Could you attach the full output of chrome://policy?

Also, make sure you set the black- and whitelist as a list of strings. You can do that either by setting a String array containing "*", or a single String containing a JSON serialization of the list, i.e. "[\"*\"]".

>> Also, make sure you set the black- and whitelist as a list of strings.

They were set as a part of app restrictions, so that should not be a concern.

I am assuming URLBlacklist format should be different.

Not it is URLBlacklist=*

What mechanism/API do you use to set app restrictions?

I was using DPC > DPM.setApplicationRestrictions()
https://goo.gl/CncU5I

Ex: http://enterprise.google.com/android/experience

Turns out that was incorrect format I was setting.

That's that config that does work (tested on a device managed by http://enterprise.google.com/android/experience)

blacklist: ["*"]
whitelist: ["chrome://*", "bbc.co.uk"]

This will only allow bbc.co.uk (which does redirect to www.bbc.co.uk) and all chrome://* internal URLs.

Note: ["*"] blacklist does in fact block all chrome://* URLs

Archiving the result of an offline discussion: If you translate policies from JSON to an Android Bundle, the JSON value should be ["*"]. Also, the asterisk only works as a full wildcard -- subdomains are matched by default (and you can prepend a period to _not_ match them).

Ah, yes. Didn't see your comment :)