Automatically install web apps and Isolated Web Apps

Applies to managed Chrome browsers and ChromeOS devices.

As an administrator, you can automatically install web apps or Isolated Web Apps (IWAs) for users in your organization. Users can then quickly get to the apps from the launcher on ChromeOS devices or in Chrome browser on other devices.

To make settings for a specific group of users or enrolled Chrome browsers, put the user accounts or browsers in a group or organizational unit. Only user accounts can be added to groups. For details, see Groups and Add an organizational unit.

Considerations

IWAs are only supported on ChromeOS.

Step 1: Review policies

Policy	Description and settings
WebAppInstallForceList	Automatically install specific web apps without user interaction. Users cannot disable or remove them. Unset: No web apps are automatically installed.
IsolatedWebAppInstallForceList	Automatically install specific IWAs without user interaction. Users cannot disable or remove them. Unset: No IWAs are automatically installed.

Step 2: Set the policies

Click below for the steps, based on how you want to manage these policies.

Admin console

1. Sign in with an administrator account to the Google Admin console.

   If you aren’t using an administrator account, you can’t access the Admin console.

2. Go to Menu  Devices > Chrome > Apps & extensions. The Overview page opens by default.

   If you signed up for Chrome Enterprise Core, go to Menu  Chrome browser > Apps & extensions.

3. Click Users & browsers, Kiosks, or Managed guest sessions.
4. (Users only) To apply the setting to a group, do the following:
   1. Select Groups.
   2. Select the group to which you want to apply the setting.
5. (Optional) To apply the setting to a department or team, at the side, select an organizational unit. Show me how
6. (Optional) If you haven’t already, add the app:
   • For Progressive Web Apps (PWAs):
     1. Point to Add Add by URL .
     2. Enter the URL.
        Use URLs that do not redirect to a different origin. For example, for Google Maps, use https://www.google.com/maps, not https://maps.google.com.
     3. Click Save. 
   • For IWAs:
     1. Point to Add   Add an Isolated Web App .
     2. Enter the web bundle ID. This is a base32 [a-z2-7] string of 56 or 58 characters.
     3. Enter the update manifest URL.
     4. Click Save. 
7. Go to the app that you want to automatically install.
8. Under Installation policy, choose one of the following:
   • Force install
   • The relevant install and pin option:
     • Force install + pin
     • Force install + pin to ChromeOS taskbar
   • Installed
9. Click Save.

Windows

Applies to Windows users who sign in to a managed account on Chrome browser.

Using Group Policy

In the Group Policy Management Editor (Computer or User Configuration folder):

1. Go to Policies  Administrative Templates  Google  Google Chrome.
2. Open Configure list of force-installed web apps.
   Tip: If you don’t see the policy, download the latest policy template.
3. Enable the policy and enter its compact JavaScript^® Object Notation (JSON) data in the text box.
   Note: Enter JSON data as a single line with no line breaks. You can use a third-party JSON compression tool to validate policies and compact them into a single line.
4. Set your desired web app policies:
   1. Add the URLs of the web apps that you want to automatically install on users’ computers. Use URLs that do not redirect, except to possibly change query parameters. For example, for Google Maps, use https://www.google.com/maps, not https://maps.google.com.
   2. (Optional) To open URLs in a new tab or window, set default_launch_container to tab or window. By default, web apps open in a new tab.
   3. (Optional) To create a desktop shortcut, set create_desktop_shortcut to true.
5. Deploy the update to your users

The example shows how to:

• Automatically install Google Maps and Google Docs.
• Add a desktop shortcut for Google Maps.
• Open Google Maps in a new window.
• Open Docs in a new tab.

Example JSON data

[
{
    "create_desktop_shortcut": true, 
    "default_launch_container": "window", 
    "url": "https://www.google.com/maps"
  }, 
  {
    "default_launch_container": "tab", 
    "url": "https://www.docs.google.com"
  }
]

Compact JSON data

[{"create_desktop_shortcut":true,"default_launch_container":"window","url":"https://www.google.com/maps"},{"default_launch_container":"tab","url":"https://www.docs.google.com"}]

Mac

Applies to Mac users who sign in to a managed account on Chrome browser.

In your Chrome policy configuration profile (.plist file):

1. Add or update the following keys in the <WebAppInstallForceList> key: 
   1. Add the URLs of the web apps that you want to automatically install on users’ computers. Use URLs that do not redirect, except to possibly change query parameters. For example, for Google Maps, use https://www.google.com/maps, not https://maps.google.com.
   2. (Optional) To open URLs in a new tab or window, set the <default_launch_container> key to <string>value</string>, where value is tab or window.  By default, web apps open in a new tab, and the <create_desktop_shortcut> key has no effect on users’ Mac machines.
2. Deploy the change to your users.

