Block apps in Google Admin and managed Google Play

Where to block apps in Google Workspace

Most confusion comes from one fact: Google Admin is not one MDM screen. App rules for Chromebooks sit under Chrome, rules for phones sit under Mobile and endpoints, and data access rules sit under Security. Use this map to find the right place first.

Allowlist or blocklist: which modes Google gives you

Google leans towards allowlists. That is safe, but it makes every new app request a ticket. Knowing which screens accept a blocklist tells you where a category file can do the heavy lifting.

Block Android apps on Chromebooks, step by step

These steps cover Google Play apps running on ChromeOS. Chrome extensions use the same Apps and extensions screen but are a different kind of app; see our page on Chromebook apps and extensions for those.

1. Accept the Play terms and add Android Enterprise. A super administrator must accept the Google Play terms, and Android Enterprise must be listed under Billing > Subscriptions. Without both, Android apps never appear.
2. Turn Android apps on for the right users. In the additional app settings, open Android apps on Chrome Devices and allow users to install Android apps. Apply it to a test organizational unit first.
3. Pick the allow or block mode. Business domains can choose Allow all apps, admin manages blocklist. Education domains will only see the allowlist mode.
4. Add the apps you want to control. On the Users & browsers tab, use Add from Google Play, search for the app and open it. The detail panel shows the package name, which is what our files list.
5. Set the installation policy. Choose Block for apps you do not want, Allow install for approved apps, or Force install for apps every student needs. Force install + pin also places the app on the shelf.
6. Save, then wait and test. Changes usually apply within minutes but can take up to an hour. Sign in as a test user and confirm the Play Store shows only what it should.

Limit Android phones and tablets to approved apps

For Android phones, Google endpoint management works on an approved list. You add apps under Apps > Web and mobile apps, then tell devices to offer only those apps.

1. Set up advanced mobile management. The Available apps setting and blocking unmanaged installs both require it, plus the Mobile Device Management administrator privilege.
2. Build the approved list. Go to Apps > Web and mobile apps, click Add app, then Search for apps. Choose the users or organizational units, then set the access method to Available or Force install.
3. Switch on the allowlist. Open Devices > Mobile & endpoints > Settings > Android, then Apps and data sharing > Available apps, and select Only allowed apps. Save, or Override for a child unit.
4. Handle what is already installed. The switch blocks new installs only. Apps already on the device stay, so clean them up or re-provision devices that matter.
5. Allow up to a day. Google says this change can take up to 24 hours, though it is usually faster. Test on one device before widening the scope.

iPhones and iPads in Google Admin

Google endpoint management can secure iPads and iPhones, but its app controls are narrow. Know the limits before you promise a principal that a game will vanish from every iPad.

How an AppBlockList file plugs into Google Admin

Our blocklists ship as Android package lists, iOS bundle ID lists, CSV files with every column and Apple configuration profiles. In Google Admin, each one has a clear job.

Example lines from an Android package file: TikTok, Snapchat, Roblox, NordVPN, Turbo VPN, ChatGPT, DraftKings Sportsbook and Tinder. Real files hold every app in the categories you pick, refreshed monthly.

Test before you roll out

A ten-minute test on one device saves a morning of help desk calls. Run through this list with a test account in its own organizational unit.

• Create a test organizational unit and put one test user and one device in it.
• Confirm group settings do not override it: groups beat organizational units.
• On the Chromebook, open the Play Store and search for a blocked app by name.
• Try a force-installed app: it should appear without the user doing anything.
• On a phone, open the work Play Store and check only approved apps are listed.
• Install an app before the policy, then apply it, and note that it stays.
• Check an iPad with App installation off: the App Store icon should be gone.
• Write down the time of each change so you can judge how long sync took.

Common errors and how to fix them

These are the problems admins hit most often when they block apps in Google Admin. Each one has a simple cause.

Related Google Admin tasks people mix up

Searches for blocking apps often turn out to be about websites, email or Workspace services. Here is where each of those lives, in brief.

Questions admins ask

Want to check an app before you decide? Our package name lookup gives a few free lookups a day, and the VPN and proxy apps list shows the category most schools block first.