MDM guide: Google Play restrictions

How to block the Google Play Store and Play Store downloads

On Android you rarely delete the Play Store. You decide what it is allowed to show. Family Link does that for a child's phone, and managed Google Play does it for school and work devices. This guide covers both, plus the side doors that a Play block does not close.

Children's phones
School Android tablets
Work phones
Chromebooks

Google Play Store app

Google LLC · preinstalled Android system app

Android package name: com.android.vending
Can a user uninstall it?: No. It ships with the system image on certified Android devices.
What it also does: Installs and updates every managed app your MDM sends
Best control: Limit what it shows, rather than removing it

2 routes

Family Link for families, managed Google Play for organizations

Allow list

is the default on fully managed Android Enterprise devices

1 package

com.android.vending, if you must hide the store itself

Separate

controls needed for sideloading, other stores and VPNs

Which method fits your devices?

The right control depends on who owns the phone and how it was set up. Pick the row that matches your device, then jump to that section.

Device	Main control	What the user sees in Play
Child's personal Android phone	Google Family Link: approvals and content ratings	The full store, but installs wait for a parent, and apps above the rating are filtered
School tablet, fully managed	Managed Google Play with an allow list	Only the apps IT approved
Company phone, fully managed	Managed Google Play with an allow list	Only the apps IT approved
Company phone with a work profile	Allow list in the work profile, plus personal side rules on company-owned devices	A work Play Store with approved apps, and the normal personal store
Personal phone with a work profile (BYOD)	Work profile only	IT controls the work store, not the personal one
Kiosk or single purpose device	Dedicated device mode with a locked launcher	No store at all
School Chromebook	Google Admin: Android apps allow list	Only approved Android apps

For the Apple side of the same question, see blocking the App Store on supervised iPhones and iPads, or the wider guide to blocking apps on Android.

Block Play Store downloads on a child's phone with Family Link

Family Link is Google's parental control app for children's Google Accounts. It does not hide the Play Store. It puts a parent between the child and every install.

Require approval for downloads

Open the Family Link app on the parent's phone and select the child.
Go to Controls, then Content restrictions, then Google Play.
Open the purchase and download approval setting.
Choose approval for all content, so free apps need a yes too.
Test it: the child taps Install and the parent gets a request.

Approval for paid content only still lets free games and free VPN apps through. Pick all content.

Set content ratings for apps and games

In the same Google Play screen, open Apps and games.
Pick the highest rating the child may install, for example a rating for ages 10 and up.
Apps above that rating drop out of search and browse for the child.
Repeat for films and books if the child uses those parts of Play.

Rating names follow your country's system. They come from the developer's answers to a questionnaire, not from a review of chat or ads.

Block apps already on the phone

Ratings and approvals stop new installs. They do not remove apps the child already has.
In Family Link, go to Controls, then App limits.
Find the app and set it to Block, or give it a daily time limit.
Check the list again after each approval, since a new app starts as allowed.

Some core system apps cannot be blocked this way. The Play Store is one an Android phone needs for updates.

Know where Family Link stops

At 13, or the age of consent in your country, a child can choose to stop supervision. The parent is notified and the phone locks for a while.
Approvals cover Google Play only. Apps from other stores are a separate setting on the device.
Family Link does not filter the open web the way a network filter does.
It is built for one family, not for a class set of tablets.

Google's Family Link help center lists the current menus for each Android version.

Managed Google Play: an allow list for school and work devices

On a device enrolled in Android Enterprise, the Play Store becomes a managed store. It shows the apps your organization approved and nothing else. This is the Android version of an app allowlist.

Fully managed

The company or school owns the device and enrolls it at setup.
By default users see only the apps in the policy. In the Android Management API this is the allow list Play Store mode.
Switching to the open mode shows the whole store, minus the apps you mark as blocked.

Work profile, company-owned

A separate work profile has its own Play Store with a briefcase badge, limited to approved apps.
The personal profile has its own store. Most MDMs can set a blocked or allowed apps list for it.
Use this when staff carry one phone for both roles.

