Multi-app kiosk profile assignment is how Windows 11 decides which restricted desktop a person sees when they sign in to a shared device. You build an Assigned Access profile that lists the allowed apps, then you bind that profile to a user, a group, an autologon account, or every non-admin on the device. The binding lives in the configuration file, and it's the part that trips people up most. This guide explains the assignment model, per Microsoft Learn, and where it quietly fails.
Key takeaways
- A profile defines the allowed apps; a config binds that profile to an account or group. Assignment is the config, not the profile.
- You can assign by individual account, by group, by a managed autologon account, or globally to all non-admin users.
- Local, Active Directory, and Microsoft Entra ID accounts and groups are all supported, but single-app profiles can't be assigned to groups.
- Assigned Access needs Windows 11 Pro, Enterprise, Education, or IoT Enterprise. Home isn't supported.
- Conditional access that needs interaction, like MFA, can lock assigned users out, so plan identity carefully.
Quick explanation
In simple terms
It's how you tell Windows 11 which locked-down app set each person should see when they log in to a shared computer.
Technical definition
Within the AssignedAccess CSP XML, each Config element associates a standard user account or group with an AllAppList profile Id, enforced at sign-in along with the restricted-experience policy and AppLocker rules.
Analogy
Think of the profile as a keycard's access level and the config as the list that says which badge gets which level. Same door, different rooms unlock depending on who taps in.
Definition
Multi-app kiosk profile assignment is the Windows 11 mechanism that binds an Assigned Access restricted-experience profile to a specific user account, group, or the whole device, so the right locked-down desktop loads when someone signs in.
Multi-app kiosk profile assignment is the part of Windows 11 Assigned Access that decides who receives which restricted desktop. A profile lists the apps a person may run, plus the Start layout and taskbar. Assignment lives separately, in the Configs section of the same XML, where each entry ties one profile to an account, a group, an autologon account, or every non-admin on the device.
When a user signs in, Windows resolves their account or group to a config, applies the linked profile, and enforces it with AppLocker and restricted-experience policy. Per Microsoft Learn, this works on Windows 11 Pro, Enterprise, Education, and IoT Enterprise. The assignment, not the app list, is where most deployments go wrong.
Why it matters
Core concepts
Assigned Access
The Windows feature that turns a device into a kiosk or a restricted user experience.
Assigned Access is the engine behind every kiosk profile on Windows 11. It has two modes: a full-screen single-app kiosk, and a restricted user experience, which is the multi-app case. The multi-app mode keeps a familiar desktop but limits it to an approved app list, a tailored Start menu, and set policies. Per Microsoft Learn, it runs on Windows 11 Pro, Enterprise, Education, and IoT Enterprise.
Example
A library sign-in account that opens to a desktop with only a browser, a PDF reader, and the catalog app.
Why it matters — Everything about profile assignment sits inside Assigned Access, so its rules and edition limits set the boundaries.
The profile (AllAppList)
A named block in the XML that lists the apps a user may run, plus the Start and taskbar layout.
In a multi-app setup, the profile uses the AllAppList node. You add each allowed app by its AUMID for UWP apps or by DesktopAppPath for Win32 apps. When Windows applies the profile, it generates AppLocker rules for exactly those apps. A single file can hold several AllAppList profiles, so one device can serve several roles.
Example
A 'Nurse' profile with an EHR client and Edge; a 'Reception' profile with only a check-in app.
Why it matters — The profile is the 'what.' Without a matching assignment, though, nobody ever receives it.
The config (the assignment)
A Configs entry that binds one profile to an account or group.
This is profile assignment itself. Each Config pairs a profile Id with who should get it: a specific Account, a UserGroup, an AutoLogonAccount, or a device-wide GlobalProfile. At sign-in, Windows looks up the account, finds its config, and enforces the linked profile. No config means the profile stays dormant.
Example
An Account element of AzureAD\nurse@contoso.com paired with the Nurse profile Id.
Why it matters — Assignment is where most multi-app kiosk problems start, because the profile can be perfect yet reach no one.
Identity types you can assign
The account and group kinds a config accepts: local, Active Directory, and Microsoft Entra ID.
Per Microsoft Learn, an Account can be a local user (user or .\user), a domain user (domain\samAccountName), or a Microsoft Entra user (AzureAD\upn). A UserGroup can be a LocalGroup, an ActiveDirectoryGroup, or an AzureActiveDirectoryGroup, which uses the group's object ID. Local accounts must already exist; domain and Entra identities are resolved from the joined forest or tenant.
Example
An AzureActiveDirectoryGroup config using a group object ID for all frontline staff.
Why it matters — Picking the wrong identity format is a common reason an assignment silently fails to apply.
The four assignment scopes
Individual account, group, autologon account, and global profile.
