How to Force-Install Chrome Extensions via Google Admin Console

Deploying Chrome extensions to hundreds or thousands of managed Chromebooks is one of the most common tasks school IT administrators handle. Whether you are rolling out a TTS tool like ReadingVox, a content filter, or a classroom management extension, the process goes through the Google Admin Console. This guide walks through the full process, from initial setup to troubleshooting.

Prerequisites

Before you start, make sure you have:

Google Workspace for Education admin access (super admin or an admin role with Chrome Management privileges)
The extension ID from the Chrome Web Store. You can find this in the extension's Web Store URL: https://chromewebstore.google.com/detail/extension-name/EXTENSION_ID_HERE
A clear plan for which organizational units (OUs) should receive the extension
If the extension requires configuration, the managed policy JSON from the extension vendor

Step 1: Open the Chrome App Management Page

Sign in to the Google Admin Console with your admin account.
In the left navigation, go to Devices > Chrome > Apps & extensions.
You will see tabs across the top: Users & browsers, Managed guest sessions, Kiosks, and Managed browsers. For standard student Chromebooks, select Users & browsers.
On the left side, select the Organizational Unit you want to configure. If you want to test with a small group first (recommended), select a test OU rather than the top-level organization.

Step 2: Add the Extension

In the bottom-right corner, click the yellow + button and select Add Chrome app or extension by ID.
Enter the Extension ID in the ID field. For ReadingVox, this would be the extension ID provided in your setup documentation.
For Extension URL, leave this as the default Chrome Web Store URL unless you are installing from a self-hosted CRX file (uncommon in education).
Click Save.

The extension will now appear in your app list for the selected OU.

Step 3: Choose the Installation Policy

This is the most important step. Click on the extension you just added to open its settings. Under Installation policy, you have four options:

Force install

The extension is automatically installed on all devices in the selected OU. Users cannot disable or remove it. The extension icon appears in the toolbar automatically. This is the recommended setting for required accessibility tools like TTS extensions. Students do not need to find and install the extension themselves, and they cannot accidentally remove it.

Force install + pin to toolbar

Same as force install, but the extension icon is also pinned to the Chrome toolbar so it is always visible. This is useful for extensions that students need to interact with directly. For TTS extensions, this is often the best choice since students need to click the extension icon to activate it.

Allow install

The extension is available in the Chrome Web Store for users in the OU, but it is not installed automatically. Users must find it in the Web Store and install it themselves. This is appropriate for optional tools that some teachers or students may want.

Block

The extension is blocked for users in the OU, even if it is available in the Chrome Web Store. Use this if you need to prevent a specific OU from using an extension that is allowed at a higher level.

For most school TTS deployments, choose Force install + pin to toolbar. Click Save after selecting your policy.

Step 4: Configure Managed Policies (If Required)

Some extensions accept managed configuration via JSON policy. This allows administrators to pre-configure the extension so students do not need to enter settings manually.

For ReadingVox, the managed policy includes the school's license key, which activates the extension for all students in the OU without requiring individual setup:

{
  "licenseKey": {
    "Value": "your-site-license-key-here"
  },
  "defaultVoice": {
    "Value": "alloy"
  },
  "enableTranslation": {
    "Value": true
  }
}

To add managed policy:

In the extension settings within the Admin Console, scroll down to Policy for extensions.
Paste the JSON configuration into the text field.
Click Save.

The extension will read this policy on startup and configure itself accordingly. Students will not see a setup screen or need to enter a license key.

Not all extensions support managed policies. Check with the extension vendor for their policy schema. If the extension does not document a managed policy, it probably does not support one.

Step 5: Test on a Single OU First

Never deploy an extension to your entire district in one step. Instead:

Create a test OU (or use an existing one) that contains a small group of devices or users. A single classroom is ideal.
Apply the extension with your chosen installation policy and managed configuration to this test OU.
Wait 10 to 15 minutes for the policy to propagate. On Chromebooks, you can force a policy refresh by going to chrome://policy and clicking Reload policies.
Verify the extension appears on a test device. Open Chrome, check that the extension icon is in the toolbar, and test basic functionality.
Check chrome://extensions on the test device to confirm the extension is listed as "Installed by your administrator" (for force-installed extensions).
Have a teacher or student in the test group use the extension with their actual workflow for at least a day before expanding.

Step 6: Roll Out to Additional OUs

Once testing is successful:

Go back to Devices > Chrome > Apps & extensions > Users & browsers.
Select the next OU you want to deploy to.
Add the same extension with the same settings and policies.
Repeat for each OU, or apply at a parent OU level if all child OUs should receive the extension.

