End-to-end deployment of corporate-owned Android devices in a locked-down kiosk configuration for a client, from unboxed hardware to production-ready fleets.
Background
A client needed a fleet of tablets that had access to specific apps, configurationsthat can be controlled remotely, and with settings locked off to the end users.
I delivered and managed the entire project: consulting with the client on the android tablet to procure with my sales and procurement team, creating the device profile in Intune, setting up Corporate-Owned Dedicated Device (CODD) enrollment, configuring Managed Home Screen for kiosk mode, deploying apps through Managed Google Play, and hardening device restrictions to prevent exploitation.
Result: Delivered a production-ready Android kiosk deployment, configuring devices with a standardized app layout and enforcing restricted system access to maintain security, consistency, and controlled user interaction.
Architecture
How policies, apps, and configurations flow from Intune to each device.
How it was done
How the deployment was executed, step by step.
Created a Corporate-Owned Dedicated Device (CODD) enrollment profile under Android Enterprise. Configured the enrollment method for a QR code token so devices could be enrolled without needing user accounts. This enrollment profile will be linked to the device configuration profile in the next step so settings are applied automatically on first boot.
Android Enterprise · Dedicated devicesSet up the foundational profile in Intune defining how each device would behave in kiosk mode via Managed Home Screen, allowed out of box apps, screen settings, and PIN policy. This profile was assigned to the device group which dynamic membership rules were based off a tablet model number variable and the Enrollment Profile used to enroll the device.
Intune › Devices › Configuration profilesSynced Intune with Managed Google Play and approved the client selected apps. Apps were assigned as Required to the device group.
Managed Google Play · Required assignmentWithin the Managed Home Screen configuration, the exact grid layout of the set to be deployed were in which positions. Disabled the ability for users to rearrange the grid, access the app drawer, or navigate outside the approved app set.
Managed Home Screen · Grid configurationHardened each device with a restriction profile targeting Android Enterprise dedicated devices. Blocked access to system settings, disabled factory reset, removed developer options, and prevented installation of any apps outside Managed Google Play.
Managed Home Screen · Grid configurationPhysically enrolled each device using the QR code from the enrollment profile. Once scanned; the device was registered in Entra ID, Intune automatically pushed the configuration profile, and began synced app assignments.
Zero-touch / QR enrollmentSecurity configuration
Settings locked down via the Intune device restriction profile to prevent end-user exploitation.
End result
Managed Home Screen was configured to display a fixed grid of approved apps. End users see only this — no launcher, no app drawer, no settings access.
Fixed grid · No launcher access
Results
Successfully delivered production-ready Android tablets with a comprehensive handover package, including configuration documentation, app provisioning details, and secure credential transfer. Ongoing management was maintained through Microsoft Intune, enabling continuous updates, compliance enforcement, and remote app deployment.
Stack