Work profile, personal phone

IT controls only the work profile and its store.
The personal Play Store, and every game in it, stays the owner's business.
If games must be gone entirely, the device needs to be company-owned.

Allow list or block list? An allow list is stricter and needs less upkeep, because new apps are blocked until someone approves them. A block list is easier on users but needs a constant feed of new IDs. Our page on app allowlists versus blocklists weighs both, and the Android work profile guide covers the personal side in detail.

Google documents the policy fields in its Android Management API developer docs, which most MDMs build on.

Hide the Play Store app itself: com.android.vending

Sometimes a policy says the store icon must be gone. Android lets a device owner hide system apps, and the Play Store's package name is com.android.vending, the name it has had since the store was called Android Market.

Think before you hide it. Managed Google Play installs and updates apps through the Play Store app. On most setups, hiding com.android.vending also stops your MDM from pushing apps and updates. Restrict the store's content first, and hide it only on kiosk style devices where nothing new needs to arrive.

Microsoft Intune

Go to Devices, Configuration, Create, New policy, and pick Android Enterprise with the Device restrictions template for fully managed, dedicated and corporate-owned work profile devices.
Under Applications, leave Allow access to all apps in Google Play store turned off, so users see only assigned apps.
Set Allow installation from unknown sources to off.
For a device with no store at all, use dedicated device mode with Managed Home Screen and leave the Play Store off the allowed apps.

Full walk-through in our Intune app blocking guide.

Google Admin console

With advanced mobile management on, go to Menu, Apps, Web and mobile apps, and add only the Android apps you approve.
In the Android settings for the organizational unit, set the available apps option so users can install only allowlisted apps.
Set the unknown sources option to block installs from outside Play.
Apply to a test organizational unit and sync a phone.

Removing an app from the list does not uninstall copies already on phones. See our Google Admin guide.

Workspace ONE UEM

Add approved apps from managed Google Play under Resources, Apps, Native, Public.
In an Android Restrictions profile, keep Play Store access limited to approved apps and turn off installs from unknown sources.
To hide the store on a single purpose device, use the system app settings in the profile and list com.android.vending.
Assign to a smart group of test devices first.

Labels differ between console versions. Our Workspace ONE guide shows both blocklist and allowlist setups.

Hexnode UEM

Create or open an Android policy and approve apps through the managed Google Play integration.
Under app management, set an allowlist so only listed apps can run, or a blocklist for apps that must not.
Add com.android.vending to the blocklist only on devices that receive apps another way, such as kiosk mode.
Associate the policy with a test device and confirm the result.

More options in our Hexnode app blocking guide and the Meraki Systems Manager guide.

Block games and whole categories, not one app at a time

The most common reason to restrict Play is games. There is no single switch in Play for "no games" on a managed device, so you either approve a short list of apps or block games by their package names.

Game	Android package	iOS bundle ID	App Store ID
Roblox	com.roblox.client	com.roblox.robloxmobile	431946152
Minecraft	com.mojang.minecraftpe	com.mojang.minecraftpe	479516143
Brawl Stars	com.supercell.brawlstars	com.supercell.laser	1229016807
Subway Surfers	com.kiloo.subwaysurf	com.kiloo.subwaysurfers	512939461
PUBG MOBILE	com.tencent.ig	com.tencent.ig	1330123889
Free Fire	com.dts.freefireth	com.dts.freefireth	1300146617
Google Play Games (game hub)	com.google.android.play.games	Android only	Android only

Package names and bundle IDs often differ. Brawl Stars is com.supercell.brawlstars on Android but com.supercell.laser on iOS. Never copy an iOS ID into an Android policy without checking. The package name lookup and bundle ID lookup give you the right string for each platform.

Android packages, one per line

com.roblox.client
com.mojang.minecraftpe
com.supercell.brawlstars
com.kiloo.subwaysurf
com.tencent.ig
com.dts.freefireth
com.google.android.play.games

Matching iOS bundle IDs

com.roblox.robloxmobile
com.mojang.minecraftpe
com.supercell.laser
com.kiloo.subwaysurfers
com.tencent.ig
com.dts.freefireth

Seven games is a start. The Games category holds many thousands of titles, and new ones appear every week. Read how to block games on school devices for the category approach.

