Locking down and remotely managing in-store tablets: kiosk mode with the Essentials licence

Locking down, restricting and remotely managing the customer and staff tablets placed in Tchibo stores is a good example of what MDM is for in retail. This article takes a general, practical look at how such a task can be solved with the components of the Samsung Knox Suite – Essentials Plan, and where the plan's limits lie.

Customer and staff tablets: two different requirements

A customer tablet is a public device. Anyone can pick it up, so it has to be locked to a single task: product catalogue, survey or loyalty sign-up. No browser can be opened, settings are out of reach, and if someone leaves the app the device returns to the assigned screen at once.

A staff tablet is a work tool. It needs several apps – stock lookup, internal messaging, training material – but again, network settings must not be changed and personal apps must not be installed. The two tablet types therefore need different kiosk profiles in the same shop.

Single- or multi-app kiosk with the Kiosk Wizard

In the Knox Manage Kiosk Wizard (Kiosk builder in the new console), both versions are assembled by drag and drop. A single-app kiosk suits the customer tablet: the device runs one app full screen. A multi-app kiosk shows the approved apps on the staff tablet, arranged in folders and complemented by a clock, calendar or banner. If a website is needed, Knox Browser can be allowed in restricted form.

Your own branding

The kiosk can carry your logo and wallpaper, so customers see the brand rather than a generic tablet. On Android 15 or later the Bar colour cannot be changed – worth keeping in mind when designing.

Blocked settings, allowed background processes

The settings menu and status bar can be blocked so users cannot switch off Wi-Fi or open notifications. Some apps still need to run in the background – a payment or sync service, for example. These can be allowed separately without appearing on the kiosk screen.

Remote updates and changes

Store tablets don't have to be handled one by one. From Knox Manage you can deploy app updates, change kiosk content – a new campaign wallpaper, say – and swap the Wi-Fi profile. Changes go out to the devices the profile is assigned to.

Troubleshooting without a site visit

If a tablet in a store misbehaves, IT can see and control its screen from the console using Knox Remote Support. This is documented for Android devices; on non-Samsung devices the person on site must approve the session. In many cases this avoids a site visit or shipping the device back.

What Essentials doesn't provide

The Essentials Plan does not include Knox E-FOTA. If you want to pin the Android major version on store tablets – because the catalogue app was only tested on one version, for instance – or schedule updates outside opening hours, you need the Enterprise Plan or a standalone E-FOTA licence. Fleet-wide battery and health diagnostics (Knox Asset Intelligence), useful with many deployed tablets, is also Enterprise only.

Checklist for an in-store tablet rollout

1. Decide which tablets are customer devices and which are staff devices.
2. Choose the allowed apps for each tablet type.
3. Build the kiosk profiles in the Kiosk Wizard with your logo and wallpaper.
4. Block the settings menu and status bar; allow the required background apps.
5. Set up the store Wi-Fi profile and password policy.
6. Assign Knox Remote Support permissions to the right IT roles.
7. Test the setup in a pilot store using the trial licence.
8. Decide whether you need OS version pinning – if so, plan for the Enterprise Plan.

If you're planning an in-store tablet rollout, we're happy to review the specific requirements – find us in the Contact section.