Configure Kiosk mode for smartwatches

When Android devices like smartphones and tablets are engaged in Kiosk mode, the device user can visually distinguish the kiosk from a normal device. Typically, the kiosk would have some type of launcher, be restricted to either a single app, or limited to a small number of apps, and have some sort of background image set by Knox Manage.

When it comes to Wear OS smartwatches, they too can enter Kiosk mode, however they look identical to a normal smartwatch, and present some notable differences in the user experience. When a smartwatch is engaged in Kiosk mode, the device user is limited to the apps and watch face set by Knox Manage. Certain menus like Quick Panel, Notification Panel, and Widgets and Tiles are disabled by default — but can be enabled through a policy update — while other menus like the Apps List and Watch Face Customization are disabled completely.

Watch faces and Kiosk mode

The watch face of a smartwatch is the entry point to the smartwatch user experience. All apps and functionality are accessed through the interface provided by this package. Because of this, there are serious constraints you should plan around when engaging a smartwatch in Kiosk mode.

A smartwatch kiosk is restricted to the watch face set by Knox Manage. Therefore, the device’s watch face must provide access to all apps you intend the device user to operate — if an app isn’t included of the watch face’s allowlist, it won’t appear in the Apps List. Furthermore, the user won’t be able to open or operate the app, even if the app was delivered by Knox Manage. A further complication is that if an app is hidden, it might not necessarily be disabled. A system app or first-party default app, such as Samsung Health, will continue to run in the background. A third-party app, even if it’s a default app, is disabled unless the watch face allows it and it’s controlled by Knox Manage.

To avoid all issues surrounding access to apps in Kiosk mode, you must:

• Manage the watch face package as an app in your tenant. For more details about watch face packages, see About kiosk mode watch faces in the Samsung developer docs.
• Ensure that the watch face package you manage is imbued with the capability to run all desired apps.
• In the kiosk profile, configure the appropriate policies to allow all desired apps.

See the next section for details.

Configure and deploy a Wear OS kiosk

First, add the appropriately-configured watch face as a managed app:

1. Begin adding a Wear OS app.
2. For step 3, upload the watch face package.
3. Save the app. You don’t need to assign the app to the Wear OS device group.

Next, configure a kiosk profile for Wear OS and deploy it:

1. Go to Profile, then click Add. The Add Profile page opens.

2. Enter a unique Name for the kiosk profile.

3. For Platform, select Wear OS.

4. Click Save & Set Policy to proceed to the policy configuration page.

5. Expand the Kiosk policy drawer and set the following policies:

   

   • Kiosk Settings — Apply
   • Kiosk Settings > Allowlisted App — Click Add and select each app that should be accessible on the smartwatch.

6. Expand the Application policy drawer and set the following policies:

   

   • Watch Face Customization — Apply
   • Watch Face Customization > Package Name — Click Add and select the watch face app package that you added to the tenant.
   • Watch Face Customization > Watch Face Change — Disallow

7. Click Save & Assign to register the profile and proceed to the Assign Profile page.

8. In the Target section, set Target Type to Group.

9. Search for and select the Wear OS device group, then click Assign.

10. When asked to confirm, verify the assignment details, then click OK.

The kiosk configuration is saved and assigned to the chosen device group. If you need to add more apps, edit the profile, add them to the Kiosk Settings > Allowlisted App policy, then re-assign the profile.

Unenroll a device or exit the kiosk mode

In case of connectivity issues or for offline devices not connected to a network, device users can manually unenroll the device or exit the kiosk mode on a Wear OS device.

To do so, device users must tap Offline Unenrollment or Exit Kiosk in the device settings and provide a nine-digit code to initiate device unenrollment or exit from the kiosk mode.

Pre-requisites for exiting kiosk mode

You must add a direct link to the Knox Manage agent on the kiosk device, using one of the following methods:

• Device users must remap the double-press action on the device’s Home key to the Knox Manage agent.

  To do so, go to Settings > Advanced features > Customize keys > Home key Double press > Knox Manage.

• App developers must add a direct link to the Knox Manage agent in the kiosk app.

  To do so, use the following code in the kiosk app implementation:

  val intent = Intent("com.sds.emm.cloud.knox.samsung.activity.EXIT_KIOSK") intent.flags = Intent.FLAG_ACTIVITY_NEW_TASK or Intent.FLAG_ACTIVITY_CLEAR_TOP or Intent.FLAG_ACTIVITY_CLEAR_TASK context.startActivity(intent)