9 Marketplace install allowlist

Caveats

• Removing an app from the allowlist cuts users’ access to it even if it is still installed — but for OAuth grants made outside the Marketplace path, №8 is what actually cuts the data path.
• Admin-installed apps bypass user install settings entirely — auditing the allowlist without auditing admin-installed apps leaves the hole open.
• Allowlisting for a child OU excludes the app for everyone else — convenient, but easy to misread as ‘blocked’ when it is merely scoped.

Setup steps

1. 1. Open User install settings and switch installation from open to allowlist-only for the target OU (organizational unit).
   open ↗

   

   https://admin.google.com/ac/apps/gmail/marketplace/domaininstall · captured 2026-07-15

   Apps › Google Workspace Marketplace apps › Apps list

   Manage access to apps

   Allow users to install only allowlisted apps

2. 2. Decide the internal-app carve-out. Internal (same-domain) apps can be allowed wholesale — only do that if you also govern Apps Script (№67).
   open ↗

   

   https://admin.google.com/ac/apps/gmail/marketplace/allowlistaccess · captured 2026-07-15

   Apps › Google Workspace Marketplace apps › Apps list

   Allow users to install and run any internal app = Off unless №67 appsscript-governance is in place

3. 3. Add each business-approved app via 'Allowlist app', reviewing the listing's requested scopes before you accept it.

   Apps › Google Workspace Marketplace apps › Apps list

   Per app: allowlist scoped to the OU/group that needs it, not the root OU

4. 4. Cross-check: confirm each allowlisted app also carries the intended verdict in the API-controls app-access list (№8), since an allowlisted app can still be blocked there (and should be, if its scopes are wrong).
   open ↗

   

   https://admin.google.com/ac/owl · captured 2026-07-15

   Security › Access and data control › API controls

   Allowlist and API-controls verdict must agree per app

Ongoing maintenance

• requires a human On request: review a new app’s scopes against the data it would touch before allowlisting.

How to verify

1. From a test account, open the Marketplace and try installing any app not on the allowlist — the install button should be blocked with the admin message. This needs no admin access and tests the real gate.