Is there a specific setting in the Google Chrome group policy template to block / disable user’s ability to “install” Chrome apps? Ex: If I browse to Youtube.com, Chrome presents an option to “install YouTube” and it adds it as an app on the start menu for the user.

We typically don’t allow Chrome, but we have a vendor site that only works with Chrome. Before anyone suggests trying Edge, Firefox, etc. we have done so, and the site only works correctly in Chrome. I wish it would work with Edge as we already have policies in place for Edge.

I have the Chrome Enterprise admin templates in Group Policy but the settings only mention extensions.

7 Spice ups

Well since you have the Admin Templates:

Computer Configuration > Administrative Templates > Google > Google Chrome > Extensions > Configure extension installation blocklist

Another option, you can modify the Chrome shortcut to include --disable-features=DefaultWebAppInstallation.

Lastly, is to modify the master prefs file to include "default_apps": ""

It is not an Extension/App to Chromium browser(s). The --disable-features flag mentioned above does not disable this pop-up appearing in the address bar, nor block it from being installed. That flag will block apps from the Chrome/Edge stores.

What is getting installed is a “Progressive Web App”. It essentially creates a browser session to that website, so really it’s nothing more than a “fancy” shortcut. There’s no security implications since you are already allowing users to visit that website. If you inspect the shortcut, it’s calling msedge-proxy.exe, and passing an app-id. That appID just goes to youtube, and adds some navigation buttons. If you replace that --app-id flag with --app=“https://www.youtube.com”, you’ll get a very similar looking “app”, minus those buttons.

If you’re on O365, you can create an Outlook “app” for your users, Rename the shortcut to “Outlook”, and point the app URL to “https://outlook.office.com/mail”. It’s just OWA, but “fancy”.

I’m not aware of any method to block them - since it’s functionally no different from the user creating a shortcut to an allowed website.

Let me know if you do find a way, I keep looking every so often.

TL;DR: Nope. You cannot block this from users.

That makes more sense. Thanks for the detail.

I was asked to block this but I had already explained that it was more than likely not doable.