Should I Build a Visitor Sign-In Kiosk with Microsoft 365?

Whichever app you choose, lock down the tablet with a kiosk or mobile-device-management configuration so visitors can’t leave the sign-in screen or access settings. Pairing that with SharePoint and Power Automate is practical, but make sure the device can recover cleanly after a crash or network outage and that reception staff can override or correct entries when necessary.

Power Apps is a better fit than Forms if you need sign-out, current on-site status, role-based staff views, and state changes. SharePoint can work well as the record store, but I would not treat it as the workflow engine. Design for offline tablets, delayed or failed flows, deleted or renamed hosts, duplicate visitors, and emergency access to the fire register. Also test retention, permissions, auditability, and what happens if Teams or Power Automate is temporarily unavailable.

Before building and maintaining all of that, compare the cost of a dedicated visitor-management product. Some inexpensive services already cover sign-in, notifications, visitor tracking, mobile and tablet support, and reporting. We eventually moved away from a custom Power Apps solution because having someone else handle updates and support was worth it.

Think carefully about the visitor experience. Don’t require every visitor to select a host from a rigid list or assume they were pre-registered. Contractors and people several subcontracting layers away may not appear in your directory, and forcing them through an inflexible workflow can create delays and inaccurate notifications. Include a receptionist or “I’m not listed” path, with a way to handle the visit manually.

A custom system can work, especially if your requirements are unusual. One implementation used a public visitor page plus a restricted staff area with Entra ID authentication and role-based access. Hosts created normal Outlook meetings, and the system used a shared mailbox to identify external visitors, collect their details, and store signed GDPR and security acknowledgements. The mailbox had a one-year retention policy. It also included an option for reception staff to create ad hoc visits and view scheduled meetings. I would avoid relying on generated code for anything genuinely business-critical, but this can be a useful small internal project if you have clear ownership and support plans.