Set Chrome app and extension policies (Windows)

Applies to Windows users who sign in to a managed account on Chrome browser.

As an administrator, you can automatically install Chrome apps and extensions on users' computers. You can also control which apps or extensions users can install. You set the default policies for all apps and extensions. Then, if you want to customize policies for specific apps or extensions, you can override your defaults.

Step 1: Review the policy

Policy

Description and settings

ExtensionSettings

Manage the apps and extensions users can install.

Overrides the following extension policies (which might already be set):

Step 2: Update your Group Policies

In your Microsoft Windows Group Policy Editor (Computer or User Configuration folder):

Go to Administrative Templates Google Google Chrome Extensions.
Open Extension management settings.
Tip: If you don’t see the policy, download the latest policy template.
Enable the policy and enter its compact JavaScript Object Notation (JSON) data in the text box.
Note: Enter JSON data as a single line with no line breaks. You can use theJSON validation tool of your choice to validate policies and compact them into a single line (example JSON data below).
Set your desired app and extension policies (details below).

Example JSON data

{
"*": {
"runtime_blocked_hosts": ["*://*.example.com"],
"blocked_permissions": ["usb"]
}
}

Compact JSON data

{"*":{"runtime_blocked_hosts":["*://*.example.com"],"blocked_permissions":["usb"]}}

Step 3: Get Chrome app or extension IDs

Skip this step if you're not going to customize policies for specific apps or extensions.

To apply policies and settings to a specific Chrome app or extension, you need to identify it. Every app and extension in the Chrome Web Store has its own unique identification (ID) that doesn’t change across versions. So, if a user installs a specific app or extension on multiple devices, it has the same ID on all devices. Each ID is 32 characters long.

To find an app or extension ID:

Open the Chrome Web Store.
Find and select the app or extension you want.
Look at the URL. The ID is the long string of characters at the end of the URL.
For example, gmbgaklkmjakoegficnlkhebmhkjfich is the ID for Google Calendar.

Step 4: Set app and extension policies

For each implementation (sample code below):

Set a default policy that applies for all apps and extensions. Use the * value.
(Optional) Customize the policy for individual apps or extensions. Use the app or extension ID (details above).

Set installation policies (automatically install, force install, allow, or block)

Pin app or extension updates

Define the extension download location

Set custom message for blocked apps and extensions

Prevent users from running apps or extensions based on permissions

Prevent apps and extensions from altering webpages

You can prevent extensions on devices from modifying websites that you specify. Modifications include blocking script injection, cookie access, and web-request modifications. This setting doesn’t prevent users from installing or removing extensions.

You can use 2 settings:

runtime_blocked_hosts—Prevents extensions from interacting with specified websites.
runtime_allowed_hosts—Allows extensions to interact with specified websites, even if they’re also defined in runtime_blocked_hosts.

[http|https|*], [hostname|*], and [eTLD|*] are required
[subdomain|*] is optional.

Valid host patterns	Matches	Doesn't match
://.example.*	http://example.com https://test.example.co.uk	https://example.google.com http://example.google.co.uk
http://example.*	http://example.com http://example.ly	https://example.com http://test.example.com
http://example.com	http://example.com	https://example.com http://test.example.co.uk
http://*.example.com	http://example.com http://test.example.com http://t.t.example.com	https://example.com https://test.example.com
http://example.co.*	http://example.co.com http://example.co.co.uk	http://example.co.uk
http://*.test.example.com	http://t.test.example.com http://test.example.com	http://not.example.com
://	All Urls

Invalid host patterns

http://t.*.example.com
http*://example.com
http://*example.com
http://example.com/
http://example.com/*

Example code to prevent webpage modification

Download an example JSON file here. You can edit it using a text editor.

The example shows how to:

Block extensions from accessing *.example.com webpages.
Block extensions that require USB permission.

Step 5: Deploy to users and validate policies

After you deploy any Chrome extension policy, check user devices to make sure the policy was applied correctly.

On a managed ChromeOS device, browse to chrome://policy.
Click Reload policies.
In the top right, in the Filter policies by field box, enter ExtensionSettings.
Check the Show policies with no value set box.
Under the Chrome policy name next to each extension setting, make sure Status is set to OK.
Click Show value and make sure the value field isn’t empty.

Was this helpful?

How can we improve it?

Set Chrome app and extension policies (Windows)

Step 1: Review the policy

Step 2: Update your Group Policies

Step 3: Get Chrome app or extension IDs

Step 4: Set app and extension policies

Example installation code

Example extension download location code

Example extension download location code

Example custom-message code

Example prevent permission code

Example code to prevent webpage modification

Step 5: Deploy to users and validate policies

Related topics

Was this helpful?

Need more help?

Try these next steps:

What is the issue with this selection?

Share additional info or suggestions