Devices that do one job and keep doing it
Tablets, screens and phones locked to a single app, enrolled in a management console, and watched so a dead kiosk does not stay dead until a customer mentions it. IG Digital Lab sets up kiosks, digital signage, check-in screens, field-crew tablets and meeting-room displays.
How do you lock an Android tablet to a single app?
IG Digital Lab locks Android tablets with device-owner provisioning: we factory reset the tablet, enroll it by QR code or zero-touch, then run your app in lock task mode so home, recents and settings are blocked. An MDM console pushes updates remotely. We stage devices at our Sacramento office and ship them ready.
There are three levels of locking a device, and they are not the same thing. Knowing which one you have is the difference between a kiosk and a tablet with a browser on it.
- Screen pinning is built into Android and any user can switch it on. Holding back and recents together switches it off again. Fine for handing a phone to a customer for a minute, not a kiosk.
- Device-owner mode is set once, during setup, on a device with no accounts on it. From then on the management app decides which packages are allowed to run at all. This is the part that makes the lock actually hold.
- Lock task mode plus a restriction set is the finished thing: your app full screen, no status bar, no navigation, and separate policies blocking safe boot, USB debugging, factory reset from settings, new accounts and anything installed from outside Managed Google Play.
The order matters, and it catches people out. Device-owner mode cannot be added later to a tablet that already has a Google account signed in, so a device that arrived last month and got used for a week has to be wiped before it can be enrolled properly. We plan the staging around that instead of discovering it on install day.
Provision
Factory reset, then enroll by QR code from the first setup screen, or by zero-touch if the devices were bought through a reseller that supports it. The device comes up already managed, with your app installed and the policy applied.
Lock
Your app is pinned in lock task mode and the restriction set goes on: no recents, no sideloading, no safe boot, no new users, no factory reset from the device. One hidden exit stays, a gesture plus a PIN your managers hold.
Watch
Every device checks in on a schedule. If a screen stops reporting, drops off the network or falls below a battery threshold, the alert reaches us before it reaches your staff. Same monitoring stack as servers and support.
What we set up
Six shapes cover almost everything businesses ask for. The hardware differs, the discipline underneath is the same one.
Self-service kiosks
A tablet at the counter or on a stand running one app: ordering, sign-up, a survey, a queue ticket, a payment. Mounted, powered, locked, and reachable from the console when the app or the wording needs to change.
Digital signage
Screens showing a menu, a price list, a schedule or a live dashboard, that come back on their own after a power cut. Content changes from one place instead of a USB stick carried to every screen.
Visitor check-in
A screen at reception that signs the visitor in, notifies the person they came to see, and prints a badge. It can write straight into the systems you already run, which is where AI workflow automation takes over.
Field-crew tablets
Rugged or standard tablets for crews in vans and on sites: job list, photos, signatures, offline first, syncing when the signal comes back. Locked so the work device does not quietly become somebody's personal phone.
Meeting-room displays
Panels outside rooms showing what is booked and letting people grab the room on the spot, reading and writing the calendar you already use. Same enrollment, same monitoring, no separate system to learn.
Smart-space automation
Doors, lights, sensors and screens tied into one flow so the space reacts instead of waiting for someone to press something. The logic runs on hardware you own, on your network, so it survives a vendor cloud outage.
Enrollment and management
Enrollment is what turns a box of tablets into a fleet you can change from one screen. We use Android Enterprise, and which enrollment path we take depends mostly on how the devices were bought.
| Method | When we use it | What it needs |
|---|---|---|
| Zero-touch | New devices ordered through a reseller in Google's zero-touch program. Best for anything above a handful of units. | Devices registered to your zero-touch account before they ship. Nothing to do on the device itself, it enrolls on first boot. |
| QR code | Any new or factory-reset device, including hardware you already own. Our default for small fleets. | Someone taps the first setup screen six times, scans our QR, and the device provisions itself unattended. |
| afw#setup | Devices where the QR path is unavailable or the setup wizard differs by vendor. | A Google account typed as afw#setup during setup, then the management app installs itself. |
| Knox / vendor tooling | Samsung and Zebra hardware where the vendor layer adds controls Android alone does not have. | A vendor account and, on Samsung, a Knox licence key applied at staging. |
Once devices are enrolled, the console is where the work happens:
- Push a new app version to every device at once, or to one site, or to one device.