You can target one account, a whole group, a managed autologon account that signs in after restart, or every non-admin through GlobalProfile. Scopes combine: a user with their own config overrides the global profile. Per Microsoft Learn, autologon uses a local standard account that Assigned Access creates and manages.
Example
A GlobalProfile for a walk-up desktop, plus a named config for the on-site supervisor.
Why it matters — The scope decides how a fleet scales and whether one XML covers a device or just one person.
The AssignedAccess CSP and delivery
The configuration service provider that receives the XML and the channels that deliver it.
The whole XML, profiles and configs together, is pushed to ./Vendor/MSFT/AssignedAccess/Configuration. Per Microsoft Learn, you deliver it through an MDM like Microsoft Intune, a provisioning package, or PowerShell with the MDM Bridge WMI Provider. The XML is versioned by namespace, so Windows 11 features like StartPins need the matching v5 namespace.
Example
An Intune custom policy with OMA-URI ./Vendor/MSFT/AssignedAccess/Configuration and the XML as its value.
Why it matters — Assignment only takes effect once the CSP applies the file, so delivery and schema version matter as much as the config itself.
How it works
Define the profiles
Author one or more AllAppList profiles in the XML. Each gets a unique Profile Id and its own allowed-apps list, Start layout, and taskbar setting.
Profiles
Example — A 'Retail' and a 'Manager' profile in the same file.
Bind each profile in Configs
Add a Config for every audience: an Account, a UserGroup, an AutoLogonAccount, or a GlobalProfile, each pointing at a Profile Id. This is the assignment.
Configs
Example — A UserGroup config for cashiers pointing at the Retail profile.
Deliver through the AssignedAccess CSP
Push the full XML to the AssignedAccess CSP through Intune, a provisioning package, or PowerShell. Windows validates it against the schema version in the root namespace.
CSP push
Example — An Intune custom OMA-URI policy targeting the device group.
Resolve the profile at sign-in
When a user signs in, Windows matches their account or group to a config. A personal config wins over the global profile. Autologon signs in the managed account automatically after restart.
Sign-in match
Example — The account nurse@contoso.com resolves to the Nurse profile.
Render the restricted experience
Windows loads the desktop with only the profile's apps, its Start layout, and its taskbar choice. File Explorer browsing is locked down unless the profile allows Downloads or removable drives.
Restricted shell
Example — Start shows three pinned apps; Settings and cmd are gone.
Enforce during the session
Auto-generated AppLocker rules and restricted-experience policies block apps outside the allowlist for the whole session. The breakout sequence, Ctrl+Alt+Del by default, exits the experience.
Runtime enforcement
Example — Launching an unlisted app is denied by AppLocker.
Use cases
Role-based shared workstations
Healthcare ITOne device, several roles, each getting its own restricted app set through a group config.
A ward PC where nurses and clerks sign in to different profiles.
Benefit — No need for separate devices per role.
Frontline device fleets
Retail and operationsAssign a global profile so every non-admin who signs in gets the same locked desktop.
Store-floor tablets with a single approved app set.
Benefit — Consistent experience with one XML.
Autologon walk-up stations
Facilities and receptionA managed autologon account opens the restricted desktop after restart with no credentials.
A check-in station that boots straight into the queue app.
Benefit — Zero-touch startup for public devices.
Student and lab devices
Education ITGroup configs by class or lab give students a controlled set of tools.
A lab profile with the LMS, a browser, and office apps.
Benefit — Blocks installs and distractions.
Benefits
Different experiences on one device
Multiple AllAppList profiles plus per-account configs let a single PC serve many roles.
Reception and manager profiles on the same front-desk machine.
Central assignment through Intune
Configs deploy with the XML through the AssignedAccess CSP, so a fleet updates from one policy.
Adding an app to the allowlist and re-pushing to a device group.
Automatic lockdown policies
Per Microsoft Learn, the restricted experience applies policy settings and AppLocker rules for you, unlike Shell Launcher.
Unlisted apps blocked without writing AppLocker rules by hand.
Identity-aware targeting
Assign by local, domain, or Entra account and group, matching how the fleet is already managed.
An Entra security group driving the assignment.
Limitations
Admins can't be assigned
MediumPer Microsoft Learn, you can only apply a restricted experience to standard users, not administrator accounts.
Workaround — Use a separate standard account for the kiosk role.
Groups can't get single-app profiles
LowA config that names a group can only use a restricted-experience profile, not a single-app KioskModeApp profile.
Workaround — Assign single-app profiles to individual accounts instead.
Conditional access can lock users out
HighMicrosoft warns that assigning a profile to users behind interactive conditional access, like MFA or Terms of Use, can block sign-in.
Workaround — Exclude kiosk accounts from interactive CA, or use non-interactive authentication.
Schema version sensitivity
MediumThe XML is versioned by namespace, so Windows 11 features need the v5 namespace or the CSP rejects the file.
