Shared iPads, Guided Access and Single App Mode for Classrooms
Apple gives schools five ways to share or lock an iPad. They differ in who starts them, who can end them and whether you need supervision. Pick the right one and the lesson runs; pick the wrong one and an iPad ends up stuck on a test screen.
Pick the right lock for the lesson
Use this table first. Most problems with "single app mode settings" come from choosing a mode that needs supervision on an iPad that is not supervised, or a mode only IT can end.
| Mode | Who starts it | Supervision | MDM | Who ends it | Good for |
|---|---|---|---|---|---|
| Guided Access | A person at the iPad | Not needed | Not needed | Anyone with the Guided Access passcode, Face ID or Touch ID | One student, one app, one activity; special education; early years |
| Classroom: Lock in app | The teacher, from Classroom | Needed | Needed | The teacher | Whole-class focus for part of a lesson, with nearby classes |
| Single App Mode | IT, through the MDM | Needed | Needed | Only the MDM, by removing the profile | Kiosks, sign-in stations, displays, testing carts for a fixed period |
| Autonomous Single App Mode | The app, when a test starts | Needed | Needed, to approve the app | The app, when the test ends | Assessment apps built to use it |
| Assessment mode | The test app | Not needed | Not needed | The test app | Online exams from providers whose apps support it |
| Shared iPad | IT, at enrollment | Needed | Needed | Not a lock: students sign in and out | Carts and labs where each student keeps their own work |
Common classroom situations
Reading center with four iPads
Guided Access on each iPad, set by the teacher, with touch switched off around the store and settings buttons.
State or district assessment
The provider's app in assessment mode or Autonomous Single App Mode. Use Single App Mode only if the provider asks for it.
Thirty iPads, six classes
Shared iPad, device-assigned apps and one category blocklist profile for the whole cart.
One student, one app
Guided Access with a time limit, so the session ends on its own and the student gets a clear stopping point.
Shared iPad: one cart, many students
Shared iPad lets several students use the same iPad, each with their own Managed Apple Account and their own work. It is chosen when the iPad enrolls, so plan it before the cart goes out.
Temporary session
A Guest button on the login screen, no username or password. Everything is deleted at logout, including browsing history. Apple services such as the App Store are not available.
Storage for guests
The MDM can reserve storage for the temporary user, so apps and media can still be used during a guest session.
Authenticated Guest Mode
A temporary session after sign-in with a Managed Apple Account. At sign-out, local data, the session passcode and the account are removed from the iPad.
Faster sign-ins
Classroom on iPad or Mac works with Shared iPad. Caching returns students to iPads they used before, which speeds up sign-in.
Where to switch it on: Shared iPad is set in your MDM's Automated Device Enrollment settings, which differ by product: Jamf Pro, Jamf School and Microsoft Intune each place it in their enrollment configuration. Check your MDM's current documentation for the exact label.
Apps
Assign apps to the device, not to users. Every student who signs in sees the same managed apps.
Restrictions
Blocklists and App Store settings apply to the whole iPad, so one profile covers every student on the cart.
Books
Purchased books cannot be assigned in a temporary session, because books are user-assigned only.
Guided Access: the teacher's lock with no MDM
Guided Access is built into every iPad and iPhone. It keeps the device in one app and can switch off parts of the screen or the hardware buttons. It works the same on an iPad Air, iPad mini or iPad Pro.
Turn it on once. Settings > Accessibility > Guided Access. Under Passcode Settings, set a Guided Access passcode and choose whether Face ID or Touch ID can end a session.
Open the app the student will use. Guided Access always locks the app that is on screen.
Triple-click the button. The top button on iPads without a Home button, the Home button on older models. If the Accessibility Shortcuts panel appears, tap Guided Access.
Circle what to switch off. Draw around any part of the screen that should ignore touches, such as a settings icon or a store button.
Set the options. Turn off the top or Home button, volume buttons, motion, software keyboards or all touch. Add a time limit if the activity has a fixed length.
Tap Start. If no passcode exists yet, the iPad asks you to create one.
Guided Access troubleshooting
Guided Access iPad stuck: how to turn it off
Triple-click the top button (or Home button), enter the Guided Access passcode or use Face ID or Touch ID, then tap End. If nobody knows the passcode, hand the iPad to IT rather than guessing codes.
Guided Access not working when I triple-click
- Check Settings > Accessibility > Guided Access is on.
