Restricting Chrome browser access to a single URL using JSON URL blocking or Google Play Web Apps

Android

Title: Restrict Android devices to a single URL — Chrome policy or Web App

When you need to lock Android devices down to a single website, attempting to block all other URLs through device settings alone leaves gaps that users can exploit. Esper provides two reliable methods: Chrome's managed URL policy and Google Play Web Apps.

Why this happens

Android does not have a native single-URL lockdown setting. Browser-level restrictions must be applied through managed configurations pushed by a Device Owner, which is why both methods below require full Android Enterprise provisioning before they take effect.

Choose your method

Option A — Chrome URL policy: Blocks all URLs in Chrome except your allowed domain. Users still see the Chrome browser UI but cannot navigate away.
Option B — Google Play Web App: Wraps your URL as a standalone app icon with no address bar, tabs, or browser controls. Best for full kiosk-style lockdown.

Option A: Block all URLs except one using Chrome managed configuration

Open the app configuration screen. In the Esper Console, go to Apps & Configuration → Apps, search for Google Chrome, and open its managed configuration settings.
Enter the URL policy JSON. In the managed configuration editor, paste the following:
```
{
  "URLBlocklist": ["*"],
  "URLAllowlist": ["https://your-allowed-domain.com"]
}
```
Replace https://your-allowed-domain.com with your exact URL. The URLBlocklist value * blocks every address by default; URLAllowlist then carves out a single exception. Both keys are case-sensitive.
Save and apply the configuration to a Blueprint. Attach the Chrome managed configuration to the Blueprint targeting your device group. This ensures the policy is consistently applied to every device in that group.
Push the Blueprint to your devices. In the Esper Console, go to Devices & Groups, select your target group, and apply the updated Blueprint.

Verify: Open Chrome on a provisioned device and attempt to navigate to any URL other than your allowed domain. Chrome should display a blocked-site error page. Navigating to your allowed URL should succeed immediately. The policy typically takes effect within 5 minutes of the Blueprint sync completing.

Option B: Lock down to a single URL using a Google Play Web App

Create the Web App in managed Google Play. In the Esper Console, go to Apps & Configuration → Play For Work Apps and select Web Apps. Enter your target URL, provide a display name and icon, then save. This creates a standalone app that launches your URL with no browser navigation controls exposed to the user.
Add the Web App to your Blueprint. In the Esper Console, go to Apps & Configuration → Blueprints, open the target blueprint, and add the newly created Web App as a managed app just as you would any other application.
Push the Blueprint to your devices. In the Esper Console, go to Devices & Groups, select your target group, and apply the updated Blueprint.

Verify: Tap the Web App icon on a provisioned device. The URL should open directly with no address bar, tabs, or back-navigation controls visible. The device Activity Feed in Devices & Groups → [Device Name] → Activity Feed should show a successful app install event.

Troubleshooting

Chrome JSON policy is not applying

Confirm the device is fully provisioned in Device Owner mode. Managed configurations do not apply to personally-owned devices in Profile Owner mode unless Chrome is in the work profile.
Check that all JSON key names match exactly — URLBlocklist and URLAllowlist are both case-sensitive.
Confirm Chrome is the default browser on the device. Option A applies only to Chrome; third-party browsers such as Firefox or Brave are unaffected unless they support equivalent managed configuration keys.

Web App option is not visible in the Console

Confirm that a Managed Google Play account is bound to your Esper tenant. Go to Company Settings → Managed Google Play to verify the binding status. If no account is bound, follow the on-screen setup steps to connect one.

Policy applies to some devices but not others

Some OEM devices ship with an alternate browser set as the system default. Verify Chrome is installed and set as the default browser on all affected devices before applying the managed configuration.

If this doesn't resolve it

If the Chrome policy is still not applying after confirming Device Owner provisioning and correct JSON syntax, collect the following before contacting Esper Support:

The exact JSON entered in the managed configuration editor (copy directly from the Console)
The Chrome version installed on the affected device (Devices & Groups → [Device Name] → Apps)
A screenshot of the device's Activity Feed showing the most recent Blueprint sync event
The device's provisioning mode (Device Owner or Profile Owner), visible under Devices & Groups → [Device Name] → Device Info

Contact Esper Support with this information to speed up diagnosis.

Still need help?

If the steps above don't resolve the issue, submit a support ticket with your device model, Android version, Esper Agent version, and a description of what you've already tried — this helps the support team investigate without a follow-up.