> You can configure different users to have different Kiosk Mode experiences by using "Azure AD" as the "User logon type". However, this option is only available in Multi-App kiosk mode. Multi-App kiosk mode will work with only one app as well as multiple apps.
|
||||
|
||||
|
||||
|
||||
For other MDM services, check your provider's documentation for instructions. If you need to use a custom setting and full XML configuration to set up a kiosk in your MDM service, additional directions can be found [here](hololens-kiosk.md#set-up-kiosk-mode-using-microsoft-intune-or-mdm-windows-10-version-1803)
|
||||
For other MDM services, check your provider's documentation for instructions. If you need to use a custom setting and full XML configuration to set up a kiosk in your MDM service, additional directions can be found [here](hololens-kiosk.md#use-microsoft-intune-or-other-mdm-to-set-up-a-single-app-or-multi-app-kiosk)
|
||||
|
||||
## Certificates and Authentication
|
||||
|
||||
|
||||
@ -1,5 +1,5 @@
|
||||
---
|
||||
title: Set up HoloLens as a kiosk for specific applications
|
||||
title: Set up HoloLens as a kiosk
|
||||
description: Use a kiosk configuration to lock down the apps on HoloLens.
|
||||
ms.prod: hololens
|
||||
ms.sitesec: library
|
||||
@ -7,8 +7,9 @@ author: dansimp
|
||||
ms.author: dansimp
|
||||
ms.topic: article
|
||||
ms.localizationpriority: medium
|
||||
ms.date: 11/13/2018
|
||||
ms.date: 04/27/2020
|
||||
ms.custom:
|
||||
- CI 115262
|
||||
- CI 111456
|
||||
- CSSTroubleshooting
|
||||
ms.reviewer:
|
||||
@ -18,71 +19,347 @@ appliesto:
|
||||
- HoloLens 2
|
||||
---
|
||||
|
||||
# Set up HoloLens as a kiosk for specific applications
|
||||
# Set up HoloLens as a kiosk
|
||||
|
||||
In Windows 10, version 1803, you can configure your HoloLens devices to run as multi-app or single-app kiosks. You can also configure guest access for a HoloLens kiosk device by [designating a SpecialGroup account in your XML file.](#add-guest-access-to-the-kiosk-configuration-optional)
|
||||
You can configure a HoloLens device to function as a fixed-purpose device, also called a *kiosk*, by configuring the device to run in kiosk mode. Kiosk mode limits the applications (or users) that are available on the device. Kiosk mode is a convenient feature that you can use to dedicate a HoloLens device to business apps, or to use the HoloLens device in an app demo.
|
||||
|
||||
When HoloLens is configured as a multi-app kiosk, only the allowed apps are available to the user. The benefit of a multi-app kiosk, or fixed-purpose device, is to provide an easy-to-understand experience for individuals by putting in front of them only the things they need to use, and removing from their view the things they don't need to access.
|
||||
This article provides information about aspects of configuring kiosks that are specific to HoloLens devices. For general information about types of Windows-based kiosks and how to configure them, see [Configure kiosks and digital signs on Windows desktop editions](https://docs.microsoft.com/windows/configuration/kiosk-methods).
|
||||
|
||||
Single-app kiosk mode starts the specified app when the user signs in, and restricts the user's ability to launch new apps or change the running app. When single-app kiosk mode is enabled for HoloLens, the [start gestures](https://docs.microsoft.com/hololens/hololens2-basic-usage#start-gesture) (including [Bloom](https://docs.microsoft.com/hololens/hololens1-basic-usage) on HoloLens (1st Gen)) and Cortana are disabled, and placed apps aren't shown in the user's surroundings.
|
||||
> [!IMPORTANT]
|
||||
> Kiosk mode determines which apps are available when a user signs in to the device. However, kiosk mode is not a security limitation. It does not stop an "allowed" app from launching an app that is not allowed. In order to block apps or processes from launching, use [Windows Defender Application Control (WDAC) CSP](https://docs.microsoft.com/windows/client-management/mdm/applicationcontrol-csp) to create appropriate policies.
|
||||
|
||||
The following table lists the device capabilities in the different kiosk modes.
|
||||
You can use kiosk mode in one of two configurations (single-app kiosk or multi-app kiosk), and you can use select one of three processes to set up and deploy the kiosk configuration.
|
||||
|
||||
Kiosk mode | Voice and Bloom commands | Quick actions menu | Camera and video | Miracast
|
||||
--- | --- | --- | --- | ---
|
||||
Single-app kiosk |  |  |  | 
|
||||
Multi-app kiosk |  |  with **Home** and **Volume** (default)<br><br>Photo and video buttons shown in Quick actions menu if the Camera app is enabled in the kiosk configuration.<br><br>Miracast is shown if the Camera app and device picker app are enabled in the kiosk configuration. |  if the Camera app is enabled in the kiosk configuration. |  if the Camera app and device picker app are enabled in the kiosk configuration.
|
||||
> [!IMPORTANT]
|
||||
> Deleting the multi-app configuration removes the user lockdown profiles that the assigned access feature put in place. However, it does not revert all of the policy changes. To revert these policies, you have to reset the device to the factory settings.
|
||||
|
||||
> [!NOTE]
|
||||
> Use the Application User Model ID (AUMID) to allow apps in your kiosk configuration. The Camera app AUMID is `HoloCamera_cw5n1h2txyewy!HoloCamera`. The device picker app AUMID is `HoloDevicesFlow_cw5n1h2txyewy!HoloDevicesFlow`.
|
||||
## Plan the kiosk deployment
|
||||
|
||||
The [AssignedAccess Configuration Service Provider (CSP)](https://docs.microsoft.com/windows/client-management/mdm/assignedaccess-csp) enables kiosk configuration.
|
||||
### Kiosk mode requirements
|
||||
|
||||
> [!WARNING]
|
||||
> The assigned access feature which enables kiosk mode is intended for corporate-owned fixed-purpose devices. When the multi-app assigned access configuration is applied on the device, certain policies are enforced system-wide, and will impact other users on the device. Deleting the multi-app configuration will remove the assigned access lockdown profiles associated with the users, but it cannot revert all [the enforced policies](https://docs.microsoft.com/windows/configuration/lock-down-windows-10-to-specific-apps#policies-set-by-multi-app-kiosk-configuration). A factory reset is needed to clear all the policies enforced via assigned access.
|
||||
You can configure any HoloLens 2 device to use kiosk mode.
|
||||
|
||||
To configure a HoloLens (1st gen) device to use kiosk mode, you must first make sure that the device runs Windows 10, version 1803, or a newer version. If you have used the Windows Device Recovery Tool to recover your HoloLens (1st gen) device to its default build, or if you have installed the most recent updates, then your device is ready.
