Chrome is usually the browser your Android fleet actually runs on, which makes it one of the highest-leverage Apps you can configure centrally. Applivery manages it the same way it manages any other Managed Google Play App: you deploy it through a Policy and, inside that same Policy, you set its managed properties — the mechanism Google uses to expose Chrome Enterprise policies on Android. From there you control URL filtering, privacy, security and general browser behavior without ever touching a Device.
How Chrome management works in Applivery
Chrome does not have its own dedicated configuration screen in Applivery. It is managed with the same generic mechanism used for any Managed Google Play App that exposes a managed configuration schema:
App deployment. You add Chrome to a Policy like any other Google Play App, usually as a force-installed App, since most Android Enterprise Devices already ship with it.
Managed properties. Google defines a configuration schema for Chrome — the Chrome Enterprise policies, in their Android variant — and publishes it on Google Play. Applivery detects that schema automatically and renders it as an editable form inside the Policy, so nobody at Applivery has to maintain a separate list.
Applied on the Device. The Applivery DPC applies the values through
DevicePolicyManager.setApplicationRestrictions(...). This works the same on Android Enterprise (AMAPI) Devices and on AOSP Devices with no Google services, as long as the App declares its restrictions schema.
The list of available properties is defined by Google and Chrome, not by Applivery. Applivery only detects and exposes that schema — which is why the same mechanism that works for Chrome works for any other managed App. See Managed App Properties for the generic version of this flow.
Configuration
Go to the Applivery Dashboard and open the Policy where you want to manage Chrome.
Go to the Apps section in the left-hand menu and click + Add App.
Search for Google Chrome in the Managed Google Play list and select it. A side panel opens with every managed property available for that version of Chrome.
Set the fields you need. The categories below walk through what is available.
Click Save changes and deploy the Policy to the relevant Device group. Changes apply automatically, usually within a few minutes.
Available managed property categories
Chrome exposes a large slice of its Chrome Enterprise policies on Android — over 150 distinct properties — though a smaller subset than on desktop. The most important exception: Chrome for Android does not support browser extensions, so every extension-related policy (ExtensionInstallForcelist, ExtensionInstallAllowlist, ExtensionInstallBlocklist, ExtensionSettings, ExtensionInstallSources, ExtensionAllowedTypes, ExtensionDeveloperModeSettings, BlockExternalExtensions, EnterpriseHardwarePlatformAPIEnabled) does not apply on Android and will not appear as configurable.
What follows groups the properties most relevant to an MDM rollout by function. It is a functional summary of what each one does, not a transcription of Google's own documentation.
1. Web access control
Property | What you can configure |
|---|---|
| Blocked URL patterns, up to 1,000. |
| Exceptions to |
| Block and exception lists specific to incognito mode, independent of the general ones. |
| Hosts exempt from the forced HTTPS upgrade. |
| Hosts that skip HSTS preload. |
| Domains excluded from Safe Browsing checks. |
| Domains excluded from the "looks like another site" warning. |
| Exceptions to Certificate Transparency enforcement. |
| Origins where every HTTP authentication scheme is allowed, ignoring |
| Whether users can continue past an SSL warning, globally or for specific origins. |
Applivery has its own page with the exact syntax for these filters. Read URL Filters before writing your rules. The format is [scheme://][.]host[:port][/path][@query].
