I85PREP
⌘ K
ChromeOS Administrator study materials
ChromeOS Administrator study resources

ChromeOS Administrator: Applications, Extensions, and Chrome Browser Policy

ChromeOS Administrator · Work through your exam, one topic at a time.

All guide sections

Applications, Extensions, and Chrome Browser Policy

What this domain tests

This domain covers Chrome Web Store apps and extensions, Android apps on ChromeOS, kiosk and managed guest sessions, and Chrome browser policies delivered through the Admin console or Chrome Browser Cloud Management. Expect questions on force-install, allowlists, policy precedence, and extension risk.

Core rules

  • Manage extensions by ID, not display name. Force-install approved extensions with the Chrome Web Store update URL, typically https://clients2.google.com/service/update2/crx for store-hosted items.
  • Use allowlists and blocklists to control what users can install. A common posture is to block extensions that are not approved, then force-install the approved set. Review requested permissions before approval.
  • Chrome browser policies can be user-level for signed-in Chrome or machine-level through Chrome Browser Cloud Management enrollment. On ChromeOS, the Admin console applies Chrome and ChromeOS policies to the OU.
  • Android apps are managed separately through Google Play settings: enable Play Store access for the OU, force-install apps, and manage permissions.
  • Kiosk apps and managed guest sessions are configured for the device session, not as ordinary user extensions. Confirm the app supports kiosk mode.
  • Policy conflicts are resolved by scope and OU inheritance. Verify the effective policy on the device rather than assuming the console value won.

Worked example

A company wants a password manager extension for everyone and all other extensions blocked. The admin adds the password manager ID to the allowlist, force-installs it with the store update URL, and configures the extension policy to block items not on the allowlist. Why it works: the allowlist limits installation, force-install deploys the approved extension automatically, and the update URL lets Chrome fetch updates. The admin then verifies the applied policy on a test device before broad rollout.

Traps that cost marks

  • Using an extension name instead of its ID.
  • Blocking an extension through one policy while force-installing it through another and assuming the result.
  • Mixing user-level Chrome policy with device-level ChromeOS policy.
  • Forgetting that Android app controls are separate from Chrome extension controls.
  • Treating a kiosk app like a normal user-installed extension.
  • Approving extensions without reviewing permissions or risk.