Recommend and manage iOS apps

If you have the legacy free edition of G Suite, upgrade to G Suite Basic to get this feature. 

As an administrator, you can recommend and manage work apps for users with Apple® iOS® devices. You can create a whitelist of recommended apps to make them available for users to install. For more control over your organization's data, you can set apps as managed. 

About managed apps

How users set up managed apps

When you set an app as managed, users must accept management the apps. Here’s how that process works: 
  1. Using their work account, a user signs in to a Google mobile app (such as Gmail or Google Docs, Drive, or Calendar). 
  2. The user is prompted to install the Google Device Policy app.
  3. If any apps that you specified as managed are installed on the device, the user is asked to allow your organization to manage the apps.
  4. If the user accepts, you have control of the apps. For details, see What you can do with managed apps (next section).
  5. If the user doesn’t accept within 24 hours, they can't access Google mobile apps on their device with their work account.

What you can do with managed apps

When you set an app as managed, you have more control over the app and its data. If a user removes the Device Policy profile from a device, you can remove managed apps from the device. You can also apply settings that control how the app is used. You can:

  • Prevent the app’s data from being backed up to Apple iCloud®.
  • Control whether users can trust apps they install from outside the Apple App Store® or Google Device Policy app.
  • Decide which apps can be used to open corporate documents and links.
  • Control whether managed apps can use mobile data to go online.

For more details, see Managed Apps.

Users can:

  • Install managed apps from the Device Policy app.
  • Open the Device Policy app to see if an app is managed by your organization: 
    • Green checkmark—Managed. 
    • Gray checkmark—Unmanaged. 
    • Red exclamation—Managed, but the user hasn’t allowed your organization to manage it yet. The red exclamation mark can also appear if the user downloads an app from the Apple App Store® (unmanaged) and then the app is whitelisted and set to enforced.
You can manage the apps on the device until the user uninstalls the Device Policy profile (even if you change the app’s management settings or the user uninstalls and reinstalls the app).

Before you begin

Open all   |   Close all

Step 1: Open your iOS app whitelist

  1. Sign in to your Google Admin console.

    Sign in using your administrator account (does not end in @gmail.com).

  2. From the Admin console Home page, go to Devices.
  3. On the left, click App Management and then  Manage apps for iOS devices.
  4. Click the link to manage iOS apps.

Step 2: Build your whitelist

Add an app
  1. If you haven't already, open your iOS app whitelist.
  2. At the bottom right, click Add application .
  3. Enter either the app name or the app URL (from Apple iTunes®) and click Search.
  4. Select the app and click Continue.
  5. To whitelist the app for all users in your organization, select All users and click Continue.

    If your organization uses G Suite Business, G Suite Enterprise, or G Suite Enterprise for Education, you can whitelist the app for a specific group of users:

    1. Select A specific organizational unit (OU) or group(s).
    2. Select the organization or group that the users belong to.
    3. Click Continue.
  6. If you want to manage the app, check the Make this a managed app box. Learn more
  7. (Optional for managed apps) To automatically remove the app from a device if a user removes the Device Policy profile, check the Remove app when MDM profile is removed box. 
  8. Click Save.
  9. If you added Microsoft® Outlook® for iOS (not recommended), ensure that it respects your endpoint management settings:
    1. If you didn’t check Make this a managed app during setup, edit the configuration and require management.
    2. In the Admin console, click Menu and thenSecurityand thenApp Access Controland thenManage Google services.
    3. Locate Gmail and Drive in the list of services. If Access is set to Unrestricted, change the value to Restricted. This setting prevents untrusted apps from accessing the services. When you add the app in the preceding steps, the app is automatically trusted and can access Gmail and Drive.
  10. (Optional) To view information about any of your whitelisted apps, next to the app, click Moreand then Open in App Store.
  11. Have users install the Google Device Policy app to get whitelisted apps.

The app appears in the whitelist almost immediately. It might take up to an hour for the app to appear in the Google Device Policy app on users' devices.

Remove an app

When you remove an iOS app from your whitelist, the app isn't available for users to install from the Google Device Policy app. If the app is managed, it remains managed until the user removes the Device Policy profile from their device. Other users can still install the app from the App Store, but you can't manage it. 

  1. If you haven't already, open your iOS app whitelist.
  2. To remove a single app, click More  and then Remove. To remove multiple apps, point to each app's icon to display a checkbox and check the box. After you select all the apps you want to remove, in the top-right corner, click Delete  .
  3. Click Remove in the confirmation dialog.

You see a message that the selected app was removed from the whitelist.

Step 3: Manage apps in your whitelist

Change an app’s management settings
  1. If you haven't already, open your iOS app whitelist.
  2. Click the app you want to edit. 
  3. Next to the organizational unit or group that you want to change the settings for, click More and then Edit configuration
  4. If you want to manage the app, check the Make this a managed app box. Learn more
  5. (Optional for managed apps) To remove the app from a device when a user removes the Device Policy profile, check the Remove app when MDM profile is removed box. 
  6. Click Update.

If you unchecked the Make this a managed app box, the app remains managed on devices until the user uninstalls the Google Device Policy profile (even they uninstall and reinstall the app).

Distribute a whitelisted app to specific users

This feature is available with G Suite Business and Enterprise editions. Compare editions

You can distribute an app to users in a specific organizational unit or group.

  1. If you haven't already, open your iOS app whitelist.
  2. Click the app you want to distribute. 
    You see the organizations and groups the app is distributed to.
    Tip: To only see the apps that are whitelisted for a specific user or group of users, use the filters on the left. You can select an organizational unit, a group, or user. 
  3. To distribute the app to another group of users, click Add More.
  4. Choose an option and click Continue
    • To distribute the app to users in an organizational unit, on the left, select Organizational Unit. Then select the name of the organizational unit from the list.
    • To distribute the app to users in a group, on the left, select Group, and start entering the name of the group. Select the group from the list.

Note: Changes typically take effect in minutes, but might take up to 24 hours to be reflected across all of your users’ devices.

Remove users from an app’s distribution list
This feature is available with G Suite Business and Enterprise editions. Compare editions
  1. If you haven't already, open your iOS app whitelist.
  2. Click the app whose distribution you want to change. 
    You see the organizations and groups the app is distributed to. 
    Tip: To only see the apps that are whitelisted for a specific user or group of users, use the filters on the left. You can select an organizational unit, a group, or user. 
  3. Next to the organization or group you want to remove, click More  and then Remove OU or Remove group.
  4. Click Remove to confirm.

Note: Changes typically take effect in minutes, but might take up to 24 hours to be reflected across your users’ devices.

Related topics 

Was this helpful?
How can we improve it?