What is Assigned Access?

You can configure devices using a custom policy with the AssignedAccess CSP.

• Setting: ./Vendor/MSFT/AssignedAccess/Configuration
• Value: content of the XML configuration file

Assign the policy to a group that contains as members the devices that you want to configure.

Use the following settings to create a provisioning package:

• Path: AssignedAccess/AssignedAccessSettings
• Value: Enter the account and the application you want to use for Assigned access, using the AUMID of the app. Example:
  • {"Account":"domain\user", "AUMID":"Microsoft.WindowsCalculator_8wekyb3d8bbwe!App"}

Apply the provisioning package to the devices that you want to configure.

To configure a device using Windows PowerShell:

1. Sign in as administrator

2. Create the user account for Assigned Access

3. Sign in as the Assigned Access user account

4. Install the required UWP app

5. Sign out as the Assigned Access user account

6. Sign in as administrator and from an elevated PowerShell prompt use one of the following commands:

   #Configure Assigned Access by AppUserModelID and user name
   Set-AssignedAccess -AppUserModelId <AUMID> -UserName <username>
   
   #Configure Assigned Access by AppUserModelID and user SID
   Set-AssignedAccess -AppUserModelId <AUMID> -UserSID <usersid>
   
   #Configure Assigned Access by app name and user name
   Set-AssignedAccess -AppName <CustomApp> -UserName <username>
   
   #Configure Assigned Access by app name and user SID**:
   Set-AssignedAccess -AppName <CustomApp> -UserSID <usersid>
   
   

For more information:

• Find the Application User Model ID of an installed app
• Set-AssignedAccess

To remove assigned access, using PowerShell, run the following cmdlet:

Clear-AssignedAccess

For advanced customizations that use the XML configuration file, you can use PowerShell scripts via the MDM Bridge WMI Provider.

To test the PowerShell script, you can:

1. Download the psexec tool
2. Open an elevated command prompt and run: psexec.exe -i -s powershell.exe
3. Run the script in the PowerShell session

$shellLauncherConfiguration = @"

# content of the XML configuration file

"@

$namespaceName="root\cimv2\mdm\dmmap"
$className="MDM_AssignedAccess"
$obj = Get-CimInstance -Namespace $namespaceName -ClassName $className
$obj.ShellLauncher = [System.Net.WebUtility]::HtmlEncode($shellLauncherConfiguration)
$obj = Set-CimInstance -CimInstance $obj -ErrorVariable cimSetError -ErrorAction SilentlyContinue
if($cimSetError) {
    Write-Output "An ERROR occurred. Displaying error record and attempting to retrieve error logs...`n"
    Write-Error -ErrorRecord $cimSetError[0]

    $timeout = New-TimeSpan -Seconds 30
    $stopwatch = [System.Diagnostics.Stopwatch]::StartNew()
    do{
        $events = Get-WinEvent -FilterHashtable $eventLogFilterHashTable -ErrorAction Ignore
    } until ($events.Count -or $stopwatch.Elapsed -gt $timeout) # wait for the log to be available

    if($events.Count) {
        $events | ForEach-Object {
            Write-Output "$($_.TimeCreated) [$($_.LevelDisplayName.ToUpper())] $($_.Message -replace "`n|`r")"
        }
    } else {
        Write-Warning "Timed-out attempting to retrieve event logs..."
    }

    Exit 1
}

Write-Output "Successfully applied Shell Launcher configuration"

For more information, see Use PowerShell scripting with the WMI Bridge Provider.

Here are the steps to configure a kiosk using the Settings app:

1. Open the Settings app to view and configure a device as a kiosk. Go to Settings > Accounts > Other Users, or use the following shortcut:

   Other Users

2. Under Set up a kiosk, select Get Started

3. In the Create an account dialog, enter the account name, and select Next

   Note

   If there are any local standard user accounts already, the Create an account dialog offers the option to Choose an existing account

4. Choose the application to run when the kiosk account signs in. Only apps that can run above the lock screen are available in the list of apps to choose from. If you select Microsoft Edge as the kiosk app, you configure the following options:

   • Whether Microsoft Edge should display your website full-screen (digital sign) or with some browser controls available (public browser)
   • Which URL should be open when the kiosk accounts signs in
   • When Microsoft Edge should restart after a period of inactivity (if you select to run as a public browser)

5. Select Close

When the device isn't joined to an Active Directory domain or Microsoft Entra ID, automatic sign-in of the kiosk account is configured automatically:

• If you want the kiosk account to sign in automatically, and the kiosk app launched when the device restarts, then you don't need to do anything
• If you don't want the kiosk account to sign in automatically when the device restarts, then you must change the default setting before you configure the device as a kiosk. Sign in with the account that you want to use as the kiosk account. Open Settings > Accounts > Sign-in options. Set the Use my sign-in info to automatically finish setting up my device after an update or restart setting to Off. After you change the setting, you can apply the kiosk configuration to the device

You can configure devices using a custom policy with the AssignedAccess CSP.

• Setting: ./Vendor/MSFT/AssignedAccess/ShellLauncher
• Value: content of the XML configuration file

Assign the policy to a group that contains as members the devices that you want to configure.

Use the following settings to create a provisioning package:

• Path: AssignedAccess/MultiAppAssignedAccessSettings
• Value: content of the XML configuration file

Apply the provisioning package to the devices that you want to configure.

Configure your devices using PowerShell scripts via the MDM Bridge WMI Provider.

To test the PowerShell script, you can:

1. Download the psexec tool
2. Open an elevated command prompt and run: psexec.exe -i -s powershell.exe
3. Run the script in the PowerShell session

$assignedAccessConfiguration = @"

# content of the XML configuration file

"@

$namespaceName="root\cimv2\mdm\dmmap"
$className="MDM_AssignedAccess"
$obj = Get-CimInstance -Namespace $namespaceName -ClassName $className
$obj.Configuration = [System.Net.WebUtility]::HtmlEncode($assignedAccessConfiguration)
$obj = Set-CimInstance -CimInstance $obj -ErrorVariable cimSetError -ErrorAction SilentlyContinue
if($cimSetError) {
    Write-Output "An ERROR occurred. Displaying error record and attempting to retrieve error logs...`n"
    Write-Error -ErrorRecord $cimSetError[0]

    $timeout = New-TimeSpan -Seconds 30
    $stopwatch = [System.Diagnostics.Stopwatch]::StartNew()
    do{
        $events = Get-WinEvent -FilterHashtable $eventLogFilterHashTable -ErrorAction Ignore
    } until ($events.Count -or $stopwatch.Elapsed -gt $timeout) # wait for the log to be available

    if($events.Count) {
        $events | ForEach-Object {
            Write-Output "$($_.TimeCreated) [$($_.LevelDisplayName.ToUpper())] $($_.Message -replace "`n|`r")"
        }
    } else {
        Write-Warning "Timed-out attempting to retrieve event logs..."
    }

    Exit 1
}

Write-Output "Successfully applied Assigned Access configuration"

For more information, see Use PowerShell scripting with the WMI Bridge Provider.

This option isn't available using Settings.