- Check the Accessibility Shortcut includes Guided Access.
- Make sure the app is open and on screen, not the Home Screen.
- On a managed iPad, ask IT whether a profile restricts accessibility settings.
The time limit ended and the screen is frozen
When a time limit runs out, a full-screen message appears. Triple-click, authenticate and pause the session to get back to the Guided Access screen.
Guided Access during a test
Do not combine it with test apps. If Guided Access is on, it takes priority over the restrictions of assessment mode, which can leave the test less locked than you expect.
Guided Access with Intune or another MDM
Guided Access is started on the device by a person. For a lock IT controls from the console, use the MDM's Single App Mode, which Intune calls kiosk mode.
Single App Mode from your MDM
Single App Mode locks a supervised iPad into one app until the MDM removes the profile. Restarting does not end it: the iPad comes back into the same app. Here is how the common school MDMs set it.
- Devices > Configuration Profiles, create a new profile.
- Fill in the General payload.
- Open the Single App Mode payload, click Configure and choose the app.
- Scope the profile to the cart or kiosk group.
Works with apps Jamf Pro manages and with built-in apps such as Safari or Books, not with apps students installed themselves.
- Profiles, then Create Profile.
- Select iOS and Device Enrollment, then Next.
- Pick the Single App Mode payload and enable locking to one app.
- Choose the app and assign the profile.
If a locked iPad loses Wi-Fi, it cannot receive the command that removes the profile and stays in the app until it reconnects.
- Create an iOS and iPadOS device restrictions profile.
- Open the Kiosk section.
- Set App to run in kiosk mode: Store App, Managed App or Built-In App.
- Add options such as Block auto lock, Block touch or Block volume buttons.
Intune's kiosk mode is Apple's App Lock payload and applies only to supervised devices from Automated Device Enrollment.
Install the app first
Make sure the app is on the iPad before the profile lands. A smart group that waits for the app avoids an iPad locked to nothing.
Keep web clips separate
For a kiosk that shows a website, put the web clip and the Single App Mode payload in separate profiles. Combined, they may not apply as intended.
Plan the exit
Only the MDM can end it. Keep the iPads on reliable Wi-Fi and know which group to remove them from when the session is over.
Autonomous Single App Mode for testing apps
With Autonomous Single App Mode, an approved app locks the iPad when a test begins and releases it when the test ends. Nobody has to push or remove a profile during the exam.
Approved apps list
The restriction autonomousSingleAppModePermittedAppIDs lists the bundle IDs allowed to lock the device. It needs a supervised iPad.
Autonomous Single App Mode section
In the iOS and iPadOS device restrictions profile, add the App name and App Bundle ID, or import a CSV of names and bundle IDs. Export gives you the current list.
Restrictions profile
Jamf Pro and Jamf School set the same approved list in their restrictions settings, scoped to the testing devices.
Approval is not support
Adding an app to the list does not make it use the feature. Ask the test provider whether its app uses Autonomous Single App Mode or assessment mode.
Need the exact bundle ID for a test app? Search it by name in the bundle ID lookup before typing it into the profile. A typo means the app is silently ignored.
Assessment mode for online exams
Assessment mode uses Apple's Automatic Assessment Configuration. Approved apps lock the iPad into the test on their own, from iPadOS 9.3.2, with no MDM and no supervision.
What the iPad switches off during the test
From iPadOS 14, test developers can turn some keyboard features back on for their test. If a provider's app has no assessment mode, Apple points schools to Single App Mode through the MDM, and keyboard and dictionary features must then be restricted separately.
Kiosk mode beyond the iPad: Chromebook and Android
Mixed fleets need the same idea on every platform. "MDM kiosk mode" means one thing on each: the device opens one app and stays there.
What is kiosk mode on a Chromebook?
A full-screen session that runs one kiosk app with no student sign-in. Schools use it for state tests, sign-in stations and library catalogues.
- Admin console: Devices > Chrome > Apps & extensions > Kiosks
- Add the app, then choose it next to Auto-launch app
- Without auto-launch, students pick the kiosk app from the sign-in screen
- For exams, keep local user data so a reboot does not lose answers
- Kiosk settings include a time-limited option to keep old Chrome apps; ask vendors about replacements
Single app mode on Android
Android Enterprise calls these dedicated devices. Your MDM enrolls the tablet as a dedicated device and runs one app, or a small set, in kiosk mode.
