Manage Marketplace apps on your allowlist

You can choose which third-party and internal apps users can install from the Google Workspace Marketplace. The default setting is to allow users to install any app available in the Marketplace. However, the default setting for apps for Google Workspace for Education accounts is Block all.

To allow users to install some apps published through Marketplace but not others, you can add specific apps to your allowlist. Your users can then install only the apps you add to this list.

Note: The Marketplace settings don’t control third-party ability to access data managed via API controls. For an additional and more powerful control use the third-party app access in API controls.

Before you begin

Even if you restrict certain apps, your users might still have the ability to install a third-party app outside of the Marketplace. If you want to block an app entirely, you can block all third-party API access in the Google Admin console. For details, go to Control which third-party & internal apps access Google Workspace data.

Marketplace apps access

Important: If you move to a setting that’s more restrictive, your users might lose access to apps that they previously installed.

  1. Sign in to your Google Admin console.

    Sign in using your administrator account (does not end in @gmail.com).

  2. In the Admin console, go to Menu""and then"" Appsand thenGoogle Workspace Marketplace appsand thenApps list.
  3. On the left, click Settings and select an option:
    • Allow users to install and run any app from the Marketplace—Users can install and run Marketplace apps.

      Note: Users will not be able to install Classroom add-ons unless the add-on is explicitly installed or allowlisted by the administrator. If a Classroom add-on was previously installed prior to July 2022 and not allowlisted, it will continue to run.

    • Allow users to install and run only selected apps from the Marketplace—Blocks users from installing and running apps that aren’t on your allowlist.
      For details, see Add apps to your allowlist this page.
    • Don’t allow users to install and run apps from the Marketplace—Blocks users from installing and running any apps from the Marketplace. Users can still see apps listed in the Marketplace but can't install them.

      Note: You can set these options for your entire organization or for an organizational unit or group.

  4. Click Save.
    Changes can take up to 24 hours to propagate to all users.

Allowlist apps and select who can use them

When you allowlist an app, you can allow it for your entire organization or choose which organizational units or groups can access it.

Depending on the settings, the details of an app can be:

  • Inherited—The app has the same access setting as the parent organizational unit or domain.
  • Overridden—The app has a different setting from the parent organizational unit or domain.

Alternatively, you can distribute apps to your users. For information on app distribution, go to make a Marketplace app available to users.

Note: Your allowlist only shows apps that are available to users who are not administrators. If you can't find an app to allowlist,  the app might be published as an Admin Only Install app. Contact the app developer about enabling individual installations for the app. For more information, go to installation settings.

Add apps to your allowlist

  1. Sign in to your Google Admin console.

    Sign in using your administrator account (does not end in @gmail.com).

  2. In the Admin console, go to Menu""and then"" Appsand thenGoogle Workspace Marketplace appsand thenApps list.
  3. Click Allowlist app.
  4. Enter the name of the app or search for it on the Marketplace.
  5. Click Select.
  6. By default, Allow users to install this app is selected.

    To block access to the app, select Block users from installing this app.

  7. Click Continue.
  8. Click Specific groups or organizational units.
  9. (Optional) To select a group, click Select groupsand thenthe groupand thenSave.
  10. (Optional) To select an organizational unit, click Select organizational unitsand thenthe organizational unitand then Save.
  11. To add other groups or organizational units, click Add groups or Add organizational units, select the group or organizational unit, and click Save.
  12. To remove a group or an organization unit, beside it, click "".
  13. Click Finish.

Change access settings for an organizational unit

You can change user or allowlist access settings for apps.

  1. Sign in to your Google Admin console.

    Sign in using your administrator account (does not end in @gmail.com).

  2. In the Admin console, go to Menu""and then"" Appsand thenGoogle Workspace Marketplace appsand thenApps list.
  3. Click the app.
  4. At User access or Allowlist access, click View organizational units and groups.
  5. Click the organizational unit you want to change access for.
  6. Choose an option:
    • If the Allowlist setting is set to Inherited (the access is the same as the parent organizational unit), click Override.
    • If the Allowlist setting is set to Overridden (the access is different to the parent organizational unit), click Inherit.

Change access settings for groups

  1. Sign in to your Google Admin console.

    Sign in using your administrator account (does not end in @gmail.com).

  2. In the Admin console, go to Menu""and then"" Appsand thenGoogle Workspace Marketplace appsand thenApps list.
  3. Click the appand thenView organizational units and groups.
  4. Click the group you want to change access for.
  5. Check or uncheck the On or Off box and click Save.

Remove apps from the allowlist

Note: Your users might lose access to apps that they have previously installed that are not in the allowlist and those apps which were removed will not be uninstalled from user’s computers.

  1. Sign in to your Google Admin console.

    Sign in using your administrator account (does not end in @gmail.com).

  2. In the Admin console, go to Menu""and then"" Appsand thenGoogle Workspace Marketplace appsand thenApps list.
  3. Click Allowlisted appsand thenthe app.
  4. Click Remove app from allowlistand thenRemove app from allowlist.

Removing add-ons and Chat apps

  • When you remove an add-on from the allowlist, the add-on is still installed but does not show up in the companion bar for any users who previously installed it.
  • When you remove the Chat app from the allowlist, your users can no longer use the app in Google Chat.
Was this helpful?
How can we improve it?

Need more help?

Sign in for additional support options to quickly solve your issue

Search
Clear search
Close search
Google apps
Main menu
Search Help Center
true
73010
false
false