Manage Marketplace apps on your allowlist

You can choose which third-party and internal apps users can install from the Google Workspace Marketplace. The default setting is to allow users to install any app available in the Marketplace. However, the default setting for apps for Google Workspace for Education accounts is Block all.

To allow users to install some apps published through Marketplace but not others, you can add specific apps to an allowlist. Your users can then install only the apps you add to this list.

Before you begin

• The Marketplace settings don’t control third-party ability to access data managed via API controls. For an additional and more powerful control, use the third-party app access in API controls.
• Even if you restrict certain apps, your users might still be able to install a third-party app outside of the Marketplace. If you want to block an app entirely, you can block all third-party API access in the Google Admin console.

  For details, go to Control which third-party & internal apps access Google Workspace data.

Step 1: Set the organizational structure

Skip this step if you want to make an app available to everyone in your organization.

To make an app available only to some users, first put their user accounts in an organizational unit or in an access group. Then, you can distribute the app only to those teams. For steps, visit:

• Apply policies to different users
• Use groups to customize service access

Step 2: Turn user access to Marketplace apps on or off

Important: If you move to a setting that’s more restrictive, your users might lose access to apps that they previously installed.

1. Sign in to your Google Admin console.

   Sign in using your administrator account (does not end in @gmail.com).

2. In the Admin console, go to Menu  AppsGoogle Workspace Marketplace appsApps list.
3. On the left, click Settings and select an option:
   • Allow users to install and run any app from the Marketplace—Users can install and run Marketplace apps.

     Note: Users will not be able to install Classroom add-ons unless the add-on is explicitly installed or allowlisted by the administrator. If a Classroom add-on was previously installed prior to July 2022 and not allowlisted, it will continue to run.

   • Allow users to install and run only selected apps from the Marketplace—Blocks users from installing and running apps that aren’t on your allowlist.
     For details, see Add apps to your allowlist (below on this page).
   • Don’t allow users to install and run apps from the Marketplace—Blocks users from installing and running any apps from the Marketplace. Users can still see apps listed in the Marketplace but can't install them.
4. Click Save. Changes can take up to 24 hours but typically happen more quickly. Learn more

Step 3: Add apps to your allowlist

Your allowlist only shows apps that are available to users who are not administrators. If you can't find an app to allowlist, it's possible the app is set up only for admins to install. Contact the app developer and ask them to turn on individual installations for the app.

As well as creating allowlists, you can distribute apps to your users. For more information, go to make a Marketplace app available to users.

1. Sign in to your Google Admin console.

   Sign in using your administrator account (does not end in @gmail.com).

2. In the Admin console, go to Menu  AppsGoogle Workspace Marketplace appsApps list.
3. Click Allowlist app.
4. Enter the name of the app or search for it on the Marketplace.
5. Click Select.
6. Make sure Allow users to install this app is selected.
7. Click Continue.
8. (Optional) To allowlist the app for an organizational unit or group:
   1. Select Specific groups or organizational units.
   2. (Optional) To select a group, click Select groupsthe groupSave.
   3. (Optional) To select an organizational unit, click Select organizational unitsthe organizational unit Save.
   4. To add other groups or organizational units, repeat the steps.
9. Click Finish.

Change app access settings for an organizational unit

1. Sign in to your Google Admin console.

   Sign in using your administrator account (does not end in @gmail.com).

2. In the Admin console, go to Menu  AppsGoogle Workspace Marketplace appsApps list.
3. Click the app.
4. At User access or Allowlist access, click View organizational units and groups.
5. Click the organizational unit.
   • If the Allowlist setting is set to Inherited (the access is the same as the parent organizational unit), click Override.
   • If the Allowlist setting is set to Overridden (the access is different to the parent organizational unit), click Inherit.

Change app access settings for groups

1. Sign in to your Google Admin console.

   Sign in using your administrator account (does not end in @gmail.com).

2. In the Admin console, go to Menu  AppsGoogle Workspace Marketplace appsApps list.
3. Click the appView organizational units and groups.
4. Click the group.
5. Check or uncheck the On or Off boxSave.

Remove apps from the allowlist

Your users might lose access to apps when you remove an app from the allowlist, even though the user still has the app installed.

1. Sign in to your Google Admin console.

   Sign in using your administrator account (does not end in @gmail.com).

2. In the Admin console, go to Menu  AppsGoogle Workspace Marketplace appsApps list.
3. Click Allowlisted appsthe app.
4. Click Remove app from allowlistRemove app from allowlist.

Removing add-ons and Chat apps

• When you remove an add-on from the allowlist, the add-on is still installed but does not show up in the companion bar for any users who previously installed it.
• When you remove the Chat app from the allowlist, your users can no longer use the app in Google Chat.