Android app directory · Browsers
The settings IT can push to Chrome on managed Android devices, what each one changes, and how to roll them out to a fleet. Chrome reads the same enterprise policies as on desktop, but only some of them apply on Android. This page covers the ones fleets use most; Google's policy list documents the rest.
Nomidcom.android.chrome Common setups
Copy a setup into the managed configuration of a policy, then adjust the values. Each one uses only keys explained below.
Block everything, then allow the domains your team needs. Listing example.com also allows its subdomains, and allowlist entries take priority over the blocklist.
{
"URLBlocklist": "[\"*\"]",
"URLAllowlist": "[\"example.com\"]"
}For tablets passed between shifts: no personal sign-in, no saved passwords, no Incognito tabs and no browsing history. Cookies and website sessions stay in Chrome, so people must sign out of sites themselves.
{
"BrowserSignin": "0",
"PasswordManagerEnabled": false,
"IncognitoModeAvailability": "1",
"SavingBrowserHistoryDisabled": true
}Filter explicit search results, keep Chrome's warnings on, push HTTPS and stop pop-ups.
{
"ForceGoogleSafeSearch": true,
"SafeBrowsingProtectionLevel": "1",
"HttpsOnlyMode": "force_enabled",
"DefaultPopupsSetting": "2"
}Managed configuration
Key names and value types come from the vendor’s documentation. The explanations are written by Nomid.
| Key | Type | What it does | Example |
|---|---|---|---|
| Sites and bookmarks | |||
URLBlocklist | Text: JSON list of URL patterns | Blocks every site that matches a pattern. Use * to block all sites that are not on the allowlist. On Android, enter the list as one text value in JSON format. | ["*"] |
URLAllowlist | Text: JSON list of URL patterns | Makes exceptions to the blocklist. A domain such as example.com also covers its subdomains. Add a dot in front, as in .example.com, to match that host only. On Android, enter the list as one text value in JSON format. | ["example.com"] |
ManagedBookmarks | Bookmark list (JSON) | Adds a folder of company bookmarks that people can open but cannot edit or delete. | [{"name": "Intranet", "url": "intranet.example.com"}] |
HomepageLocation | Web address | Sets the page the home button opens. People cannot change it while the policy is set. | https://intranet.example.com |
ShowHomeButton | On or off | Shows or hides the home button in the toolbar. Pair it with HomepageLocation on kiosk-style devices. Needs Chrome 144 or later on Android. | true |
EditBookmarksEnabled | On or off | Turns bookmark adding, editing and deleting on or off for the people using the device. | false |
| Accounts and saved data | |||
BrowserSignin | Choice: 0 off, 1 allowed, 2 required | Controls whether people can sign in to Chrome with an account. Requiring sign-in (2) needs Chrome 153 or later on Android. | 0 |
PasswordManagerEnabled | On or off | Stops Chrome from offering to save passwords. Turn it off on devices that several people share. | false |
IncognitoModeAvailability | Choice: 0 available, 1 off | Allows Incognito tabs or turns them off. Chrome on Android does not support the forced value (2) that desktop Chrome has. | 1 |
SavingBrowserHistoryDisabled | On or off | Stops Chrome from keeping a browsing history on the device. | true |
| Safety, downloads and search | |||
SafeBrowsingProtectionLevel | Choice: 0 off, 1 standard, 2 enhanced | Sets how strongly Chrome checks sites and downloads against its list of dangerous ones. | 1 |
HttpsOnlyMode | Choice: allowed, disallowed, force_enabled, force_balanced_enabled | Decides whether Chrome upgrades pages to HTTPS and warns before opening plain HTTP sites. | force_enabled |
DownloadRestrictions | Choice: 0 default, 1 to 4 block more | Blocks dangerous or all downloads. Value 3 stops every download, which suits locked-down devices. | 3 |
DisableScreenshots | On or off | Stops people from taking screenshots of what Chrome shows. Newer Chrome versions only. | true |
ForceGoogleSafeSearch | On or off | Forces SafeSearch filtering on Google Search results, whatever the person's own setting is. | true |
ForceYouTubeRestrict | Choice: 0 off, 1 moderate, 2 strict | Applies YouTube's restricted mode to videos opened in Chrome. | 1 |
SearchSuggestEnabled | On or off | Stops Chrome from sending what people type in the address bar to the search engine for suggestions. | false |
| Site content defaults | |||
DefaultPopupsSetting | Choice: 1 allow, 2 block | Sets whether sites may open pop-up windows unless a site-specific rule says otherwise. | 2 |
DefaultGeolocationSetting | Choice: 1 allow, 2 block, 3 ask | Sets whether sites may read the device's location. Ask is the usual default; block suits shared devices. | 2 |
DefaultCookiesSetting | Choice: 1 allow, 2 block, 4 until Chrome closes | Controls whether sites may store cookies, or only until the browser is closed. | 4 |
PrintingEnabled | On or off | Allows or blocks printing from Chrome. | false |
TranslateEnabled | On or off | Turns Chrome's page translation offer on or off. | false |
DnsOverHttpsMode | Choice: off, automatic, secure | Controls whether Chrome sends DNS lookups over encrypted HTTPS. | automatic |
Deploy with Nomid
Find it on Google Play from the policy’s apps list and choose how it is installed.
In the policy, set the app’s managed configuration with the keys and values from this page.
Devices in the policy receive Google Chrome and its configuration on their next sync.
Questions
com.android.chrome. Use it to find Chrome when you add it to a policy, or in an adb command.
Yes. Add patterns to URLBlocklist, or block everything with * and list the sites people may open in URLAllowlist.
Yes. The configuration applies to the copy of Chrome inside the work profile and leaves the personal copy alone.
Google documents every Chrome policy on every platform. This page covers the Android keys fleets use most, with examples and how to apply them. Check Google's list for the full set and for newer policies.
Add the app to a Nomid policy, set its configuration and choose its permissions.