- Change the locked app, the wallpaper, the Wi-Fi profile or the restriction set without touching the hardware.
- Lock or wipe a device that walked out of the building.
- Set maintenance windows so updates do not land in the middle of your busy hour.
- See battery, storage, app version and last check-in per device, and get alerted when one goes quiet.
- Bring a replacement device up from the same profile in minutes, instead of rebuilding it from memory.
Three things we say before any hardware order goes in, because they decide more about the install than the software does:
Batteries do not like living on a charger
A consumer tablet plugged in around the clock swells eventually. Choose hardware with charge limiting or a power-only mode, or budget for battery replacement on a schedule.
Enclosure, cable route and power
Where the cable runs and how the device is mounted decide whether the kiosk looks installed or looks temporary. We spec the enclosure with the device, not after it.
Never put a kiosk on guest Wi-Fi
A captive portal that expires overnight will take your screens down every time. Kiosks get their own network segment, or a SIM, and a static configuration pushed from the console.
Buy one spare
Screens get dropped and ports wear out. One staged spare on a shelf turns a broken kiosk into a ten-minute swap instead of a two-week wait for a replacement.
What it costs per device
There is no per-device price. A small fleet at one site running one app is a One Process implementation from IG Digital Lab in Sacramento: $2,500 to $6,000. Multi-site or integrated fleets run $6,000 to $15,000. Ongoing management is $300 to $1,500 a month, one-off work $150 to $200 an hour. The audit is free.
One location, one app, a small fleet.
- Hardware and enclosure spec, then staging
- Enrollment, kiosk lock and restriction set
- On-site install and staff handover
Several sites, or devices wired into your systems.
- Multi-site fleets and mixed device types
- Check-in or signage wired into your CRM and calendar
- Smart-space automation across a floor or a building
- Monitoring and alerting per device from day one
When the app on the screen has to be built too.
- A device app written for your process
- Backend, sync and offline handling
- Phased rollout across sites
Why not a price per device? Because nearly all of the work sits in the first one. Once the profile, the app and the restriction set exist, the tenth tablet costs a fraction of the first. A per-device number would either overcharge you on the fleet or undercharge the setup, so we quote the project instead.
Hardware is not in these numbers. You buy the tablets, mounts and screens directly, or we order them and pass the invoice through at cost. MDM licensing is billed per device by the vendor, usually annually, and we tell you that figure before you commit rather than folding it into ours.
After the install, management is a flat monthly plan: Care at $300 to $500 per month for monitoring, updates and small changes, Active at $750 to $1,500 per month when devices and sites keep being added. Occasional one-off work, like re-provisioning a replaced tablet, is $150 to $200 per hour. Full detail on the pricing page.
Frequently asked questions
Locking, ownership, replacements, platforms and timelines.
Can staff exit kiosk mode?
Not by accident, and not with the usual tricks. Lock task mode removes home and recents, and the policy set blocks safe boot, USB debugging, factory reset from settings and new user accounts. We leave one deliberate way out, normally a hidden gesture plus a PIN that only your managers hold. A device that is truly stuck can be wiped and re-enrolled from the console.
Can you manage devices we already own?
Usually yes, with one condition. Device-owner mode can only be set on a device that has no accounts on it, so a tablet already signed into a Google account has to be factory reset before it can be enrolled. We back up anything on it first. Devices too old to still receive security patches we will tell you to replace rather than enroll.
What happens if a device breaks, is lost or is stolen?
We lock or wipe it from the console, then provision a replacement from the same profile. Because the configuration lives in the console and not in one person's head, a spare that arrives in the morning can be on the wall the same day, with the same app, the same restrictions and the same monitoring.
Do you work with iPads and Windows screens, or only Android?
Android is where we go deepest, and it is usually the cheapest per screen. We also set up iPads through Apple Business Manager with a single-app profile, and Windows displays with assigned access. If you already run a mixed fleet, we will tell you which parts are worth consolidating on one platform and which are fine as they are.
How long does a device rollout take?
A small fleet at one location is typically two to three weeks from the free audit: a few days to choose hardware and build the profile, one staging session where every device is enrolled and tested, then the install. Multi-site rollouts run longer because of shipping and site access, not because of the software.
Tell us what the screen needs to do.
Book a 30-minute free audit and we will tell you which device, which lock and which console fit, before anyone orders hardware. Or call (916) 618-0502.
No commitment. You keep the audit notes either way.