Single App and Multi App Mode on Android Enterprise
Single App and Multi App Mode
One common use-case for managing mobile devices with Android Enterprise is to run them as dedicated devices that serve a specific purpose. These devices are used in special employee-facing (Inventory management, filed service management, transport and logistics) and customer-facing (Kiosks, digital signage, hospitality check-in) scenarios. With Silverback, you can assign a Single App Mode profile to device owner devices to achieve a single-use mode for your managed devices. In earlier Android versions, the app that should run in the single-use mode, must already support start its own activity in lock task mode what often led to confusion. Luckily, on newer Android devices are allowing the DPCs (Companion) to start any (and multiple) app's activity into lock task mode, which provides a much better usage of the Single App Mode that allows to use any application to run in a Single App Mode. Within this guide, we will highlight the requirements and share some insights about the Single App Mode, before we will configure first the Single App Mode and then we will turn the Single App Mode into a Multi App Mode on a test device. To round off the entire handling of the Single App and Multi App mode, we will also go over the so-called Maintenance mode, which explains how the Single App and Multi App mode can be temporarily deactivated in order to carry out any necessary work on the device.
Requirements
- Silverback Version 22.0 Update 2 and newer
- Companion Version 22.0 Update 2 and newer
- Activated Android Enterprise with devices enrolled as device owner
- For configuration of Kiosk Features, devices must run on Android 9 or newer
- Fur utilizing the Maintenance Mode, Silverback and Companion must be on version 24.0 Update 3
Before you Start
Before we start, we want to highlight that there are a few different names in the glossary for the setting up devices for a specific purpose and all of them are meaning more or less the same:
- Corporate-owned single-use (COSU) or Dedicated devices
- Kiosk Mode or Kiosk Devices
- Single App Mode or Lock Task Mode
The Corporate-owned single-use, or COSU and the Dedicated devices terms describes the management method for Android devices within Android Enterprise and is coming from Google itself. While COSU was the first name, Google switched to the term dedicated devices. Kiosk Devices or Kiosk Mode describes in general a special mode for computer programs or applications in which the user's rights are restricted. The Single App Mode describes to lock a device to a specific application and the Lock Task Mode is what is technically being used for application developers to run tasks (apps) in an immersive, kiosk-like fashion mode. Silverback in combination with the Companion application as the DPC is using the Single App Mode term by utilizing the Lock Task Mode for developers.
Every application developer can design their application(s) to run the Lock Task mode independently and there are a series of applications public available at Google Play. In addition, the experience for users to run devices only with one or with multiple applications can be achieved by either using and running a custom launcher (with additional options) or using the Lock Task Mode option or even both options together. Silverback is using the Lock Task Mode and we want to emphasize that utilizing the Single App Mode in Silverback in combination with an application that is designed to start and stop the Lock Task mode itself might lead to interferences.
Ensure to install or distribute the applications that should run in Single or Multi App Mode to your target devices in your desired way. If the Single App Mode configuration is applied before the application is installed, it might take some time after the installation until the device is locked to the specific purpose. The Single App or Multiple App mode will always be activated by refreshing a device from the Management Console (if the device is able to communicate), by opening the Companion (that will automatically initiate a refresh), after the device is rebooted and the device sends the system event Boot completed and after every Enterprise App (*.apk) installation that is contained in the Single App Mode profile. If the maintenance mode has been used, the device will enter the Single or Multi App Mode either after the maintenance timeframe has been elapsed or after the technician has manually re-enabled the Mode in Companion.
The following article was created with a Google Pixel 4A, running on Android 13. Please be aware that there might be different behaviours between different vendors, devices and operating system versions and used applications (e.g. any app that utilizes the Lock Task Mode, too).
Configuration
Within this article, we will start from the easiest point, and we will let the device run with Google Chrome in Single App Mode, before we start to discover the optional User Interface Features for Android 9+ devices and then we will switch from a Single App Mode to the Multi App Mode, before we demonstate how to use the Maintenance Mode.
Create a new Tag
- Open your Silverback Management Console
- Login as Administrator
- Navigate to Tag
- Press New Tag
- Enter a Name, e.g., Single/Multi App Mode
- Enter a description (optional)
- Enable Profile as Enabled Feature
- Enable under Device Types, e.g., Android
- Press Save
Enable Single App Mode
- Navigate to Profile
- Select Single App Mode
- Enable Single App Mode
- Now you will need to enter an Application Identifier as your main app and you have two options
- For Managed Play Apps: Press the Magnifier Icon and search for e.g., Google Chrome, choose the App and press Select
- For Enterprise Apps: Enter the package name of your enterprise application, e.g., com.matrix42.m42content
- Keep the User Interface options as default and do not enable the Maintenance Mode
- Press Save
The application added under Application Identifier will act as the main application, which will be used in the Multi App Mode as the default opened application.
