9 Marketplace install allowlist

Switches Marketplace from open installation to allowlist-only, so a user can install only apps you have reviewed. The review is of the listing's requested scopes: this is where an add-on's data access is decided, before anyone grants it. Allowlist per OU or group rather than at the root, so an app is available to the team that needs it and nobody else.

Documentation: Get started as a Marketplace app admin ↗

Caveats

Removing an app from the allowlist cuts users’ access to it even if it is still installed¹
Admin-installed apps bypass user install settings entirely²
Allowing internal (same-domain) apps wholesale is only safe if Apps Script is governed (№65)³
Allowlisting for a child OU excludes the app for everyone else⁴
Service-specific Marketplace settings for Drive, Chat, and Calendar can override ‘Manage access to apps’⁵

Setup steps

open ↗
https://admin.google.com/ac/apps/gmail/marketplace/domaininstall · captured 2026-07-15
Apps › Google Workspace Marketplace apps › Apps list
Open User install settings and switch installation from open to allowlist-only for the target OU (organizational unit).

Manage access to apps
Allow users to install only allowlisted apps

Set whether users can install Marketplace apps ↗
open ↗
https://admin.google.com/ac/apps/gmail/marketplace/allowlistaccess · captured 2026-07-15
Apps › Google Workspace Marketplace apps › Apps list
Decide the internal-app carve-out. Internal (same-domain) apps can be allowed wholesale — only do that if you also govern Apps Script (№65).

Allow users to install and run any internal app = Off unless №65 appsscript-governance is in place

Set whether users can install Marketplace apps ↗
Apps › Google Workspace Marketplace apps › Apps list
Add each business-approved app via 'Allowlist app', reviewing the listing's requested scopes before you accept it.

Per app: allowlist scoped to the OU/group that needs it, not the root OU

Manage the Marketplace app allowlist for your organization ↗
open ↗
https://admin.google.com/ac/owl · captured 2026-07-15
Security › Access and data control › API controls
Cross-check: confirm each allowlisted app also carries the intended verdict in the API-controls app-access list (№8), since an allowlisted app can still be blocked there (and should be, if its scopes are wrong).

Allowlist and API-controls verdict must agree per app

Control which apps access Google Workspace data ↗

Ongoing maintenance

requires a human On request: review a new app’s scopes against the data it would touch before allowlisting.

How to verify

From a test account, open the Marketplace and try installing any app not on the allowlist — the install button should be blocked with the admin message. This needs no admin access and tests the real gate.

v0.1.2Prevent policy #19 · #37 ↗