2. Web content permissions and behavior
Property | What you can configure |
|---|---|
| Cookie behavior by default, per site, and for third parties. |
| Site access to the user's location. |
| Web push notifications. |
| JavaScript execution, globally or per site. |
| JIT compilation in the JS engine — performance against attack surface. |
| Advanced JS engine optimizations. |
| Pop-up windows. |
| Access to motion and light sensors. |
| Serial port access through the Web Serial API. |
| Access to nearby Bluetooth devices. |
| Access to connected USB devices. |
| User idle detection through the Idle Detection API. |
| Site access to the clipboard. |
| Automatic download of multiple files. |
| Automatic media playback. |
| Whether sites can check if the user has saved payment methods. |
| Permission to share a screen, window or tab from a website. |
| Augmented reality sessions through WebXR. |
| Site access to the local network or to the Device itself (loopback). Tied to Chrome's Local Network Access restriction. |
3. Privacy and browsing data
Property | What you can configure |
|---|---|
| Allow, disable or always force incognito mode. |
| Maximum retention per data type — history, passwords, autofill and others — in hours. |
| Turns off browsing history storage. |
| Excludes specific data types (bookmarks, passwords, tabs) from sync. |
| Shows or hides the history view grouped by topic. |
| Content suggestions on the new tab page. |
| Sending anonymized URLs to Google to improve search and browsing. |
| Reduces the |
| Sending domain reliability diagnostics. |
| Sending anonymous usage and crash reports. |
| Product surveys built into Chrome. |
| Which Google accounts are visible inside Chrome, by name pattern. |
4. Passwords, autofill and authentication
Property | What you can configure |
|---|---|
| Whether Chrome can save new passwords. |
| Checks whether entered credentials have appeared in a breach. |
| Sharing saved passwords with family group members. |
| Whether a third-party password manager configured in Android can be used instead of Chrome's. |
| Autofill for addresses and payment cards. |
| Whether the user can sign in to Chrome with their Google account. Android does not support the forced mode. |
| Automatic sign-in to Microsoft properties through the Entra ID authentication broker. |
| Corporate integrated authentication (Kerberos, NTLM, Negotiate) against internal servers. |
| Automatic client certificate selection by site pattern. |
| Remote desktop App origins allowed to make WebAuthn requests. |
| Allows WebAuthn on sites with faulty TLS certificates. |
| Exempts specific origins from secure context restrictions, useful for internal Apps without TLS. |
5. Security and Safe Browsing
Property | What you can configure |
|---|---|
| Safe Browsing level: off, standard or enhanced. |
| Sending extra data to Google to improve threat detection. |
| Real-time checks through a proxy that does not expose the user's IP. |
| Stops the user from continuing past a malicious site warning. |
| Blocks ads on sites flagged for intrusive advertising. |
| Restriction level for downloads considered dangerous. |
| Blocks screenshots taken through shortcuts or extensions. |
| Adult content filter based on Google's SafeSearch API. |
| Forces SafeSearch on Google Search. |
| Forces a minimum level of YouTube restricted mode. |
| Trusted root certificate management — adding, constraining or distrusting. |
| HTTPS enforcement and TLS ClientHello encryption (ECH). |
| Preference for compliance-oriented cryptographic algorithms, such as CNSA. |
| Isolates each site in its own process (Site Isolation) on Devices with more than 1 GB of RAM. |
6. Built-in generative AI features
Chrome ships several AI features — Gemini, AI Mode, smart autofill — that you can also control through managed configuration:
Property | What you can configure |
|---|---|
| Availability of Google's AI mode in the address bar and new tab page. |
| General availability of the Gemini integration in Chrome. |
| Whether Gemini can act directly on web pages on the user's behalf, optionally restricted by URL. |
| The "Find and fill with Gemini" feature. |
| Chrome Finds, AI-assisted search over page content. |
| Form autofill assisted by generative AI. |
| Whether page content can be shared with AI Mode or Lens from the side panel. |
| Third-party AI integrations in the address bar, when the default search engine is not Google. |
| Download and use of the local AI model for on-device inference. |
All of these AI policies fall back to GenAiDefaultSettings when left undefined. If your organization has a general stance on generative AI, set that default first and then fine-tune each feature.
