README.md

   1 **These policies are in active development and so might contain changes that do not work with current versions of Firefox.**
   2
   3 **You should use the [officially released versions](https://github.com/mozilla/policy-templates/releases) if you are deploying changes.**
   4
   5 Policies can be specified using the [Group Policy templates on Windows](https://github.com/mozilla/policy-templates/tree/master/windows), [Intune on Windows](https://support.mozilla.org/kb/managing-firefox-intune), [configuration profiles on macOS](https://github.com/mozilla/policy-templates/tree/master/mac), or by creating a file called `policies.json`. On Windows, create a directory called `distribution` where the EXE is located and place the file there. On Mac, the file goes into `Firefox.app/Contents/Resources/distribution`.  On Linux, the file goes into `firefox/distribution`, where `firefox` is the installation directory for firefox, which varies by distribution or you can specify system-wide policy by placing the file in `/etc/firefox/policies`.
   6
   7 | Policy Name | Description
   8 | --- | --- |
   9 | **[`3rdparty`](#3rdparty)** | Set policies that WebExtensions can access via chrome.storage.managed.
  10 | **[`AllowedDomainsForApps`](#alloweddomainsforapps)** | Define domains allowed to access Google Workspace.
  11 | **[`AppAutoUpdate`](#appautoupdate)** | Enable or disable automatic application update.
  12 | **[`AppUpdateURL`](#appupdateurl)** | Change the URL for application update.
  13 | **[`Authentication`](#authentication)** | Configure sites that support integrated authentication.
  14 | **[`AutoLaunchProtocolsFromOrigins`](#autolaunchprotocolsfromorigins)** | Define a list of external protocols that can be used from listed origins without prompting the user.
  15 | **[`BackgroundAppUpdate`](#backgroundappupdate)** | Enable or disable the background updater (Windows only).
  16 | **[`BlockAboutAddons`](#blockaboutaddons)** | Block access to the Add-ons Manager (about:addons).
  17 | **[`BlockAboutConfig`](#blockaboutconfig)** | Block access to about:config.
  18 | **[`BlockAboutProfiles`](#blockaboutprofiles)** | Block access to About Profiles (about:profiles).
  19 | **[`BlockAboutSupport`](#blockaboutsupport)** | Block access to Troubleshooting Information (about:support).
  20 | **[`Bookmarks`](#bookmarks)** | Add bookmarks in either the bookmarks toolbar or menu.
  21 | **[`CaptivePortal`](#captiveportal)** | Enable or disable the detection of captive portals.
  22 | **[`Certificates`](#certificates)** |
  23 | **[`Certificates -> ImportEnterpriseRoots`](#certificates--importenterpriseroots)** | Trust certificates that have been added to the operating system certificate store by a user or administrator.
  24 | **[`Certificates -> Install`](#certificates--install)** | Install certificates into the Firefox certificate store.
  25 | **[`Cookies`](#cookies)** | Configure cookie preferences.
  26 | **[`DisableAppUpdate`](#disableappupdate)** | Turn off application updates.
  27 | **[`DisableBuiltinPDFViewer`](#disablebuiltinpdfviewer)** | Disable the built in PDF viewer.
  28 | **[`DisabledCiphers`](#disabledciphers)** | Disable ciphers.
  29 | **[`DisableDefaultBrowserAgent`](#disabledefaultbrowseragent)** | Prevent the default browser agent from taking any actions (Windows only).
  30 | **[`DisableDeveloperTools`](#disabledevelopertools)** | Remove access to all developer tools.
  31 | **[`DisableFeedbackCommands`](#disablefeedbackcommands)** | Disable the menus for reporting sites.
  32 | **[`DisableFirefoxScreenshots`](#disablefirefoxscreenshots)** | Remove access to Firefox Screenshots.
  33 | **[`DisableFirefoxAccounts`](#disablefirefoxaccounts)** | Disable Firefox Accounts integration (Sync).
  34 | **[`DisableFirefoxStudies`](#disablefirefoxstudies)** | Disable Firefox studies (Shield).
  35 | **[`DisableForgetButton`](#disableforgetbutton)** | Disable the "Forget" button.
  36 | **[`DisableFormHistory`](#disableformhistory)** | Turn off saving information on web forms and the search bar.
  37 | **[`DisableMasterPasswordCreation`](#disablemasterpasswordcreation)** | Remove the master password functionality.
  38 | **[`DisablePasswordReveal`](#disablepasswordreveal)** | Do not allow passwords to be revealed in saved logins.
  39 | **[`DisablePocket`](#disablepocket)** | Remove Pocket in the Firefox UI.
  40 | **[`DisablePrivateBrowsing`](#disableprivatebrowsing)** | Remove access to private browsing.
  41 | **[`DisableProfileImport`](#disableprofileimport)** | Disables the "Import data from another browser" option in the bookmarks window.
  42 | **[`DisableProfileRefresh`](#disableprofilerefresh)** | Disable the Refresh Firefox button on about:support and support.mozilla.org
  43 | **[`DisableSafeMode`](#disablesafemode)** | Disable safe mode within the browser.
