Web app inaccessible on managed devices: add missing domain to Chrome URLAllowlist in managed configuration

Android

If a web application fails to load or prevents users from logging in on your managed devices, the issue may be that the required domain is missing from Chrome's URLAllowlist in your managed configuration. This article explains how to identify and fix this problem.

How Chrome's URL allowlist works

When you apply a managed configuration policy to Google Chrome that includes a URLAllowlist, Chrome enforces an implicit deny on all URLs not explicitly listed. This means that even if you haven't created a visible "block" rule, any domain not present in the allowlist array remains inaccessible. This applies to all domains in the user's journey, including authentication or single sign-on (SSO) redirect domains such as Okta, SAML identity providers, or OAuth endpoints.

Before you begin

Identify all domains required for your web application to function. This includes:

• The main application domain
• All authentication or SSO redirect domains (such as Okta, Azure AD, or Google Identity)
• Any subdomains the application depends on

You can trace the full login redirect chain by using Chrome DevTools on a non-managed device to see which domains are visited during login.

How to add domains to Chrome's URL allowlist

1. In the Esper Console, go to Apps.
2. Locate Google Chrome in the managed app list for the affected Blueprint or device group.
3. Open the Managed Configuration for Chrome.
4. Locate the URLAllowlist array in the managed configuration JSON.
5. Add all required domains to the allowlist, including authentication and SSO redirect domains. Use the following format:

   {
    "URLAllowlist": [
    "https://yourdomain.com/path",
    "https://yourdomain.com/path/*",
    "https://auth.provider.com",
    "https://auth.provider.com/*"
    ]
   }

6. Use wildcard subpath entries (domain/*) to cover all pages under a domain, not just the root URL.
7. Save the updated managed configuration.
8. Push the configuration to the affected devices or Blueprint.
9. On an affected device, open Chrome and navigate to the web application. Verify that the login flow completes successfully, including any SSO or authentication redirects.

If the web app still fails to load

If login still fails after adding the domain: Ensure you have identified all intermediate domains in the authentication flow. Authentication flows (OAuth, SAML, Okta) often redirect through multiple domains—all must be explicitly listed in the allowlist.

If the policy is not applying to devices: Confirm that the managed configuration has been saved and the Blueprint or app config has been pushed to your devices. Check the device's Blueprint sync status by going to Devices & Groups → [Device Name] → Blueprint.

If Chrome is not respecting the updated policy: Force a Chrome policy refresh by rebooting the device to ensure it pulls the latest policy configuration.

If the managed configuration is correct and synced but Chrome continues to block listed domains: Contact Esper Support. This may indicate an issue with managed configuration delivery.

Still need help?

If you've completed these steps and your web application is still inaccessible, submit a support ticket. Include the managed configuration JSON and the domains your application requires.