Control Apps and Extensions on School Chromebooks
A school Chromebook runs three kinds of add-on software: Chrome extensions, Android apps from Managed Google Play and web apps. Each has its own switch in the Google Admin console, and an open switch is where workarounds start.
Three kinds of software on a school Chromebook
Before you change a setting, know which of the three you are dealing with. They use different identifiers, sit under different menus and carry different risks.
Chrome extensions
- What it is
- Small add-ons inside the Chrome browser that can read or change the pages a student opens.
- Where you control it
- Apps & extensions > Users & browsers, plus the Chrome Web Store setting under Allow/block mode.
- Identifier
- A 32-character extension ID, visible in the item's Chrome Web Store address.
- Typical risk
- Proxy and VPN extensions, game portals packaged as extensions, and add-ons asking for access to every site.
Android apps
- What it is
- Phone-style apps from Managed Google Play that run on the Chromebook next to the browser.
- Where you control it
- User app settings > Android apps on Chrome Devices, and the Play Store option under Allow/block mode.
- Identifier
- A package name, for example com.google.android.apps.classroom for Google Classroom.
- Typical risk
- Android browsers and VPN apps. An Android browser is a separate browser, so your Chrome browser settings do not apply inside it.
Web apps and PWAs
- What it is
- Websites installed like apps, with their own window and icon. Progressive web apps (PWAs) can also work offline.
- Where you control it
- Add by URL in Apps & extensions to push them; site access stays with URL blocking and your web filter.
- Identifier
- The web address of the app.
- Typical risk
- Low on its own, because the traffic is ordinary web traffic that your filter already sees.
What AppBlockList covers here: Android package names for the apps students can run on Chromebooks, sorted into category lists such as VPN and proxy, games, social media, chat, AI chat and browsers.
We do not publish Chrome extension lists. For extensions, the Chrome Web Store allowlist mode is the dependable control.
Where the controls live in Google Admin
Every path below starts from Menu > Devices > Chrome in the Admin console, apart from the two Google services rows. Select the organizational unit first, because each setting can differ per unit.
| Control | Path | Options you will see |
|---|---|---|
| Turn Android apps on or off | Apps & extensions > User app settings > Additional app settings > Android apps on Chrome Devices | Allow users to install Android apps, or leave it off so the unit has no Play Store at all |
| Play Store mode | Apps & extensions > User app settings > Allow/block mode > Play Store | Allow all apps, admin manages blocklist; Block all apps, admin manages allowlist |
| Chrome Web Store mode | Apps & extensions > User app settings > Allow/block mode > Chrome Web Store | Allow all apps, admin manages blocklist; Block all apps, admin manages allowlist; Block all apps, admin manages allowlist, users may request extensions |
| Policy for one app or extension | Apps & extensions > Users & browsers > select the item > Installation policy | Force install; Force install + pin to ChromeOS taskbar; Force install + pin to browser toolbar; Force install, allow users to disable; Allow install; Block; Block, uninstall from Chrome |
| Add an item | Apps & extensions > Users & browsers > Add menu | Add from Chrome Web Store; Add from Google Play; Add Chrome app or extension by ID; Add by URL; Add an Isolated Web App |
| Block by permission | Apps & extensions > User app settings > Additional app settings > Permissions and URLs | Tick each permission that extensions may not use, such as USB device access |
| Second Google account in Play | Devices > Chrome > Settings, Android apps section | Account management setting that stops users adding a second Google Account |
| Chrome Web Store service | Apps > Additional Google services | Must be on for students to browse even approved items; off by default in some education domains |
| YouTube access | Apps > Additional Google services > YouTube > Permissions | Strict restricted YouTube access; Moderate restricted YouTube access; Unrestricted YouTube access; Can approve videos |
Google moves labels from time to time. If a name differs in your console, search the setting name in the Admin console search bar. Google also limits group-based app policies: apps multiplied by groups cannot exceed 500, so keep group rules lean.
Allowlist or blocklist: picking the mode for students
The Allow/block mode decides your daily workload. A blocklist means chasing every new proxy extension. An allowlist means answering requests. For students, answering requests is the lighter job.
Allow all apps, admin manages blocklist
- Students can install anything you have not blocked.
- Every new unblocker or game extension is open until someone reports it.
- Fits staff units, where trust is higher and requests are rare.
Block all apps, admin manages allowlist
- Students see only the extensions and Android apps you approved.
