As an administrator, you can control which Google Workspace Marketplace apps are available to users in your company or school. You can make an app available to everyone or only to users in a particular department or team. There's two ways to make an app available: you can add it to your allowlist so users can install it, or you can install the app for users. This page describes how to manage your allowlist. To learn how to install an app for users, go to Install Marketplace apps for your organization.
- How the allowlist works
- Add an app to the allowlist or excludelist
- Change who the app is allowed or excluded for
- Remove an app from the allowlist or excludelist
How the allowlist works
- The allowlist affects users who have the Manage access to apps setting set to Allow users to install and run allowlisted apps from the Marketplace. The allowlist has no impact on users who are allowed to install and run any app, or on users who aren't allowed to install and run apps. For more information, see Set whether users can install Marketplace apps.
- When you allow an app for your entire organization, everyone can install and run the app. You can prevent users in certain organizational units from using the app by adding the app to the excludelist for those entities.
- When you allow an app for certain organizational units or groups, the app is automatically excluded for all other users. You don't have to separately add it to the excludelist. A group’s allowlist takes precedence over an organizational unit's excludelist.
- When you exclude an app for your entire organization, that’s the equivalent of not adding it to the allowlist.
- When you exclude an app for certain organizational units, it has no effect unless the app has also been allowed for a parent organizational unit.
- The excludelist doesn't prevent users from installing apps from outside the Marketplace. If you need more data access control, you can exclude all third-party API access. For details, go to Control which third-party & internal apps access Google Workspace data.
Add an app to the allowlist or excludelist
Before you begin: To make an app available only to some users, first put their user accounts in an organizational unit or in an access group. Then you can allow the app only for those organizational units and groups.
-
Sign in with an administrator account to the Google Admin console.
If you aren’t using an administrator account, you can’t access the Admin console.
-
Go to Menu
Apps > Google Workspace Marketplace apps > Apps list.
Requires having the Service Settings administrator privilege.
- Click Allowlist app.
- Search for the app. To review an app and ensure it's the one you want to allow or exclude, click its name to open the app listing. If you can't find the app, it may be available only for administrators to install and can’t be allowlisted.
- Next to the app, click Select.
- Select whether to allow or exclude the app and click Continue.
- Select who this setting applies to. For the excludelist, you can only select organizational units. Note:
- If you allow the app for a child organizational unit or group, the app is excluded for all other users.
- If you add an app to the excludelist, users can still access it if they're allowed to install all apps or if you don't add it to an allowlist, too.
- Allowlisted apps can still be excluded by API controls.
- Click Finish.
Users can find allowlisted apps in the Marketplace in the Approved for you category.
Change who the app is allowed or excluded for
-
Sign in with an administrator account to the Google Admin console.
If you aren’t using an administrator account, you can’t access the Admin console.
-
Go to Menu
Requires having the Service Settings administrator privilege.
- Find the app in the Allowlisted Apps or Excluded Apps tab and click it.
- In the Allowlist Access card, click View organizational units and groups. The Allowlist Setting shows the setting for the top organizational unit.
- At the left, find the organizational unit or group you want to change the setting for and click it.
- Select whether the app is allowed (On) or blocked (Off) and click Save or Override.
Remove an app from the allowlist or excludelist
Note:
- Your users lose access to an app when you remove it from the allowlist, even if they still have it installed. Add-ons no longer show up in the side panel.
- When you remove the Chat app from the allowlist, your users can no longer use the app in Google Chat.
To remove an app:
-
Sign in with an administrator account to the Google Admin console.
If you aren’t using an administrator account, you can’t access the Admin console.
-
Go to Menu
Requires having the Service Settings administrator privilege.
- Find the app in the Allowlisted Apps or Excluded Apps tab and click it.
- At the left, click Remove app from allowlist.
- Review the warning box and click Remove app from all allowlists.
