Deploy Android apps to managed users on ChromeOS devices

For managed users on Chromebooks and other ChromeOS devices.

As an administrator, you can decide which Android apps your users can install and use on their ChromeOS devices. To get started, turn on Android apps for users in your organization.

Before you begin

• Ensure that super administrators accept the Google Play Terms of Service.
• If you allowlist Android apps, users can’t switch to secondary accounts in managed Google Play.
• Set up Android management for your organization. In your Google Admin console, go to BillingSubscriptions and add the Android Enterprise subscription.
• If you don't have a subscription to Chrome Enterprise Upgrade, you can manage Android apps for users only. In the steps below, skip the step to click the Users & browsers tab at the top of the page.
• To configure ChromeOS devices to run as kiosks or managed guest sessions, first you need to enroll devices. For details, see Enroll ChromeOS devices.
• To make settings for a specific group of users or enrolled Chrome browsers, put the user accounts or browsers in a group or organizational unit. Only user accounts can be added to groups. For details, see Groups and Add an organizational unit.

Open all   |   Close all

Enable Android apps

Step 1: Enable Android apps

1. Sign in to your Google Admin console.

   Sign in using your administrator account (does not end in @gmail.com).

2. In the Admin console, go to Menu  DevicesChromeApps & extensionsUsers & browsers.

   If you signed up for Chrome Browser Cloud Management, go to Menu  Chrome browserApps & extensionsUsers & browsers.
3. (Users only) To apply the setting to a group, do the following:
   1. Select Groups.
   2. Select the group to which you want to apply the setting.
4. (Optional) To apply the setting to a department or team, at the side, select an organizational unit. Show me how
5. On the right, click Additional settings .
6. Go to Additional app settings.
7. For Android apps on Chrome Devices, select Allow.
8. (Optional) For Android reporting for users and devices, select Enable Android reporting.
   The report only shows information for managed users using managed ChromeOS devices that support managed Google Play.
9. Click Save.

Step 2: (Optional) Use additional controls

1. Sign in to your Google Admin console.

   Sign in using your administrator account (does not end in @gmail.com).

2. In the Admin console, go to Menu  DevicesChromeSettings. The User & browser settings page opens by default.

   If you signed up for Chrome Enterprise Core, go to Menu  Chrome browserSettings.

3. (Optional) To apply the setting only to some users and enrolled browsers, at the side, select an organizational unit (often used for departments) or configuration group (advanced). Show me how

   Group settings override organizational units. Learn more

4. Go to Android apps.
5. (Optional) To stop users from adding a second Google Account:
   1. Click Account management.
   2. Check the Google account box.
   3. Click Save.
6. (Optional) To synchronize Google ChromeOS CA certificates available to Android apps:
   1. Click Certificate synchronization.
   2. Select Enable usage of ChromeOS CA certificates in Android apps.
   3. Click Save.

Settings typically take effect in minutes. But they might take up to an hour to apply for everyone.

Install Android apps on ChromeOS devices

Step 1: Select apps

1. Sign in to your Google Admin console.

   Sign in using your administrator account (does not end in @gmail.com).

2. In the Admin console, go to Menu  DevicesChromeApps & extensions. The Overview page opens by default.

   If you signed up for Chrome Browser Cloud Management, go to Menu  Chrome browserApps & extensions.

3. At the top, click Users & browsers or Kiosks.
4. (Users only) To apply the setting to a group, do the following:
   1. Select Groups.
   2. Select the group to which you want to apply the setting.
5. (Optional) To apply the setting to a department or team, at the side, select an organizational unit. Show me how
6. Click Add Add from Google Play .
7. Search for and click the app you’d like to manage.
8. Click Select.
9. To accept the app permissions on behalf of your organization, click Accept.

Step 2: Decide how apps are installed

As an admin you have 2 ways to install apps for your users on ChromeOS devices. You can automatically install apps (Force install), or you can allow the user to manually install apps from managed Google Play (Allow install). You can also pin force-installed apps to the user’s taskbar and you can block users from installing apps.

Configure app installation settings

1. Sign in to your Google Admin console.

   Sign in using your administrator account (does not end in @gmail.com).