Assign Tag
As always, you have three different ways to assign the Tag to your device(s):
- Navigate in the Tag to Definition and use the Associated Devices button to attach devices
- Navigate in the Tag to Definition and enable the Auto Population
- Navigate to Devices and use the assign Tag button and select the Tag and press save
According to this Knowledgebase Article, we recommend for testing and evaluation of this feature, to navigate first to Definition and use the Associated Devices button to attach only your test device.
Review Profile Installation
After assigning the Tag, you can refresh the device from the device overview to speed up the process of installing the profile. Open afterwards from the device overview under Actions the Pending Commands overview and review the Restriction profile installation, which contains on Android and Samsung Knox the configuration for the Single App Mode. It should look like this:
Review Single App Mode
When the Restrictions profile and Google Chrome is installed on the device, the application should be started. In this case, Google Chrome is opened and because you've selected the default configuration, you should see the following:
- The Notification and the System Status bar are hidden
- The Home button and the Recent App Buttons are hidden
- You can't close the application anymore
- The display timeout will still be active, but the Lock screen is suppressed
When you press now the Start Button of the device, you should be able to lock the device. If you long-press the button you should be able to Power off or Restart device.
Device Restart
Press the Start button and let the device reboot or execute a Restart from the Device Overview in Silverback. After performing the reboot, you will recognize the following behaviour:
- Within a certain time frame of approx. 15-30 seconds, the device will be free to use and then the Single App Mode will relaunch.
To keep the time as close as possible and as the Lock Task Mode on Android devices needs to be reapplied after every reboot, Companion will listen to the system event Boot completed and will immediately reapply the Single App and Multi App Mode again. In the meantime, your configured Single App Mode should be already reapplied, and we can proceed with additional features.
Disable the Allow user to unenroll option under Admin > Companion to prevent users to unenroll the device.
Disable Global Actions
- Head back to your Silverback Management Console
- Navigate to your recently created Tag and open the Single App Mode Profile again
- Now disable the Global Actions checkbox and press save
- After saving, None will be the only active checkbox
- Navigate to Definition and press push to devices
- You can now review again the Pending Commands for this device and locate the Restriction profile installation
- Take your device and long-press again the Power button and you should recognize that the options fo restart or shutdown does not appear
- The only buttons which will still work as familiar to regular users are the volume up and volume down buttons
- Also, acknowledge that you have still two options to restart a device:
- Physically: By long pressing the power button for approx. 15 seconds
- Remotely: By executing a restart from the Console
Disable Volume Buttons
- Navigate back to your Single App Mode Profile
- Select the Restrictions Profile
- Expand System Settings and disable the checkbox for Allow Volume Control
- Press Save, navigate to Definition and press push to devices
- Wait until the Restriction profile is applied again and review the device behaviour
- Now all buttons should be disabled, and the device is only running in Google Chrome
Enable Additional Features
- Navigate back to your Single App Mode Profile
- Disable the None checkbox and enable all other features
- Press Save and push the Tag again
- If you had a lock screen active for the device, the device will now be locked after installing the Restriction profile
- Unlock your device
- All previously hided options should be active now (except the Volume Control) and you can try to go to the App Drawer
- On the Pixel 4A as test device, you can achieve this by tapping the Recent Apps button and tab into the grey window
- Afterwards you can try to open any application other than Google Chrome and you will be only successful with opening the Companion application
After opening Companion, it will take some seconds and the Lock Task Mode will be enabled again. Keep just in mind that the Companion application is automatically added in the background to the allowed application list to ensure a working Lock Task Mode, so you won't need to add the Application Identifier for Companion extra.
