Hi Thomas,
No sure if this is the case, but if you go to Groups & Settings > All Settings > Devices & Users > General > Shared Device, do you have 'Require Shared Device Passcode' and 'Enable Single App Mode' on?
I had issues with these being on in the past because I also had payload profiles determining the single app mode and pass code, so they fought against each other. I was told best practice was to use payload profiles, but not sure if that's really true or not.