Manage Chrome kiosk app settings

This article is for Chrome administrators and developers with experience developing Chrome apps.

As an administrator, you can use the Admin console to customize Chrome kiosk apps. For example, you might want your app to control the version of Chrome that's running on a kiosk. Or, you can automatically launch a kiosk app on a digital sign.

Autolaunch a kiosk app on ChromeOS devices

Setting a kiosk app to launch automatically turns devices running ChromeOS into single-purpose devices. You can deploy multiple kiosk apps to devices, but you can only configure one app to automatically launch when devices start. For example, you might automatically launch an app on devices where user interaction isn’t controlled with a keyboard and mouse.

Sign in to your Google Admin console.
Sign in using your administrator account (does not end in @gmail.com).
In the Admin console, go to Menu DevicesChromeApps & extensionsKiosks.
To apply the setting to everyone, leave the top organizational unit selected. Otherwise, select a child organizational unit.
Next to Auto-launch app, choose the app that you want to automatically launch on ChromeOS devices.
In the app window, configure settings such as deployment and auto-launch.

Let a kiosk app control the Chrome version

Supported on Chrome 52 and later.

You can let a kiosk app control the Chrome version on a device running ChromeOS to improve device stability if the app, or certain app features, aren't compatible with the latest Chrome release.

We recommend that you only let a kiosk app control the Chrome version if:

Your testing process doesn’t align with the standard 6-week cycle for ChromeOS updates.
There is significant risk associated with any potential stability issues.

Step 1: Set the OS version in the kiosk app’s manifest file

Identify the ChromeOS version that you want to specify.
1. Go to CrOS-OmahaProxy CSV Viewer.
2. For the most common device in your organization, take note of the chrome_version value.
In the app’s manifest.json file, set required_platform_version to the value you noted.
For example: "required_platform_version”: “8350”.
To automatically update the app to the latest version, even if the ChromeOS version isn't compliant, set always_update to true.

This sample configuration sets the required_platform_version to 8350 and always lets the app update automatically.

Step 2: Let the kiosk app control the Chrome version

Sign in to your Google Admin console.
Sign in using your administrator account (does not end in @gmail.com).
In the Admin console, go to Menu DevicesChromeSettingsDevice settings.
To apply the setting to everyone, leave the top organizational unit selected. Otherwise, select a child organizational unit.
For an autolaunched kiosk app, go to Device update settings:
1. Click Auto-update settings:
  1. Select Block updates.
  2. Click Save.
2. Click Kiosk-controlled updates.
  1. Select Allow Kiosk app to control OS version.
  2. Verify that the app's manifest file contains required_platform_version and click OK.
  3. Click Save.
For all other kiosk apps, go to Device update settings:
1. Click App-controlled updates.
2. Click Select an app.
3. Search for your kiosk app in the Chrome Web Store.
4. Click Pin OS version to app.
5. Click Save.

Step 3 : Verify policies are applied

After you apply any Chrome policies, users need to restart Chrome devices for the settings to take effect. You can check the devices to make sure the policy was applied correctly.

On a managed ChromeOS device, browse to chrome://policy.
Click Reload policies.
For an autolaunched kiosk app:
- For AllowKioskAppControlChromeVersion, make sure that Status is set to OK and Policy value is true.
- For DeviceAutoUpdateDisable, make sure that Status is OK and Policy value is true.
For specified kiosk apps:
- For DeviceTargetVersionPrefix, make sure that Status is set to OK.
- For DeviceTargetVersionPrefix, make sure that Policy value is the same as the value set for required_platform_version in the app's manifest file.

Common scenarios

This table describes different scenarios where kiosk apps are configured to control the ChromeOS version on a device.

Scenario	Result
The app’s manifest file does not have the `required_platform_version` manifest key.	Devices autoupdate to the latest ChromeOS version when it becomes available.
The app’s manifest file has an invalid `required_platform_version` setting.	The app developer sees an error message in chrome://extensions when they try to load the app. The `required_platform_version` must be valid for the app to get installed or updated from the Chrome Web Store.
The `required_platform_version` value is lower than the device’s current platform version.	The app is installed but the device's OS will not get updated unless the `required_platform_version` value is updated to a version higher than the current device OS version. Note: The first time an app is installed from the Chrome Web Store, the `required_platform_version` value is verified, but not compared to the device’s current platform version.
The `required_platform_version` is updated to a lower value than the device’s current platform version.	The app is not installed and the client device continues to run the older version of the app.

Specify URLs kiosk apps can access

You can block and allow up to 1,000 URLs so that kiosk apps can only access certain websites.

Sign in to your Google Admin console.
Sign in using your administrator account (does not end in @gmail.com).
In the Admin console, go to Menu DevicesChromeSettingsDevice settings.
To apply the setting to everyone, leave the top organizational unit selected. Otherwise, select a child organizational unit.
Go to Kiosk settings.
Click URL Blocking.
Enter URLs as needed:
- Blocked URLs—URLs that you want to prevent kiosk apps from accessing.
  For syntax and examples, see Devices > Blocked URLs.
- Blocked URLs exceptions—URLs that you want to allow kiosk apps to access (URLAllowlist). Access is allowed even if the URLs are also defined in Blocked URLs.
  For syntax and examples, see Devices > Blocked URLs exceptions.
Click Save.

Was this helpful?

How can we improve it?