Single App and Multi App Mode on Android Enterprise
Single App and Multi App Mode
One common use-case for managing mobile devices with Android Enterprise is to run them as dedicated devices that serve a specific purpose. These devices are used in special employee-facing (Inventory management, filed service management, transport and logistics) and customer-facing (Kiosks, digital signage, hospitality check-in) scenarios. With Silverback, you can assign a Single App Mode profile to device owner devices to achieve a single-use mode for your managed devices. In earlier Android versions, the app that should run in the single-use mode, must already support start its own activity in lock task mode what often led to confusion. Luckily, on newer Android devices are allowing the DPCs (Companion) to start any (and multiple) app's activity into lock task mode, which provides a much better usage of the Single App Mode that allows to use any application to run in a Single App Mode. Within this guide, we will highlight the requirements and share some insights about the Single App Mode, before we will configure first the Single App Mode and then we will turn the Single App Mode into a Multi App Mode on a test device.
Requirements
- Silverback Version 22.0 Update 2 and newer
- Companion Version 22.0 Update 2 and newer
- Activated Android Enterprise with devices enrolled as device owner
- For configuration of Kiosk Features, devices must run on Android 9 or newer
Before you Start
Before we start, we want to highlight that there are a few different names in the glossary for the setting up devices for a specific purpose and all of them are meaning more or less the same:
- Corporate-owned single-use (COSU) or Dedicated devices
- Kiosk Mode or Kiosk Devices
- Single App Mode or Lock Task Mode
The Corporate-owned single-use, or COSU and the Dedicated devices terms describes the management method for Android devices within Android Enterprise and is coming from Google itself. While COSU was the first name, Google switched to the term dedicated devices. Kiosk Devices or Kiosk Mode describes in general a special mode for computer programs or applications in which the user's rights are restricted. The Single App Mode describes to lock a device to a specific application and the Lock Task Mode is what is technically being used for application developers to run tasks (apps) in an immersive, kiosk-like fashion mode. Silverback in combination with the Companion application as the DPC is using the Single App Mode term by utilizing the Lock Task Mode for developers.
Every application developer can design their application(s) to run the Lock Task mode independently and there are a series of applications public available at Google Play. In addition, the experience for users to run devices only with one or with multiple applications can be achieved by either using and running a custom launcher (with additional options) or using the Lock Task Mode option or even both options together. Silverback is using the Lock Task Mode and we want to emphasize that utilizing the Single App Mode in Silverback in combination with an application that is designed to start and stop the Lock Task mode itself might lead to interferences.
Ensure to install or distribute the applications that should run in Single or Multi App Mode to your target devices in your desired way. If the Single App Mode configuration is applied before the application is installed, it might take some time after the installation until the device is locked to the specific purpose. The Single App or Multiple App mode will always be activated by refreshing a device from the Management Console (if the device is able to communicate), by opening the Companion (that will automatically initiate a refresh), after the device is rebooted and the device sends the system event Boot completed and after every Enterprise App (*.apk) installation that is contained in the Single App Mode profile.
The following article was created with a Google Pixel 4A, running on Android 13. Please be aware that there might be different behaviours between different vendors, devices and operating system versions and used applications (e.g. any app that utilizes the Lock Task Mode, too).
Configuration
Within this article, we will start from the easiest point, and we will let the device run with Google Chrome in Single App Mode, before we start to discover the optional User Interface Features for Android 9+ devices and then we will switch from a Single App Mode to the Multi App Mode.
Create a new Tag
- Open your Silverback Management Console
- Login as Administrator
- Navigate to Tag
- Press New Tag
- Enter a Name, e.g., Single/Multi App Mode
- Enter a description (optional)
- Enable Profile as Enabled Feature
- Enable under Device Types, e.g., Android
- Press Save
Enable Single App Mode
- Navigate to Profile
- Select Single App Mode
- Enable Single App Mode
- Now you will need to enter an Application Identifier as your main app and you have two options
- For Managed Play Apps: Press the Magnifier Icon and search for e.g., Google Chrome, choose the App and press Select
- For Enterprise Apps: Enter the package name of your enterprise application, e.g., com.matrix42.m42content
- Keep the User Interface options as default and press Save
The application added under Application Identifier will act as the main application, which will be used in the Multi App Mode as the default opened application.
Assign Tag
As always, you have three different ways to assign the Tag to your device(s):
- Navigate in the Tag to Definition and use the Associated Devices button to attach devices
- Navigate in the Tag to Definition and enable the Auto Population
- Navigate to Devices and use the assign Tag button and select the Tag and press save
According to this Knowledge Article, we recommend for testing and evaluation of this feature, to navigate first to Definition and use the Associated Devices button to attach only your test device.
