How to configure assigned access for a user account in Windows

Create a standard local user account without a Microsoft account. 2. Choose a UWP app supported for kiosk mode. 3. Assign the app to the user via Settings under Family & other users. 4. Test the setup to ensure only the designated app runs and system access is restricted, with troubleshooting applied if necessary.

Configuring Assigned Access in Windows allows you to restrict a user account to run only one specific app—ideal for kiosks, shared devices, or dedicated-purpose computers. This feature is available in Windows 10/11 Pro, Enterprise, and Education editions. Here’s how to set it up properly.

✅ Step 1: Create a Standard Local User Account

Assigned Access must be set on a standard local user account, not an administrator or Microsoft account.

1. Open Settings → Accounts → Family & other users.
2. Under Other users, click Add account.
3. Choose I don’t have this person’s sign-in information.
4. Select Add a user without a Microsoft account.
5. Enter a username (e.g., KioskUser) and password (optional, but recommended for security).
6. Click Next. The account will be created as a standard user.

? Tip: Avoid using Microsoft accounts for kiosk users, as they may trigger unwanted sync or update prompts.

✅ Step 2: Choose the App for Assigned Access

The app must be a Universal Windows Platform (UWP) app installed on the system. Common examples:

• Microsoft Edge
• Calculator
• A custom kiosk app from the Microsoft Store

Desktop apps (like Chrome, Firefox, or traditional .exe programs) are not supported unless wrapped as a UWP app via tools like the Microsoft Intune App Wrapping Tool (enterprise only).

To check if an app is UWP:

• Open Settings → Apps → Apps & features
• Look for apps labeled as “Windows” under the “Publisher” column.

✅ Step 3: Configure Assigned Access via Settings

1. Go to Settings → Accounts → Family & other users.
2. Under Set up assigned access, click Set up assigned access.
3. Select the user account you created (e.g., KioskUser).
4. Choose the UWP app you want to restrict them to (e.g., Microsoft Edge).
5. Click OK.

Now, when that user logs in, only the selected app will run. They won’t be able to access the desktop, taskbar, or other apps.

✅ Step 4: Test and Lock Down the Experience

• Log in as the assigned access user to verify:
  • Only the allowed app opens.
  • Keyboard shortcuts like Alt Tab, Win L, or Ctrl Shift Esc are restricted.
  • The user cannot exit the app to reach the desktop.

⚠️ Note: Some shortcuts may still work during app startup. Consider disabling unnecessary keys via Group Policy in enterprise environments.

Optional: Use PowerShell (Advanced)

You can also configure Assigned Access using PowerShell:

Add-AppxPackage -Path "C:\Path\To\App.appx"  # if installing a custom app

To set assigned access via registry (used by system):

# This sets the app using the App User Model ID (AUMID)
# First, find the AUMID of the app:
Get-StartApps

# Example output: Microsoft.MicrosoftEdge_8wekyb3d8bbwe!MicrosoftEdge
# Then run:
Set-AssignedAccess -UserName KioskUser -AppUserModelId "Microsoft.MicrosoftEdge_8wekyb3d8bbwe!MicrosoftEdge"

? Note: Set-AssignedAccess requires the AssignedAccess PowerShell module, available in Windows 10 1803 .

Troubleshooting Tips

• Assigned Access option grayed out?
  Ensure you're on Windows Pro/Enterprise and using a local standard user.

• App doesn’t launch in kiosk mode?
  Confirm it’s a UWP app and the AUMID is correct.

• User can still access desktop?
  Make sure no other accounts are auto-logging in and that Assigned Access is correctly applied.

Basically, just create a local user, pick a UWP app, and assign it through Settings or PowerShell. It’s not hard, but easy to miss a detail like account type or app compatibility.

The above is the detailed content of How to configure assigned access for a user account in Windows. For more information, please follow other related articles on the PHP Chinese website!