|
||||
|
||||
> [!IMPORTANT]
|
||||
> To help protect devices that run in kiosk mode, consider adding device management policies that turn off features such as USB connectivity. Additionally, check your update ring settings to make sure that automatic updates do not occur during business hours.
|
||||
|
||||
### Decide between a single-app kiosk or a multi-app kiosk
|
||||
|
||||
A single-app kiosk starts the specified app when the user signs in to the device. The Start menu is disabled, as is Cortana. A HoloLens 2 device does not respond to the [Start](hololens2-basic-usage.md#start-gesture) gesture. A HoloLens (1st gen) device does not respond to the [bloom](hololens1-basic-usage.md) gesture. Because only one app can run, the user cannot place other apps.
|
||||
|
||||
A multi-app kiosk displays the start menu when the user signs in to the device. The kiosk configuration determines what apps are available on the Start menu. You can use a multi-app kiosk to provide an easy-to-understand experience for users by putting in front of them only the things they need to use, and removing from their view the things they don't need to access.
|
||||
|
||||
The following table lists the feature capabilities in the different kiosk modes.
|
||||
|
||||
| |Start menu |Quick Actions menu |Camera and video |Miracast |Cortana |Built-in voice commands |
|
||||
| --- | --- | --- | --- | --- | --- | --- | --- | --- | --- |
|
||||
|Single-app kiosk |Disabled |Disabled |Disabled |Disabled |Disabled |Enabled<sup>1</sup> |
|
||||
|Multi-app kiosk |Enabled |Enabled<sup>2</sup> |Available<sup>2</sup> |Available<sup>2</sup> |Available<sup>2, 3</sup> |Enabled<sup>1</sup> |
|
||||
|
||||
> <sup>1</sup> Voice commands that relate to disabled features do not function.
|
||||
> <sup>2</sup> For more information about how to configure these features, see [Select kiosk apps](#plan-kiosk-apps).
|
||||
> <sup>3</sup> Even if Cortana is disabled, the built-in voice commands are enabled.
|
||||
|
||||
The following table lists the user support features of the different kiosk modes.
|
||||
|
||||
| |Supported user types | Automatic sign-in | Multiple access levels |
|
||||
| --- | --- | --- | --- |
|
||||
|Single-app kiosk |Managed Service Account (MSA) in Azure Active Directory (AAD) or local account |Yes |No |
|
||||
|Multi-app kiosk |AAD account |No |Yes |
|
||||
|
||||
For examples of how to use these capabilities, see the following table.
|
||||
|
||||
|Use a single-app kiosk for: |Use a multi-app kiosk for: |
|
||||
| --- | --- |
|
||||
|A device that runs only a Dynamics 365 Guide for new hires. |A device that runs both Guides and Remote Assistance for a range of employees. |
|
||||
|A device that runs only a custom app. |A device that functions as a kiosk for the majority of users (running only a custom app), but functions as a normal device for a specific group of users. |
|
||||
|
||||
### Plan kiosk apps
|
||||
|
||||
For general information about selecting kiosk apps, see [Guidelines for choosing an app for assigned access (kiosk mode)](https://docs.microsoft.com/windows/configuration/guidelines-for-assigned-access-app).
|
||||
|
||||
If you use the Windows Device Portal to configure a single-app kiosk, you select the app during the setup process.
|
||||
|
||||
If you use an MDM system or a provisioning package to configure kiosk mode, you use the [AssignedAccess Configuration Service Provider (CSP)](https://docs.microsoft.com/windows/client-management/mdm/assignedaccess-csp) to specify applications. The CSP uses [Application User Model IDs (AUMIDs)](https://docs.microsoft.com/windows/configuration/find-the-application-user-model-id-of-an-installed-app) to identify applications. The following table lists the AUMIDs of some in-box applications that you can use in a multi-app kiosk.
|
||||
|
||||
> [!CAUTION]
|
||||
> You cannot select the Shell app as a kiosk app. In addition, we recommend that you do **not** select the Microsoft Edge, Microsoft Store, or the File Explorer app as kiosk apps.
|
||||
|
||||
<a id="aumids"></a>
|
||||
|
||||
|App Name |AUMID |
|
||||
| --- | --- |
|
||||
|3D Viewer |Microsoft.Microsoft3DViewer\_8wekyb3d8bbwe\!Microsoft.Microsoft3DViewer |
|
||||
|Calendar |microsoft.windowscommunicationsapps\_8wekyb3d8bbwe\!microsoft.windowslive.calendar |
|
||||
|Camera<sup>1, 2</sup> |HoloCamera\_cw5n1h2txyewy\!HoloCamera |
|
||||
|Cortana<sup>3</sup> |Microsoft.549981C3F5F10\_8wekyb3d8bbwe\!App |
|
||||
|Device Picker |HoloDevicesFlow\_cw5n1h2txyewy\!HoloDevicesFlow |
|
||||
|Dynamics 365 Guides |Microsoft.Dynamics365.Guides\_8wekyb3d8bbwe\!MicrosoftGuides |
|
||||
|Dynamics 365 Remote Assist |Microsoft.MicrosoftRemoteAssist\_8wekyb3d8bbwe\!Microsoft.RemoteAssist |
|
||||
|Feedback Hub |Microsoft.WindowsFeedbackHub\_8wekyb3d8bbwe\!App |
|
||||
|Mail |c5e2524a-ea46-4f67-841f-6a9465d9d515\_cw5n1h2txyewy\!App |
|
||||
|Miracast<sup>4</sup> | |
|
||||
|Movies & TV |Microsoft.ZuneVideo\_8wekyb3d8bbwe\!Microsoft.ZuneVideo |
|
||||
|OneDrive |microsoft.microsoftskydrive\_8wekyb3d8bbwe\!App |
|
||||
|Photos |Microsoft.Windows.Photos\_8wekyb3d8bbwe\!App |
|
||||
|Settings |HolographicSystemSettings\_cw5n1h2txyewy\!App |
|
||||
|Tips |Microsoft.HoloLensTips\_8wekyb3d8bbwe\!HoloLensTips |
|
||||
|
||||
> <sup>1</sup> To enable photo or video capture, you have to enable the Camera app as a kiosk app.
|
||||
> <sup>2</sup> When you enable the Camera app, be aware of the following:
|
||||
> - The Quick Actions menu includes the Photo and Video buttons.
|
||||
> - You should also enable an app that can interact with or retrieve pictures (such as Photos, Mail, or OneDrive).
|
||||
>
|
||||
> Be aware that voice commands are enabled for kiosk mode configured in Microsoft Intune or provisioning packages, even if the Cortana app is not selected as a kiosk app.
|
||||
> <sup>3</sup> Even if you do not enable Cortana as a kiosk app, built-in voice commands are enabled. However, commands that are related to disabled features have no effect.