Review Profile Installation
After assigning the Tag, you can refresh the device from the device overview to speed up the process of installing the profile. Open afterwards from the device overview under Actions the Pending Commands overview and review the Restriction profile installation, which contains on Android and Samsung Knox the configuration for the Single App Mode. It should look like this:
Review Single App Mode
When the Restrictions profile and Google Chrome is installed on the device, the application should be started. In this case, Google Chrome is opened and because you've selected the default configuration, you should see the following:
- The Notification and the System Status bar are hidden
- The Home button and the Recent App Buttons are hidden
- You can't close the application anymore
- The display timeout will still be active, but the Lock screen is suppressed
When you press now the Start Button of the device, you should be able to lock the device. If you long-press the button you should be able to Power off or Restart device.
Device Restart
Press the Start button and let the device reboot or execute a Restart from the Device Overview in Silverback. After performing the reboot, you will recognize the following behaviour:
- Within a certain time frame of approx. 15-30 seconds, the device will be free to use and then the Single App Mode will relaunch.
To keep the time as close as possible and as the Lock Task Mode on Android devices needs to be reapplied after every reboot, Companion will listen to the system event Boot completed and will immediately reapply the Single App and Multi App Mode again. In the meantime, your configured Single App Mode should be already reapplied, and we can proceed with additional features.
Disable the Allow user to unenroll option under Admin > Companion to prevent users to unenroll the device.
Disable Global Actions
- Head back to your Silverback Management Console
- Navigate to your recently created Tag and open the Single App Mode Profile again
- Now disable the Global Actions checkbox and press save
- After saving, None will be the only active checkbox
- Navigate to Definition and press push to devices
- You can now review again the Pending Commands for this device and locate the Restriction profile installation
- Take your device and long-press again the Power button and you should recognize that the options fo restart or shutdown does not appear
- The only buttons which will still work as familiar to regular users are the volume up and volume down buttons
- Also, acknowledge that you have still two options to restart a device:
- Physically: By long pressing the power button for approx. 15 seconds
- Remotely: By executing a restart from the Console
Disable Volume Buttons
- Navigate back to your Single App Mode Profile
- Select the Restrictions Profile
- Expand System Settings and disable the checkbox for Allow Volume Control
- Press Save, navigate to Definition and press push to devices
- Wait until the Restriction profile is applied again and review the device behaviour
- Now all buttons should be disabled, and the device is only running in Google Chrome
Enable Additional Features
- Navigate back to your Single App Mode Profile
- Disable the None checkbox and enable all other features
- Press Save and push the Tag again
- If you had a lock screen active for the device, the device will now be locked after installing the Restriction profile
- Unlock your device
- All previously hided options should be active now (except the Volume Control) and you can try to go to the App Drawer
- On the Pixel 4A as test device, you can achieve this by tapping the Recent Apps button and tab into the grey window
- Afterwards you can try to open any application other than Google Chrome and you will be only successful with opening the Companion application
After opening Companion, it will take some seconds and the Lock Task Mode will be enabled again. Keep just in mind that the Companion application is automatically added in the background to the allowed application list to ensure a working Lock Task Mode, so you won't need to add the Application Identifier for Companion extra.
Overview of User interface options
In general, the Lock Task Mode on Android and Samsung Knox devices offers the following options for customizing the user experience on devices that runs in the Lock Task Mode. Please review the following options and customize the features to your needs.
|
User Interface |
Description |
|---|---|
| None | Disables all the system user interface features listed below. |
| Home Button | Shows or hides the Home button. Enable this option for custom launchers and please note that tapping an enabled Home button in general has no action unless you allow list the default Android launcher. |
| Recent Apps | Shows or hides the Overview button which opens the Recents Apps screen after tapping. To activate this setting, the Home button must be enabled. |
| Notifications Area | Enables or disables notifications for all apps. This shows or prevents notification icons in the status bar, heads-up notifications, and the expandable notification shade. To activate this setting, the Home button must be enabled. Please note that tapping notification actions and buttons that open new panels, will not work while in kiosk mode. |
| Global Actions | Enables or disables the global actions dialog that shows when long-pressing the power button. By having this setting enabled, users are allowed to, for example, switch off or restart the device with the Global Actions dialog. Please note that even with disabled Global Actions, users still can force a restart on devices with e.g, holding the Power Button on Google Pixel 4a for about ~10 seconds. The execution process to force a restart, hard restart or reboot may differ from the operating system and/or hardware vendor. |
| System Status Bar | Enables or disables the status bar’s system info area that contains indicators such as connectivity, battery, and sound and vibrate options. |
| Keyguard | Enables any lock screen that might be set on the device. Please note that this is typically not suitable for devices with public users such as information kiosks or digital signage. If a lock screen has been set on the device, either manually or via a profile, disabling Keyguard will be suppressed until a reboot has been made. After rebooting, the lock screens needs to be unlocked once. |
User Interface Differences
The following two screnshots demonstrates the different User interface options:
| Example User Experience with enabled Notifications Area, Home Button, Recents Apps and System Status Bar | Example User Experience with disabled Notifications Area, Home Button, Recents Apps and System Status Bar |
 |
 |
Multi App Mode
As we previously enabled the Home Button and all other User interface options, we will proceed now with the Multi App Mode. As mentioned in the last steps, the steps to navigate to the App drawer might be difficult, so we will now add first the default launcher to the Single App Mode Profile to enable our first Multi App Mode and then we will extend the list.