7. Browsing, bookmarks and search
Property | What you can configure |
|---|---|
| Homepage URL. |
| Uses the new tab page as the homepage. |
| Shows the home button in the toolbar. |
| Bookmark bar visibility, and whether the user can edit bookmarks. |
| Deploys a predefined bookmark folder, with subfolders, that the user cannot modify. |
The | Configures or forces your own default search engine instead of leaving the choice to the user. |
| Search suggestions in the address bar. |
| The Touch to Search feature. |
| Built-in page translation. |
| Whether printing from Chrome is allowed. |
| The built-in QR code generator. |
| Price tracking for products seen in the browser. |
| Google Cast availability. |
| Read-aloud for web pages. |
| Sending text between desktop Chrome and an Android Device linked by account. |
8. Session, account and cloud management
Property | What you can configure |
|---|---|
| Skips the Terms of Service dialog on first use. Applies only to Chrome Custom Tabs (CCT) on Fully Managed Devices. |
| Token for Chrome to enroll in Chrome Enterprise Core, Google's cloud management, alongside management through Applivery and AMAPI. |
| Precedence rules between cloud policies (Chrome Enterprise Core) and platform policies, the ones arriving through Applivery. |
| Merge rules when the same policy arrives from more than one management source. |
This block only matters if your organization also manages Chrome from the Google Admin console (Chrome Enterprise Core) on top of Applivery. If Applivery is your only management source, you normally do not need to touch these properties.
9. Network, proxy and performance
Chrome also exposes a broad set of infrastructure policies: DNS (DnsOverHttpsMode, DnsOverHttpsTemplates, BuiltInDnsClientEnabled), proxy (ProxySettings, per-proxy connection limits), WebRTC (WebRtcEventLogCollectionAllowed, WebRtcUdpPortRange) and component updates (ComponentUpdatesEnabled). They matter mostly in environments with a mandatory corporate proxy or restrictive network policies. They are not listed row by row here because they are rarely used in a standard MDM rollout, but they follow exactly the same managed properties mechanism as everything else.
Internal rendering engine policies
Chrome also publishes a considerable number of internal rendering engine policies — temporary web compatibility flags, back/forward cache behavior, Service Workers, CORS — aimed at web platform migrations rather than MDM administration. They are not listed here because they have little practical relevance for an IT admin. If you ever need one, you configure it exactly like the rest: search for it by name in Chrome's managed properties form inside the Applivery Policy.
The form you actually see in Applivery for the Chrome App is generated dynamically from the schema Google declares on Play, so it can vary slightly depending on the published Chrome version. Before assuming a very specific field is available, check it directly in the Dashboard when you select the App.
Value formats: watch out for lists and booleans
When you fill in managed properties for Chrome, keep two things in mind:
List values — such as
URLBlocklistorURLAllowlist— must be entered as a serialized JSON string, not as a native array. For example,["facebook.com"]as text, not as a set of separate fields. This is empirically verified for Chrome on Android throughchrome://policy, withStatus: OK.Boolean values — such as
SavingBrowserHistoryDisabled— and integer or enum values — such asIncognitoModeAvailabilityorSafeBrowsingProtectionLevel— are sent as the numeric value ortrue/falsedefined by Chrome's schema, not as free text.
If a list field does not apply, or the Device seems to ignore it, check the format first — serialized JSON string — before assuming the property is unsupported.
Verify the configuration with chrome://policy
Once the Policy is deployed, the most reliable way to confirm Chrome received the configuration is on the Device itself:
Open Chrome on the managed Device.
Navigate to chrome://policy.
Look for the property you configured, URLBlocklist for example.
Confirm Status shows OK. A parse error or "Ignored" means the value could not be applied — usually a formatting problem, or a property that is not supported in that version of Chrome.
Click Show value to confirm the applied content matches what you configured in Applivery.
chrome://policy is Chrome's own source of truth, independent of Applivery. If the status is correct there, the configuration reached the Device properly.
Chrome in kiosk mode
Chrome can also act as the browser behind an Applivery web App in kiosk mode. Add Chrome from the Google Play tab with the Force install install type, then set it as the browser for the web App inside the Policy. That lets you display a specific URL full screen, as the Device's only App. See Web Apps and Kiosk Mode for the remaining options, including the basic launcher, the advanced launcher and AOSP support.
Troubleshooting
Symptom | Likely cause |
|---|---|
The list field blocks nothing | The value is not serialized as a JSON string. |
| Wrong value format for the field type — list against boolean against integer. |
An expected property is missing from the Applivery form | It may not be available in the Chrome version published on Play for that Device, or it may need a minimum Android version. Check in the Dashboard before assuming support is missing. |
Changes never reach the Device | Check the Policy was actually deployed to the right Device group, not just saved. |