Deploy Android apps to managed users on ChromeOS devices

1. Sign in to your Google Admin console.

   Sign in using your administrator account (does not end in @gmail.com).

2. In the Admin console, go to Menu  DevicesChromeApps & extensionsUsers & browsers.

   If you signed up for Chrome Browser Cloud Management, go to Menu  Chrome browserApps & extensionsUsers & browsers.
3. (Users only) To apply the setting to a group, do the following:
   1. Select Groups.
   2. Select the group to which you want to apply the setting.
4. (Optional) To apply the setting to a department or team, at the side, select an organizational unit. Show me how
5. On the right, click Additional settings .
6. Go to Additional app settings.
7. For Android apps on Chrome Devices, select Allow.
8. (Optional) For Android reporting for users and devices, select Enable Android reporting.
   The report only shows information for managed users using managed ChromeOS devices that support managed Google Play.
9. Click Save.

1. Sign in to your Google Admin console.

   Sign in using your administrator account (does not end in @gmail.com).

2. In the Admin console, go to Menu  DevicesChromeSettings. The User & browser settings page opens by default.

   If you signed up for Chrome Enterprise Core, go to Menu  Chrome browserSettings.

3. (Optional) To apply the setting only to some users and enrolled browsers, at the side, select an organizational unit (often used for departments) or configuration group (advanced). Show me how

   Group settings override organizational units. Learn more

4. Go to Android apps.
5. (Optional) To stop users from adding a second Google Account:
   1. Click Account management.
   2. Check the Google account box.
   3. Click Save.
6. (Optional) To synchronize Google ChromeOS CA certificates available to Android apps:
   1. Click Certificate synchronization.
   2. Select Enable usage of ChromeOS CA certificates in Android apps.
   3. Click Save.

Settings typically take effect in minutes. But they might take up to an hour to apply for everyone.

1. Sign in to your Google Admin console.

   Sign in using your administrator account (does not end in @gmail.com).

2. In the Admin console, go to Menu  DevicesChromeApps & extensions. The Overview page opens by default.

   If you signed up for Chrome Browser Cloud Management, go to Menu  Chrome browserApps & extensions.

3. At the top, click Users & browsers or Kiosks.
4. (Users only) To apply the setting to a group, do the following:
   1. Select Groups.
   2. Select the group to which you want to apply the setting.
5. (Optional) To apply the setting to a department or team, at the side, select an organizational unit. Show me how
6. Click Add Add from Google Play .
7. Search for and click the app you’d like to manage.
8. Click Select.
9. To accept the app permissions on behalf of your organization, click Accept.

As an admin you have 2 ways to install apps for your users on ChromeOS devices. You can automatically install apps (Force install), or you can allow the user to manually install apps from managed Google Play (Allow install). You can also pin force-installed apps to the user’s taskbar and you can block users from installing apps.

Configure app installation settings

1. Sign in to your Google Admin console.

   Sign in using your administrator account (does not end in @gmail.com).

2. In the Admin console, go to Menu  DevicesChromeApps & extensionsUsers & browsers.

   If you signed up for Chrome Browser Cloud Management, go to Menu  Chrome browserApps & extensionsUsers & browsers.
3. (Users only) To apply the setting to a group, do the following:
   1. Select Groups.
   2. Select the group to which you want to apply the setting.
4. (Optional) To apply the setting to a department or team, at the side, select an organizational unit. Show me how
5. Click the app that you want to configure.
6. In the panel that opens on the right, under Installation policy, choose Allow install, Force install, Force install + pin to ChromeOS taskbar, or Block.
7. Click Save.

Note: While a force-installed app is downloading on ChromeOS devices, users see a STOP button. If they click it, the download stops. Another installation attempt is made at the next sign in. Install attempts continue until the app successfully installs or is no longer part of the list of apps that are force-installed.

Allow the installation of any app

Not available for education domains.

If you give your users full access to the managed Google Play store, they can search for and install any app on their ChromeOS devices, even apps you haven’t selected.