2. In the Admin console, go to Menu  DevicesChromeApps & extensionsUsers & browsers.

   If you signed up for Chrome Browser Cloud Management, go to Menu  Chrome browserApps & extensionsUsers & browsers.
3. (Users only) To apply the setting to a group, do the following:
   1. Select Groups.
   2. Select the group to which you want to apply the setting.
4. (Optional) To apply the setting to a department or team, at the side, select an organizational unit. Show me how
5. Click the app that you want to configure.
6. In the panel that opens on the right, under Installation policy, choose Allow install, Force install, Force install + pin to ChromeOS taskbar, or Block.
7. Click Save.

Note: While a force-installed app is downloading on ChromeOS devices, users see a STOP button. If they click it, the download stops. Another installation attempt is made at the next sign in. Install attempts continue until the app successfully installs or is no longer part of the list of apps that are force-installed.

Allow the installation of any app

Not available for education domains.

If you give your users full access to the managed Google Play store, they can search for and install any app on their ChromeOS devices, even apps you haven’t selected.

1. Sign in to your Google Admin console.

   Sign in using your administrator account (does not end in @gmail.com).

2. In the Admin console, go to Menu  DevicesChromeApps & extensionsUsers & browsers.

   If you signed up for Chrome Browser Cloud Management, go to Menu  Chrome browserApps & extensionsUsers & browsers.
3. (Users only) To apply the setting to a group, do the following:
   1. Select Groups.
   2. Select the group to which you want to apply the setting.
4. (Optional) To apply the setting to a department or team, at the side, select an organizational unit. Show me how
5. On the right, click Additional settings .
6. Go to Allow/block mode.
7. Click Edit.
8. Under Play Store, choose an option;
   • Allow all apps, admin manages blocklist—Users can install all apps from managed Google Play except the ones that you block.
   • Block all apps, admin manages allowlist—Users can only install the apps from managed Google Play that you allow.
9. Click Save.

(Optional) Add private apps

You can use the managed Google Play store to host private Android apps for your organization. You can control who can download an app, and you can benefit from security checks, such as user authentication and malware detection.

To deploy private Android apps to ChromeOS devices, first publish the apps to the managed Google Play store. For details, see Manage private Android apps in Google Play.

1. Sign in as an admin to managed Google Play.
2. On the left, click Admin Settings and note your Organization ID.
3. Go to the Google Play Console.
4. Select your private app.
5. Click Store Presence Pricing & distribution.
6. Check the Privately target this app to a list of organizations box.
7. Click Choose Organizations and add your Organization ID (noted in step 2).
8. Click Submit Update.

It might take up to 24 hours to see the app in the My managed apps list. The managed Google Play help center contains detailed information on how to manage apps and app licenses for use in your organization.

Step 3: (Optional) Apply managed configurations to an Android app

For some apps and extensions, you can install custom policies. For example, a digital signage kiosk app might have a schedule of events that’s contained in a JavaScript Object Notation (JSON) file.

1. Sign in to your Google Admin console.

   Sign in using your administrator account (does not end in @gmail.com).

2. In the Admin console, go to Menu  DevicesChromeApps & extensions. The Overview page opens by default.

   If you signed up for Chrome Browser Cloud Management, go to Menu  Chrome browserApps & extensions.

3. At the top, click Users & browsers or Kiosks.
4. (Users only) To apply the setting to a group, do the following:
   1. Select Groups.
   2. Select the group to which you want to apply the setting.
5. (Optional) To apply the setting to a department or team, at the side, select an organizational unit. Show me how
6. Find and click the app that you want to configure policies for.
7. In the panel that opens on the right, under Managed configuration, enter the JSON data in the text field.
8. Click Save.

Sample policy configuration files

The following sample configuration shows how to define a very restrictive block list that stops the app from accessing any URL. It also includes an allow list of specific URLs that the app can access:

{ "com.android.browser:URLBlocklist": "[\"*\"]"
"com.android.browser:URLAllowlist": "[\"www.solamora.com\", \"www.altostrat.com\”]" }

The following sample configuration shows how to specify all supported setting types (boolean, string, array, and object array):

{
"can_say_hello": true,
"message": "Hello, it's me",
"approvals": [ "read", "write" ],
"items": [{ "key": "key1", "value": "1"}, { "key": "key2", "value": "2"}]
}

Supported variables for managed configuration files

Managed configuration files can be defined with any of the following placeholders. All values are optional.