|
||||
> <sup>4</sup> To enable Miracast as a kiosk app, enable the Camera app and the Device Picker app.
|
||||
|
||||
For HoloLens devices running Windows 10, version 1803, there are three methods that you can use to configure the device as a kiosk:
|
||||
- You can use [Microsoft Intune or other mobile device management (MDM) service](#set-up-kiosk-mode-using-microsoft-intune-or-mdm-windows-10-version-1803) to configure single-app and multi-app kiosks.
|
||||
- You can [use a provisioning package](#set-up-kiosk-mode-using-a-provisioning-package-windows-10-version-1803) to configure single-app and multi-app kiosks.
|
||||
- You can [use the Windows Device Portal](#set-up-kiosk-mode-using-the-windows-device-portal-windows-10-version-1607-and-version-1803) to configure single-app kiosks. This method is recommended only for demonstrations, as it requires that developer mode be enabled on the device.
|
||||
### Plan user and device groups
|
||||
|
||||
For HoloLens devices running Windows 10, version 1607, you can [use the Windows Device Portal](#set-up-kiosk-mode-using-the-windows-device-portal-windows-10-version-1607-and-version-1803) to configure single-app kiosks.
|
||||
In an MDM environment, you use groups to manage device configurations and user access.
|
||||
|
||||
## Start layout for HoloLens
|
||||
|
||||
If you use [MDM, Microsoft Intune](#set-up-kiosk-mode-using-microsoft-intune-or-mdm-windows-10-version-1803), or a [provisioning package](#set-up-kiosk-mode-using-a-provisioning-package-windows-10-version-1803) to configure a multi-app kiosk, the procedure requires a Start layout. Start layout customization isn't supported in Holographic for Business, so you'll need to use a placeholder Start layout.
|
||||
The kiosk configuration profile includes the **User logon type** setting. **User logon type** identifies the user (or group that contains the users) who can use the app (or apps) that you add. If a user signs in by using an account that is not included in the configuration profile, that user cannot use apps on the kiosk.
|
||||
|
||||
> [!NOTE]
|
||||
> Because a single-app kiosk launches the kiosk app when a user signs in, there is no Start screen displayed.
|
||||
> The **User logon type** of a single-app kiosk specifies a single user account. This is the user context under which the kiosk runs. The **User logon type** of a multi-app kiosk can specify one or more user accounts or groups that can use the kiosk.
|
||||
|
||||
### Start layout file for MDM (Intune and others)
|
||||
Before you can deploy the kiosk configuration to a device, you have to *assign* the kiosk configuration profile to a group that contains the device or a user that can sign on to the device. This setting produces behavior such as the following.
|
||||
|
||||
Save the following sample as an XML file. You can use this file when you configure the multi-app kiosk in Microsoft Intune (or in another MDM service that provides a kiosk profile).
|
||||
- If the device is a member of the assigned group, the kiosk configuration deploys to the device the first time that any user signs in on the device.
|
||||
- If the device is not a member of the assigned group, but a user who is a member of that group signs in, the kiosk configuration deploys to the device at that time.
|
||||
|
||||
For a full discussion of the effects of assigning configuration profiles in Intune, see [Assign user and device profiles in Microsoft Intune](https://docs.microsoft.com/intune/configuration/device-profile-assign).
|
||||
|
||||
> [!NOTE]
|
||||
> If you need to use a custom setting and full XML configuration to set up a kiosk in your MDM service, use the [Start layout instructions for a provisioning package](#start-layout-for-a-provisioning-package).
|
||||
> The following examples describe multi-app kiosks. Single-app kiosks behave in a similar manner, but only one user account gets the kiosk experience.
|
||||
|
||||
**Example 1**
|
||||
|
||||
You use a single group (Group 1) for both devices and users. One device and users A, B, and C are members of this group. You configure the kiosk configuration profile as follows:
|
||||
|
||||
- **User logon type**: Group 1
|
||||
- **Assigned group**: Group 1
|
||||
|
||||
No matter which user signs on to the device first (and goes through the Out-of-Box Experience, or OOBE), the kiosk configuration deploys to the device. Users A, B, and C can all sign in to the device and get the kiosk experience.
|
||||
|
||||
**Example 2**
|
||||
|
||||
You contract devices out to two different vendors who need different kiosk experiences. Both vendors have users, and you want all of the users to have access to kiosks from both their own vendor and the other vendor. You configure groups as follows:
|
||||
|
||||
- Device Group 1:
|
||||
- Device 1 (Vendor 1)
|
||||
- Device 2 (Vendor 1)
|
||||
|
||||
- Device Group 2:
|
||||
- Device 3 (Vendor 2)
|
||||
- Device 4 (Vendor 2)
|
||||
|
||||
- User Group:
|
||||
- User A (Vendor 1)
|
||||
- User B (Vendor 2)
|
||||
|
||||
You create two kiosk configuration profiles that have the following settings:
|
||||
|
||||
- Kiosk Profile 1:
|
||||
- **User logon type**: User Group
|
||||
- **Assigned group**: Device Group 1
|
||||
|
||||
- Kiosk Profile 2:
|
||||
- **User logon type**: User Group
|
||||
- **Assigned group**: Device Group 2
|
||||
|
||||
These configurations produce the following results:
|
||||
|
||||
- When any user signs on to Device 1 or Device 2, Intune deploys Kiosk Profile 1 to that device.
|
||||
- When any user signs on to Device 3 or Device 4, Intune deploys Kiosk Profile 2 to that device.
|
||||
- User A and user B can sign in to any of the four devices. If they sign in to Device 1 or Device 2, they see Vendor 1's kiosk experience. If they sign in to Device 3 or Device 4, they see Vendor 2's kiosk experience.
|
||||
|
||||
#### Profile conflicts
|
||||
|
||||
If two or more kiosk configuration profiles target the same device, they conflict. In the case of Intune-managed devices, Intune does not apply any of the conflicting profiles.
|
||||
|
||||
Other types of profiles and policies, such as device restrictions that are not related to the kiosk configuration profile, do not conflict with the kiosk configuration profile.
|
||||
|
||||
### Select a deployment method
|
||||
|
||||
You can select one of three methods to deploy kiosk configurations:
|
||||
|
||||
- [Microsoft Intune or other mobile device management (MDM) service](#use-microsoft-intune-or-other-mdm-to-set-up-a-single-app-or-multi-app-kiosk)
|
||||
|
||||
- [Provisioning package](#use-a-provisioning-package-to-set-up-a-single-app-or-multi-app-kiosk)
|
||||
|
||||
- [Windows Device Portal](#use-the-windows-device-portal-to-set-up-a-single-app-kiosk)
|
||||
|
||||
> [!NOTE]
|
||||
> Because this method requires that developer mode be enabled on the device, we recommend that you use it only for demonstrations.