Workaround — Match the namespace to the target build and feature set.
Removal isn't fully clean
LowPer Microsoft Learn, deleting the configuration removes policy settings but keeps some changes, such as the multi-app Start menu layout.
Workaround — Reimage or manually reset leftover layout where it matters.
Build-specific deployment regressions
MediumOn Microsoft Q&A, admins report multi-app kiosk deployment failing on some Windows 11 24H2 and 25H2 builds, around 26100.4946 and later, with MDM error 0x86000005.
Workaround — Test on your exact target build; some report the known-good 26100.1742 build as a fallback.
Architecture
A multi-app kiosk deployment has three moving parts: the profiles that describe each restricted experience, the configs that assign them, and the AssignedAccess CSP that applies the XML. Identity providers resolve who a config points to, and AppLocker plus policy enforce the result at runtime.
AllAppList profile
Defines the allowed apps, Start layout, and taskbar for one restricted experience.
A 'Reception' profile with a check-in app and Edge.
Config (assignment)
Binds a profile to an account, group, autologon account, or all non-admins.
An AzureActiveDirectoryGroup config pointing at the Reception profile.
AssignedAccess CSP
Receives and applies the XML at ./Vendor/MSFT/AssignedAccess/Configuration.
An Intune custom policy delivering the file.
Identity provider
Resolves local, Active Directory, or Microsoft Entra accounts and groups named in configs.
An Entra tenant resolving a group object ID.
AppLocker
Auto-generates allow rules from the profile's app list and blocks the rest.
A rule allowing only the listed AUMIDs and paths.
Data flow
The admin authors the XML, then Intune, a provisioning package, or PowerShell writes it to the AssignedAccess CSP. At sign-in, Windows reads the configs, matches the account or group, applies the linked profile, and enforces AppLocker and policy for the session.
Integrations: Microsoft Intune, Provisioning packages (Windows Configuration Designer), PowerShell MDM Bridge WMI Provider, Microsoft Entra ID, Active Directory
Architecture limitations
Examples
Per-user Entra assignment
A clinic wants each clinician on a shared PC to get a role-specific desktop.
Each Config names an AzureAD user and a matching profile Id. At sign-in, Windows resolves the Entra account to its profile.
Global profile for a walk-up kiosk
A lobby PC should give every visitor the same locked desktop.
A single GlobalProfile config applies to all non-admin sign-ins, so no per-user config is needed.
Autologon check-in station
A reception device must boot into a queue app with no login.
An AutoLogonAccount config creates a managed local standard user that signs in after restart and loads the profile.
Comparisons
Multi-app vs single-app kiosk vs Single-app kiosk (KioskModeApp)
Multi-app is the restricted user experience on a desktop; single-app runs one UWP app or Edge full screen above the lock screen.
| Criterion | Multi-app vs single-app kiosk | Single-app kiosk (KioskModeApp) |
|---|---|---|
| Apps available | A defined list of UWP and Win32 apps | One app only |
| Assignment to groups | Supported | Not supported, users only |
| Interface | Tailored Start menu and taskbar | Full-screen single app |
| Profiles per file | Multiple AllAppList profiles | One KioskModeApp profile |
When to choose — Multi-app for role-based shared devices; single-app for signage or a pure one-task station.
Learn moreAssigned Access vs Shell Launcher vs Shell Launcher
Both lock down a device, but Assigned Access applies default policies and AppLocker automatically, while Shell Launcher replaces the shell with a chosen app and no default lockdown.
| Criterion | Assigned Access vs Shell Launcher | Shell Launcher |
|---|---|---|
| Default lockdown | Policies and AppLocker applied automatically | No default lockdown policies |
| Relation to lock screen | Single-app mode runs above it; multi-app is on the desktop | Replaces the Explorer shell, not above the lock screen |
| Coexistence | Can't run alongside Shell Launcher | Can't run alongside Assigned Access |
When to choose — Assigned Access for most restricted-desktop needs; Shell Launcher for a custom Win32 shell.
Learn moreMyths, corrected
Myth
Multi-app kiosk is just single-app kiosk with more apps.
Correction
Microsoft treats multi-app as a separate restricted user experience that keeps a desktop, uses the AllAppList profile, and applies AppLocker and policy. Single-app runs one app above the lock screen with a different profile type.
Why it happens: Both live under Assigned Access, so they get lumped together.
Myth
Profiles are assigned to devices.
Correction
Profiles are assigned to accounts or groups in Configs, except GlobalProfile. The device holds the XML, but which profile loads depends on who signs in.
Why it happens: The XML is pushed to the device, so people assume the assignment is device-level too.
Myth
The built-in Intune Kiosk template covers Windows 11 multi-app.
Correction
Practitioners widely recommend a custom OMA-URI policy against the AssignedAccess CSP for full Windows 11 multi-app control, since the older Kiosk template doesn't expose everything.