Add your Launcher
- Navigate back to your Single App Mode profile
- Under Custom Application Identifier, you have now again two options:
- For Managed Play Apps: Press the Magnifier Icon and search for e.g., Google Chrome, choose the App and Press Select
- For Enterprise Apps: Enter the package name of your enterprise application, e.g., com.matrix42.m42content
- Add now your default launcher to the Custom Application Identifier list and press the + button
- The default launcher for the Google Pixel Launcher is com.google.android.apps.nexuslauncher
- If you will need to find out your launcher, we recommend either to use a search engine or install/distribute the Package List application
- The package name for Samsung One UI Home is com.sec.android.app.launcher
- After adding your launcher, press Save
- Either open now the Companion application again or press again push to devices from the Definition tab
- Wait until the Restrictions profile will be installed again and then use the Home button
- It should be now much easier to get to the App Drawer
Devices might need a reboot after adding the default launcher.
Add Settings Application
- Navigate back to your Single App Mode Profile
- Enter in the Custom Application identifier the following package name: com.android.settings
- Press the + button
- Press Save
In this way, you can also add additional enterprise applications by their package name
Add and Remove Managed Play App
- Now press the search icon next to Custom Application Identifier
- Search and add any other application, e.g., Google Maps
- Now search and add another app and remove the app with the x button
- Press Save and push the Tag again
Review Device
You should have now the following device behaviour:
- Google Chrome, Settings, Google Maps and Companion should be usable
- All other applications should not be usable
- All your buttons (except Volume Up and Down) and Notification Bars should be visible
- When you restart the device, the Multi App Mode should be automatically reapplied and will open the application in the foreground which is set in the Application Identifier field
- You can use the Home Button and open only previously listed applications
- Switching Apps between the listed applications should also work
Additional Notes
- You can utilize the Auto-install priority option for Managed Play Apps to set the installation order of applications
- Remote installations and uninstalling for Managed Play Apps is working even if the Play Store has not been added to the application list
- Managed Play Apps can't be uninstalled when running, this is especially important for the application which is added under Application Identifier (Main Application)
- Enterprise Apps can be uninstalled remotely when running as Companion will first stop the Lock Task Mode and then uninstall the App
- Apps that are selected as Main application might be only manually uninstall able after pausing or killing the application, which is possible by the user or admin in the scenario when the Home and or Recent Apps Buttons are allowed
- When upgrading an Enterprise App, the Lock Task Mode will be stopped, the updated version will be installed, and the Lock Task Mode will be reapplied again
- For devices running with the Single App or Multi App Mode, we recommend to configure additional restrictions depending on your security requirements and use-cases
- Setting, changing and clearing a passcode might influence the device behavior differently in combination with a set or not set passcode, a set or removed passcode profile, a not added settings application (e.g. com.android.settings - due to the passcode change prompt), a running or not running Single/Multi App Mode, a change in the Keyguard configuration, performed or not performed reboots and the operating system version. We recommend to have some test devices and run configuration changes on these devices first. Ultimately, it might be required to re-assign the Tag with the Single App Mode and to reboot a device to ensure a proper state after influencing the passcode remotely on the device
- By default, the Matrix42 Companion package name is added in the background to the application list to work properly. If users can access and open the Companion application based on your configuration, we recommend to deactivate the Allow user to unenroll option in Silverback.
- In addition, the following package names are added automatically to Samsung Knox devices to prevent technical conflicts with Knox cloud services:
| Products | Package Name |
|---|---|
| Knox Mobile Enrollment |
|
| Knox Configure |
|
| Knox Guard |
|
| Knox E-FOTA |
|
| Knox Asset Intelligence |
|
| Knox Licensing |
|