Skip to main content
Organization Admin permissions are required to access and modify app policy settings.
The Settings > Apps tab controls whether your organization can use Apps and which external hosts those apps may load resources from.

​
Enable apps

Controls whether your organization can use Apps, which let you build custom data experiences beyond traditional dashboards. To restrict app creation to specific users or groups rather than turning apps off entirely, use the granular permission on a custom role.

​
External source policy

Apps run in a sandboxed iframe whose Content Security Policy blocks outbound network requests by default. The External source policy sets the organization-wide ceiling on which external hosts that policy will open up — for images, scripts, stylesheets, fonts, and network connections. This is separate from, and takes precedence over, the Safe domains setting an app editor configures on an individual app.

​
Policy options

Omni defaults is the policy for an organization that hasn’t chosen one.
Under Custom, your list replaces Omni’s default hosts. If your apps rely on a default host — a charting library from cdn.jsdelivr.net, or fonts.googleapis.com — you have to list it yourself or those resources stop loading.
To block external loading entirely, choose Custom and leave the host list empty. There’s no separate off switch: an empty custom list means an app loads nothing from any external host.

​
Setting a custom host list

  1. Go to Settings > Apps.
  2. Under External source policy, set Source policy to Custom.
  3. Enter your hosts in the Custom hosts field. Add one host per line, or separate them with commas or spaces:
  4. Click Save source policy.
A custom list accepts up to 25 hosts and uses the same formats as an app’s Safe domains. A *. wildcard matches subdomains but not the domain itself, so *.example.com covers cdn.example.com but not example.com.

​
Next steps