• ${DEVICE_DIRECTORY_ID}—Device’s directory ID
• ${USER_EMAIL}—Signed-in user’s email address
• ${USER_EMAIL_DOMAIN}—Signed-in user’s domain name
• ${DEVICE_SERIAL_NUMBER}—Device's serial number
• ${DEVICE_ASSET_ID}—Asset ID assigned to device by administrator
• ${DEVICE_ANNOTATED_LOCATION}—Location assigned to device by administrator
• ${USER_EMAIL_NAME}—First part (part before @) of signed-in user’s email address

If a placeholder value isn’t available, it’s replaced with an empty string. Values are only provided for enrolled devices.

Verify Android apps are available on users’ devices

Step 1: Open Google Play

After you enable Android apps for users in your organization, users see Play Store in the shelf at the bottom or side of the screen on their ChromeOS device.

1. On a ChromeOS device, click Play Store to open Google Play.
2. Click Agree to accept the Terms of Service.

Step 2: Get Android apps

Users can install selected apps on their devices from Play Store.

1. On a ChromeOS device, click Play Store to open Google Play.
2. Click MenuStore Home.
3. Browse or search for the app that you want to install and click it.
4. Click Install.
5. If prompted, review the requested access permissions and click Accept.

To see a list of the Android apps installed on the device, from the Menu , click My work apps or My school apps.

Remove Android apps from ChromeOS devices

Remove apps

You can remove Android apps that you no longer want on user devices. The next time users sign in to their ChromeOS device, the app and its associated user data are removed. And, although users can still see the app in the library in managed Google Play, they can't install it.

Before you begin

If you give some users access to all apps in managed Google Play, you can’t modify the Allow installation setting (remove any Android apps) for those users.

Remove an app and its associated user data

1. Sign in to your Google Admin console.

   Sign in using your administrator account (does not end in @gmail.com).

2. In the Admin console, go to Menu  DevicesChromeApps & extensionsUsers & browsers.

   If you signed up for Chrome Browser Cloud Management, go to Menu  Chrome browserApps & extensionsUsers & browsers.
3. (Users only) To apply the setting to a group, do the following:
   1. Select Groups.
   2. Select the group to which you want to apply the setting.
4. (Optional) To apply the setting to a department or team, at the side, select an organizational unit. Show me how
5. Find and click the app that you want to remove.
6. In the panel that opens on the right, under Installation policy, choose Block.
7. Click Save.

Remove an app from the Admin Console

Users that already have the app installed will still be able to use it.

1. Sign in to your Google Admin console.

   Sign in using your administrator account (does not end in @gmail.com).

2. In the Admin console, go to Menu  DevicesChromeApps & extensionsUsers & browsers.

   If you signed up for Chrome Browser Cloud Management, go to Menu  Chrome browserApps & extensionsUsers & browsers.
3. On the left, select the top-level organizational unit.
4. Find and click the app that you want to remove.
5. In the panel that opens on the right, click Remove.
6. Click Save.

(Optional) Run an Android app as a kiosk on a ChromeOS device

For information about how to push Android apps to a ChromeOS device in locked-down kiosk mode, see Use Android apps on Chrome devices running as a kiosk.

FAQs

Which ChromeOS devices support Android apps?

For a list of ChromeOS devices that support Android apps, read ChromeOS systems supporting Android apps.

Note: As an administrator, you need to enable Android apps for your domain before your users can install Android apps on their devices.

Can users install any Android app they want?

As an administrator, you can:

1. Create and manage a list of Google Play apps to use in your organization. Learn more
2. Choose how you want to install apps, depending on which organizational unit users belong to. Learn more
3. Let users search for and install any Android app from managed Google Play. Learn more

Related topics

• Android apps on Chrome devices
• Monitor forced Android app installs
• Chrome Deployment Guide
• Set up Minecraft: Education Edition on Chromebooks
• Chromebook App Hub
• Managed Google Play Help Center
• Manage Google Play private apps

Google and related marks and logos are trademarks of Google LLC. All other company and product names are trademarks of the companies with which they are associated.