Troubleshoot mobile app management

When you turn on advanced mobile management, if a user hasn't set up Android Device Policy on their Android device, or installed Google Device Policy app on the iOS device, they may not be able to find and install work apps.

Android: If an Android user can't access managed Google Play , have them follow the troubleshooting instructions in About Android Device Policy.

iOS: If an iPhone or iPad user can't download apps through Google Device Policy app or doesn't have Google Device Policy app installed, have them follow the instructions in Use the iOS Google Device Policy app.

When you add a third-party app, private Android app (in the Admin console), private Android web apps, or private iOS app, you might set which organizational units and groups have access. If a user isn't in an organizational unit or group with access, they can't install the app.

To check if the app is available for the user, first make a note of the app's availability:

1. Sign in to your Google Admin console.

   Sign in using your administrator account (does not end in @gmail.com).

2. In the Admin console, go to Menu  AppsWeb and mobile apps.

3. In the list of apps, point to the app and click Access details.
4. Make a note of which organizational units and groups the app is turned on or off for.

Now check the user's organizational units and groups:

1. At the left, click DirectoryUsers.
2. Locate the user in the list and click their name.
3. Under their name, review the organizational units the user is in.
4. In the Groups panel, review the groups the user owns, manages, or is a member of. You might need to click Groups to see the entire list.

If the app is turned off for the user's organizational unit or group, you have different options, depending on your organization's user management strategy:

• Move the user to an organizational unit the app is turned on for.
• Add the user to a group the app is turned on for.
• Turn on access for an organizational unit or group, or change the priority of groups so the app is turned on for the user's group.

If you use advanced mobile management, Google endpoint management gives you many ways to block access to an app. The following steps show you how to check the settings that might block app installation.

Troubleshoot Android apps

1. Sign in to your Google Admin console.

   Sign in using your administrator account (does not end in @gmail.com).

2. In the Admin console, go to Menu  DevicesMobile and endpointsSettingsAndroid.
3. Click Apps and data sharing and review the following settings for the user's organizational unit:
   1. Available apps–When set to Only allowed apps, the app must be in the managed apps list for the user to install it. If the app isn't in the list, you can add the app to the list.
   2. System apps–When set to Block all or Block all except specified system apps, some system apps might be blocked on company-owned devices. If the app is a system app, you can add the app to the exceptions list.
   3. Unknown sources–When checked, users can't install apps from sources other than the Google Play Store. We recommend that you keep the box checked to prevent users from installing malicious apps.

Troubleshoot iOS apps

1. Sign in to your Google Admin console.

   Sign in using your administrator account (does not end in @gmail.com).

2. In the Admin console, go to Menu  DevicesMobile & endpointsSettingsiOS.
3. Click Apps and services and for the user's organizational unit, click App installation. When Allow users to install apps is unchecked, users can only install managed apps (apps added to your devices list) through the Google Device Policy app. If the app isn't in the list, you can add the app to the list.

To install private iOS apps or private Android web apps, a user must have a Google Workspace license and device that supports advanced mobile management. For details, see the Device requirements for Google endpoint management.

Some apps are restricted geographically. Ask the app developer if any restrictions are in place.

On supervised, company-owned iPhones and iPads, you have the option to turn off access to many iOS apps.

To determine if a specific app is blocked by admin settings:

1. Sign in to your Google Admin console.

   Sign in using your administrator account (does not end in @gmail.com).

2. In the Admin console, go to Menu  DevicesMobile & endpointsSettingsiOS.
3. Review the features and apps listed in the following sections:
   1. Safari–If Allow Safari is unchecked, users can't use Safari.
   2. Device features–Options in this section control iOS features such as account settings, ScreenTime, and Wallpaper.
   3. Apps and services–Options in this section control iOS features such as Find My Device, Find My Friends, and Notifications.
   4. Apple apps–Options in this section control iOS apps such as FaceTime, iTunes, Apple News, and more.

For details, see the iOS settings reference.

If your organization set up CAA policies on web or mobile apps, the user's device may not meet the criteria required for access.

To determine why access to an app was denied, review the CAA audit log. For instructions, see Context-Aware Access log events.

Even when you add an app to your managed devices list, the app can still be blocked by App Access Control. To check the status of an app:

1. Sign in to your Google Admin console.

   Sign in using an account with super administrator privileges (does not end in @gmail.com).

2. In the Admin console, go to Menu  SecurityAccess and data controlAPI controlsManage Third-Party App Access.
   You must be signed in as a super administrator for this task.

3. In the Accessed apps card at top right, click View list.
4. Find the app in the list. If App access is set to Blocked, the user might not be able to use the app as expected.

If a user can't uninstall an Android app, this might be because you force-install the app and don't allow it to be removed. Or, for company-owned devices, this might be because you prevent users from uninstalling any iOS or Android apps.

To check if an Android app was force installed and not allowed to be removed:

1. Sign in to your Google Admin console.

   Sign in using your administrator account (does not end in @gmail.com).

2. In the Admin console, go to Menu  AppsWeb and mobile apps.

3. In the list of apps, click the app and then Settings.
4. If you control app settings by organizational unit or group, select the group or organizational unit the user is a member of.
5. Review the value of Access method. If it's set to Force install, check if Prevent users from uninstalling the app is turned off.
6. If it's turned off and you want to let users in that organizational unit or group uninstall the app, change the value to On and click Save.

To check if your admin settings block app removal on company-owned Android devices:

1. Sign in to your Google Admin console.

   Sign in using your administrator account (does not end in @gmail.com).

2. In the Admin console, go to Menu  DevicesMobile and endpointsSettingsAndroid.
3. Click Apps and data sharingApps settings. If it's turned off (unchecked) for the user's organizational unit, they can't uninstall or disable apps.

To check if your admin settings block app removal on company-owned iOS devices:

1. Sign in to your Google Admin console.

   Sign in using your administrator account (does not end in @gmail.com).

2. In the Admin console, go to Menu  DevicesMobile & endpointsSettingsiOS.
3. Click Apps and servicesApp removal. If it's turned off (unchecked) for the user's organizational unit, they can't uninstall apps.
4. Click System app removal. If it's turned off (unchecked) for the user's organizational unit, then they can't uninstall system apps.