|
||||
|
||||
The following table lists the capabilities and benefits of each of the three deployment methods.
|
||||
|
||||
| |Deploy by using Windows Device Portal |Deploy by using a provisioning package |Deploy by using MDM |
|
||||
| --------------------------- | ------------- | -------------------- | ---- |
|
||||
|Deploy single-app kiosks | Yes | Yes | Yes |
|
||||
|Deploy multi-app kiosks | No | Yes | Yes |
|
||||
|Deploy to local devices only | Yes | Yes | No |
|
||||
|Deploy by using developer mode |Required | Not required | Not required |
|
||||
|Deploy by using Azure Active Directory (AAD) | Not required | Not required | Required |
|
||||
|Deploy automatically | No | No | Yes |
|
||||
|Deployment speed | Fastest | Fast | Slow |
|
||||
|Deploy at scale | Not recommended | Not recommended | Recommended |
|
||||
|
||||
## Use Microsoft Intune or other MDM to set up a single-app or multi-app kiosk
|
||||
|
||||
To set up kiosk mode by using Microsoft Intune or another MDM system, follow these steps.
|
||||
|
||||
1. [Prepare to enroll the devices](#mdmenroll).
|
||||
1. [Create a kiosk configuration profile](#mdmprofile).
|
||||
1. Configure the kiosk.
|
||||
- [Configure the settings for a single-app kiosk](#mdmconfigsingle).
|
||||
- [Configure the settings for a multi-app kiosk](#mdmconfigmulti).
|
||||
1. [Assign the kiosk configuration profile to a group](#mdmassign).
|
||||
1. Deploy the devices.
|
||||
- [Deploy a single-app kiosk](#mdmsingledeploy).
|
||||
- [Deploy a multi-app kiosk](#mdmmultideploy).
|
||||
|
||||
### <a id="mdmenroll"></a>MDM, step 1 – Prepare to enroll the devices
|
||||
|
||||
You can configure your MDM system to enroll HoloLens devices automatically when the user first signs in, or have users enroll devices manually. The devices also have to be joined to your Azure AD domain, and assigned to the appropriate groups.
|
||||
|
||||
For more information about enrolling the devices, see [Enroll HoloLens in MDM](hololens-enroll-mdm.md) and [Intune enrollment methods for Windows devices](https://docs.microsoft.com/mem/intune/enrollment/windows-enrollment-methods).
|
||||
|
||||
### <a id="mdmprofile"></a>MDM, step 2 – Create a kiosk configuration profile
|
||||
|
||||
1. Open the [Azure](https://portal.azure.com/) portal and sign in to your Intune administrator account.
|
||||
1. Select **Microsoft Intune** > **Device configuration - Profiles** > **Create profile**.
|
||||
1. Enter a profile name.
|
||||
1. Select **Platform** > **Windows 10 and later**, and then select **Profile type** >**Device restrictions**.
|
||||
1. Select **Configure** > **Kiosk**, and then select one of the following:
|
||||
- To create a single-app kiosk, select **Kiosk Mode** > **Single-app kiosk**.
|
||||
- To create a multi-app kiosk, select **Kiosk Mode** > **Multi-app kiosk**.
|
||||
1. To start configuring the kiosk, select **Add**.
|
||||
|
||||
Your next steps differ depending on the type of kiosk that you want. For further information, select one of the following:
|
||||
|
||||
- [Single-app kiosk](#mdmconfigsingle)
|
||||
- [Multi-app kiosk](#mdmconfigmulti)
|
||||
|
||||
For more information about creating a kiosk configuration profile, see [Windows 10 and Windows Holographic for Business device settings to run as a dedicated kiosk using Intune](https://docs.microsoft.com/intune/configuration/kiosk-settings).
|
||||
|
||||
### <a id="mdmconfigsingle"></a>MDM, step 3 (single-app) – Configure the settings for a single-app kiosk
|
||||
|
||||
This section summarizes the settings that a single-app kiosk requires. For more detailed information, see the following articles:
|
||||
|
||||
- For information about how to configure a kiosk configuration profile in Intune, see [How to Configure Kiosk Mode Using Microsoft Intune](hololens-commercial-infrastructure.md#how-to-configure-kiosk-mode-using-microsoft-intune).
|
||||
- For more information about the available settings for single-app kiosks in Intune, see [Single full-screen app kiosks](https://docs.microsoft.com/intune/configuration/kiosk-settings-holographic#single-full-screen-app-kiosks)
|
||||
- For other MDM services, check your provider's documentation for instructions. If you need to use a custom setting and full XML configuration to set up a kiosk in your MDM service, [create an XML file that defines the kiosk configuration](#ppkioskconfig).
|
||||
|
||||
1. Select **User logon type** > **Local user account**, and enter the user name of the local (device) account or Microsoft Account (MSA) that can sign in to the kiosk.
|
||||
> [!NOTE]
|
||||
> **Autologon** user account types aren't supported on Windows Holographic for Business.
|
||||
1. Select **Application type** > **Store app**, and then select an app from the list.
|
||||
|
||||
Your next step is to [assign](#mdmassign) the profile to a group.
|
||||
|
||||
### <a id="mdmconfigmulti"></a>MDM, step 3 (multi-app) – Configure the settings for a multi-app kiosk
|
||||
|
||||
This section summarizes the settings that a multi-app kiosk requires. For more detailed information, see the following articles:
|
||||
|
||||
- For information about how to configure a kiosk configuration profile in Intune, see [How to Configure Kiosk Mode Using Microsoft Intune](hololens-commercial-infrastructure.md#how-to-configure-kiosk-mode-using-microsoft-intune).
|
||||
- For more information about the available settings for multi-app kiosks in Intune, see [Multi-app kiosks](https://docs.microsoft.com/mem/intune/configuration/kiosk-settings-holographic#multi-app-kiosks)
|
||||
- For other MDM services, check your provider's documentation for instructions. If you need to use a custom setting and full XML configuration to set up a kiosk in your MDM service, [create an XML file that defines the kiosk configuration](#ppkioskconfig). If you use an XML file, make sure to include the [Start layout](#start-layout-for-hololens).
|
||||
- You can optionally use a custom Start layout with Intune or other MDM services. For more information, see [Start layout file for MDM (Intune and others)](#start-layout-file-for-mdm-intune-and-others).
|
||||
|
||||
1. Select **Target Windows 10 in S mode devices** > **No**.
|
||||
>[!NOTE]
|
||||
> S mode isn't supported on Windows Holographic for Business.
|
||||
1. Select **User logon type** > **Azure AD user or group** or **User logon type** > **HoloLens visitor**, and then add one or more user groups or accounts.