- New look-alike apps never reach a device unless you add them.
- Fits elementary and middle school units.
Block all apps, admin manages allowlist, users may request extensions
- Same lock as the allowlist, plus a request button for extensions in the Web Store.
- You then allow, block or force-install what students asked for.
- Fits high schools, where requests are frequent and varied.
A practical split by organizational unit
| Unit | Chrome Web Store | Play Store | Notes |
|---|---|---|---|
| Elementary students | Allowlist | Android apps off, or a short allowlist | Most learning tools here are websites; few classes need Android apps. |
| Middle school students | Allowlist with requests | Allowlist | Approve requests in batches once a week to keep the queue small. |
| High school students | Allowlist with requests | Allowlist | Check each request against our category lists before approving. |
| Teachers and staff | Blocklist | Blocklist | Block the risky categories (VPN, remote access, gambling) and leave the rest open. |
| Testing carts | Kiosk app only | Off | Use a single-app kiosk under Apps & extensions > Kiosks during exams. |
On education domains Google does not offer the option that lets users install any Play app, so a student unit always runs either an allowlist or a blocklist. Our guide on app allowlists versus blocklists covers the trade-offs in more depth.
How to block apps on a Chromebook: Android apps step by step
These steps cover the Android side, where package names and our category files do the work. The extension side follows in the next section.
- Decide whether the unit needs Android apps at all. If no class depends on one, leave Android apps on Chrome Devices off. That removes the Play Store and every Android browser and VPN app in one move.
- Set the Play Store mode for students. Choose Block all apps, admin manages allowlist. With an allowlist in place, users also cannot switch to a secondary account inside Managed Google Play.
- Add the approved apps. Use Add from Google Play, then set each app to Allow install or Force install. Force install + pin to ChromeOS taskbar puts it on the shelf and stops removal.
- For blocklist units, add the blocks. Add each unwanted app and set Installation policy to Block. Our category files list the package names to add, so nobody types them from memory.
- Audit once a month. Export the apps and extensions usage report and compare the installed Android packages with our CSV. VPN, browser and game apps that slipped through show up by category.
- Remove what should not be there. Set the app to Block, or use Remove on the app in the console, then save. Changes usually land within minutes and can take up to an hour.
VPN and proxy apps
- NordVPNcom.nordvpn.android
- Psiphoncom.psiphon3
- Turbo VPNfree.vpn.unblock.proxy.turbovpn
- Hotspot Shieldhotspotshield.android.vpn
- Cloudflare 1.1.1.1 (WARP)com.cloudflare.onedotonedotonedotone
- Windscribecom.windscribe.vpn
Other browsers
- Firefoxorg.mozilla.firefox
- Operacom.opera.browser
- Bravecom.brave.browser
- DuckDuckGocom.duckduckgo.mobile.android
- Puffin Browsercom.cloudmosa.puffinFree
- Tor Browserorg.torproject.torbrowser
Games
- Robloxcom.roblox.client
- Minecraftcom.mojang.minecraftpe
- Among Uscom.innersloth.spacemafia
- Subway Surferscom.kiloo.subwaysurf
- Gacha Lifeair.com.lunime.gachalife
- 8 Ball Poolcom.miniclip.eightballpool
Social and chat
- TikTokcom.zhiliaoapp.musically
- Instagramcom.instagram.android
- Snapchatcom.snapchat.android
- Discordcom.discord
- Telegramorg.telegram.messenger
- WhatsAppcom.whatsapp
AI chat and homework solvers
- ChatGPTcom.openai.chatgpt
- Google Geminicom.google.android.apps.bard
- Character.AIai.character.app
- Gauthcom.education.android.h.intelligence
- Brainlyco.brainly
Remote access
- TeamViewercom.teamviewer.teamviewer.market.mobile
- AnyDeskcom.anydesk.anydeskandroid
These are well-known examples only. The category files carry the rest of each category, including the clones that appear every month. Check any single package with the Android package name lookup, and see the full picture on the VPN and proxy apps list and the AI apps list.
Chrome extensions: allow, block and force-install by ID
- Find the extension ID. Open the item in the Chrome Web Store. The 32-character string at the end of the address is its ID.
- Add it by ID. In Users & browsers, open the Add menu, choose Add Chrome app or extension by ID, paste the ID and save.
- Pick the installation policy. Force install suits filter, classroom and accessibility extensions. Students cannot remove a force-installed extension.
