Microsoft Kiosk Licensing Complete Guide: F1, Kiosk SKU, and Shared Device Mode

Kiosk device licensing is one of the most frequently misunderstood areas of Microsoft frontline licensing. Organisations deploy kiosk stations in warehouses, retail floors, hospitals, and manufacturing lines — and then assign E3 licences ($36/user/month) to those devices out of habit. The correct licence for most kiosk deployments is M365 F1 at $2.25/user/month. For a 500-device kiosk estate, that is a $202,500/year difference. This guide gives you the complete architecture — licence options, deployment models, Windows kiosk configuration, Teams Shared Device Mode, and the EA negotiation approach.

Kiosk Licence Options: The Decision Matrix

M365 F1: The Default Correct Answer for Most Kiosk Deployments

M365 F1 at $2.25/user/month is the minimum viable licence for kiosk deployments that require Teams. It includes: full Microsoft Teams (meetings, chat, channels, Walkie Talkie, Shifts, Approvals), Exchange Online (2GB mailbox), SharePoint (read and contribute), OneDrive (2GB), basic Intune, and Azure AD P1 for conditional access. For the typical kiosk use case — a worker signing into Teams to receive shift communications, check their schedule, and participate in team channels — F1 is architecturally complete.

The 2GB mailbox is sufficient for most kiosk workers who receive infrequent email. The limited OneDrive storage is not a constraint for workers who do not sync personal files. The absence of desktop Office app installation rights is irrelevant for a kiosk that runs Teams in a browser or via the Teams app.

Teams Kiosk Mode: Single-Account vs Shared Device Mode

There are two distinct kiosk deployment models for Teams, with different licensing implications:

Model 1: Single-Account Kiosk (Always Signed In)

The simplest kiosk model: the device is always signed into a single dedicated user account (e.g., [email protected]). Every worker who uses that station uses the same account. They access Teams channels and announcements, check the Shifts schedule for the team, and use Walkie Talkie under that shared identity.

Licensing requirement: One F1 licence assigned to the kiosk account. Individual workers do not need separate licences to use the device — they are using the device's account, not their own. This is the most cost-efficient model for high-density kiosk deployments.

Limitation: No individual accountability. All Teams activity — chat messages, Shifts actions, form submissions — appears under the kiosk account identity, not a named worker. For environments requiring individual accountability (safety-critical industries, environments with worker performance monitoring), this model is inappropriate.

Model 2: Teams Shared Device Mode (Per-Worker Sign-In)

Teams Shared Device Mode enables multiple workers to sign in and out of the same physical device under their own identities. When a worker signs in, they see their personal Teams experience — their channels, their Shifts schedule, their chat history. When they sign out (or their session auto-expires), Teams clears their data completely, leaving the device clean for the next worker.

Technical requirements for Shared Device Mode: the device must be enrolled in Intune and configured as a Shared Device via an Intune device configuration profile. Azure AD Shared Device mode must be enabled on the device. Teams is configured with the "Shared Device" flag, which restricts certain features (no personal calls, no voicemail) and enables auto-sign-out after inactivity.

Licensing requirement: Each worker who uses the device under their own identity needs an F1 licence. If 40 workers share 5 kiosk stations across two shifts, you need 40 F1 licences (one per worker) and 5 physical devices. The device:user ratio drives the licence count — not the device count.

Teams Shared Devices Licence vs F1: When to Use Each

The Teams Shared Devices licence ($2.50/device/month) is a device-licence model designed specifically for common area phones, panels, and terminals that run Teams in common area mode — not tied to a named user. It is not appropriate for shared devices where individual workers sign in with their own identity under Shared Device Mode. The distinction is architectural:

For more detail on the Teams Shared Devices licence, see our Teams Shared Devices licensing guide.

Windows Kiosk Mode Licensing: The OS Layer

Microsoft 365 F1 does not include Windows Enterprise upgrade rights. This matters for kiosk deployments that need advanced Windows kiosk configuration features available only in Windows Enterprise:

Features requiring Windows Enterprise: Multi-app kiosk mode (presenting multiple apps in a restricted shell), Shell Launcher (replacing the Windows desktop with a custom shell application), Unified Write Filter (UWF — prevents disk writes so kiosk reverts to clean state after restart), Keyboard Filter (blocking specific key combinations like Ctrl+Alt+Del), and Assigned Access Configuration Service for enterprise kiosk policies.