|
||||
|
||||
Only users that belong to the groups or accounts that you specify in **User logon type** can use the kiosk experience.
|
||||
|
||||
1. Select one or more apps by using the following options:
|
||||
- To add an uploaded line-of-business app, select **Add store app** and then select the app you want.
|
||||
- To add an app by specifying its AUMID, select **Add by AUMID** and then enter the AUMID of the app. [See the list of available AUMIDs](#aumids)
|
||||
|
||||
Your next step is to [assign](#mdmassign) the profile to a group.
|
||||
|
||||
### <a id="mdmassign"></a>MDM, step 4 – Assign the kiosk configuration profile to a group
|
||||
|
||||
Use the **Assignments** page of the kiosk configuration profile to set where you want the kiosk configuration to deploy. In the simplest case, you assign the kiosk configuration profile to a group that will contain the HoloLens device when the device enrolls in MDM.
|
||||
|
||||
### <a id="mdmsingledeploy"></a>MDM, step 5 (single-app) – Deploy a single-app kiosk
|
||||
|
||||
When you use an MDM system, you can enroll the device in MDM during OOBE. After OOBE finishes, device sign-in is easy.
|
||||
|
||||
During OOBE, follow these steps:
|
||||
|
||||
1. Sign in by using the account that you specified in the kiosk configuration profile.
|
||||
1. Enroll the device. Make sure that the device is added to the group that the kiosk configuration profile is assigned to.
|
||||
1. Wait for OOBE to finish, for the store app to download and install, and for policies to be applied. Then restart the device.
|
||||
|
||||
The next time you sign in to the device, the kiosk app should automatically launch.
|
||||
|
||||
If you're not seeing your Kiosk mode yet, [check the assignment status](https://docs.microsoft.com/intune/configuration/device-profile-monitor).
|
||||
|
||||
### <a id="mdmmultideploy"></a>MDM, step 5 (multi-app) – Deploy a multi-app kiosk
|
||||
|
||||
When you use an MDM system, you can join the device to your Azure AD tenant and enroll the device in MDM during OOBE. If appropriate, provide the information that's required for enrollment to the users for the OOBE process.
|
||||
|
||||
> [!NOTE]
|
||||
> If you have assigned the kiosk configuration profile to a group that contains users, make sure that one of those user accounts is the first account to sign in to the device.
|
||||
|
||||
During OOBE, follow these steps:
|
||||
|
||||
1. Sign in by using the account that belongs to the **User logon type** group.
|
||||
1. Enroll the device.
|
||||
1. Wait for any apps that are part of the kiosk configuration profile to download and install, and for policies to be applied.
|
||||
1. After OOBE finishes, you can install additional apps from the Microsoft store or by sideloading. [Required apps](https://docs.microsoft.com/mem/intune/apps/apps-deploy#assign-an-app) for the group that the device belongs to install automatically.
|
||||
1. When finished, restart the device.
|
||||
|
||||
The next time you sign in to the device by using an account that belongs to the **User logon type**, the kiosk app should automatically launch.
|
||||
|
||||
If you're not seeing your Kiosk mode yet, [check the assignment status](https://docs.microsoft.com/intune/configuration/device-profile-monitor).
|
||||
|
||||
## Use a provisioning package to set up a single-app or multi-app kiosk
|
||||
|
||||
To set up kiosk mode by using a provisioning package, follow these steps.
|
||||
|
||||
1. [Create an XML file that defines the kiosk configuration.](#ppkioskconfig), including a [Start layout](#start-layout-for-hololens).
|
||||
2. [Add the XML file to a provisioning package.](#ppconfigadd)
|
||||
3. [Apply the provisioning package to HoloLens.](#ppapply)
|
||||
|
||||
### <a id="ppkioskconfig"></a>Prov. package, step 1 – Create a kiosk configuration XML file
|
||||
|
||||
Follow [the instructions for creating a kiosk configuration XML file for desktop](https://docs.microsoft.com/windows/configuration/lock-down-windows-10-to-specific-apps#configure-a-kiosk-using-a-provisioning-package), except for the following:
|
||||
|
||||
- Do not include Classic Windows applications (Win32). HoloLens does not support these applications.
|
||||
- Use the [placeholder Start XML](#start-layout-for-hololens) for HoloLens.
|
||||
- Optional: Add guest access to the kiosk configuration
|
||||
|
||||
#### <a id="ppkioskguest"></a>Optional: Add guest access to the kiosk configuration
|
||||
|
||||
In the [**Configs** section of the XML file](https://docs.microsoft.com/windows/configuration/lock-down-windows-10-to-specific-apps#configs), you can configure a special group named **Visitor** to allow guests to use the kiosk. When the kiosk is configured with the **Visitor** special group, a "**Guest**" option is added to the sign-in page. The **Guest** account does not require a password, and any data associated with the account is deleted when the account signs out.
|
||||
|
||||
To enable the **Guest** account, add the following snippet to your kiosk configuration XML:
|
||||
|
||||
```xml
|
||||
<LayoutModificationTemplate
|
||||
xmlns="http://schemas.microsoft.com/Start/2014/LayoutModification"
|
||||
xmlns:defaultlayout="http://schemas.microsoft.com/Start/2014/FullDefaultLayout"
|
||||
xmlns:start="http://schemas.microsoft.com/Start/2014/StartLayout"
|
||||
Version="1">
|
||||
<RequiredStartGroupsCollection>
|
||||
<RequiredStartGroups>
|
||||
<AppendGroup Name="">
|
||||
<start:Tile Size="2x2" Column="0" Row="0" AppUserModelID="placeholderpackagename_kzf8qxf38zg5c!App" />
|
||||
</AppendGroup>
|
||||
</RequiredStartGroups>
|
||||
</RequiredStartGroupsCollection>
|
||||
</LayoutModificationTemplate>
|
||||
<Configs>
|
||||
<Config>
|
||||
<SpecialGroup Name="Visitor" />
|
||||
<DefaultProfile Id="enter a profile ID"/>
|
||||
</Config>
|
||||
</Configs>
|
||||
```
|
||||
|
||||
### Start layout for a provisioning package
|
||||
#### Start layout for HoloLens
|
||||
|
||||
You will [create an XML file](#set-up-kiosk-mode-using-a-provisioning-package-windows-10-version-1803) to define the kiosk configuration to be included in a provisioning package. Use the following sample in the `StartLayout` section of your XML file.
|
||||
If you use a [provisioning package](##use-a-provisioning-package-to-set-up-a-single-app-or-multi-app-kiosk) to configure a multi-app kiosk, the procedure requires a Start layout. Start layout customization isn't supported in Windows Holographic for Business, so you'll need to use a placeholder Start layout.
