Fully Managed vs Kiosk Android Devices: Which Setup to Use

Fully managed vs kiosk Android devices comes down to one question: does a single person use this device for many things, or does anyone use it for one thing? A technician’s phone is fully managed. A check-in tablet on a clinic counter is a kiosk. Pick the mode first, then the security settings follow from it.

Both are company-owned setups under Google’s Android Enterprise, and both are set up the same way: factory reset, scan a QR code, done. What differs is how much of the phone the person holding it can reach.

What does “fully managed” mean on Android?

A fully managed device belongs to the company and is used by one employee. They get a normal-looking phone with email, maps, the job app, the camera. The business controls the settings underneath.

Android Enterprise is built into the operating system, so there is no separate agent app to install and keep alive. Google also keeps adding plumbing that device management tools can read, such as the recently released AndroidX Security State Libraries, which report patch levels in more detail. We cover what those libraries report in how to check Android security patch level on company phones.

Take a plumbing company with eight technicians. Each tech carries a phone with the scheduling app, a payments app, maps and the camera for job photos. That is a fully managed phone. The tech needs flexibility during the day, and the owner needs to know the phone locks itself, only has approved apps, and can be erased if it goes missing.

What does kiosk mode do?

A kiosk device (Android calls it a dedicated device) is locked to one app or a short list of apps. There is no home screen full of icons and no route into Settings unless you allow it.

Picture a retail counter tablet running a sign-up form. Nobody should be checking email on it, installing games or changing the Wi-Fi. Kiosk mode takes all of that off the table, which also shrinks what an attacker or a curious customer can get at.

In NounDesk, a four-step kiosk wizard sets this up: single-app or multi-app, whether the Home button works, screen brightness and stay-awake, whether Settings can be opened, and volume lock. If the kiosk is really a web page, you can add a website as a web app from its URL. There is also a per-device kiosk health view, so you can see when a counter tablet has dropped out. For the full walkthrough, read how to lock an Android tablet to one app.

COBO, COSU and COPE: the Android Enterprise names

You will see three acronyms in Google’s documentation and in other tools. They map onto the two setups on this page:

• COBO, company-owned business-only, is a fully managed phone used only for work. It’s the technician’s or driver’s phone.
• COSU, company-owned single-use, is a dedicated device locked to one app or a few: the counter tablet, the check-in screen. Google now calls these dedicated devices, and NounDesk sets them up with kiosk mode.
• COPE, company-owned personally enabled, is a company phone with a work profile, so the employee can use it personally too. NounDesk doesn’t manage work profiles yet, so COPE isn’t available today; see work profiles and BYOD.

Fully managed vs kiosk: which security settings go where?

The settings are mostly the same list. The values change.

Screen lock and auto-lock. On a fully managed phone, require a PIN or password and a short auto-lock. On a kiosk, a lock screen usually gets in the way of the one job the tablet does, so the protection comes from kiosk mode itself.

Apps outside Google Play. Block them on both. A technician does not need to sideload anything, and a counter tablet certainly does not.

Play Protect. Keep it on everywhere. It is Android’s built-in malware scanner and costs you nothing.

Encryption. Require it on both. If a device walks off, the data on it stays unreadable.

USB data transfer. Turn it off on kiosks, where a stranger could plug in a cable. On fully managed phones, turn it off unless someone has a real reason to move files by cable.

Camera and screenshots. Leave the camera on for the plumbers who photograph jobs. A front-desk tablet at a clinic that shows patient details may be better with screenshots off.

Update schedule. Set one on both types so updates install at a predictable time. A kiosk that restarts mid-shift is a support call.

NounDesk ships five policy templates (Standard Business, Maximum Security, Field Worker, Kiosk and Custom) with these settings written in plain English. Each setting shows the Android version it needs, and the publish preview lists what will change and how many devices it hits before you commit.

How do you enroll each type?

Enrollment is the same for both. You factory reset an Android 8 or newer device, scan a QR code, and it enrolls with a group, a policy and a name already attached.

With saved enrollment profiles in NounDesk, you can make one profile for “Field techs, Field Worker policy” and another for “Front counter, Kiosk policy”. The dashboard shows each device move from “Waiting for device” to “Ready”. Setting up ten phones for a new crew becomes a queue of QR scans instead of an afternoon of tapping through menus. There is a step-by-step version in how to set up a new company Android phone in 10 minutes.

How do you keep both types healthy after setup?

Setup is the easy part. The ongoing job is spotting the device that drifted.

A good Android MDM tells you plainly which devices have gone quiet. NounDesk’s dashboard shows each device as Online, Recently offline, Offline (24 hours or more) or Not seen yet, and rates the fleet Healthy, Needs attention or Critical with the rules spelled out. Apps can be marked Required, Available or Blocked per policy, with minimum versions, so the counter tablet and the tech phones stay on the same build of the apps you rely on.

Patching is its own routine, and it applies to both device types. If you want a monthly checklist, see how to keep company Android phones updated. If you want to know what attackers are doing with sideloaded apps right now, read about the Corp MDM spyware campaign.

What to do this week

1. Sort your devices into two lists. One person, many apps: fully managed. Anyone, one job: kiosk. Most small businesses find one or two tablets that should have been kiosks all along.
2. Match each list to a policy. Start from Field Worker or Standard Business for phones and Kiosk for shared tablets, then change only what you have a reason to change.
3. Check the settings that matter on both. Apps outside Google Play blocked, Play Protect on, encryption required, an update schedule set.
4. Look at your fleet health. Open the mobile device management dashboard and deal with anything marked Needs attention or Critical before you add new devices.

FAQ

What is the difference between a fully managed device and a kiosk device?

A fully managed device is a company-owned phone or tablet used by one employee with a normal set of apps. A kiosk (dedicated) device is locked to one app or a short list for a single purpose, with Settings and other features hidden.

Can I switch a device from fully managed to kiosk later?

Yes, by assigning it a kiosk policy. If you are changing who uses it, a clean factory reset and fresh enrollment is the tidier route, so no old accounts or files carry over.

Do I need an agent app to manage Android devices?

No. Android Enterprise is built into Android, so a company-owned device enrolled by QR code is managed without a separate agent app.

If you are sorting phones and tablets into the right setups, see how NounDesk manages Android fleets.