Manage apps on Android devices

  If you have the legacy free edition of G Suite, upgrade to G Suite Basic to get this feature. 

As an administrator, you can securely manage work apps on Android devices and leave personal apps under the user’s control. You can:

  • Create a whitelist of recommended apps to make them available for users to install.
  • Automatically install preferred work apps.
  • Manage system apps that are preinstalled on company-owned devices.

How whitelisting works

You select apps from Google Play (in the Google Admin console) and add them to a whitelist. Users see a catalog of those apps on their device. 

When a user installs a whitelisted app, it’s managed by your organization. That means if someone leaves your organization, the app is removed when the user’s corporate account is removed from their device. You can also remove managed apps if a device is lost or stolen. Some Google mobile apps are already whitelisted for you, such as Gmail and Google Drive.

Keep work and personal apps separate

If their device supports it, encourage users to set up a work profile to keep work and personal apps separate. Then, they can get managed apps from the managed Google Play store. Once installed, managed apps are marked with Android enterprise Android enterprise so they’re easy to distinguish from personal apps. If a device doesn’t support work profiles, users can get apps from the Play Store (on the Work Apps tab). For details, see Using Google Play in your organization.

Before you begin

To manage apps for mobile device users, you need advanced mobile management. For details, see Set up advanced mobile device management.

Open all   |   Close all

Step 1: Open your Android app whitelist

  1. Sign in to your Google Admin console.

    Sign in using your administrator account (does not end in @gmail.com).

  2. From the Admin console Home page, go to Device management.

    To see Device management, you might have to click More controls at the bottom.

  3. On the left, click App management and then Manage Applications for Android devices.
  4. Click the link to manage Android apps.
  5. Use the steps below to build and manage your whitelist. 

Step 2: Build your whitelist

Add an app
  1. Follow the preceding steps to open your Android app whitelist.
  2. At the bottom right, click Add Add.
    The Google Play store opens.
  3. At the top right, search for the app you want to whitelist. When you find the app, click it.
  4. Click Approve, read the app permissions, and click Approve again.
  5. Decide how you want to handle new app permission requests (for example, access to in-app purchases or identity information). If you previously approved the app, click Approval Preferences first. You can:

    • Automatically reapprove an app when it requests new permissions.
    • Remove an app from your whitelist until you reapprove it.

    For more details about app permissions, see Manage app permissions.

  6. Choose an option:
    • Click Save
    • If you previously approved the app, click Select.
  7. To whitelist the app for all users in your organization, select All users and click Continue. If you’re a G Suite Business or Enterprise customer, you can whitelist the app for a specific group of users. Select A specific organizational unit (OU) or group(s) and then select the organization or group that the users belong to. For details, see Distribute apps to specific users (below).

  8. Specify your app preferences and click Save.
    You can:
    • Automatically install the app on users’ devices now.
    • Prevent users from uninstalling the app.
    • Allow users to add an app widget (when available) for a home screen shortcut.
  9. (Optional) To view more information about any of your whitelisted apps, next to the app, click More More and then Open in Play Store.

The app appears in the whitelist almost immediately. It will be available for users to install from managed Google Play or the Work Apps tab of the Play Store the next time their device synchronizes with Google Mobile Management. If a user installs an app from outside of the managed Google Play store or the Work Apps tab, the app isn't managed.

Remove an app

When you remove an app from your whitelist, it’s no longer available for users to install from the managed Google Play store or the Work Apps tab in the Play Store. If a user already installed the app, it won’t be removed from their device. Users who haven’t installed the app can still install it from the Play Store, but it won’t be managed.

  1. Follow the preceding steps to open your Android app whitelist.
  2. Choose an option:
    • Find the app you want to remove and click More  More and then Remove.
    • Hover over the app's icon to display a checkbox. Check the box (you can check multiple apps at once). In the top-right corner, click Delete Trash .
  3. Click Remove.

You see a message that the selected app has been removed from the whitelist.

Note: You can't remove the Google Apps Device Policy app from the whitelist.

Step 3: Manage apps in your whitelist

Manage app preferences
  1. Follow the preceding steps to open your Android app whitelist.
  2. Click the app you want to manage.
    Tip: To only see the apps that are whitelisted for a specific user or group of users, use the filters on the left. You can select an organizational unit, Google Group, or user. You can also choose to only view public or private apps.
  3. Next to the group or organizational unit you want to change app preferences for, click More More and then Edit configuration.
  4. Specify your app preferences. You can:
    • Automatically install the app on users’ devices now.
    • Prevent users from uninstalling the app if you automatically install it.
    • Allow users to add an app widget (when available) to their home screen.
    • If the app supports it, apply a managed configuration (see below for details).
  5. Click Update.

Note: The change typically take effect in minutes, but it might take up to 24 hours to be reflected across all of your users’ devices.

Approve permission updates

When you whitelist an Android app, you control what the app can access on behalf of users in your organization—also known as permissions. For example, an app might want permission to see a device’s contacts or location. No matter which permissions you grant, users can still change those permissions after the app installs on their device.

