How to Add Allowed Apps for Google Workspace Users on Android Mobile Devices

Quick and easy-to-follow guide for Google Workspace administrators

Requirements to add allowed apps for Android mobile devices

This feature is supported for Google Workspace Business Starter, Standard, and Plus; Enterprise; Education Fundamentals, Standard, Teaching and Learning Upgrade, and Plus; G Suite Basic and Business; Essentials; Frontline.

The Android devices must:

The features mentioned below won’t work on personal devices that have no work profile on them.

Note that Advanced Mobile management is not mandatory for force-installing Android apps to users’ devices – Basic Mobile management is enough for this particular feature.

What you can do with allowed managed Android apps

You can set up a list of managed Android apps, which allows you to:

Force-install Android apps to users’ devices
Block installation of any Android apps that you haven’t added to the managed apps list
Prevent users from uninstalling Android apps
Allow or disallow shortcut widgets
Set an Android app as the VPN service

Follow the steps below.

How to add allowed apps for Android mobile devices step-by-step with images

Step 1

In Google Admin at https://admin.google.com, click Apps > Web and mobile apps.

Step 2

Click Add App on the top left, above the Apps list.

Step 3

Click Add private Android app.

Step 4

Search for an app by name, then hover over it in the results list and click Select.

In this case, just as an example, we’ll add Dropbox.

Step 5

Select if you want to add the app for all users in Google Workspace or only those in a specific organizational unit (OU) or group and click CONTINUE.

Step 6

You can make the app Available for download (when non-managed apps are blocked, as shown here) or Force-install it to users’ devices.

Additionally, you can:

Prevent users from uninstalling the app;
Allow users to add widgets to the home screen
Check Use for Always on VPN to add a VPN service for app traffic. Never turn on Use as Always on VPN for more than one app. If you turn it on for multiple apps, one of the apps will be randomly used as the Always on VPN app.

Click FINISH.

Step 7

After adding the app, you’ll see this screen, which allows you to update the app’s settings. You can always go back to this page later by clicking the app’s name in the list of managed apps.

There are three sections here: User access, Settings, and Runtime permissions.

The User access section lets you control which Organizational Units listed on the left side of the screen have access to the app.

For example, to prevent users in a specific OU from using a managed app, select that OU, then update this setting to OFF and click SAVE.

The Settings section lets you make the app Available for download ( when non-managed apps are blocked, as shown here) or Force-install it to users’ devices.

Additionally, you can:

Prevent users from uninstalling the app;
Allow users to add widgets to the home screen
Check Use for Always on VPN to add a VPN service for app traffic

The Runtime permissions section is not available for Google Workspace Business Starter and Standard.

Some apps request permissions from the user. For example, an app might request access to a device’s location or contacts. In this section, you can choose to automatically Allow or Deny access to specific types of permissions without prompting the user.