- Block single items. Set Block to stop installs, or Block, uninstall from Chrome to also remove copies already installed.
- Block by permission. Under Permissions and URLs, tick permissions you never want granted. That stops whole groups of extensions you have not reviewed.
Force-install comes first
Force-installed items install even when the Chrome Web Store mode blocks everything, and even when the Web Store service is turned off. That is why your filter and classroom extensions should always be force-installed.
Extension types to keep off student units
- Proxy and VPN extensions that tunnel traffic past the filter
- Game portals and "unblocked games" packaged as extensions
- AI writing sidebars, if your AI policy says no
- Screen recorders and screenshot tools during tests
- Anything that wants to read and change data on all websites
One trap: turning the Chrome Web Store service off does not stop sideloaded extensions by itself. Keep the allowlist mode in place as the main control, and treat the service switch as a convenience.
Web apps and PWAs versus Android apps
Many services offer both a website and an Android app. On a Chromebook, the web version is often the easier one to manage, because Chrome extensions and the browser's settings only see browser traffic.
| Question | Web app or PWA | Android app |
|---|---|---|
| Can a filter extension in Chrome see the traffic? | Yes, it runs inside the browser | No, a Chrome extension does not see Android app traffic; you need a network or DNS filter |
| How do you push it? | Add by URL, then force-install and pin | Add from Google Play, then Force install |
| Does the student need Play access? | No | Yes, Android apps must be on for the unit |
| Who controls updates? | The service, on its own servers | Google Play, on the device |
| When is it the right pick? | Most learning platforms, quizzes, reading sites | Offline use, camera features, or tools with no web version |
Add by URL
Pushes a website as an installed app. Pair it with Force install + pin to ChromeOS taskbar so it sits on the shelf from the first sign-in.
Isolated Web Apps
A packaged form of web app that the Add menu now lists. Useful for kiosk-style and high-trust tools; check your vendor's guidance first.
Old Chrome apps
The kiosk settings include an option to keep using Chrome apps for a limited time. If an exam or kiosk tool is still a Chrome app, ask the vendor about its replacement.
Block YouTube on school Chromebooks, or restrict it
YouTube reaches a Chromebook in two ways: the website and the Android app. Close both, or restrict both, or students simply switch to the one you left open. Our YouTube app blocking guide covers iPads and phones too.
Restricted YouTube
Apps > Additional Google services > YouTube > Permissions. Strict is the tightest level; Moderate opens a much larger set of videos. It applies when students are signed in with the school account.
Teachers approve videos
Give staff units Can approve videos. Teachers can then release a video that restricted mode hides, without opening YouTube for everyone.
Turn the service off
For units that should have no YouTube at all, switch the YouTube service off for that organizational unit in the Admin console.
Block the Android app
Block com.google.android.youtube in the Play Store settings. In allowlist mode it is blocked already unless someone added it.
Block the website
Add youtube.com to Chrome URL blocking or your web filter. Account settings only apply while students are signed in, so block the site too if YouTube must be fully off.
Where network and account settings disagree, the student's organizational unit setting is the one that applies, so test with a real student account.
Why students search "how to unblock apps on school Chromebook"
Search terms like "school Chromebook unblocker" or "how to remove school blocks on Chromebook" point to settings that were left open. This is the admin checklist that closes them. It names the gap, not the student-side method.
- Guest browsingDevice settings > Sign-in settings > Guest mode: Disable guest mode. Also switch off browser guest mode in user settings.
- Personal accountsSign-in restriction: Restrict sign-in to a list of users, limited to your school domain.
- Incognito windowsSet Incognito mode to not available for student units, so extensions and history rules always apply.
- Wipe to escape managementForced re-enrollment: Force device to automatically re-enroll after wiping. This also disables developer mode.
- Powerwash on demandOptional: Powerwash set to Do not allow powerwash to be triggered, for carts that must stay ready.
- Android browsers and VPN appsPlay Store allowlist, or block the packages from our browser and VPN category files.
- Proxy extensionsChrome Web Store allowlist mode, plus permission blocks for proxy settings.
- Developer toolsRestrict developer tools for student units, except classes that teach coding.
- Second Google accountBlock adding a second Google Account in the Android apps account management setting.
More detail on each pattern, for iPads as well as Chromebooks, is in how students get around restrictions, and the browser side is covered in blocking other browsers on school devices.
