Kiosk CSP & Settings Catalog companion

Getting the XML right is only half the battle. These are the complementary policies that make or break auto-logon and keep users in the shell — while leaving your helpdesk room to support the device.

Philosophy: you’re configuring a restricted shell, not a desktop. Secure by design, need-to-know. Document what you deliberately left disabled so future conflicts are easy to spot.

1. OneDrive in the system tray

Use the SharedPC CSP to restrict the sync client instead of uninstall-and-pray.

2. Limit breakout points

Pick exactly one shutdown option and one lock option — e.g. Allow Restart and Allow Lock. Combine Start CSP customizations with keyboard shortcut control.

3. Always-on screen with auto-logon

Add the ADMX settings that keep the screen and system awake.
Explicitly set System › Logon (ADMX) and Device Lock CSPs to Disabled — and document why.

Both options use an Account Protection › Local User Group Membership profile.

Option	Group membership	User right
1 — Allow only Power Users	Add `kioskuser0` to Power Users	Allow Local Logon = Administrators, Power Users
2 — Block specific Entra users (preferred)	Add targeted users/groups to Guests	Deny Local Logon = `*S-1-5-32-546`

Removing the password field is a great first step to phishing-resistant auth on internal kiosks — but LAPS and auto-logon will break.

6. Edge kiosk CSPs in multi-app mode

Edge kiosk policies only apply when Edge launches with kiosk switches. In multi-app mode, pre-stage a shortcut with the Edge Kiosk Shortcut script and pin it in your Start/Taskbar XML.

Setting highlight: Configure address bar editing for kiosk mode public browsing experience restricts navigation without a giant URL allow list.