Key Points
- Use built-in ChromeOS controls and Google Admin Console to block and restrict apps on Chromebook devices for both home and enterprise use.
- Set up supervised Google accounts with Family Link to block apps on Chromebooks at home and apply content restrictions for children or limited-use scenarios.
- Use Google Admin Console to enforce Chromebook app restrictions at scale by allowing or blocking apps via allowlists or blocklists across organizational units.
- Block or allow specific Chrome apps or extensions by configuring installation policies in Devices > Chrome > Apps & extensions for targeted user or device groups.
- Disable Android apps on Chromebook entirely through Google Admin Console settings to prevent installation of unauthorized mobile apps.
You can block apps on Chromebook devices using functions built into ChromeOS and the management features Google provides in the Google Admin Console. This allows you to block Chrome apps and extensions, as well as Android apps from being installed.
This guide explains how home users can use native controls to block Chrome and Android apps on Chromebooks, and how organizations can do the same by locking down devices so that they can be remotely managed and properly secured.
How do I block an app on my Chromebook at home?
For individuals and small businesses, or limited use cases like a single device needing temporary restrictions, native parental controls for ChromeOS can suffice for blocking apps on Chromebook devices. Chromebooks require each user to be signed in to their Google account, so using a supervised Google account using the Family Link app is effective for these kinds of scenarios.
This is ideal for home users wanting to restrict how children use devices, and you can also set screen time and content limits in addition to restricting apps. Android also has built-in controls that limit what apps can be accessed without needing to use Family Link. App Pinning is the Android feature that lets you lock a device to a specific app, unlockable using a pre-set PIN.
How do I block apps on Chromebooks in an education or enterprise environment?
Google Admin Console should be used to manage ChromeOS and Android devices in enterprise and education environments. This provides granular control over how Chrome behaves for groups of users or devices organized into organizational units, or for all users by selecting the top organizational unit in the console.
To allow or block all Chrome apps and extensions except those that are whitelisted:
- Access the Google Admin Console at admin.google.com
- Click through to Devices > Chrome > Apps & extensions > User app settings
- Optionally select the Organizational unit, or leave it at the top level to apply to all users
- Select Allow/block mode
- For both the Play Store (Android apps) and Chrome Web Store (Chrome apps), select either
- Allow all apps, admin manages blocklist or
- Block all apps, admin manages allowlist or
- Block all apps, admin manages allowlist, users may request extensions (Chrome Web Store only)
- Click Save to apply the change
This is ideal for ensuring students or staff only have access to the productivity software they require, and cannot install unapproved apps or games.
You can also unblock or block only a single app:
- Navigate to Devices > Chrome > Apps & extensions > Users & browsers
- Select the group or organizational unit to apply the restriction to
- Locate the app you want to block, and then select Block under Installation policy
- Click Save to apply the change
You should regularly review your policies to ensure they meet requirements and do not exclude apps or extensions that users may need access to, causing them to use unsanctioned devices. You can also configure managed guest sessions for shared devices, which can be used to apply further restrictions to time limits and internet access, ideal for exam environments or public devices like kiosks or signage.
How to completely disable Android apps on Chromebooks
You can completely remove the ability to install Android apps on a Chromebook from the Google Admin Console by following these steps:
- Log in to the Google Admin Console
- Navigate to Devices > Chrome > Apps & extensions in the sidebar
- Click on the User app settings tab
- Select the desired Organizational unit you want to disable Android apps for
- Scroll through to the Additional app settings category and select Android apps on Chrome devices
- Change the setting to Do not allow users to install Android apps
- Click Save to apply the change
By preventing users from installing Android apps, you eliminate an entire channel that can be used to install unauthorized software.
Limitations and scope considerations
You should evaluate the methods you can use to block apps on Chromebook devices and choose the one most suitable for your scenario. Parental controls are often insufficient for locking down public or shared devices, and could present security or compliance issues, or make devices more attractive targets for misuse or theft.
As Chromebooks don’t block apps by default, reviewing the need for app restrictions is a key early step in planning the deployment of Chromebooks in organizations. You should also note that blocking apps doesn’t stop Chromebooks from being misused: other ChromeOS-specific controls may be required, and you should still follow security best practices across your IT infrastructure.
NinjaOne unifies IT management in education and enterprise
The Google Admin Console provides an effective set of tools for remotely managing ChromeOS devices, including blocking access to Chrome apps and extensions, and additionally Android apps.
Most education and enterprise IT environments are not limited to ChromeOS and Android devices, however. For complete coverage, NinjaOne provides unified, comprehensive IT management tools that cover Apple and Android mobile devices, as well as Windows and Mac workstations, servers, networking, and SaaS.