Educational Android apps for Chromebook
Search for "educational apps for Chromebook" and you get lists of Android apps. Many of these services also run in the browser, so check the web version before you approve the Android one.
| App | Android package | Suggested policy | Notes |
|---|---|---|---|
| Google Classroom | com.google.android.apps.classroom | Allow install | The web version covers most class work on a Chromebook. |
| Canvas Student | com.instructure.candroid | Allow install | Only for schools that run Canvas. |
| Schoology | com.schoology.app | Allow install | Only for schools that run Schoology. |
| Khan Academy | org.khanacademy.android | Allow install | Useful where classes download lessons for offline use. |
| Duolingo | com.duolingo | Allow install | Language classes; consider limiting to those units. |
| Quizlet | com.quizlet.quizletandroid | Allow install | Study sets; the website works too. |
| Kahoot! | no.mobitroll.kahoot.android | Allow install | Students can also join games in the browser. |
| Epic | com.getepic.Epic | Force install for K to 5 reading units | Digital reading library for younger students. |
| PBS KIDS Games | org.pbskids.gamesapp | Allow install for early grades | Learning games; listed 4+ in the App Store. |
| Libby | com.overdrive.mobile.android.libby | Allow install | Public library e-books with a library card. |
| Microsoft Teams | com.microsoft.teams | Allow install | For schools on Microsoft 365. |
| Google Meet | com.google.android.apps.tachyon | Usually not needed | Meet runs in the browser on ChromeOS. |
Building the approved list across iPads and Chromebooks at once? Our district approved apps list guide shows how to keep one list for both platforms.
What you get from AppBlockList for Chromebook fleets
If your district runs Chromebooks and iPads side by side, the same category choice produces a file for each platform. You pick categories once; we keep the lists current.
Android package lists
One file per category, ready to paste into your blocklist process or compare against the usage report.
CSV with every column
App name, developer, package, the twin iOS bundle ID where one exists, App Store genre, age rating and our categories.
Same categories on iPad
The 58 categories we use for web filtering, so the AI, VPN or games list means the same thing on every device.
Monthly updates
New apps added, removed apps dropped. The next file catches the clone that appeared last week.
For the Admin console steps in other contexts, such as managed Android phones, see blocking apps in Google Admin. For games on any school device, see blocking games on school devices.
Chromebook app questions from school IT
Can students download apps on a school Chromebook?
Only if Android apps are allowed for their organizational unit, and then only what the Play Store mode permits. Education domains cannot give students open access to every Play app, so it is always an allowlist or a blocklist.
How do I block YouTube on school Chromebooks?
Set the YouTube permissions (Strict, Moderate, Unrestricted or Can approve videos) or turn the service off for the unit. Then block the Android app com.google.android.youtube and the website itself.
Does AppBlockList sell Chrome extension blocklists?
No. Our lists cover iPhone, iPad and Android apps, which includes the Android apps that run on Chromebooks. For extensions, use the Chrome Web Store allowlist mode.
Do settings apply to a Chromebook straight away?
Google says app settings usually arrive within minutes but can take up to an hour. When testing, have the student sign out and sign back in.
Can I force-install Android apps on student Chromebooks?
Yes. Set the installation policy to Force install, or Force install + pin to ChromeOS taskbar. Students cannot remove a force-installed app.
Do these controls apply to a student's personal Chromebook?
Device settings apply only to Chromebooks enrolled in your domain. User settings follow the school account when a student signs in with it. A personal account on a personal device, such as a college student's own laptop, is outside school management.
What about parental control for a school Chromebook?
On a school-managed Chromebook, the Admin console settings are the controls that count, at school and at home. For take-home rules, see our guide to take-home device restrictions.
Category lists for Chromebooks and iPads
Android package lists and iOS bundle ID lists by category, updated monthly, for one school or a whole district.
Google, Chromebook, ChromeOS, Google Play, Google Classroom, Google Meet, Gemini and YouTube are trademarks of Google LLC. Microsoft Teams is a trademark of Microsoft Corporation. TikTok is a trademark of ByteDance Ltd. Instagram and WhatsApp are trademarks of Meta Platforms, Inc.
Roblox is a trademark of Roblox Corporation. Minecraft is a trademark of Mojang Synergies AB. ChatGPT is a trademark of OpenAI. Names are used only to identify the products discussed. AppBlockList is not affiliated with, sponsored or endorsed by these companies.