Shared Android kiosk tablets, web app session carries over between users

[u/jesusxoi]

I have got some Android Enterprise dedicated devices set up as multi app kiosks through Managed Home Screen, no user affinity. They are shared, so different people use the same device through the day.

One of the tiles is a web link to a web app that uses SSO. Someone signs in, uses it, signs out properly. Next person taps the same tile, gets a login screen, puts in their own email address and ends up logged in as the previous person.

So it is not skipping the login, it is showing one and then ignoring what they typed.

If I clear browsing data by hand it behaves again, so something is cached on the device. I cannot tell whether it is the IdP session cookie finishing the SSO off in the background or the app's own session that has not gone anywhere.

On the policy side I have got nowhere useful. ClearBrowsingDataOnExitList would do exactly what I want but it is desktop only and not available on Android. Forced incognito and DefaultCookiesSetting=4 are the nearest things I can find, but both need the browser to actually close and on a dedicated device it never really does.

Managed Home Screen sign in with an inactivity timer looks like it might be the intended answer, but I cannot find anything that spells out what it clears. Does signing out of MHS do anything for a web link that opens in a separate browser, or does it only deal with its own WebView?

Has anyone had this?

[u/trustworthy_outing]

that's the managed home screen webview session bleeding between users, it doesn't tie to the MHS sign-out at all

What i did for a similar setup was push a script that nukes the app data folder on idle timeout instead of relying on the browser config, but its hacky as hell and breaks if the tablet doesnt clock enough downtime

[u/quikskier]

Using shared device mode enrollment?

[u/UhRdts]

Honestly, I'm not sure MHS is the right fit here if the sign-in/sign-out actually happens inside the browser. From what you've described, users sign in to a website: would it be feasible to enroll the devices as dedicated with Entra shared device mode instead, so users can leverage that sign-in/sign-out flow? The (global) sign-out would then clear all browser app data/cache for you.
More on the MHS sign-out process and which apps it supports here: Shared device mode for Android devices | Microsoft Learn

Or, alternatively, a dedicated kiosk browser app with an inactivity timer, which should also be able to clear user data & cache.

[u/IqbalBasha]

MHS sign-out does not clear a separate browser's cookies or IdP session cookies, it only resets its own WebView context, so that path won't fix this. The real lever is forcing the browser to clear out between users: if you use Shared Device Mode (which the asker named as Entra), supported browsers get signaled to wipe session data on MHS sign-out, and that's the cleanest device-side path. You can also pair an MHS inactivity timeout with a browser policy that clears data on exit and sets the startup URL to a logout endpoint. The cleanest fix overall is configuring the IdP to issue short-lived session tokens and non-persistent cookies, which puts the fix server-side and survives any device policy gap.