How to setup Assigned Access in Windows 8.1 (Kiosk Mode!)



AskPFEPlat is in the process of a transformation to the new Core Infrastructure and Security TechCommunity, and will be moving by the end of March 2019 to our new home at (hosted at Please bear with us while we are still under construction!

We will continue bringing you the same great content, from the same great contributors, on our new platform. Until then, you can access our new content on either as you do today, or at our new site Please feel free to update your bookmarks accordingly!

Why are we doing this? Simple really; we are looking to expand our team internally in order to provide you even more great content, as well as take on a more proactive role in the future with our readers (more to come on that later)! Since our team encompasses many more roles than Premier Field Engineers these days, we felt it was also time we reflected that initial expansion.

If you have never visited the TechCommunity site, it can be found at On the TechCommunity site, you will find numerous technical communities across many topics, which include discussion areas, along with blog content.

NOTE: In addition to the AskPFEPlat-to-Core Infrastructure and Security transformation, Premier Field Engineers from all technology areas will be working together to expand the TechCommunity site even further, joining together in the technology agnostic Premier Field Engineering TechCommunity (along with Core Infrastructure and Security), which can be found at!

As always, thank you for continuing to read the Core Infrastructure and Security (AskPFEPlat) blog, and we look forward to providing you more great content well into the future!


Hey, here’s Joao again. My inbox has been filled with Windows 8.1 related e-mails, and I decided to talk to you about a much requested feature that finally saw the light of day.

Have you heard of Assigned Access? Maybe you have heard of the scenario it implements: Kiosk mode!

So far your only option to create a Windows Kiosk where your users and customers could interact with a single application without the risk of compromising the system was to use Windows Embedded.

Now with the enhanced security of having each Modern App (coming from the Store or Sideloaded) sandboxed, Microsoft is finally offering an alternative that I’m sure will please many customers. It doesn’t matter if you are a very big customer or a startup, but if you feel like Windows Embedded is an overkill, maybe Assigned Access is really what you are looking for.

Why use Assigned Access

When you set up assigned access you can choose any Modern App to be run exclusively and in full screen in a local account. The only Modern Apps that cannot be used are those that would allow a user to make changes to the local system and compromise the kiosk (Store, and PC Settings, and Internet Explorer). The focus is to easily set up a single purpose machine that users are not able to tamper.

Please note that traditional desktop apps don’t provide the same level of security and therefore cannot be used in Assigned Access. You will need Windows Embedded to lock a machine in a desktop application.

With an Assigned Access account the user will not see any notifications, and the Windows hardware button will be suppressed as will be the following shortcuts and gestures:

Key Combination

Functionality Blocked


Close Application


Close Window


Secure Authentication Screen (SAS)


Task Manager


Switch Apps/Go to Start Screen


Shortcut menu for active window


Start Screen


Task Switch


Task Switch


Window Switch


Functionality Blocked

Swipe from left

Switch app, side-by-side app

Swipe from right

Charms bar

Swipe from top

Close an app


How to configure a local account for Assigned Access

The only pre-requisites are to have a local account and preinstall the Modern App for that account. For that you will have to login to that account at least once before you set it up for Assigned Access.

Note: The accounts should be single purpose, so it’s not possible to use a domain account.

In my demo I have created a new local account called Kiosk, but you can choose any name that you like




You can press Set up an account for assigned access to proceed with selecting the account and application you want to use






It’s as simple as that!

If you want to set this up on multiple machines or simply love Windows Powershell, this configuration can also be scripted using Set-AssignedAccess

A typical command would be Set-AssignedAccess -AppName <appname> -UserName <username>




How to sign out from an account configured for Assigned Access

If you use a device for multiple purposes (e.g. normal user machine, but used as a Kiosk in trade shows), or need to make changes to your kiosk configuration, you will eventually want to sign out of the Assigned Access account. To do that you will have to have a physical keyboard attached to the device and press the Windows Logo key 5 times in a short period of time either on your physical keyboard (the touch keyboard won’t work) or in the Windows hardware button, if your device has one. Remember, the physical Windows button on the device will not work, to sign out of an Assigned Access account you really need a physical keyboard.

As most kiosk machines are now touchscreen or use a specifically designed keyboard, users will not have a keyboard with the Windows button available to them, and admins have this simple solution for signing out and making changes to the Assigned Access machine and its applications.

I can imagine many scenarios for Assigned Access, but I’m really looking forward to your comments on how you are going to use it!

If you haven’t seen the variety of form factors that you can leverage, follow this link:


UPDATE 12-4-13: Due to an incorrect statement regarding Internet Explorer not being available in Assigned Access, and the Windows hardware button not being able to sign out of the Assigned Access account. Thank you Vadim Sterkin for testing and reporting back these inconsistencies 


Joao “Loves Comments” Botto

11-25-13 Spanish version of this post -MarkMoro