Why it happens: The Kiosk profile template is the obvious first stop in Intune.
Myth
You can assign any profile to a group.
Correction
Group configs can only use restricted-experience profiles. Single-app KioskModeApp profiles are user-only.
Why it happens: Groups work for multi-app, so people assume they work everywhere.
Myth
A multi-app kiosk is a full security boundary.
Correction
It reduces access and applies AppLocker, but it isn't a substitute for wider hardening. Edge cases around File Explorer and allowed paths have been reported, so treat it as one layer.
Why it happens: The locked-down look suggests total containment.
Practical implications
For admins
Design the assignment before the profile. Decide whether each device needs per-account configs, a group config, autologon, or a global profile, then confirm the account formats resolve on the join type you use.
For MSPs
Standardize an XML template per client scenario and deploy through Intune custom policies. Group-based configs scale better than per-user across many tenants.
For business
One device can serve several roles, cutting hardware count on shared floors. Plan for the edition cost, since Home isn't supported.
For security
Assignment interacts with conditional access. Exclude kiosk accounts from interactive MFA or Terms of Use, and remember AppLocker enforcement is automatic but not a complete boundary.
For end users
Users see only their role's apps and a trimmed Start menu. The breakout sequence, Ctrl+Alt+Del by default, is how they leave the experience.
Cost impact
Requires Windows 11 Pro, Enterprise, Education, or IoT Enterprise. Licensing for Enterprise features may add cost over Home or Pro baselines.
Operational impact
Changes mean editing the XML and re-pushing through the CSP. Test on the exact target build, since some 24H2 and 25H2 builds have shown deployment regressions.
Decision guide
Use when
- A shared device must serve different roles with different apps
- You manage the fleet through Intune, Active Directory, or Entra
- You need autologon or a single global restricted experience
Avoid when
- You only need one app full screen, where single-app kiosk fits
- Target users require interactive MFA at sign-in
- The device runs Windows 11 Home
Requirements
- Windows 11 Pro, Enterprise, Education, or IoT Enterprise
- A delivery channel: Intune, provisioning package, or PowerShell MDM Bridge
- Standard, non-admin accounts or groups to assign
- The correct XML schema namespace for the target build
Alternatives
- Single-app kiosk for one-task devices
- Shell Launcher for a custom Win32 shell
- Standard MDM restrictions without full kiosk lockdown
Related terms
The Windows feature that configures a device as a kiosk or restricted user experience.
AllAppList profile
The XML node listing allowed apps for a restricted user experience.
AssignedAccess CSP
The configuration service provider that applies the kiosk XML to a device.
Application User Model ID, the identifier used to allow a UWP app in the profile.
GlobalProfile
An assignment that applies one profile to every non-admin account on the device.
AppLocker
The Windows app-control feature that enforces the kiosk's allowed-apps list.
Frequently asked questions
What is multi-app kiosk profile assignment on Windows 11?
It's the step that binds an Assigned Access restricted-experience profile to a user account, a group, an autologon account, or every non-admin on the device. When someone signs in, Windows loads the profile linked to their account.
Where is the assignment actually defined?
In the Configs section of the Assigned Access XML. Each Config pairs a profile Id with an Account, a UserGroup, an AutoLogonAccount, or a GlobalProfile, per Microsoft Learn.
Can I assign a kiosk profile to a group?
You can assign a multi-app restricted-experience profile to a group, but not a single-app KioskModeApp profile. Single-app profiles are user-only.
Which account types can I assign?
Local, Active Directory, and Microsoft Entra ID accounts and groups. Local accounts must already exist on the device; domain and Entra identities resolve from the joined forest or tenant.
How do I deploy the assignment?
Push the full XML to the AssignedAccess CSP through Microsoft Intune, a provisioning package, or PowerShell with the MDM Bridge WMI Provider.
Which Windows 11 editions support it?
Assigned Access works on Windows 11 Pro, Enterprise, Enterprise LTSC, Education, and IoT Enterprise. Windows 11 Home isn't supported.
Why does a correctly built profile reach no one?
Usually the config is missing or the account format is wrong. A profile with no matching Config stays dormant, and mistyped local, domain, or Entra identifiers won't resolve.
Can conditional access break kiosk sign-in?
Yes. Microsoft warns that assigning a profile to users behind interactive conditional access, such as MFA or Terms of Use, can prevent them from signing in.
Conclusion
Multi-app kiosk profile assignment binds an Assigned Access profile to who should receive it. The profile lists the apps; the config, under Configs, ties that profile to an account, group, autologon account, or the whole device. Windows resolves the match at sign-in and enforces it with AppLocker and policy.
Main takeaway
Next, look at building the Assigned Access XML itself and finding app AUMIDs, then at deploying it through an Intune custom policy.
