Allow or block apps and extensions

For administrators who manage Chrome policies from the Google Admin console.

As a Chrome Enterprise admin, you can control which apps or extensions users can install on managed Chrome Browsers or Chrome devices.

This article gives a high-level overview of how to set policies for all users or customize settings for different groups. For more detailed information, see the guide Managing Extensions in Your Enterprise.

Before you begin

  • To make settings for a specific group of users or enrolled Chrome Browsers, put the user accounts or browsers in an organizational unit.
  • To apply settings for Chrome Browser users on Windows, Mac, or Linux computers, turn on Chrome Browser management for the organizational unit that they belong to. See Turn on Chrome Browser management.

Set policies in the Admin console

Can apply for signed-in users on any device or enrolled browsers on Windows, Mac, or Linux. For details, see Understand when settings apply.

Allow all apps but those you want to block

These steps assume you're familiar with making Chrome settings in your Admin console.

  1. Sign in to your Google Admin console.

    Sign in using your administrator account (does not end in @gmail.com).

  2. From the Admin console Home page, go to Devicesand thenChrome management.

    If you don't see Devices on the Home page, click More controls at the bottom.

  3. Click Apps & extensions.
  4. To apply the setting to all users and enrolled browsers, leave the top organizational unit selected. Otherwise, select a child organizational unit.
  5. At the top, click Users & Browsers.
  6. Choose what type of apps that you want to let users install:
    • Allow all other apps and extensions—Users can install all apps and extensions from the Google Play store and Chrome Web Store except the ones that you block.
    • Allow other apps from the Google Play Store only—Users can install all apps from the Google Play store except the ones that you block. Users can only install apps from the Chrome Web store that you allow.
    • Allow other apps & extensions from the Chrome Web Store only—Users can install all apps and extensions from the Chrome Web store except the ones that you block. Users can only install apps from the Google Play store that you allow.
    • Block all other apps & extensions—Users can only install the apps and extensions that you allow.
  7. Click Save. If you configured a child organizational unit, you might be able to Inherit or Override a parent organizational unit's settings.
Block or allow one app

These steps assume you're familiar with making Chrome settings in your Admin console. 

Tip: To block or allow an extension for enrolled browsers, it's easier to use the Browser extensions list.​

  1. Sign in to your Google Admin console.

    Sign in using your administrator account (does not end in @gmail.com).

  2. From the Admin console Home page, go to Devicesand thenChrome management.

    If you don't see Devices on the Home page, click More controls at the bottom.

  3. Click Apps & extensions.
  4. To apply the setting to all users and enrolled browsers, leave the top organizational unit selected. Otherwise, select a child organizational unit.
  5. At the top, click Users & Browsers.
  6. Find the app that you want to configure policies for.
  7. Under Installation policy, choose Block.
  8. Click Save. If you configured a child organizational unit, you might be able to Inherit or Override a parent organizational unit's settings.
Block apps and extensions based on permissions

These steps assume you're familiar with making Chrome settings in your Admin console.

You can prevent users from running apps or extensions that request certain permissions that your organization doesn’t allow. For example, you can block extensions that connect to USB devices or access cookies.

  1. Sign in to your Google Admin console.

    Sign in using your administrator account (does not end in @gmail.com).

  2. From the Admin console Home page, go to Devicesand thenChrome management.

    If you don't see Devices on the Home page, click More controls at the bottom.

  3. Click Apps & extensions.
  4. To apply the setting to all users and enrolled browsers, leave the top organizational unit selected. Otherwise, select a child organizational unit.
  5. At the top, click Users & Browsers.
  6. On the far right, click Settings Settings.
  7. Next to Permissions and URLs, check each permission to block or allow. For details about permissions, go to Chrome app and extension permissions.
  8. Click Save. If you configured a child organizational unit, you might be able to Inherit or Override a parent organizational unit's settings.

Related topics

Was this helpful?
How can we improve it?