Frontline shared devices are the familiar setup where one device gets passed from team to team across shifts. Nobody stays signed in, yet everyone needs quick, secure access to Microsoft 365 apps like Teams, Outlook or Edge. In many of the environments I work in, this scenario is back on the priority list, mostly because Microsoft 365 Copilot and more sensitive data are now landing on these devices. That makes the details count: how devices are enrolled, how Conditional Access is scoped, and which apps can actually handle shared sign-in safely. iOS now has official support (up to a point), so things are finally starting to move.
Android Enterprise dedicated devices pair Intune with Entra Shared Device Mode
Android has been the go-to platform for shared frontline devices for years. Enrolling a device in Intune as an "Android Enterprise dedicated device" is simple enough (step-by-step guide). The harder part is letting shift workers sign in and out while apps like Teams or Outlook switch user context reliably. That's the job of Microsoft Entra Shared Device Mode. The device remains enrolled with a generic device account, and supported apps let users sign in at the start of a shift, do their work and sign out again. When they do, all tokens, data and sessions are wiped.
At the heart of this setup sits the Managed Home Screen (MHS). Intune deploys it as the launcher (kiosk mode), and you control it further through app configuration policies (see this overview). Users usually sign in with a QR code or PIN, with Entra ID Single Sign-On doing the work in the background. Teams, the Microsoft 365 Copilot app and Outlook all respect global sign-out. Once a user signs out through MHS, every supported app clears its session, so accounts don't get left behind.
{
"profileType": "kiosk",
"enrollmentType": "dedicatedDevice",
"sharedDeviceMode": true,
"launcher": "ManagedHomeScreen"
}
Example device profile for an Intune dedicated Android shared device
Practical tip: Review device compliance regularly and remove stale devices in Intune. If you skip this, your compliance reports and Conditional Access rules turn into a mess quickly. See also Intune device cleanup: Compliance & settings.
iOS shared device mode is improving but still uneven in practice
For a long time, shared iPads in frontline work caused nothing but trouble. That is slowly changing. The Microsoft Enterprise SSO plug-in for iOS can now turn on Entra Shared Device Mode for Apple devices. As of late 2025, though, real-world support and feature parity with Android are still catching up (check the current state at https://learn.microsoft.com/en-us/entra/identity-platform/msal-shared-devices).
In the pilots I've been part of, Entra Shared Device Mode on iOS works for supported Microsoft apps such as Teams and Outlook, provided the device is enrolled in Intune through User Enrollment or Automated Device Enrollment (ADE). Global logout removes user tokens across the supported apps. Most third-party business apps, however, aren't ready for shared device mode in production. If you run shared iPads, test carefully whether your specific app set really supports this workflow.
Conditional Access and licensing need careful planning
Conditional Access trips people up regularly with frontline shared devices. Your policies have to consider device compliance (the device is managed by Intune and compliant) as well as user context (who is signed in right now). Mixing device-based and user-based conditions can easily block sign-ins or open gaps in your access controls if you haven't tested properly. I always set up a pilot group with dedicated shared devices and frontline user accounts before rolling policies out across the tenant. With Microsoft 365 Copilot or Teams Premium in particular, data access has to be tied to the right user, location and time window.
For licensing, Microsoft 365 F1 or F3 user licenses are usually enough. Keep in mind, though, that F1 doesn't include every feature (Copilot, for example). Shared Device Mode functionality depends on the user's license, not on the device. Some advanced features, such as more granular app assignments in Managed Home Screen, may need Intune Suite or E5 add-ons.
Managed Home Screen controls PINs, session timeouts and sign-out hygiene
One oversight I run into often is session duration and hygiene when users switch. You configure PIN length, auto-logout and session timeouts through app configuration for Managed Home Screen in Intune. A short inactivity timeout of 5–10 minutes makes a sensible default, so nobody ends up working under a colleague's account by accident. Choose a PIN complexity that suits your environment. For a better experience and stronger security, use automatic sign-out at the end of a shift or after a period of inactivity. Also keep watching device compliance and stale device cleanup, especially if old Android device admin enrollments are still around – see my guide on Android device admin and compliance hygiene.
The real-world flow on the device depends on a solid operating concept
Frontline shared devices aren't only a technical topic. Without a clear operating concept and a proper test phase, the combination of Intune, Managed Home Screen, Entra Shared Device Mode and Conditional Access gets messy quickly. My honest advice is to hold off on iOS shared mode for genuine multi-user shifts until you've confirmed that all your apps behave as expected. For now, Android stays ahead because of its tight Intune integration and wide app support. And if device compliance and cleanup slip, your environment will become chaotic fast.
The diagram below shows how Intune, Entra Shared Device Mode and Managed Home Screen work together on Android shared devices:
flowchart TD
Enrollment["Intune enrollment"] --> Device["Android dedicated device"]
Device --> MHS["Managed Home Screen"]
MHS --> UserSignIn["User sign-in"]
UserSignIn --> Apps["Microsoft 365 apps (shared device mode)"]
Apps --> GlobalSignOut["Global sign-out"]
GlobalSignOut --> MHS
Figure: How Intune enrollment, Managed Home Screen and Shared Device Mode interact on Android.