If your OU structure inherits settings from parent OUs, you can apply the extension at a higher level and it will cascade down. However, be careful: if different schools need different configurations (different license keys, for example), you will need to configure each school's OU separately.

Policy Propagation Timing

After saving changes in the Admin Console, policies do not take effect immediately. Here is what to expect:

Chromebooks (managed devices): Policies refresh approximately every 3 hours during active use, or on the next device restart. You can force an immediate refresh from chrome://policy.
Managed Chrome browsers (on Windows/Mac): Policies refresh approximately every 30 minutes. You can force a refresh from chrome://policy or by restarting Chrome.
New device enrollment: When a Chromebook is first enrolled, it pulls all policies immediately during the enrollment process. New devices will have the extension from the start.

For a scheduled rollout (for example, deploying over a weekend), configure the extension Friday afternoon. By Monday morning, all active devices will have received the policy.

Troubleshooting Common Issues

Extension does not appear on the device

Check the OU. Is the device or user actually in the OU where you applied the extension? Go to Devices > Chrome > Devices and look up the specific device to verify its OU.
Force a policy refresh. On the Chromebook, open chrome://policy and click Reload policies. Then check if the extension appears in the policy list.
Check chrome://extensions. If the extension is listed but disabled, there may be a permission conflict. Look for error messages.
Check the extension ID. A single character typo in the extension ID will silently fail. The extension just will not appear. Double-check the ID against the Chrome Web Store listing.

Extension is installed but not working correctly

Verify managed policy. On the device, go to chrome://policy and search for the extension ID. The managed policy values should appear under the extension's policies. If they are missing, the JSON may have a syntax error. Validate your JSON at jsonlint.com.
Check extension permissions. Some extensions require permissions that the student must approve on first run. Force-installed extensions automatically receive their declared permissions, but if the extension updates and requests new permissions, there may be a delay.
Version conflicts. If the extension was previously installed manually by the user, the managed installation may conflict. The user should remove the manual installation, or you can clear extension data via the Admin Console.

Extension works on some sites but not others

This is usually related to the extension's content script permissions, not the Admin Console configuration. Check with the extension vendor. For ReadingVox, all web pages are supported, with special handling for Google Docs and Google Slides via API integration.

Rolling back a deployment

If you need to remove an extension quickly:

Go to the extension settings in the Admin Console.
Change the installation policy to Block (not just removing it, which would leave manually installed copies).
Force policy refresh on devices if immediate removal is needed.
After confirming removal, you can change the policy from Block to removing the extension entry entirely.

Managing Updates

Chrome extensions installed from the Chrome Web Store update automatically. When the extension developer publishes a new version, managed devices will receive the update within a few hours, following Chrome's standard extension update cycle.

If you need to control updates more carefully:

Pin to a specific version: In the extension settings in the Admin Console, you can pin to a specific version to prevent automatic updates. This is rarely recommended for school deployments since it means you will miss security fixes.
Test channel: Some extension vendors offer a separate Chrome Web Store listing for beta versions. You can install the beta version on your test OU to preview updates before they reach production.

Permissions and Privacy Review

Before deploying any extension district-wide, review its permissions carefully:

In the Chrome Web Store listing, look at the Permissions section. Common permissions for TTS extensions include "Read and change all your data on all websites" (required to read page content for text-to-speech) and "Identity" (to identify students for license management).
Ask the vendor for their privacy policy and Student Data Privacy Agreement (if applicable in your state).
Check if the extension is listed on your state's approved application list or has been reviewed through your district's software vetting process.

For ReadingVox specifically, the extension reads page content solely for text-to-speech conversion, identifies students by email for license seat management, and stores no student data beyond usage counts for license compliance.

Summary Checklist

Before you start:

[ ] Admin Console access with Chrome Management privileges
[ ] Extension ID from Chrome Web Store
[ ] Managed policy JSON from vendor (if applicable)
[ ] Test OU identified

Deployment:

[ ] Extension added by ID in Admin Console
[ ] Installation policy set (Force install + pin recommended)
[ ] Managed policies configured
[ ] Tested on single OU for at least one day
[ ] Rolled out to additional OUs
[ ] Verified on student devices

Post-deployment:

[ ] Communicated to teachers about the new tool
[ ] Provided teacher training or documentation
[ ] Established a support channel for issues
[ ] Scheduled a review after 2 to 4 weeks to assess usage and feedback