Chromebooks and Google Play

Most school Chromebooks can run Android apps from Google Play. With a managed account, that Play Store shows only what the admin allows.

Turn Android apps off

In Google Admin, under Devices, Chrome, Settings, find the setting for Android apps on Chrome devices and disallow them. The Play Store disappears from the device.

Or allow a short list

Go to Devices, Chrome, Apps and extensions, Users and browsers, and add approved Android apps. Education domains run in allowlist mode, so anything not added stays unavailable.

Then cover the web

Many games run in the browser too. Add a URL blocklist and an extensions policy, as set out in our guide to Chromebook apps and extensions.

Network-level blocking of Play downloads, and its limits

Blocking Play traffic on a router or DNS filter sounds simple. In practice it is a blunt tool that breaks more than it fixes.

Shared infrastructure

Play downloads come from Google content servers that also deliver app updates, security patches and Google services. Block them and every app stops updating.

No per-app view

A DNS filter sees Google domains, not which app is downloading. It cannot block one game and allow a reading app.

Off the network

On mobile data, a hotspot or home Wi-Fi, the block is gone. The app that downloaded at home then runs at school.

The store website

Blocking play.google.com in a browser policy stops people browsing the store on a laptop. It does not stop the Play Store app on a phone.

Game traffic

Blocking the servers of a specific game can stop it from working on your network, which helps on guest Wi-Fi you cannot manage.

Use it as a second layer

Pair a network filter with device controls. The device stops installs everywhere, and the network covers devices you do not own.

What a Play Store block does not cover

Restricting Play closes the main door. These routes stay open until you close them on purpose.

Route	Covered by the Play block?	How to close it
Sideloading an APK file from a website or chat	No	Turn off installs from unknown sources in the MDM. Fully managed devices block this by default, but check the policy. On a child's phone, check the Install unknown apps setting.
Device maker stores, such as the store Samsung preinstalls	No	Disable the store's package as a system app in your MDM, or use an allow list of apps that may run.
Third party stores and APK sites	No	Block unknown sources, and add store and downloader apps to your blocklist in case one slips through.
Web versions of games and social apps	No	Browser URL policy and a network filter. Block other browsers so the policy cannot be dodged.
VPN and proxy apps installed earlier	No	Block the VPN category by package name and set an always-on VPN of your own where your MDM supports it. See blocking VPN apps.
Apps installed before enrollment	No	Fully managed enrollment starts from a wiped device. On older enrollments, block or uninstall apps by package.
A second user or guest profile	Sometimes	Turn off adding users in the MDM restrictions, so nobody can make a profile without the policy.
Family Link once a teen stops supervision	No	Talk it through at home first. Family Link tells the parent when it happens.

Students are inventive. Our guide to how students get around restrictions lists the other tricks, and the VPN and proxy apps list shows how many tunnel apps there are.

Android settings that close the side doors

Most Android MDMs expose the same underlying restrictions. Names vary by console, but these are the ones to look for next to your Play settings.

Unknown sources

Stops APK installs from browsers, file managers and chat apps.

installUnknownSourcesAllowed

Play Store mode

Allow list shows only approved apps. Block list shows the whole store, minus blocked apps.

playStoreMode

Blocked install type

Marks a package as blocked, so it cannot install and is removed if present.

installType: BLOCKED

Add users

Stops new profiles that would not carry your policy.

addUserDisabled

Factory reset

Stops a reset that would wipe the policy along with the apps.

factoryResetDisabled

Developer options

Stops USB debugging, which can install apps from a computer.

debuggingFeaturesAllowed

Always-on VPN

Routes traffic through your own VPN or filter, which leaves no room for another.

alwaysOnVpnPackage

Personal store, COPE

Sets an allow or block list for the personal profile on company-owned work profile devices.

personalPlayStoreMode

Field names are from the Android Management API. Your console shows them as plain language switches.

How to test the Play Store restriction

Test on one device of each type before you roll out. Keep one unrestricted device to compare against.