The example shows how to:

• Automatically install Google Maps and Google Docs.
• Open Google Maps in a new window.
• Open Docs in a new tab.

<key>WebAppInstallForceList</key>
<array>
  <dict>
    <key>default_launch_container</key>
    <string>window</string>
    <key>url</key>
    <string>https://www.google.com/maps</string>
  </dict>
  <dict>
    <key>default_launch_container</key>
    <string>tab</string>
    <key>url</key>
    <string>https://www.docs.google.com</string>
  </dict>
</array>

Linux

Using your preferred JSON file editor:

1. Go to your /etc/opt/chrome/policies/managed folder.
2. Create or update a JSON file.
3. For WebAppInstallForceList:
   1. In url, add the URLs of the web apps that you want to automatically install on users’ computers. Use URLs that do not redirect, except to possibly change query parameters. For example, for Google Maps, use https://www.google.com/maps, not https://maps.google.com.
   2. (Optional) To open URLs in a new tab or window, set default_launch_container to tab or window. By default, web apps open in a new tab.
   3. (Optional) To create a desktop shortcut, set create_desktop_shortcut to true.
4. Deploy the update to your users. 

The example shows how to:

• Automatically install Google Maps and Google Docs.
• Add a desktop shortcut for Google Maps.
• Open Google Maps in a new window.
• Open Docs in a new tab.

WebAppInstallForceList: [
  {
    "create_desktop_shortcut": true, 
    "default_launch_container": "window", 
    "url": "https://www.google.com/maps"
  }, 
  {
    "default_launch_container": "tab", 
    "url": "https://www.docs.google.com"
  }
]

Step 3: Verify policies on user devices

After you apply any Chrome policies, users need to restart Chrome browser for the settings to take effect. Then, check users’ devices to make sure the policy is correct.

1. On a managed device, go to chrome://policy.
2. Click Reload policies.
3. Check the Show policies with no value set box.
4. For WebAppInstallForceList, or IsolatedWebAppInstallForceList make sure Status is set to OK and that the policy values match what you set in the policy. 

Troubleshoot web apps and IWAs

Web apps (URLs and PWAs)

If a specified URL fails to load, users see a placeholder app instead of the actual app and app logo. Fixing the issue depends on what’s causing the placeholder app to appear. Here is a list of potential issues and solutions.

URL redirects to a different origin

You need to edit the URL to use the web app’s final URL after redirection. We recommend that you copy and paste the URL directly from the browser address bar. For example:

• If you specified example.com and it redirects to www.example.com, you need to change it to www.example.com.
• If you specified http://example.com and it redirects to https://example.com, you need to change it to https://example.com.

URL redirects to a sign-in page

Users need to open the app, sign in from the redirected page, and close the app again.

URL can only be accessed on your organization’s network

Users need to connect to the network and then open and close the app or restart Chrome browser or a ChromeOS device.

URL is temporarily unavailable due to updates or maintenance

Ask your users to restart Chrome browser or their ChromeOS device. If that doesn’t work, when the URL is available again, ask them to open and close the app again.

IWAs

Here is a list of potential issues and solutions.

Update manifest not reachable - The app doesn't install or update

Ensure the device can load the update manifest. To troubleshoot, check if you can access the manifest from your browser and also from the target devices. Typical issues can be a faulty manifest URL or access-protected URL. In case of access protection, ensure that client devices can access the manifest URL without requiring any kind of manual authentication or sing-in.

For on-device troubleshooting, turn on #enable-isolated-web-app-dev-mode from chrome://flags, restart the device when prompted, and navigate to chrome://web-app-internals. Choose Install IWA from Update Manifest to simulate the installation flow and list all IWA versions that the browser is able to parse from this manifest.

Pinned version/Specified release channel not in the update manifest - The app doesn't install or update

Ensure that the update manifest contains entries for the version or release channel.

Bundle not reachable - The app doesn't install or update

Ensure the device can load the IWA bundle. To troubleshoot, check if you can access the bundle from your browser and also from the target devices. Typical issues are a misconfigured manifest, missing bundle, or access-protected bundle resource. In case of access protection, ensure that client devices can access the bundle without requiring any kind of manual authentication or sign-in.

Invalid bundle/wrong signature - The app doesn't install or update

Contact the IWA developer to provide a valid IWA bundle.

This application is missing or damaged (after installation)

Contact the IWA developer because the sign-in key might have been rotated or the ID of this app could have been blocked.

Related topics

• Chrome app and extension policies
• Manage permissions for websites and web apps