Overview of User interface options
In general, the Lock Task Mode on Android and Samsung Knox devices offers the following options for customizing the user experience on devices that runs in the Lock Task Mode. Please review the following options and customize the features to your needs.
|
User Interface |
Description |
|---|---|
| None | Disables all the system user interface features listed below. |
| Home Button | Shows or hides the Home button. Enable this option for custom launchers and please note that tapping an enabled Home button in general has no action unless you allow list the default Android launcher. |
| Recent Apps | Shows or hides the Overview button which opens the Recents Apps screen after tapping. To activate this setting, the Home button must be enabled. |
| Notifications Area | Enables or disables notifications for all apps. This shows or prevents notification icons in the status bar, heads-up notifications, and the expandable notification shade. To activate this setting, the Home button must be enabled. Please note that tapping notification actions and buttons that open new panels, will not work while in kiosk mode. |
| Global Actions | Enables or disables the global actions dialog that shows when long-pressing the power button. By having this setting enabled, users are allowed to, for example, switch off or restart the device with the Global Actions dialog. Please note that even with disabled Global Actions, users still can force a restart on devices with e.g, holding the Power Button on Google Pixel 4a for about ~10 seconds. The execution process to force a restart, hard restart or reboot may differ from the operating system and/or hardware vendor. |
| System Status Bar | Enables or disables the status bar’s system info area that contains indicators such as connectivity, battery, and sound and vibrate options. |
| Keyguard | Enables any lock screen that might be set on the device. Please note that this is typically not suitable for devices with public users such as information kiosks or digital signage. If a lock screen has been set on the device, either manually or via a profile, disabling Keyguard will be suppressed until a reboot has been made. After rebooting, the lock screens needs to be unlocked once. |
User Interface Differences
The following two screnshots demonstrates the different User interface options:
| Example User Experience with enabled Notifications Area, Home Button, Recents Apps and System Status Bar | Example User Experience with disabled Notifications Area, Home Button, Recents Apps and System Status Bar |
 |
 |
Multi App Mode
As we previously enabled the Home Button and all other User interface options, we will proceed now with the Multi App Mode. As mentioned in the last steps, the steps to navigate to the App drawer might be difficult, so we will now add first the default launcher to the Single App Mode Profile to enable our first Multi App Mode and then we will extend the list.
Add your Launcher
- Navigate back to your Single App Mode profile
- Under Custom Application Identifier, you have now again two options:
- For Managed Play Apps: Press the Magnifier Icon and search for e.g., Google Chrome, choose the App and Press Select
- For Enterprise Apps: Enter the package name of your enterprise application, e.g., com.matrix42.m42content
- Add now your default launcher to the Custom Application Identifier list and press the + button
- The default launcher for the Google Pixel Launcher is com.google.android.apps.nexuslauncher
- If you will need to find out your launcher, we recommend either to use a search engine or install/distribute the Package List application
- The package name for Samsung One UI Home is com.sec.android.app.launcher
- After adding your launcher, press Save
- Either open now the Companion application again or press again push to devices from the Definition tab
- Wait until the Restrictions profile will be installed again and then use the Home button
- It should be now much easier to get to the App Drawer
Devices might need a reboot after adding the default launcher.
Add Settings Application
- Navigate back to your Single App Mode Profile
- Enter in the Custom Application identifier the following package name: com.android.settings
- Press the + button
- Press Save
In this way, you can also add additional enterprise applications by their package name
Add and Remove Managed Play App
- Now press the search icon next to Custom Application Identifier
- Search and add any other application, e.g., Google Maps
- Now search and add another app and remove the app with the x button
- Press Save and push the Tag again
Review Device
You should have now the following device behaviour:
- Google Chrome, Settings, Google Maps and Companion should be usable
- All other applications should not be usable
- All your buttons (except Volume Up and Down) and Notification Bars should be visible
- When you restart the device, the Multi App Mode should be automatically reapplied and will open the application in the foreground which is set in the Application Identifier field
- You can use the Home Button and open only previously listed applications
- Switching Apps between the listed applications should also work
Maintenance Mode
Now that we have successfully configured the device in Single App and Multi App mode, we will move on to another set of features in this area. Starting with Silverback and Companion 24.0 Update 2, a Maintenance Mode for Single App and Multi App Mode is available. This maintenance mode provides greater flexibility for both administrators and on-site technicians in case the device must be (temporarily) free to use for maintenance or other actions on the device. The maintenance mode can be activated in multiple ways:
- Remote Deactivation: You can temporarily suspend the Single App Mode remotely through a device action in the management console.
- On-Device Deactivation: On-site technicians can directly suspend Single App Mode mode on the device by entering a secure PIN, allowing maintenance tasks to be performed without requiring remote assistance.