|
||||
|
||||
> [!NOTE]
|
||||
> Because a single-app kiosk launches the kiosk app when a user signs in, it does not use a Start menu and does not need a Start layout.
|
||||
|
||||
> [!NOTE]
|
||||
> If you use [MDM](#use-microsoft-intune-or-other-mdm-to-set-up-a-single-app-or-multi-app-kiosk) to set up a multi-app kiosk, you can optionally use a Start layout. For more information, see [Start layout file for MDM (Intune and others)](#start-layout-file-for-mdm-intune-and-others).
|
||||
|
||||
For the Start layout, add the following **StartLayout** section to the kiosk provisioning XML file:
|
||||
|
||||
```xml
|
||||
<!-- This section is required for parity with Desktop Assigned Access. It is not currently used on HoloLens -->
|
||||
@ -104,114 +381,92 @@ You will [create an XML file](#set-up-kiosk-mode-using-a-provisioning-package-wi
|
||||
<!-- This section is required for parity with Desktop Assigned Access. It is not currently used on HoloLens -->
|
||||
```
|
||||
|
||||
## Set up kiosk mode using Microsoft Intune or MDM (Windows 10, version 1803)
|
||||
#### Start layout file for MDM (Intune and others)
|
||||
|
||||
For HoloLens devices that are managed by Microsoft Intune, directions can be found [here](hololens-commercial-infrastructure.md#how-to-configure-kiosk-mode-using-microsoft-intune).
|
||||
|
||||
For other MDM services, check your provider's documentation for instructions. If you need to use a custom setting and full XML configuration to set up a kiosk in your MDM service, [create an XML file that defines the kiosk configuration](#create-a-kiosk-configuration-xml-file), and make sure to include the [Start layout](#start-layout-for-a-provisioning-package) in the XML file.
|
||||
|
||||
## Set up kiosk mode using a provisioning package (Windows 10, version 1803)
|
||||
|
||||
Process:
|
||||
1. [Create an XML file that defines the kiosk configuration.](#create-a-kiosk-configuration-xml-file)
|
||||
2. [Add the XML file to a provisioning package.](#add-the-kiosk-configuration-xml-file-to-a-provisioning-package)
|
||||
3. [Apply the provisioning package to HoloLens.](#apply-the-provisioning-package-to-hololens)
|
||||
|
||||
### Create a kiosk configuration XML file
|
||||
|
||||
Follow [the instructions for creating a kiosk configuration XML file for desktop](https://docs.microsoft.com/windows/configuration/lock-down-windows-10-to-specific-apps#configure-a-kiosk-using-a-provisioning-package), with the following exceptions:
|
||||
|
||||
- Do not include Classic Windows applications (Win32) since they aren't supported on HoloLens.
|
||||
- Use the [placeholder Start XML](#start-layout-for-hololens) for HoloLens.
|
||||
|
||||
#### Add guest access to the kiosk configuration (optional)
|
||||
|
||||
In the [Configs section of the XML file](https://docs.microsoft.com/windows/configuration/lock-down-windows-10-to-specific-apps#configs), you can configure a special group named **Visitor** to allow guests to use the kiosk. When the kiosk is configured with the **Visitor** special group, a "**Guest**" option is added to the sign-in page. The **Guest** account does not require a password, and any data associated with the account is deleted when the account signs out.
|
||||
|
||||
Use the following snippet in your kiosk configuration XML to enable the **Guest** account:
|
||||
|
||||
```xml
|
||||
<Configs>
|
||||
<Config>
|
||||
<SpecialGroup Name="Visitor" />
|
||||
<DefaultProfile Id="enter a profile ID"/>
|
||||
</Config>
|
||||
</Configs>
|
||||
```
|
||||
|
||||
### Add the kiosk configuration XML file to a provisioning package
|
||||
|
||||
1. Open [Windows Configuration Designer](https://www.microsoft.com/store/apps/9nblggh4tx22).
|
||||
2. Choose **Advanced provisioning**.
|
||||
3. Name your project, and click **Next**.
|
||||
4. Choose **Windows 10 Holographic** and click **Next**.
|
||||
5. Select **Finish**. The workspace for your package opens.
|
||||
6. Expand **Runtime settings** > **AssignedAccess** > **MultiAppAssignedAccessSettings**.
|
||||
7. In the center pane, click **Browse** to locate and select the kiosk configuration XML file that you created.
|
||||
|
||||
|
||||
|
||||
8. (**Optional**: If you want to apply the provisioning package after device initial setup and there is an admin user already available on the kiosk device, skip this step.) Create an admin user account in **Runtime settings** > **Accounts** > **Users**. Provide a **UserName** and **Password**, and select **UserGroup** as **Administrators**. With this account, you can view the provisioning status and logs if needed.
|
||||
9. (**Optional**: If you already have a non-admin account on the kiosk device, skip this step.) Create a local standard user account in **Runtime settings** > **Accounts** > **Users**. Make sure the **UserName** is the same as the account that you specify in the configuration XML. Select **UserGroup** as **Standard Users**.
|
||||
10. On the **File** menu, select **Save.**
|
||||
11. On the **Export** menu, select **Provisioning package**.
|
||||
12. Change **Owner** to **IT Admin**, which will set the precedence of this provisioning package higher than provisioning packages applied to this device from other sources, and then select **Next.**
|
||||
|
||||
13. On the **Provisioning package security** page, do not select **Enable package encryption** or provisioning will fail on HoloLens. You can choose to enable package signing.
|
||||
|
||||
- **Enable package signing** - If you select this option, you must select a valid certificate to use for signing the package. You can specify the certificate by clicking **Browse** and choosing the certificate you want to use to sign the package.
|
||||
|
||||
14. Click **Next** to specify the output location where you want the provisioning package to go when it's built. By default, Windows Configuration Designer uses the project folder as the output location. Optionally, you can click **Browse** to change the default output location.
|
||||
|
||||
15. Click **Next**.
|
||||
|
||||
16. Click **Build** to start building the package. The provisioning package doesn't take long to build. The project information is displayed in the build page and the progress bar indicates the build status.
|
||||
|
||||
|
||||
### Apply the provisioning package to HoloLens
|
||||
|
||||
1. Connect HoloLens via USB to a PC and start the device, but do not continue past the **Fit** page of OOBE (the first page with the blue box).
|
||||
|
||||
3. HoloLens will show up as a device in File Explorer on the PC.
|
||||
|
||||
4. In File Explorer, drag and drop the provisioning package (.ppkg) onto the device storage.
|
||||
|
||||
5. Briefly press and release the **Volume Down** and **Power** buttons simultaneously again while on the **fit** page.
|
||||
|
||||
6. The device will ask you if you trust the package and would like to apply it. Confirm that you trust the package.
|
||||
|
||||
7. You will see whether the package was applied successfully or not. If it failed, you can fix your package and try again. If it succeeded, proceed with OOBE.