1. Sign in to your Google Admin console.

   Sign in using your administrator account (does not end in @gmail.com).

2. In the Admin console, go to Menu  DevicesChromeApps & extensionsUsers & browsers.

   If you signed up for Chrome Browser Cloud Management, go to Menu  Chrome browserApps & extensionsUsers & browsers.
3. (Users only) To apply the setting to a group, do the following:
   1. Select Groups.
   2. Select the group to which you want to apply the setting.
4. (Optional) To apply the setting to a department or team, at the side, select an organizational unit. Show me how
5. On the right, click Additional settings .
6. Go to Allow/block mode.
7. Click Edit.
8. Under Play Store, choose an option;
   • Allow all apps, admin manages blocklist—Users can install all apps from managed Google Play except the ones that you block.
   • Block all apps, admin manages allowlist—Users can only install the apps from managed Google Play that you allow.
9. Click Save.

(Optional) Add private apps

You can use the managed Google Play store to host private Android apps for your organization. You can control who can download an app, and you can benefit from security checks, such as user authentication and malware detection.

To deploy private Android apps to ChromeOS devices, first publish the apps to the managed Google Play store. For details, see Manage private Android apps in Google Play.

1. Sign in as an admin to managed Google Play.
2. On the left, click Admin Settings and note your Organization ID.
3. Go to the Google Play Console.
4. Select your private app.
5. Click Store Presence Pricing & distribution.
6. Check the Privately target this app to a list of organizations box.
7. Click Choose Organizations and add your Organization ID (noted in step 2).
8. Click Submit Update.

It might take up to 24 hours to see the app in the My managed apps list. The managed Google Play help center contains detailed information on how to manage apps and app licenses for use in your organization.

For some apps and extensions, you can install custom policies. For example, a digital signage kiosk app might have a schedule of events that’s contained in a JavaScript Object Notation (JSON) file.

1. Sign in to your Google Admin console.

   Sign in using your administrator account (does not end in @gmail.com).

2. In the Admin console, go to Menu  DevicesChromeApps & extensions. The Overview page opens by default.

   If you signed up for Chrome Browser Cloud Management, go to Menu  Chrome browserApps & extensions.

3. At the top, click Users & browsers or Kiosks.
4. (Users only) To apply the setting to a group, do the following:
   1. Select Groups.
   2. Select the group to which you want to apply the setting.
5. (Optional) To apply the setting to a department or team, at the side, select an organizational unit. Show me how
6. Find and click the app that you want to configure policies for.
7. In the panel that opens on the right, under Managed configuration, enter the JSON data in the text field.
8. Click Save.

Sample policy configuration files

The following sample configuration shows how to define a very restrictive block list that stops the app from accessing any URL. It also includes an allow list of specific URLs that the app can access:

{ "com.android.browser:URLBlocklist": "[\"*\"]"
"com.android.browser:URLAllowlist": "[\"solamora.com\", \"altostrat.com\”]" }

The following sample configuration shows how to specify all supported setting types (boolean, string, array, and object array):

{
"can_say_hello": true,
"message": "Hello, it's me",
"approvals": [ "read", "write" ],
"items": [{ "key": "key1", "value": "1"}, { "key": "key2", "value": "2"}]
}

Managed configuration files can be defined with any of the following placeholders. All values are optional.

• ${DEVICE_DIRECTORY_ID}—Device’s directory ID
• ${USER_EMAIL}—Signed-in user’s email address
• ${USER_EMAIL_DOMAIN}—Signed-in user’s domain name
• ${DEVICE_SERIAL_NUMBER}—Device's serial number
• ${DEVICE_ASSET_ID}—Asset ID assigned to device by administrator
• ${DEVICE_ANNOTATED_LOCATION}—Location assigned to device by administrator
• ${USER_EMAIL_NAME}—First part (part before @) of signed-in user’s email address

If a placeholder value isn’t available, it’s replaced with an empty string. Values are only provided for enrolled devices.