Broad cross-platform device management with class-leading kiosk and rugged-device support for frontline deployments.
| Concept | What it is | Notes |
|---|---|---|
| Policy | Hexnode's central object — a bundle of settings (restrictions, Wi-Fi, apps, kiosk config) associated to devices, groups, or users. | One policy can carry many payloads across platforms, which keeps the console simpler than per-payload profiles. |
| Device Groups | Static or dynamic groups; dynamic membership is criteria-based. | Scope policies to dynamic groups so devices self-manage as they change state. |
| Enrollment methods | ADE (Apple), Zero-Touch and Android Enterprise, Autopilot-adjacent Windows enrollment, plus QR, email, and self-enrollment. | The breadth of enrollment options is a real strength for mixed and BYOD environments. |
| Kiosk mode | Lock a device to one app or a curated set, with a custom launcher and branding. | The standout feature — see the Kiosk tab. |
| Remote view / control | See and, on supported platforms, control an enrolled device's screen for support. | Capabilities vary by OS — Android is fullest, iOS is view-only by platform restriction. |
| Geofencing | Apply or revoke policies based on device location. | Useful for site-bound hardware; consider privacy and local law before enabling on personal devices. |
| Hexnode Do | Scripted actions and workflows executed on devices. | The automation layer for anything policies don't express directly. |
Choose single-app or multi-app kiosk
Single-app locks to one application with no way out — right for signage and dedicated scanners. Multi-app presents a curated launcher with several approved apps — right for shared staff tablets.
Enroll as a fully managed device, not a work profile
Kiosk requires device-owner mode on Android and supervision on iOS. That means enrolling from a factory-reset state — you cannot convert an in-use personal device into a kiosk.
Lock down the hardware escape routes
Disable the status bar, home and recents buttons, safe mode, factory reset, USB debugging, and power-off where the platform allows. A kiosk that can be exited by holding a button isn't a kiosk.
Set an admin exit path — deliberately
Configure a PIN-protected exit gesture so staff can service the device. Document the PIN somewhere your team can actually find it; a locked kiosk with a forgotten exit code means a factory reset and re-enrollment.
Handle power and connectivity
Keep the screen awake while charging, auto-launch the kiosk app on boot, and auto-reconnect Wi-Fi. Most kiosk failures in the field are a device that rebooted and didn't come back into the app.
Plan remote recovery before deployment
A kiosk in a warehouse is expensive to visit. Ensure remote view/control works, that the device checks in frequently enough to receive commands, and that you can push an app update without a site trip.
- Your fleet is genuinely mixed and you want one console rather than three.
- You have kiosk, signage, rugged, or shared frontline devices — this is its strongest ground.
- You need broad enrollment options including BYOD work profiles and QR-based bulk onboarding.
- Retail, logistics, healthcare, hospitality, and education field deployments.
- Budget matters and per-platform specialists would mean multiple subscriptions.
- You're Apple-heavy and need deep macOS management — Jamf or Mosyle.
- You need Entra ID Conditional Access as the enforcement layer — Intune.
- You want RMM-style patching and monitoring of servers and workstations — NinjaOne.
- Verify support-tier expectations during evaluation; experiences vary noticeably by plan.
Gotchas
- Device Owner (fully managed) mode can only be established on a factory-reset device. There is no upgrade path from a Work Profile.
- Choose the mode before deployment: Work Profile for BYOD, Fully Managed for corporate hardware, Dedicated for kiosk.
- Getting this wrong means wiping and re-enrolling every affected device — plan it properly the first time.
- APNs certificate expires annually; renew with the same Apple ID or re-enroll all Apple devices.
- ABM/ADE and VPP tokens expire yearly too.
- Universal across MDMs — breadth of platform support doesn't change Apple's rules.
- Because a single policy carries many payloads and devices can match several policies, contradictory settings happen.
- Establish a convention: one baseline policy for everything, then narrow additive policies — rather than several broad overlapping ones.
- When a setting doesn't apply as expected, check which other policies target the same device before assuming a product bug.
- Tracking employee device location has real obligations under GDPR and similar regimes, and often under employment law.
- Restrict location features to genuinely corporate-owned devices, disclose it clearly, and document the justification.
- Never enable location tracking on a BYOD work profile — you'd be tracking a personal device.