Manage private Android apps in Google Play

Make internal work apps available to users

This feature is available with Cloud Identity Free and Cloud Identity Premium editions. Compare editions

You can host Android apps specifically for your organization in the managed Google Play store and control who can download them. With managed Google Play, you also get security checks, such as user authentication and malware detection.

You can publish private apps to the Play store from the Google Admin console or the Google Play Console. After you add a private app to the apps list, users can download it from the managed Play Store on their Android device. It can take a few hours for the app to be available to users.

Before you begin

Read the following sections to decide how to publish your app and important considerations.

Expand section | Collapse all

Managing private apps in Admin console versus Google Play Console

You might want to use Google Play Console if the following is true:

You have existing private apps in Play Console. You can't manage existing private apps in the Admin console.

You might want to use Admin console if any of the following are true:

You don't plan on making your private apps public.
You don't want to pay a one-time $25 USD registration fee.
You want your apps list to include all managed apps—public mobile apps, SAML apps, and private apps.
You want to make the app available to only select organizational units and groups.

Important information about app publishing

Apps can't be published as a private app and in the public Google Play store at the same time. If an app with the same app ID was published by another organization (publicly or privately), you can’t publish the app until the developer changes the application ID for your variant. However, you can add public apps to your app list to make them available to your users as managed apps. This setup allows your users to easily find all work-related apps in one place.
If you publish an app to the public Google Play store, you can change it to a private app but you won't be able to manage it in your Admin console.
Private apps don't support billing features. Publishers can't charge for private apps.
In Play Console, you can't publish the app for a specific group of users. You can publish an app intended for a specific country or specific device models. If you want to beta test your app with specific groups, or Play Store users, you can set up alpha/beta testing.
The app must be less than the download size limit.

Option 1: Publish private apps from the Admin console

To upload and publish private apps in the Admin console, you only need an Android application package (APK) and a title. When you publish a private app for the first time, a Play Console account is created on behalf of your organization. Private apps are automatically approved for your organization and are typically ready for distribution within 10 minutes. You can upload up to 15 private apps per day.

Sign in to your Google Admin console.
Sign in using your administrator account (does not end in @gmail.com).
In the Admin console, go to Menu AppsWeb and mobile apps.
Click Add appAdd private Android app.
At the bottom, click Create .
Enter a title.
Click Upload APK.
Select an APK and click Open.
Click Select.
Set who can find and download the app.
- To let all users in your organization install the app, select Entire organization.
- To allow only certain users to install the app, click Select groups or Select organizational units. You can add both groups and organizational units. This feature is available with Cloud Identity Premium edition. Compare editions
  Groups settings are applied at the top organizational unit level and override organizational unit settings. If a user belongs to multiple groups with conflicting configurations, the settings are applied in order of group precedence, which you can set after you add the app.
Click Continue.
Set app options.
- Access method–Choose how users get the app. To apply a managed configuration before you force install an app, select Available, complete app setup, apply the managed configuration, then edit the app settings to force install the app.
  - Available—Let users install the app themselves. Users who don’t need the app don’t have to download it.
  - Force install—Automatically install the app on all managed devices with no option to opt out. Optionally, you can prevent users from uninstalling a force-installed app.
    Force install is also supported for basic mobile management with Business Plus, Enterprise, G Suite Business, and Cloud Identity Premium editions.
- Allow users to add widgets to home screen–Let users create a home screen shortcut when a widget is available.
- Use as the always-on VPN app–When turned on, app traffic from a work profile or managed device must pass through this app. Requires Android 7.0 or later. This setting creates a more secure network connection for work profile traffic.
- App auto-update timing—Choose when app updates should be installed:
  - Default—Update the app automatically when the device is connected to a Wi-Fi network, is charging, is not actively in use, and the app is not running in the foreground.
  - High priority—Update the app as soon as the developer publishes a new version and Google Play reviews it. If the device is offline at that time, the app immediately updates the next time the device connects to the internet.
  - Postpone—Postpone app updates for 90 days after the update first becomes available. After 90 days, automatically install the latest available version of the app. For details, see Support app updates.
  This feature is available with Cloud Identity Premium edition. Compare editions
- Testing tracks (optional)—Select prerelease test versions of the app that you want to make available to users. Selecting multiple tracks makes the highest version code available. To learn how to make an app available to organizations, see Closed test: manage testers by organization.
  This feature is available with Cloud Identity Premium edition. Compare editions
Click Finish.

Depending on the app, you might have more settings options. For details, see Configure app settings.

Edit and unpublish private apps from the Admin console

Expand section | Collapse all & go to top

Edit the title or APK of a private app

Sign in to your Google Admin console.
Sign in using your administrator account (does not end in @gmail.com).
In the Admin console, go to Menu AppsWeb and mobile apps.
Click Add appAdd private Android app.
Select the private app you want to edit.
Click Edit.
Update the title or click edit to upload a new APK.
Click Save.

Edit advanced private app details

To add a description, screenshots, and other advanced app details:

Sign in to your Google Admin console.
Sign in using your administrator account (does not end in @gmail.com).
In the Admin console, go to Menu AppsWeb and mobile apps.
Click Add appAdd private Android app.
Select the private app you want to edit.
Click Make advanced edits.
Go to GrowStore presenceMain store listing.
Make any edits and click Save.

Unpublish a private app

If you unpublish a private app, the app isn't available for new users to find and download in managed Google Play. However, existing users can still use your app.

To unpublish an app:

Sign in to your Google Admin console.
Sign in using your administrator account (does not end in @gmail.com).
In the Admin console, go to Menu AppsWeb and mobile apps.
Click Add appAdd private Android app.
Select the private app you want to unpublish.
Click Make advanced edits.
Using a Google Account, sign in to the Play Console. You can use this account in the future to sign into the Play Console.
Go to ReleaseSetupAdvanced settings.
In the App Availability section, select Unpublish.

Option 2: Publish private apps from the Play Console

For instructions, see Publish private apps from the Play Console. Note: To avoid the registration fee, follow the instructions in this article to publish private apps from the Admin console.

Set who can publish and access private apps

If you aren't the one who publishes private apps, you can allow other users or third-party developers to publish private apps. If your organization uses managed Play without an EMM (formerly called Google Play Private Channel) to grant access to private apps, you must explicitly allow users to access and download private apps. For instructions, see the following sections.

Expand section | Collapse all & go to top

Allow other users to publish private apps

To ensure your organization retains access to published apps when an employee leaves the organization, we recommend that administrators create dedicated role accounts. You can also configure an administrator role to upload private apps.

Before you begin: If you need to set up a department or team for this setting, go to Add an organizational unit.

Sign in to your Google Admin console.
Sign in using your administrator account (does not end in @gmail.com).
In the Admin console, go to Menu AppsAdditional Google services.
(Optional) To apply the setting to a department or team, at the side, select an organizational unit. Show me how
Turn on the Google Play Console for users in the selected organizational unit.
On the left of the Admin console, go to Devices Mobile & endpointsAndroid settings.
Click Apps and data sharingGoogle Play private apps.
(Optional) To apply the setting to a department or team, at the side, select an organizational unit. Show me how
To allow users in the selected organizational unit to publish private apps, check the Allow users to publish and update Google Play Private apps box.
Click Save. Or, you might click Override for an organizational unit.
To later restore the inherited value, click Inherit.

Allow third-party developers to publish apps

For instructions, see Publish private apps from the Play Console.

No EMM: Allow users to access private apps