Custom Android App Kiosk Policy: Enrollment Limitation and Staging Workaround

Issue

When an administrator assigns a custom app to a Kiosk app role in NinjaOne Mobile Device Management (MDM), Android devices that do not yet have that app installed may fail to complete enrollment or encounter an error when the policy applies. This article explains the cause of this behavior and describes a workaround for the staging policy. We are developing a solution that does not require customer action, which will be available in a future release.

Environment

This article applies to the following environment:

• NinjaOne Mobile Device Management (MDM)
• Android

Cause

When you assign a custom app to a Kiosk app role, NinjaOne MDM displays a banner warning that the app must be installed before the kiosk configuration applies. If the app is not yet installed, a limitation in Google's custom app support causes one of two problems: devices already enrolled encounter an error when NinjaOne MDM applies the policy, and devices not yet enrolled refuse to complete enrollment.

Resolution

To avoid this issue, enroll new Android devices into a staging policy that deploys the custom app without a Kiosk app role assignment. After the app installs, move the device to the kiosk role policy. NinjaOne plans to address this limitation in a future release.

Create a Staging Policy

Create a policy that deploys the custom app to the device without assigning a kiosk app role.

1. In the NinjaOne platform, navigate to Administration → Policies → MDM policies, then click Add MDM policy.
2. Create a new Android policy and configure it to deploy the custom app. Do not configure a Kiosk app role in this policy. Refer to NinjaOne MDM: Android Policy Management for more information.

Enroll the Device

1. Enroll the Android device. Refer to NinjaOne MDM: Zero-Touch Enrollment For Android Devices for more information.
2. Assign the newly enrolled device to the staging policy you created.

Move the Device to the Kiosk Role Policy

After the custom app installs, locate the device in NinjaOne and reassign it from the staging policy to the kiosk role policy.