Applying Chrome URL Allowlist/Blocklist (Managed Configuration) to a Fleet via Blueprint

Android

This article explains how to use Blueprints to apply Chrome URL allowlist and blocklist policies across your fleet of Android devices. This lets you restrict which URLs users can access in the Chrome browser.

Before you begin

You need to approve Google Chrome in your Enterprise Play Store before you can manage it via Blueprint. If Chrome isn't already approved:

1. Go to Apps → Play Store Apps in the Esper Console.
2. Search for Google Chrome.
3. Click Approve and accept any required permissions.

Step 1: Add Chrome to your Blueprint

1. Navigate to Blueprints in the Esper Console.
2. Select an existing Blueprint assigned to your target device group, or create a new one.
3. Go to the Apps section.
4. Click Add App and select Google Chrome from the approved Play Store apps.

Step 2: Configure the URL allowlist and blocklist

1. Find the Chrome app you just added in the Blueprint.
2. Click the three-dot menu (⋮) next to Chrome to access the Managed App Configuration field.
3. Paste your configuration JSON into the field. For example:

   {
    "URLAllowlist": [
    "https://www.example.com/",
    "https://www.example.com/info/",
    "https://play.google.com/store/apps/details?id=com.example.app"
    ],
    "URLBlocklist": [
    "*"
    ]
   }

4. Make sure there are no leading or trailing spaces in your URL strings. For example, use https://www.example.com/ instead of https://www.example.com/ .
5. Click Save to store the app configuration.

How this works: The URLAllowlist specifies which URLs users can access. The URLBlocklist set to "*" blocks all other URLs. Users will only be able to navigate to URLs in your allowlist.

Step 3: Publish and apply the Blueprint

1. Click Save & Publish on the Blueprint.
2. Go to Devices & Groups and select your target device group.
3. Apply the updated Blueprint to the group.
4. Devices will receive the configuration on their next sync (typically within a few minutes).

Verify the configuration

To confirm the policy is working:

• On a test device, open Chrome and try to navigate to a URL that is not in your allowlist (for example, https://www.google.com). The page should be blocked.
• Navigate to a URL that is in your allowlist. The page should load successfully.
• In the Esper Console, go to Devices & Groups → [Device Name] → Blueprint and confirm the Blueprint status shows as Applied.

Troubleshooting

Chrome doesn't appear in the Blueprint app list:

• Go to Apps → Play Store Apps and verify that Chrome has been approved. Unapproved apps cannot be added to Blueprints.

The managed configuration isn't taking effect on devices:

• Confirm the Blueprint has been published (not saved as a draft).
• Ensure devices are online and have synced with Esper.
• Check the device's Blueprint compliance status in Devices & Groups → [Device Name] → Blueprint.

The blocklist isn't blocking all URLs:

• Verify your JSON is valid, with no extra spaces inside the URL strings.
• Make sure there are no trailing commas or syntax errors in the JSON.

The policy is applying to some devices but not others:

• Devices that were offline when the Blueprint was published will receive the configuration on their next check-in. Allow up to 15 minutes after devices come online.

Chrome is ignoring the policy even though it's been published:

• Verify you're running a current version of Chrome on your devices. Older Chrome builds may not support these policies.
• If the policy is correctly published but Chrome still ignores it, contact Esper Support. This may indicate a Chrome version incompatibility.

Still need help?

If you've completed these steps and the configuration still isn't working as expected, submit a support ticket. Include details about the URLs in your allowlist, the Chrome version on your devices, and the device group where you applied the Blueprint.