Configure kiosk mode
Verified with Windows 11 25H2 — updated on July 30, 2026
Supported on: Microsoft Edge on Windows 10, Version 1809 or later
Path in the GPO console
Computer Configuration\Administrative Templates\Windows Components\Microsoft Edge User Configuration\Administrative Templates\Windows Components\Microsoft Edge Description
Configure how Microsoft Edge behaves when it’s running in kiosk mode with assigned access, either as a single app or as one of multiple apps running on the kiosk device. You can control whether Microsoft Edge runs InPrivate full screen, InPrivate multi-tab with limited functionality, or normal Microsoft Edge. You need to configure Microsoft Edge in assigned access for this policy to take effect; otherwise, these settings are ignored. To learn more about assigned access and kiosk configuration, see “Configure kiosk and shared devices running Windows desktop editions” (https://aka.ms/E489vw). If enabled and set to 0 (Default or not configured): - If it’s a single app, it runs InPrivate full screen for digital signage or interactive displays. - If it’s one of many apps, Microsoft Edge runs as normal. If enabled and set to 1: - If it’s a single app, it runs a limited multi-tab version of InPrivate and is the only app available for public browsing. Users can’t minimize, close, or open windows or customize Microsoft Edge, but can clear browsing data and downloads and restart by clicking “End session.” You can configure Microsoft Edge to restart after a period of inactivity by using the “Configure kiosk reset after idle timeout” policy. - If it’s one of many apps, it runs in a limited multi-tab version of InPrivate for public browsing with other apps. Users can minimize, close, and open multiple InPrivate windows, but they can’t customize Microsoft Edge.
Registry
Software\Policies\Microsoft\MicrosoftEdge\KioskMode Software\Policies\Microsoft\MicrosoftEdge\KioskMode Value name: ConfigureKioskMode
MDM / Intune (CSP)
./Device/Vendor/MSFT/Policy/Config/Browser/ConfigureKioskMode ./User/Vendor/MSFT/Policy/Config/Browser/ConfigureKioskMode Microsoft Learn documentation Mapping data: Microsoft Learn (CC BY 4.0)
CSP values
-
1- Enable. -
0 (Default)- Disable.
Export Builder
BETAConfigure the state, scope and options, then generate .reg, PowerShell, Intune and SCCM outputs — or add the setting to a multi-setting collection.
These exports write the registry — this is not a managed GPO. ⓘ
Applying both scopes creates an ambiguous configuration (computer takes precedence over user). Only do this intentionally.
.reg file
Windows Registry Editor Version 5.00
; Exported from gporais.com
; Policy: Configure kiosk mode
; State: Enabled
; Scope: Computer (HKLM)
; Supported on: Microsoft Edge on Windows 10, Version 1809 or later
[HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\MicrosoftEdge\KioskMode]
"ConfigureKioskMode"=dword:00000001
"ConfigureKioskMode"=dword:00000000More formats (PowerShell, Intune, SCCM)
PowerShell
# Exported from gporais.com
# Policy: Configure kiosk mode
# State: Enabled
# Scope: Computer (HKLM)
# Supported on: Microsoft Edge on Windows 10, Version 1809 or later
$path = 'HKLM:\Software\Policies\Microsoft\MicrosoftEdge\KioskMode'
New-Item -Path $path -Force | Out-Null
Set-ItemProperty -Path $path -Name 'ConfigureKioskMode' -Value 1 -Type DWord
Set-ItemProperty -Path $path -Name 'ConfigureKioskMode' -Value 0 -Type DWordIntune XML
OMA-URI: ./Device/Vendor/MSFT/Policy/Config/Browser/ConfigureKioskMode
Data type: String
Value:
<enabled/>
<data id="ConfigureKioskMode_TextBox" value="0"/>Intune Remediation
# === Detection script ===
# Exported from gporais.com
# Policy: Configure kiosk mode
# State: Enabled
# Scope: Computer (HKLM)
# Supported on: Microsoft Edge on Windows 10, Version 1809 or later
function Test-RegistryValue {
param(
[Parameter(Mandatory = $true)][string]$Path,
[Parameter(Mandatory = $true)][string]$Name,
[object]$Expected,
