Allow only certain Marketplace apps for your organization

As an administrator, you can control which Google Workspace Marketplace apps are available to users in your company or school. You can make an app available to everyone or only to users in a particular department or team. There’s two ways to make an app available: you can add it to your allowlist so users can install it, or you can install the app for users. This page describes how to manage your allowlist. To learn how to install an app for users, go to Install Marketplace apps for your organization.

On this page

• How the allowlist works
• Add an app to the allowlist or blocklist
• Change who the app is allowed or blocked for
• Remove an app from the allowlist or blocklist

How the allowlist works

• The allowlist affects users who have the Manage access to apps setting set to Allow users to install and run allowlisted apps from the Marketplace. The allowlist has no impact on users who are allowed to install and run any app, or on users who aren’t allowed to install and run apps. For more information, see Set whether users can install Marketplace apps.
• When you allow an app for your entire organization, everyone can install and run the app. You can prevent users in certain organizational units from using the app by adding the app to the blocklist for those entities.
• When you allow an app for certain organizational units or groups, the app is automatically blocked for all other users. You don’t have to separately add it to the blocklist. A group’s allowlist takes precedence over an organizational unit’s blocklist.
• When you block an app for your entire organization, that’s the equivalent of not adding it to the allowlist.
• When you block an app for certain organizational units, it has no effect unless the app has also been allowed for a parent organizational unit.
• The blocklist doesn’t prevent users from installing apps from outside the Marketplace. If you need more data access control, you can block all third-party API access. For details, go to Control which third-party & internal apps access Google Workspace data.

Add an app to the allowlist or blocklist

Before you begin: To make an app available only to some users, first put their user accounts in an organizational unit or in an access group. Then you can allow the app only for those organizational units and groups.

1. Sign in to your Google Admin console.

   Sign in using your administrator account (does not end in @gmail.com).

2. In the Admin console, go to Menu  AppsGoogle Workspace Marketplace appsApps list.
3. Click Allowlist app.
4. Search for the app. To review an app and ensure it’s the one you want to allow or block, click its name to open the app listing. If you can’t find the app, it may be available only for administrators to install and can’t be allowlisted.
5. Next to the app, click Select.
6. Select whether to allow or block the app and click Continue.
7. Select who this setting applies to. For the blocklist, you can only select organizational units. Note:
   1. If you allow the app for a child organizational unit or group, the app is blocked for all other users.
   2. If you add an app to the blocklist, users can still access it if they’re allowed to install all apps or if you don’t add it to an allowlist, too.
   3. Allowlisted apps can still be blocked by API controls.
8. Click Finish.

Users can find allowlisted apps in Marketplace in the Approved for you category.

Change who the app is allowed or blocked for

1. Sign in to your Google Admin console.

   Sign in using your administrator account (does not end in @gmail.com).

2. In the Admin console, go to Menu  AppsGoogle Workspace Marketplace appsApps list.
3. Find the app int he Allowed Apps or Blocked Apps tab and click it.
4. In the Allowlist Access card, click View organizational units and groups. The Allowlist Setting shows the setting for the top organizational unit.
5. At the left, find the organizational unit or group you want to change the setting for and click it.
6. Select whether the app is allowed (On) or blocked (Off) and click Save or Override.

Remove an app from the allowlist or blocklist

Note:

• Your users lose access to an app when you remove it from the allowlist, even if they still have it installed. Add-ons no longer show up in the companion bar.
• When you remove the Chat app from the allowlist, your users can no longer use the app in Google Chat.

To remove an app:

1. Sign in to your Google Admin console.

   Sign in using your administrator account (does not end in @gmail.com).

2. In the Admin console, go to Menu  AppsGoogle Workspace Marketplace appsApps list.
3. Find the app int he Allowed Apps or Blocked Apps tab and click it.
4. At the left, click Remove app from allowlist.
5. Review the warning box and click Remove app from allowlist.