How to Configure Windows Kiosk Auto Logon with Intune and Entra
Learn how to configure Windows kiosk mode with auto logon using Microsoft Intune. Covers single-app and multi-app kiosks, the Auto logon vs Microsoft Entra user logon types, Conditional Access exclusions, and the AssignedAccess CSP.
- Difficulty
- Intermediate
- Time required
- 15 minutes
- Steps
- 5
- Platform
- Microsoft Intune
- Version
- Windows 10 1803+ / Windows 11
- Last tested
- July 19, 2026
Table of contents
Quick Answer
Go to the stepsIn the Intune admin center, create a Kiosk template profile (Devices > Configuration > Create > Windows 10 and later > Templates > Kiosk). Select single-app or multi-app mode. For automatic sign-in with no credentials, set User logon type to Auto logon (uses a local account). Add your apps and assign to a device group.
- Go to Devices > Configuration > Create > New policy.
- Select Windows 10 and later, Templates, Kiosk.
- Choose Single app or Multi-app kiosk mode.
- Set User logon type to Auto logon or Microsoft Entra user or group.
- Add apps, assign to a device group, and create.
Intune admin center > Devices > Configuration > Create > Windows 10 and later > Templates > KioskExpected result: The kiosk device auto-signs in and launches the configured app(s) at startup.
Key takeaways
- You'll learn how to configure Windows kiosk mode with automatic logon using Microsoft Intune, including the difference between Auto logon (local account) and Microsoft Entra user logon.
- Kiosk devices in public areas need to start without user interaction. Per Microsoft Learn, Intune's Auto logon type signs in automatically using a local account, so the kiosk is ready without anyone entering credentials.
- Use Intune's Kiosk template to configure auto logon (local account) or Entra user logon. Auto logon requires no credentials; Entra logon requires sign-in.
Introduction
Windows kiosk mode locks a device to run one app (single-app) or a set of apps (multi-app), ideal for public terminals, digital signage, and shared workstations. Per Microsoft Learn, Intune configures kiosks through the Kiosk template with several User logon types.
For unattended public kiosks, the Auto logon type signs in automatically using a local account with no credentials. Per Microsoft, this uses the AssignedAccess CSP. For kiosks that need a specific identity, the Microsoft Entra user or group option requires sign-in.
This tutorial covers configuring both single-app and multi-app kiosks, choosing the right logon type, and avoiding common issues like Conditional Access blocks.
Who this is for: IT admins deploying public terminals, digital signage, or shared workstations with Microsoft Intune.
Before you start
- Access
- Intune admin center (intune.microsoft.com) with Intune Administrator role.
- Required roles
- Intune Administrator
- Required licenses
- Microsoft Intune Plan 1
- Environment
- Windows 10 version 1803 or later, or Windows 11. Devices enrolled in Intune.
- Vendor
- Microsoft
- Last tested
- Administrator permissions required
15 minutes
Warning: Auto logon uses a local account, not Entra
Per Microsoft Learn, Auto logon uses a LOCAL account with no Microsoft Entra credentials. Online licenses can't be evaluated. Use offline-licensed apps for auto logon kiosks.
Warning: Conditional Access can block kiosk logon
Per Microsoft Q&A, Conditional Access policies can block kiosk sign-in. Exclude kiosk accounts from CA policies that require MFA or compliance to avoid logon loops.
1Create a Kiosk Configuration Profile
Create a Kiosk configuration profile in Intune.
Devices > Manage devices > Configuration > Create > New policyIn the Intune admin center (intune.microsoft.com), go to Devices > Manage devices > Configuration. Click Create > New policy. Select Windows 10 and later as the platform, Templates as the profile type, and Kiosk. Click Create and give it a name.
Expected result: The Kiosk template configuration wizard opens.
2Choose the Kiosk Mode
Choose between single-app and multi-app kiosk.
In the Configuration settings tab, select a Kiosk mode:
- Single app, full-screen kiosk: locks the device to one app (e.g., a browser or digital signage app).
- Multi-app kiosk: allows a restricted set of apps with a limited Start menu.
Choose based on your use case.
Expected result: The kiosk mode is selected and the configuration options appear.
Note
Single-app is best for dedicated terminals (check-in kiosks). Multi-app suits shared workstations that need a few tools.
3Set the User Logon Type
Configure how the kiosk signs in.
Set the User logon type:
- Auto logon (Windows 10 1803+): signs in automatically using a local account, no credentials. Best for public kiosks. Uses the AssignedAccess CSP.
- Local user account: signs in with a specific local account you enter.
- Microsoft Entra user or group: requires the user to sign in with Entra credentials.
For unattended public kiosks, choose Auto logon.