Remote Deactivation
To remotely deactivate the Single App Mode, a Suspend Single App Mode action is visible in the Device Overview for all devices, which is active when a Single App Mode profile is assigned to the device. Under More, select Suspend Single App Mode and confirm. This action can be performed even if Maintenance Mode is not enabled in the Single App Mode Profile configuration. In this situation, Companion will perform the action with a default maintenance timeframe of 15 minutes. You can check the execution of the SuspendSingleAppMode command as from the Pending Commands view.
Enable and configure Maintenance Mode
To enable and configure the Maintenance Mode, you will find inside the Single App Mode Profile a Maintenance Mode area to activate the Maintenance Mode, to define a 4-6 Digit PIN and a Maintenance Timeframe in minutes. To do so, just follow the next steps:
- Activate the Maintenance Mode Enable checkbox
- Enter as an example 424242 as PIN Code
- Set the Maintenance Timeframe to 5 minutes
- Press Save and push the Tag again
On-Site Access to Kiosk Settings in Companion
When devices are running Companion 24.0 Update 3 and Maintenance Mode is enabled and configured, a new menu item in Companion will indicate that the configuration has been applied to the device. Select Kiosk from the Companion menu and enter the required PIN code within 15 seconds. If no PIN is entered, the window will close automatically. From the Kiosk Settings, you can view various information such as the current status, the configured maintenance window, available user interface features, the main application in Single App Mode and additional allowed applications. The Kiosk Settings provides 3 actions that can be performed:
- Open applications: Tap on the application and Companion will open it.
- Suspend Single App Mode: To suspend the Single App for the configured and visible maintenance period, a confirmation pop-up will appear to perform the action.
- Reactivate Single App Mode: To re-enable Single App Mode, a confirmation pop-up will appear to perform the action.
 |
 |
 |
Accessing Kiosk Settings with Hardware Buttons
When devices are running Companion 24.0 Update 3 and Maintenance Mode is enabled and configured, Companion begins to listen for SCREEN_ON events reported by the device. After turning the screen on and off 5 times with no more than 3 seconds in between (including a visible counter starting with 2 repetitions remaining), the PIN code screen will appear. Again, a 15 second counter will indicate the timeframe and if the PIN code is successfully entered, the Companion Kiosk Settings screen will appear with the information and actions explained above.
Wrong Password Attempts
If an unfriendly user tries to have access to the maintenance mode and possibly tries to guess the PIN code, the PIN entry will be automatically blocked for 5 minutes after 5 failed attempts and the Companion application will switch back to the last screen each time. If the device is in this state and you need to access the maintenance mode directly, you can use the Suspend Single App Mode action from the Silverback Management Console to reset the counter and access the maintenance mode.
Additional Notes
- You can utilize the Auto-install priority option for Managed Play Apps to set the installation order of applications
- Remote installations and uninstalling for Managed Play Apps is working even if the Play Store has not been added to the application list
- Managed Play Apps can't be uninstalled when running, this is especially important for the application which is added under Application Identifier (Main Application)
- Enterprise Apps can be uninstalled remotely when running as Companion will first stop the Lock Task Mode and then uninstall the App
- Apps that are selected as Main application might be only manually uninstall able after pausing or killing the application, which is possible by the user or admin in the scenario when the Home and or Recent Apps Buttons are allowed
- When upgrading an Enterprise App, the Lock Task Mode will be stopped, the updated version will be installed, and the Lock Task Mode will be reapplied again
- For devices running with the Single App or Multi App Mode, we recommend to configure additional restrictions depending on your security requirements and use-cases
- Setting, changing and clearing a passcode might influence the device behavior differently in combination with a set or not set passcode, a set or removed passcode profile, a not added settings application (e.g. com.android.settings - due to the passcode change prompt), a running or not running Single/Multi App Mode, a change in the Keyguard configuration, performed or not performed reboots and the operating system version. We recommend to have some test devices and run configuration changes on these devices first. Ultimately, it might be required to re-assign the Tag with the Single App Mode and to reboot a device to ensure a proper state after influencing the passcode remotely on the device
- By default, the Matrix42 Companion package name is added in the background to the application list to work properly. If users can access and open the Companion application based on your configuration, we recommend to deactivate the Allow user to unenroll option in Silverback.
- In addition, the following package names are added automatically to Samsung Knox devices to prevent technical conflicts with Knox cloud services:
| Products | Package Name |
|---|---|
| Knox Mobile Enrollment |
|
| Knox Configure |
|
| Knox Guard |
|
| Knox E-FOTA |
|
| Knox Asset Intelligence |
|
| Knox Licensing |
|