Open the Play Store on a managed test phone. Only approved apps should appear in search.
Search for Roblox or another blocked game. It should not install, or should not appear at all.
Push a new approved app from the MDM. It should install without the user opening the store.
Push an update to an existing app and confirm it applies.
Download an APK in the browser and try to open it. The install should be refused.
On a child's phone, tap Install on a free app and confirm the parent gets an approval request.
On a Chromebook, confirm the Play Store is gone or shows only allowed apps.
Try to add a new user or guest profile, and try opening a VPN app you blocked.

Keep the list current with category files

An allow list works well until the approved set grows. A block list works well until a new game ships. Either way, someone has to maintain the IDs.

Package names by hand

You search for each game and copy its package name.
New releases and clones get through until a student finds them.
Separate lists for Android, iOS and Chromebooks.
No easy way to check an app request against a category.

AppBlockList category files

Pick Gaming, Social Networking, VPN / Proxy / Anonymizers or any of the 58 filtering categories.
Get an Android package list, an iOS bundle ID list, a .mobileconfig profile, Intune and Jamf files and a CSV.
Refreshed monthly, so new titles join the list without extra work.
Check app requests with the app categorization API.

Blocklists for MDM cost $99 a month or $990 a year per organization. See how the MDM app blocklist feed works, or browse the mobile app database.

Google Play blocking FAQ

How do I block the Play Store on an Android phone?

On a company or school device, enroll it in Android Enterprise and leave the managed Google Play store in allow list mode, so it shows only approved apps. On a child's phone, use Family Link to require approval for all downloads and set a content rating. Hiding the Play Store app, package com.android.vending, is possible on fully managed devices but usually stops managed app installs and updates too.

Can I block the Google Play Store with Family Link?

Family Link does not remove the Play Store, which Android needs for updates. Instead, require parent approval for all content and set the highest content rating allowed for apps and games. Use App limits in Family Link to block apps the child already has.

What is the package name of the Google Play Store?

The Google Play Store app uses the Android package name com.android.vending. It is a preinstalled system app, so users cannot uninstall it, but a device owner MDM can hide or disable it.

How do I block games on the Play Store?

On a child's phone, set a lower content rating for apps and games in Family Link and require approval for every download. On managed devices, keep the store in allow list mode so no games are approved, or block game package names such as com.roblox.client. A category blocklist covers thousands of games without typing each one.

Will hiding the Play Store stop my MDM from installing apps?

On most Android Enterprise setups, yes. Managed Google Play delivers apps and updates through the Play Store app, so hiding com.android.vending can break both. Limit what the store shows instead, and hide it only on kiosk devices that need nothing new.

Does blocking the Play Store stop sideloaded apps?

No. APK files from websites, chat apps or other stores install outside Google Play. Turn off installs from unknown sources in your MDM, and on a child's phone check that the Install unknown apps setting is off for browsers and file managers.

Can I block Play Store downloads on my Wi-Fi network?

Only roughly. Play downloads share Google servers with app updates and system services, so a network block breaks updates for everything, and it stops working as soon as the device uses mobile data. Use device controls first and a network filter as a second layer.

How do I stop Android apps on a school Chromebook?

In Google Admin, either disallow Android apps on Chrome devices, which removes the Play Store, or add only approved Android apps under Apps and extensions. Education domains run in allowlist mode, so apps that are not added stay unavailable.

Block the games, not the whole store

Android package lists by category, ready for managed Google Play, Intune and any other MDM, with matching iOS files. Refreshed every month.

See plans How the feed works

Google, Android, Google Play, Google Play Games, Family Link, Chrome, Chromebook and Google Admin are trademarks of Google LLC. Microsoft Intune is a trademark of Microsoft Corporation. Workspace ONE is a trademark of Omnissa. Hexnode is a trademark of Mitsogo Inc. Cisco Meraki is a trademark of Cisco Systems, Inc.

Roblox, Minecraft, Brawl Stars, Subway Surfers, PUBG MOBILE, Free Fire, Samsung and the other app and company names shown belong to their respective owners.

Names are used only to identify the products discussed. AppBlockList is not affiliated with, sponsored or endorsed by these companies.