Expected result: The User logon type is set to Auto logon or Microsoft Entra user or group.
Note
Per Microsoft Learn, Auto logon uses a local account with no Entra credentials, so online-licensed apps can't be used. Choose offline-licensed apps.
4Add the Kiosk Apps
Add the apps that run on the kiosk.
Add the app(s) the kiosk will run:
- Add store app: select an app from the Microsoft Store.
- Add Win32 app: enter the app name, local path to the executable (e.g.,
C:\Program Files\Google\Chrome\Application\chrome.exe), and the AUMID.
For single-app kiosks, select one app. For multi-app, add multiple apps.
Expected result: The selected apps appear in the kiosk configuration.
Note
For auto logon kiosks, use offline-licensed apps since online licenses can't be evaluated without Entra credentials.
5Assign the Profile to Devices
Deploy the kiosk profile to target devices.
On the Assignments page, click Add groups under Included groups. Select the device group containing your kiosk devices. Click Select, then Next, and Create.
If using Conditional Access, exclude the kiosk accounts from CA policies requiring MFA or compliance to prevent logon issues.
Expected result: The profile shows as Assigned. Devices receive it at the next sync.
Note
Deploy to a test device first. Verify auto logon works before targeting all kiosks.
Verify the Kiosk Auto Logon Works
Confirm configuration
After the profile applies and the device syncs, the kiosk auto-signs in (if using Auto logon) and launches the configured app(s). Per Microsoft Learn, Auto logon creates a local account automatically and signs in at boot with no user interaction.
For multi-app kiosks, the user sees a restricted Start menu with only the allowed apps. For single-app kiosks, the app launches full-screen with no way to exit to the desktop.
If the kiosk shows a sign-in prompt or logon loop, verify the logon type and check for Conditional Access policies blocking the account. Per Microsoft Q&A, excluding kiosk accounts from CA policies resolves most logon issues.
Normal result: The device auto-signs in and launches the kiosk app(s) at startup with no credentials required.
Abnormal result: The device shows a sign-in screen or logon loop. Check Conditional Access exclusions and the logon type configuration.
Working auto logon kiosk
Device boots directly into the kiosk app
Kiosk auto-signs in and launches the app.
Logon loop
Device shows sign-in screen repeatedly
Conditional Access is blocking the account.
Troubleshooting
Kiosk shows sign-in screen or logon loop
Warning
Cause: Conditional Access policies requiring MFA or compliance are blocking the kiosk account.
Per Microsoft Q&A, exclude the kiosk accounts from Conditional Access policies. For Entra kiosks, exclude the assigned users/groups from CA policies requiring MFA.
App doesn't launch on auto logon kiosk
Warning
Cause: The app uses an online license which can't be evaluated with the local auto logon account.
Per Microsoft Learn, use offline-licensed apps for auto logon kiosks. Online-licensed Store apps require Entra credentials, which the local auto logon account doesn't have.
Multi-app kiosk shows empty Start menu
Note
Cause: The AUMID for the Win32 or Store app is incorrect.
Verify the AUMID using Get-StartApps in PowerShell on a reference device. Enter the exact AUMID in the kiosk app configuration.
Frequently asked questions
What is the difference between Auto logon and Entra user logon?
Auto logon uses a local account with no credentials, signing in automatically at boot (best for public kiosks). Microsoft Entra user or group requires the user to enter credentials to sign in.
Can I auto logon with a Microsoft Entra account?
Per Microsoft Learn, true auto logon (no credentials) only works with a local account. Selecting Microsoft Entra user or group requires the user to sign in. There's no credential-free auto logon with Entra accounts.
Why can't I use online-licensed apps with auto logon?
Per Microsoft Learn, Auto logon uses the AssignedAccess CSP with a local account. Because there are no Entra credentials, online-licensed Store apps can't be evaluated. Use offline-licensed apps instead.
Why won't my kiosk sign in?
Per Microsoft Q&A, Conditional Access policies requiring MFA or device compliance can block kiosk sign-in. Exclude the kiosk accounts from these CA policies.
Conclusion
Windows kiosk mode via Intune supports single-app and multi-app configurations. Per Microsoft Learn, the User logon type determines authentication: Auto logon uses a local account with no sign-in (best for public kiosks), while Microsoft Entra user or group requires credentials.
Auto logon uses the AssignedAccess CSP and can't evaluate online licenses, so use offline-licensed apps. Exclude kiosk accounts from Conditional Access policies to prevent logon issues.
Use Intune's Kiosk template to configure auto logon (local account) or Entra user logon. Auto logon requires no credentials; Entra logon requires sign-in.
Intune admin center > Devices > Configuration > Create > Templates > Kiosk
