# 9 Marketplace install allowlist

> v0.1.2 · role: Prevent · [policy: #19 · #37](https://docs.google.com/spreadsheets/d/1nOztaPd1Y7eNeRSR_hdovYy-ncpx-bAx/edit?usp=sharing&ouid=115159875779023172526&rtpof=true&sd=true)

Switches Marketplace from open installation to allowlist-only, so a user can install only apps you have reviewed. The review is of the listing's requested scopes: this is where an add-on's data access is decided, before anyone grants it. Allowlist per OU or group rather than at the root, so an app is available to the team that needs it and nobody else.

Documentation: [Get started as a Marketplace app admin](https://knowledge.workspace.google.com/admin/apps/get-started-as-a-marketplace-app-admin)

## Caveats

- Removing an app from the allowlist cuts users' access to it even if it is still installed — but for OAuth grants made outside the Marketplace path, №8 is what actually cuts the data path.
- Admin-installed apps bypass user install settings entirely — auditing the allowlist without auditing admin-installed apps leaves the hole open.
- Allowing internal (same-domain) apps wholesale is only safe if Apps Script is governed (№65) — otherwise any user's script is an approved app.
- Allowlisting for a child OU excludes the app for everyone else — convenient, but easy to misread as 'blocked' when it is merely scoped.
- Service-specific Marketplace settings for Drive, Chat, and Calendar can override 'Manage access to apps' — verify those per-service settings too, and allow up to 24 hours for changes to propagate.

## Setup steps

1. Open User install settings and switch installation from open to allowlist-only for the target OU (organizational unit). — `Apps › Google Workspace Marketplace apps › Apps list`

   - **Manage access to apps** = Allow users to install only allowlisted apps

   docs: [Set whether users can install Marketplace apps](https://knowledge.workspace.google.com/admin/apps/set-whether-users-can-install-marketplace-apps)

2. Decide the internal-app carve-out. Internal (same-domain) apps can be allowed wholesale — only do that if you also govern Apps Script ([№65](appsscript-governance.md)). — `Apps › Google Workspace Marketplace apps › Apps list`

   Allow users to install and run any internal app = Off unless №65 appsscript-governance is in place

   docs: [Set whether users can install Marketplace apps](https://knowledge.workspace.google.com/admin/apps/set-whether-users-can-install-marketplace-apps)

3. Add each business-approved app via 'Allowlist app', reviewing the listing's requested scopes before you accept it. — `Apps › Google Workspace Marketplace apps › Apps list`

   Per app: allowlist scoped to the OU/group that needs it, not the root OU

   docs: [Manage the Marketplace app allowlist for your organization](https://knowledge.workspace.google.com/admin/apps/manage-the-marketplace-app-allowlist-for-your-organization)

4. Cross-check: confirm each allowlisted app also carries the intended verdict in the API-controls app-access list ([№8](oauth-app-control.md)), since an allowlisted app can still be blocked there (and should be, if its scopes are wrong). — `Security › Access and data control › API controls`

   Allowlist and API-controls verdict must agree per app

   docs: [Control which apps access Google Workspace data](https://knowledge.workspace.google.com/admin/apps/control-which-apps-access-google-workspace-data)

## Ongoing maintenance

- **[requires a human]** On request: review a new app’s scopes against the data it would touch before allowlisting.

## How to verify

1. From a test account, open the Marketplace and try installing any app not on the allowlist — the install button should be blocked with the admin message. This needs no admin access and tests the real gate.

## Settings screens

- Apps > Google Workspace Marketplace apps > Apps list (allowlist + User install settings)
  - console: https://admin.google.com/ac/apps/gmail/marketplace/domaininstall
  - screenshot: ../screenshots/admin.google.com/ac/apps/gmail/marketplace/domaininstall.png
- Apps > Google Workspace Marketplace apps > Settings
  - console: https://admin.google.com/ac/apps/gmail/marketplace/allowlistaccess
  - screenshot: ../screenshots/admin.google.com/ac/apps/gmail/marketplace/allowlistaccess.png
- Security > Access and data control > API controls (allowlisted apps can still be excluded here)
  - console: https://admin.google.com/ac/owl
  - screenshot: ../screenshots/admin.google.com/ac/owl.png