The permissions for a whitelisted app might change when the app updates. Apps that have permission updates that need your approval are marked with Exception Exception in your Admin console. To approve permission-update requests:

  1. Follow the preceding steps to open your Android app whitelist.
  2. Next to the app with the Exception Exception, click More More and then Open in Play Store.
  3. Click Approve, read the permissions, and click Approve again.
  4. (Optional) Decide how you want to handle new app permission requests (for example, access to in-app purchases or identity information):
    • To automatically reapprove an app when it requests new permissions, select Keep approved when app requests new permissions. The app will be automatically reapproved, regardless of the new permissions being requested.
    • To remove an app from your whitelist until you reapprove it, select Revoke app approval when this app requests new permissions.
    For more details about app permissions, see Manage app permissions.
    Note: If you previously approved the app, click Approval Preferences to decide how you’d like to handle new app permission requests and click Save. Then, click Select.
  5. Click Save.
Manage runtime permissions

Some Android apps request permissions from the user while the app is running. For example, an app might request access to a device’s calendar or location. You can manage how permission requests from an individual app are handled. These app settings take priority over any runtime permissions preferences specified for the device.

  1. Follow the preceding steps to open your Android app whitelist.
  2. Click the app you want to manage.

    Tip: To only see the apps that are whitelisted for a specific user or group of users, use the filters on the left. You can select an organizational unit, Google Group, or user. You can also choose to only view public or private apps.

  3. Next to the group or organizational unit you want to change runtime permission preferences for, click MoreMore and then Manage runtime permissions.
    If the app doesn’t support runtime permissions, the option won’t be available.
  4. For each runtime permission, you can:
    • Automatically allow the permission.
    • Automatically deny the permission.
    • Prompt the user to allow or deny the permission.
    Note: Denying runtime permissions can affect the functionality of some apps.
Create managed configurations

Some Android apps have settings that you can save as managed configurations. For example, an app may give you the option to only sync data when a device is connected to Wi-Fi. The default managed configuration assigned to an app is set by the app’s developer. You can check if an app supports managed configurations in managed Google Play. For details, see Managed app configuration.

Managed configurations allow you to automatically configure apps for a group or OU without any user interaction. You can create multiple managed configurations for the same app and apply different configurations to different groups or OUs. To create a managed configuration:

  1. Follow the preceding steps to open your Android app whitelist.
  2. Click the app you want to manage.

    Tip: To only see the apps that are whitelisted for a specific user or group of users, use the filters on the left. You can select an organizational unit, Google Group, or user. You can also choose to only view public or private apps.

  3. In the Managed Configurations section, click Create New Managed Configuration.
    If the app doesn’t support managed configurations, the option won’t be available.
  4. Add a Configuration name and set your preferred configuration.
    Note: The developer of the app defines the configuration options made available to you. If you have questions about these settings, contact the developer.
  5. Click Save.
  6. To apply a managed configuration to the app for a group or OU, see Manage app preferences (above).
  7. To edit or delete a managed configuration, click Edit Edit.
    Note: Before you can delete a managed configuration, you must remove it from any OUs or groups. When you remove a configuration, the app reverts to the default configuration defined by the developer.

Step 4: Distribute apps to specific users

Add users to an app's distribution list

This feature is available with G Suite Business and Enterprise editions. Compare editions

  1. Follow the preceding steps to open your Android app whitelist.
  2. Click the app you want to distribute.
    On the App Distribution screen, you see the organizations and groups the app is currently distributed to.
    Tip: To only see the apps that are whitelisted for a specific user or group of users, use the filters on the left. You can select an organizational unit, a group, or user. You can also choose to view only public or private apps.
  3. To distribute the app to another group of users click Add More.
  4. Choose an option: 
    • To distribute the app to users in an organizational unit, on the left, select Organizational Unit, then select the name of the organizational unit from the list.
    • To distribute the app to users in a group, on the left, select Group and start entering the name of the group. Select the group from the list.

    For more information, see Selectively distribute mobile apps.

  5. Click Continue

  6. Specify your app preferences for the organization or group and click Save.
    You can:
    • Automatically install the app on users’ devices now.
    • Prevent users from uninstalling the app.
    • Allow users to add an app widget (when available) for a home screen shortcut.

Note: The change typically takes effect in minutes, but it might take up to 24 hours to be reflected across all of your users’ devices. If you don’t select a specific organization or group, the app is distributed to all users in your top-level organization.

Remove users from an app's distribution list

This feature is available with G Suite Business and Enterprise editions. Compare editions

  1. Follow the preceding steps to open your Android app whitelist.

  2. Click the app with the distribution you want to change. 
    On the App Distribution screen, you see the organizations and groups the app is currently distributed to.
    Tip: To only see the apps that are whitelisted for a specific user or group of users, use the filters on the left. You can select an organizational unit, a group, or user. You can also choose to view only public or private apps.
  3. Next to the organization or group you want to remove, click More More and then Remove OU or Remove group.
  4. Click Remove to confirm.

Note: The change typically takes effect in minutes, but it might take up to 24 hours to be reflected across all of your users’ devices. If you don’t select a specific organization or group, the app is distributed to all users in your top-level organization.

Grant users access to non-whitelisted apps

In addition to whitelisted apps, you can also grant users in an organizational unit access to non-whitelisted apps. With this option enabled, users see whitelisted apps on the managed Play homepage, but can search for and download any app available in the public Play Store. To grant users access to all public Play Store apps:

  1. Follow the preceding steps to open your Android app whitelist.
  2. In the Organizations menu on the left, select the name of the organizational unit that you want to allow all apps for.
    (Your top-level organization is selected by default).

    Note: If you select a high-level organization, the setting will be applied to all users in that organization and its sub-organizations. For details, see How the organizational structure works.

  3. Next to Available apps on Android, select Allow all apps.
  4. Click Save.
Note: The change typically takes effect in minutes, but it might take up to 24 hours to be reflected across all of your users’ devices.
Was this article helpful?
How can we improve it?