|
||||
|
||||
|
||||
## Set up kiosk mode using the Windows Device Portal (Windows 10, version 1607 and version 1803)
|
||||
|
||||
1. [Set up the HoloLens to use the Windows Device Portal](https://developer.microsoft.com/windows/mixed-reality/using_the_windows_device_portal#setting_up_hololens_to_use_windows_device_portal). The Device Portal is a web server on your HoloLens that you can connect to from a web browser on your PC.
|
||||
|
||||
> [!IMPORTANT]
|
||||
> When you set up HoloLens to use the Device Portal, you must enable **Developer Mode** on the device. **Developer Mode** on a device that has been upgraded to Windows Holographic for Business enables side-loading of apps, which risks the installation of apps that have not been certified by the Microsoft Store. Administrators can block the ability to enable **Developer Mode** using the **ApplicationManagement/AllowDeveloper Unlock** setting in the [Policy CSP](https://msdn.microsoft.com/library/windows/hardware/dn904962.aspx). [Learn more about Developer Mode.](https://msdn.microsoft.com/windows/uwp/get-started/enable-your-device-for-development#developer-mode)
|
||||
|
||||
2. On a PC, connect to the HoloLens using [Wi-Fi](https://developer.microsoft.com/windows/mixed-reality/Using_the_Windows_Device_Portal.html#connecting_over_wi-fi) or [USB](https://developer.microsoft.com/windows/mixed-reality/Using_the_Windows_Device_Portal.html#connecting_over_usb).
|
||||
|
||||
3. [Create a user name and password](https://developer.microsoft.com/windows/mixed-reality/Using_the_Windows_Device_Portal.html#creating_a_username_and_password) if this is the first time you connect to the Windows Device Portal, or enter the user name and password that you previously set up.
|
||||
|
||||
> [!TIP]
|
||||
> If you see a certificate error in the browser, follow [these troubleshooting steps](https://developer.microsoft.com/windows/mixed-reality/Using_the_Windows_Device_Portal.html#security_certificate).
|
||||
|
||||
4. In the Windows Device Portal, click **Kiosk Mode**.
|
||||
|
||||
|
||||
Save the following sample as an XML file. You can use this file when you configure the multi-app kiosk in Microsoft Intune (or in another MDM service that provides a kiosk profile).
|
||||
|
||||
> [!NOTE]
|
||||
> The kiosk mode option will be available if the device is [enrolled in device management](hololens-enroll-mdm.md) and has a [license to upgrade to Windows Holographic for Business](hololens1-upgrade-enterprise.md).
|
||||
> If you need to use a custom setting and full XML configuration to set up a kiosk in your MDM service, use the [Start layout instructions for a provisioning package](#start-layout-for-hololens).
|
||||
|
||||
5. Select **Enable Kiosk Mode**, choose an app to run when the device starts, and click **Save**.
|
||||
```xml
|
||||
<LayoutModificationTemplate
|
||||
xmlns="http://schemas.microsoft.com/Start/2014/LayoutModification"
|
||||
xmlns:defaultlayout="http://schemas.microsoft.com/Start/2014/FullDefaultLayout"
|
||||
xmlns:start="http://schemas.microsoft.com/Start/2014/StartLayout"
|
||||
Version="1">
|
||||
<RequiredStartGroupsCollection>
|
||||
<RequiredStartGroups>
|
||||
<AppendGroup Name="">
|
||||
<start:Tile Size="2x2" Column="0" Row="0" AppUserModelID="placeholderpackagename_kzf8qxf38zg5c!App" />
|
||||
</AppendGroup>
|
||||
</RequiredStartGroups>
|
||||
</RequiredStartGroupsCollection>
|
||||
</LayoutModificationTemplate>
|
||||
```
|
||||
|
||||
## Kiosk app recommendations
|
||||
### <a id="ppconfigadd"></a>Prov. package, step 2 – Add the kiosk configuration XML file to a provisioning package
|
||||
|
||||
- You cannot select Microsoft Edge, Microsoft Store, or the Shell app as a kiosk app.
|
||||
- We recommend that you do **not** select the Settings app and the File Explorer app as a kiosk app.
|
||||
- You can select Cortana as a kiosk app.
|
||||
- To enable photo or video capture, the HoloCamera app must be enabled as a kiosk app.
|
||||
1. Open [Windows Configuration Designer](https://www.microsoft.com/store/apps/9nblggh4tx22).
|
||||
1. Select **Advanced provisioning**, enter a name for your project, and then select **Next**.
|
||||
1. Select **Windows 10 Holographic**, and then select **Next**.
|
||||
1. Select **Finish**. The workspace for your package opens.
|
||||
1. Select **Runtime settings** > **AssignedAccess** > **MultiAppAssignedAccessSettings**.
|
||||
1. In the center pane, select **Browse** to locate and select the kiosk configuration XML file that you created.
|
||||
|
||||
|
||||
|
||||
1. **Optional**. (If you want to apply the provisioning package after device initial setup and there is an admin user already available on the kiosk device, skip this step.) Select **Runtime settings** > **Accounts** > **Users**, and then create a user account. Provide a user name and password, and then select **UserGroup** > **Administrators**.
|
||||
|
||||
By using this account, you can view the provisioning status and logs.
|
||||
1. **Optional**. (If you already have a non-admin account on the kiosk device, skip this step.) Select **Runtime settings** > **Accounts** > **Users**, and then create a local user account. Make sure the user name is the same as the account that you specify in the configuration XML. Select **UserGroup** > **Standard Users**.
|
||||
1. Select **File** > **Save**.
|
||||
1. Select **Export** > **Provisioning package**, and then select **Owner** > **IT Admin**. This sets the precedence of this provisioning package higher than provisioning packages that are applied to this device from other sources.
|
||||
1. Select **Next**.
|
||||
1. On the **Provisioning package security** page, select a security option.
|
||||
> [!IMPORTANT]
|
||||
> If you select **Enable package signing**, you also have to select a valid certificate to use for signing the package. To do this, select **Browse** and select the certificate that you want to use to sign the package.
|
||||
|
||||
> [!CAUTION]
|
||||
> Do not select **Enable package encryption**. On HoloLens devices, this setting causes provisioning to fail.
|
||||
1. Select **Next**.
|
||||
1. Specify the output location where you want the provisioning package to go when it's built. By default, Windows Configuration Designer uses the project folder as the output location. If you want to change the output location, select **Browse**. When finished, select **Next**.
|
||||
1. Select **Build** to start building the package. The provisioning package doesn't take long to build. The build page displays the project information, and the progress bar indicates the build status.