Features available in Windows Pro: Single-app kiosk mode (assigned access for one UWP app), basic browser kiosk via Microsoft Edge kiosk mode, Intune enrollment for kiosk configuration. For a basic Teams kiosk or browser-based application kiosk, Windows Pro is sufficient.

If your kiosk deployment requires Windows Enterprise-level features (especially UWF for kiosks in high-churn environments, or Shell Launcher for custom enterprise UIs), you need either M365 E3 (which includes Windows Enterprise upgrade rights) or a standalone Windows Enterprise licence in addition to M365 F1. The standalone Windows VDA licence ($6-$8/device/month) may be cost-effective compared to upgrading 500 kiosk accounts from F1 ($2.25) to E3 ($36) purely for the Windows Enterprise right.

Kiosk Deployment Architecture: Retail Example

A national retailer with 200 stores, each running 3 kiosk terminals used by 10-15 shift workers:

If this same retailer had assigned E3 to the 2,000 kiosk workers (a common default): 2,000 × $36 × 12 = $864,000/year. The F1 optimisation saves $810,000/year — against approximately $100,000/year for any required Intune or device management overhead. Net saving: $700,000+/year.

EA Negotiation for Kiosk Licences

F1 licence volumes for kiosk deployments follow the same EA discount structure as all F-SKU volumes. At 2,000+ F1 seats, expect 10-15% off list ($2.25 → $1.90-$2.00). At 5,000+ seats, 15-20% discounts are achievable. Present the kiosk deployment architecture clearly — Microsoft's EA team will verify that the F1 use rights are appropriate for the kiosk worker population.

True-up mechanics for kiosk licences deserve special attention in seasonal businesses. Retail operations with 30% higher headcount in Q4, or agricultural processing facilities with seasonal worker surges, should negotiate a true-up basis that reflects annual average active users rather than peak count. The difference for a retailer hiring 500 seasonal associates in Q4 can be $27,000 in avoided true-up charges at F1 rates.

For the complete frontline licensing architecture, see our Frontline Worker licensing pillar guide. For shared device deployment details, see our shared device licensing strategy guide. For F1/F3 comparison, see our F1 vs F3 decision guide.

Frequently Asked Questions

What licence does a Microsoft Teams kiosk device need?

A Teams kiosk device needs an M365 F1 licence ($2.25/user/month in EA) assigned to the account that signs into it. In single-account kiosk mode (always signed in as one dedicated account), one F1 licence covers the device. In Teams Shared Device Mode (multiple workers sign in under their own accounts), each worker needs their own F1 licence.

Is there a dedicated Microsoft Kiosk SKU?

Microsoft offers a standalone Microsoft 365 Kiosk plan (~$2/user/month) that provides Exchange Online, SharePoint read access, and basic Yammer — but does NOT include Microsoft Teams. For modern frontline kiosk deployments where Teams is the primary communication tool, M365 F1 at $2.25 is the correct choice. The Kiosk SKU is only appropriate for legacy email-and-intranet-only kiosk scenarios.

How does Teams Shared Device Mode work for kiosk users?

Teams Shared Device Mode allows multiple workers to use the same device under their own individual identities. Each worker signs in, accesses their personal Teams experience, and when they sign out (or the inactivity timeout triggers), Teams clears all personal data. Each worker needs their own F1 licence. The device is enrolled in Intune with a Shared Device configuration profile enabling the auto-sign-out behaviour.

Does a kiosk device need Windows Enterprise licensing?

For basic kiosk scenarios (single-app kiosk via Assigned Access, Teams kiosk in a browser), Windows Pro is sufficient. Windows Enterprise (not included in F1) is needed for multi-app kiosk mode, Shell Launcher, Unified Write Filter, and Keyboard Filter. If these advanced kiosk OS features are required, evaluate E3 (includes Windows Enterprise upgrade) or a standalone Windows VDA licence in addition to F1.

Can a kiosk device use Microsoft 365 without a per-user licence?

No. Microsoft licensing requires a per-user licence for every person using M365 services. There is no device-only licence for the M365 suite (Teams Rooms and Teams Shared Devices licences are device-based but limited to specific Teams device scenarios). Organisations using a single shared account for all kiosk workers without individual licences are in violation of the per-user licence requirement.