# Chrome policy JSON

> The full chrome-policy.json for the Applane extension: force-install, allow-only and the managed storage tenantDomain block, with where each one goes.

Source: https://docs.applane.dev/reference/chrome-policy/

This is `infra/scripts/chrome-policy.json` from the Applane repository. Where to paste it: [Allow or force-install the extension](https://docs.applane.dev/workspace-admins/chrome-extension-policy/).

Replace `<APPLANE_EXTENSION_ID>` with the id shown in the Applane console and `<YOUR_DOMAIN>` with your Workspace domain. Use one of the two `ExtensionSettings` entries, not both.

```json
{
  "ExtensionInstallForcelist": [
    "<APPLANE_EXTENSION_ID>;https://clients2.google.com/service/update2/crx"
  ],
  "ExtensionSettings": {
    "<APPLANE_EXTENSION_ID>": {
      "installation_mode": "force_installed",
      "update_url": "https://clients2.google.com/service/update2/crx",
      "toolbar_pin": "force_pinned"
    }
  },
  "ExtensionSettings_allow_only_alternative": {
    "<APPLANE_EXTENSION_ID>": {
      "installation_mode": "allowed",
      "update_url": "https://clients2.google.com/service/update2/crx"
    }
  },
  "ManagedStoragePolicyForApplane": {
    "tenantDomain": "<YOUR_DOMAIN>"
  }
}
```

| Block | What it is |
|---|---|
| `ExtensionInstallForcelist` | The classic force-install list: id and the Chrome Web Store update URL. Silent install, not removable. |
| `ExtensionSettings` (`force_installed`) | The same as a per-extension setting, plus `toolbar_pin` so the icon is visible. Use this or the forcelist; both is harmless. |
| `ExtensionSettings_allow_only_alternative` | Rename this key to `ExtensionSettings` if you want employees to install it themselves. Needed when your policy blocks unlisted extensions. |
| `ManagedStoragePolicyForApplane` | The value to paste into the extension's own **Policy for extensions** box; it is not a Chrome policy key of its own. `tenantDomain` pins the company domain so employees never type it. Sign-in still checks the account's domain. |

## Where each block goes

- Google Admin console: **Devices > Chrome > Apps & extensions > Users & browsers**. The console has its own form for install mode and pinning; the JSON is for reference. The managed storage block goes in the extension's **Policy for extensions** field.
- Chrome Browser Cloud Management custom policies, Windows registry, macOS profile or Linux policy files: `ExtensionInstallForcelist` and `ExtensionSettings` as shown. Managed storage goes under `3rdparty/extensions/<APPLANE_EXTENSION_ID>/policy`.

## Verify

Open `chrome://policy` on a managed profile and click **Reload policies**. The id appears under the relevant key. Under `chrome://extensions`, the extension shows "Installed by your administrator" when force-installed.