|
||||
|
||||
### <a id="ppapply"></a>Prov. package, step 3 – Apply the provisioning package to HoloLens
|
||||
|
||||
The "Configure HoloLens by using a provisioning package" article provides detailed instructions for applying the provisioning package under the following circumstances:
|
||||
|
||||
- You can initially [apply a provisioning package to HoloLens during setup](hololens-provisioning.md#apply-a-provisioning-package-to-hololens-during-setup).
|
||||
|
||||
- You can also [apply a provisioning package to HoloLens after setup](hololens-provisioning.md#4-apply-a-provisioning-package-to-hololens-after-setup).
|
||||
|
||||
## Use the Windows Device Portal to set up a single-app kiosk
|
||||
|
||||
To set up kiosk mode by using the Windows Device Portal, follow these steps.
|
||||
|
||||
> [!IMPORTANT]
|
||||
> Kiosk mode is only available if the device has [Windows Holographic for Business](hololens1-upgrade-enterprise.md) installed.
|
||||
|
||||
1. [Set up the HoloLens device to use the Windows Device Portal](https://developer.microsoft.com/windows/mixed-reality/using_the_windows_device_portal#setting_up_hololens_to_use_windows_device_portal). The Device Portal is a web server on your HoloLens that you can connect to from a web browser on your PC.
|
||||
|
||||
> [!CAUTION]
|
||||
> When you set up HoloLens to use the Device Portal, you have to enable **Developer Mode** on the device. **Developer Mode** on a device that has Windows Holographic for Business enables you to side-load apps. However, this setting creates a risk that a user can install apps that have not been certified by the Microsoft Store. Administrators can block the ability to enable **Developer Mode** by using the **ApplicationManagement/AllowDeveloper Unlock** setting in the [Policy CSP](https://docs.microsoft.com/windows/client-management/mdm/policy-configuration-service-provider). [Learn more about Developer Mode.](https://docs.microsoft.com/windows/uwp/get-started/enable-your-device-for-development#developer-mode)
|
||||
|
||||
1. On a computer, connect to the HoloLens by using [Wi-Fi](https://developer.microsoft.com/windows/mixed-reality/Using_the_Windows_Device_Portal#connecting_over_wi-fi) or [USB](https://developer.microsoft.com/windows/mixed-reality/Using_the_Windows_Device_Portal#connecting_over_usb).
|
||||
|
||||
1. Do one of the following:
|
||||
- If you are connecting to the Windows Device Portal for the first time, [create a user name and password](https://developer.microsoft.com/windows/mixed-reality/Using_the_Windows_Device_Portal#creating_a_username_and_password)
|
||||
- Enter the user name and password that you previously set up.
|
||||
|
||||
> [!TIP]
|
||||
> If you see a certificate error in the browser, follow [these troubleshooting steps](https://developer.microsoft.com/windows/mixed-reality/Using_the_Windows_Device_Portal#security_certificate).
|
||||
|
||||
1. In the Windows Device Portal, select **Kiosk Mode**.
|
||||
|
||||
1. Select **Enable Kiosk Mode**, select an app to run when the device starts, and then select **Save**.
|
||||
|
||||
|
||||
1. Restart HoloLens. If you still have your Device Portal page open, you can select select **Restart** at the top of the page.
|
||||
|
||||
## More information
|
||||
|
||||
|
||||
@ -33,7 +33,7 @@ Some of the HoloLens configurations that you can apply in a provisioning package
|
||||
- Set up a Wi-Fi connection
|
||||
- Apply certificates to the device
|
||||
- Enable Developer Mode
|
||||
- Configure Kiosk mode (Detailed instructions for configuring kiosk mode can be found [here](hololens-kiosk.md#set-up-kiosk-mode-using-a-provisioning-package-windows-10-version-1803).
|
||||
- Configure Kiosk mode (Detailed instructions for configuring kiosk mode can be found [here](hololens-kiosk.md#use-a-provisioning-package-to-set-up-a-single-app-or-multi-app-kiosk).
|
||||
|
||||
## Provisioning package HoloLens wizard
|
||||
|
||||
@ -49,7 +49,7 @@ The HoloLens wizard helps you configure the following settings in a provisioning
|
||||
- Enroll the device in Azure Active Directory, or create a local account
|
||||
- Add certificates
|
||||
- Enable Developer Mode
|
||||
- Configure kiosk mode (for detailed instructions,see [Set up kiosk mode using a provisioning package](hololens-kiosk.md#set-up-kiosk-mode-using-a-provisioning-package-windows-10-version-1803)
|
||||
- Configure kiosk mode. (Detailed instructions for configuring kiosk mode can be found [here](hololens-kiosk.md##use-a-provisioning-package-to-set-up-a-single-app-or-multi-app-kiosk)).
|
||||
|
||||
> [!WARNING]
|
||||
> You must run Windows Configuration Designer on Windows 10 to configure Azure Active Directory enrollment using any of the wizards.
|
||||
|
||||
@ -66,7 +66,7 @@ There are two types of Kiosk Modes: Single app and multi-app. Single app kiosk m
|
||||
|
||||
**How to Configure Kiosk Mode:**
|
||||
|
||||
There are two main ways ([provisioning packages](hololens-kiosk.md#set-up-kiosk-mode-using-a-provisioning-package-windows-10-version-1803) and [MDM](hololens-kiosk.md#set-up-kiosk-mode-using-microsoft-intune-or-mdm-windows-10-version-1803)) to deploy kiosk mode for HoloLens. These options will be discussed later in the document; however, you can use the links above to jump to the respective sections in this doc.
|
||||
There are two main ways ([provisioning packages](hololens-kiosk.md#use-a-provisioning-package-to-set-up-a-single-app-or-multi-app-kiosk) and [MDM](hololens-kiosk.md#use-microsoft-intune-or-other-mdm-to-set-up-a-single-app-or-multi-app-kiosk)) to deploy kiosk mode for HoloLens. These options will be discussed later in the document; however, you can use the links above to jump to the respective sections in this doc.
|
||||
|
||||
### Apps and App Specific Scenarios
|
||||
|
||||
|
||||
@ -284,7 +284,10 @@ Each command is tracked with full details such as:
|
||||
- Large scale command execution is not supported.
|
||||
- A user can only initiate one session at a time.
|
||||
- A device can only be in one session at a time.
|
||||
- There is a file size limit of 750mb when downloading files from a device.
|
||||
- The following file size limits apply:
|
||||
- `getfile` limit: 3 GB
|
||||
- `fileinfo` limit: 10 GB
|
||||
- `library` limit: 250 MB
|
||||
|
||||
## Related article
|
||||
- [Live response command examples](live-response-command-examples.md)
|
||||
|
||||
Loading…
x
Reference in New Issue
Block a user