Windows 11 kiosk baseline
Assigned Access is the supported way to build Windows 11 kiosks. This method connects local XML testing, Intune groundwork and Autopilot into one repeatable flow. Phases 1 and 2 are a one-time investment; phase 3 is where you get velocity.
Phase 1 — Validate locally
Section titled “Phase 1 — Validate locally”- Provision a fresh Windows 11 Pro machine with a local admin account. Do not join it to Entra ID or Autopilot yet.
- Build it like the target kiosk: install every app manually and test it under a regular user profile.
- Keep the OS patched (25H2 recommended — Assigned Access fixes keep landing).
- Skip the Settings-app kiosk wizard. Start from the XML template or the Assigned Access Designer and apply it until it works every time.
When it doesn’t go smoothly, enable these logs:
| Symptom | Where to look |
|---|---|
| XML won’t apply | Event Viewer → Applications and Services Logs → Microsoft → Windows → AssignedAccess → Operational |
| Apps won’t launch in kiosk mode | Event Viewer → … → Microsoft → Windows → AppLocker → EXE and DLL / MSI and Script |
Phase 2 — Lay the Intune foundation once
Section titled “Phase 2 — Lay the Intune foundation once”-
Dynamic device group keyed on an Autopilot Group Tag prefix:
(device.devicePhysicalIds -any (_ -startsWith "[OrderID]:MALO-KIOSK")) -
Autopilot deployment profile for kiosks (self-deploying or user-driven).
-
Assignment filter on the deployment profile name, so you can exclude kiosks from production policy.
-
A dedicated Enrollment Status Page that blocks on every app the XML references — if Intune can’t see them installed, the XML never applies.
-
Exclude kiosks from production CSPs and from any compliance policy that enforces passwords (it breaks auto-logon).
-
Finally, a custom OMA-URI profile with your XML:
OMA-URI: ./Vendor/MSFT/AssignedAccess/ConfigurationData type: String (XML file)
Phase 3 — Zero-touch velocity
Section titled “Phase 3 — Zero-touch velocity”Tag a test device with the kiosk Group Tag, run it through Autopilot, and validate end-to-end on fresh hardware before scaling.