- Single-app kiosk: one app in the foreground, home and recent buttons limited
- Multi-app kiosk: a locked launcher with a few approved apps
- Settings live in your MDM's Android Enterprise profiles
- Block Android browsers and VPN apps on the same devices; see blocking apps on Android Enterprise
For Chromebook app and extension controls outside kiosk mode, see controlling apps and extensions on school Chromebooks.
An iPad as a kiosk outside lessons
Front office sign-in, a library catalogue, a hallway display: the same tools apply, with a few kiosk-specific choices.
Kiosk app for an iPad display
Single App Mode with Block auto lock keeps a display awake and on one app. Pair it with a power schedule so it does not run all night.
Kiosk for a website
Lock to Safari or another built-in app with a web clip in a separate profile. Restrict the browser to the one site in your web content settings.
Kiosk app for iPad lock
For a sign-in form, lock to the form app and switch off the volume and sleep buttons, so a visitor cannot leave the app.
Library and public use
Lending and in-library iPads have their own needs, covered in library tablet and iPad lending.
Where blocklists still matter on shared devices
Locks are for minutes or hours. The rest of the day a cart iPad is open, and a shared iPad passes through dozens of hands. A category blocklist is the background layer that stays on.
VPN and proxy
- NordVPNcom.nordvpn.NordVPN
- Psiphonca.psiphon.Psiphon
- Turbo VPNcom.allconnected.turbovpn
Other browsers
- Firefoxorg.mozilla.ios.Firefox
- Bravecom.brave.ios.browser
- Aloha Browsercom.alohabrowser.alohabrowser
Games
- Robloxcom.roblox.robloxmobile
- Among Uscom.innersloth.amongus
- Subway Surferscom.kiloo.subwaysurfers
Social media
- TikTokcom.zhiliaoapp.musically
- Snapchatcom.toyopagroup.picaboo
- Discordcom.hammerandchisel.discord
These are a handful of well-known bundle IDs. Our category files hold the rest and update monthly. To choose categories for carts, start with apps to block on school iPads, set the device-level rules in school iPad restrictions, and close known gaps with how students get around restrictions.
Profile how-tos per MDM: Jamf and Intune. Licences and device assignment for carts are covered in Apple School Manager app management.
Questions about shared iPads and app locks
What is the difference between Guided Access and Single App Mode?
Guided Access is started on the iPad by someone who knows its passcode and needs no MDM. Single App Mode is sent by an MDM to a supervised iPad and ends only when the MDM removes it.
My iPad is stuck in Guided Access. How do I get out?
Triple-click the top button, or the Home button on older iPads, authenticate with the passcode, Face ID or Touch ID, and tap End. If nobody knows the passcode, give the iPad to IT.
Does Single App Mode work on unsupervised iPads?
No. Single App Mode and Autonomous Single App Mode both need supervision. Guided Access and assessment mode work without it.
Can I use Single App Mode in Intune?
Yes, as kiosk mode in the iOS and iPadOS device restrictions profile: App to run in kiosk mode, with Store App, Managed App or Built-In App. It applies to supervised devices from Automated Device Enrollment.
What does Shared iPad need?
A supervised iPad with 32 GB or more, an MDM and Managed Apple Accounts. Supported models: all iPad Pro, iPad 5th generation and later, iPad Air 2 and later, iPad mini 4th generation and later.
How do I put a Chromebook in kiosk mode?
Admin console: Devices > Chrome > Apps & extensions > Kiosks. Add the kiosk app and choose it next to Auto-launch app. The device opens it at the next start.
Keep carts clean between lessons
Category blocklists for iPads, iPhones, Android and Chromebook Android apps, in files your MDM imports, updated monthly.
See school plans Talk to usApple, iPad, iPad Air, iPad mini, iPad Pro, iPadOS, Safari, Face ID, Touch ID and Classroom are trademarks of Apple Inc. Jamf, Jamf Pro and Jamf School are trademarks of Jamf Software, LLC. Microsoft Intune is a trademark of Microsoft Corporation. Chromebook and Android are trademarks of Google LLC.
TikTok is a trademark of ByteDance Ltd. Snapchat is a trademark of Snap Inc. Roblox is a trademark of Roblox Corporation. Discord is a trademark of Discord Inc. Names identify the products discussed only. AppBlockList is not affiliated with, sponsored or endorsed by these companies.