[ValidateSet('String', 'DWord', 'MultiString')][string]$Kind = 'String',
[switch]$Absent
)
try {
$item = Get-ItemProperty -LiteralPath $Path -Name $Name -ErrorAction Stop
} catch {
return $Absent.IsPresent
}
if ($Absent.IsPresent) { return $false }
$actual = $item.$Name
if ($Kind -eq 'DWord') { return ([int64]$actual) -eq ([int64]$Expected) }
if ($Kind -eq 'MultiString') {
$actualValues = @($actual)
$expectedValues = @($Expected)
if ($actualValues.Count -ne $expectedValues.Count) { return $false }
for ($i = 0; $i -lt $expectedValues.Count; $i++) {
if ([string]$actualValues[$i] -ne [string]$expectedValues[$i]) { return $false }
}
return $true
}
return [string]$actual -eq [string]$Expected
}
$checks = @(
(Test-RegistryValue -Path 'HKLM:\Software\Policies\Microsoft\MicrosoftEdge\KioskMode' -Name 'ConfigureKioskMode' -Expected 1 -Kind DWord)
(Test-RegistryValue -Path 'HKLM:\Software\Policies\Microsoft\MicrosoftEdge\KioskMode' -Name 'ConfigureKioskMode' -Expected 0 -Kind DWord)
)
if ($checks -notcontains $false) {
Write-Output 'Compliant'
exit 0
}
Write-Output 'Non-compliant'
exit 1
# === Remediation script ===
# Exported from gporais.com
# Policy: Configure kiosk mode
# State: Enabled
# Scope: Computer (HKLM)
# Supported on: Microsoft Edge on Windows 10, Version 1809 or later
$path = 'HKLM:\Software\Policies\Microsoft\MicrosoftEdge\KioskMode'
New-Item -Path $path -Force | Out-Null
Set-ItemProperty -Path $path -Name 'ConfigureKioskMode' -Value 1 -Type DWord
Set-ItemProperty -Path $path -Name 'ConfigureKioskMode' -Value 0 -Type DWordSCCM scripts
# Exported from gporais.com
# Policy: Configure kiosk mode
# State: Enabled
# Scope: Computer (HKLM)
# Supported on: Microsoft Edge on Windows 10, Version 1809 or later
# SCCM Configuration Item guidance:
# Create a Configuration Item of type "Setting: Script".
# Discovery script: use the Detection script below.
# Remediation script: use the Remediation script below.
# Compliance rule: the Discovery script output equals 'Compliant'.
# === Detection script ===
# Exported from gporais.com
# Policy: Configure kiosk mode
# State: Enabled
# Scope: Computer (HKLM)
# Supported on: Microsoft Edge on Windows 10, Version 1809 or later
function Test-RegistryValue {
param(
[Parameter(Mandatory = $true)][string]$Path,
[Parameter(Mandatory = $true)][string]$Name,
[object]$Expected,
[ValidateSet('String', 'DWord', 'MultiString')][string]$Kind = 'String',
[switch]$Absent
)
try {
$item = Get-ItemProperty -LiteralPath $Path -Name $Name -ErrorAction Stop
} catch {
return $Absent.IsPresent
}
if ($Absent.IsPresent) { return $false }
$actual = $item.$Name
if ($Kind -eq 'DWord') { return ([int64]$actual) -eq ([int64]$Expected) }
if ($Kind -eq 'MultiString') {
$actualValues = @($actual)
$expectedValues = @($Expected)
if ($actualValues.Count -ne $expectedValues.Count) { return $false }
for ($i = 0; $i -lt $expectedValues.Count; $i++) {
if ([string]$actualValues[$i] -ne [string]$expectedValues[$i]) { return $false }
}
return $true
}
return [string]$actual -eq [string]$Expected
}
$checks = @(
(Test-RegistryValue -Path 'HKLM:\Software\Policies\Microsoft\MicrosoftEdge\KioskMode' -Name 'ConfigureKioskMode' -Expected 1 -Kind DWord)
(Test-RegistryValue -Path 'HKLM:\Software\Policies\Microsoft\MicrosoftEdge\KioskMode' -Name 'ConfigureKioskMode' -Expected 0 -Kind DWord)
)
if ($checks -notcontains $false) {
Write-Output 'Compliant'
exit 0
}
Write-Output 'Non-compliant'
exit 1
# === Remediation script ===
# Exported from gporais.com
# Policy: Configure kiosk mode
# State: Enabled
# Scope: Computer (HKLM)
# Supported on: Microsoft Edge on Windows 10, Version 1809 or later
$path = 'HKLM:\Software\Policies\Microsoft\MicrosoftEdge\KioskMode'
New-Item -Path $path -Force | Out-Null
Set-ItemProperty -Path $path -Name 'ConfigureKioskMode' -Value 1 -Type DWord
Set-ItemProperty -Path $path -Name 'ConfigureKioskMode' -Value 0 -Type DWordBuilding a multi-setting collection? Add this setting and generate combined .reg / PowerShell / GPO scripts.