  44 | **[`DisableSecurityBypass`](#disablesecuritybypass)** | Prevent the user from bypassing security in certain cases.
  45 | **[`DisableSetDesktopBackground`](#disablesetdesktopbackground)** | Remove the "Set As Desktop Background..." menuitem when right clicking on an image.
  46 | **[`DisableSystemAddonUpdate`](#disablesystemaddonupdate)** | Prevent system add-ons from being installed or update.
  47 | **[`DisableTelemetry`](#disabletelemetry)** | DisableTelemetry
  48 | **[`DisplayBookmarksToolbar`](#displaybookmarkstoolbar)** | Set the initial state of the bookmarks toolbar.
  49 | **[`DisplayMenuBar (Deprecated)`](#displaymenubar-deprecated)** | Set the initial state of the menubar.
  50 | **[`DisplayMenuBar`](#displaymenubar)** | Set the state of the menubar.
  51 | **[`DNSOverHTTPS`](#dnsoverhttps)** | Configure DNS over HTTPS.
  52 | **[`DontCheckDefaultBrowser`](#dontcheckdefaultbrowser)** | Don't check if Firefox is the default browser at startup.
  53 | **[`DefaultDownloadDirectory`](#defaultdownloaddirectory)** | Set the default download directory.
  54 | **[`DownloadDirectory`](#downloaddirectory)** | Set and lock the download directory.
  55 | **[`EnableTrackingProtection`](#enabletrackingprotection)** | Configure tracking protection.
  56 | **[`EncryptedMediaExtensions`](#encryptedmediaextensions)** | Enable or disable Encrypted Media Extensions and optionally lock it.
  57 | **[`EnterprisePoliciesEnabled`](#enterprisepoliciesenabled)** | Enable policy support on macOS.
  58 | **[`Extensions`](#extensions)** | Control the installation, uninstallation and locking of extensions.
  59 | **[`ExtensionSettings`](#extensionsettings)** | Manage all aspects of extensions.
  60 | **[`ExtensionUpdate`](#extensionupdate)** | Control extension updates.
  61 | **[`FlashPlugin`](#flashplugin)** | Configure the default Flash plugin policy as well as origins for which Flash is allowed.
  62 | **[`FirefoxHome`](#firefoxhome)** | Customize the Firefox Home page.
  63 | **[`HardwareAcceleration`](#hardwareacceleration)** | Control hardware acceleration.
  64 | **[`Handlers`](#handlers)** | Configure default application handlers.
  65 | **[`Homepage`](#homepage)** | Configure the default homepage and how Firefox starts.
  66 | **[`InstallAddonsPermission`](#installaddonspermission)** | Configure the default extension install policy as well as origins for extension installs are allowed.
  67 | **[`LegacyProfiles`](#legacyprofiles)** | Disable the feature enforcing a separate profile for each installation.
  68 | **[`LocalFileLinks`](#localfilelinks)** | Enable linking to local files by origin.
  69 | **[`ManagedBookmarks`](#managedbookmarks)** | Configures a list of bookmarks managed by an administrator that cannot be changed by the user.
  70 | **[`ManualAppUpdateOnly`](#manualappupdateonly)** | Allow manual updates only and do not notify the user about updates..
  71 | **[`PrimaryPassword`](#primarypassword)** | Require or prevent using a primary (formerly master) password.
  72 | **[`NetworkPrediction`](#networkprediction)** | Enable or disable network prediction (DNS prefetching).
  73 | **[`NewTabPage`](#newtabpage)** | Enable or disable the New Tab page.
  74 | **[`NoDefaultBookmarks`](#nodefaultbookmarks)** | Disable the creation of default bookmarks.
  75 | **[`OfferToSaveLogins`](#offertosavelogins)** | Control whether or not Firefox offers to save passwords.
  76 | **[`OfferToSaveLoginsDefault`](#offertosaveloginsdefault)** | Set the default value for whether or not Firefox offers to save passwords.
  77 | **[`OverrideFirstRunPage`](#overridefirstrunpage)** | Override the first run page.
  78 | **[`OverridePostUpdatePage`](#overridepostupdatepage)** | Override the upgrade page.
  79 | **[`PasswordManagerEnabled`](#passwordmanagerenabled)** | Remove (some) access to the password manager.
  80 | **[`PDFjs`](#pdfjs)** | Disable or configure PDF.js, the built-in PDF viewer.
  81 | **[`Permissions`](#permissions)** | Set permissions associated with camera, microphone, location, and notifications.
  82 | **[`PictureInPicture`](#pictureinpicture)** | Enable or disable Picture-in-Picture.
  83 | **[`PopupBlocking`](#popupblocking)** | Configure the default pop-up window policy as well as origins for which pop-up windows are allowed.
  84 | **[`Preferences`](#preferences)** | Set and lock preferences.
  85 | **[`Preferences (Deprecated)`](#preferences-deprecated)** | Set and lock some preferences.
  86 | **[`PromptForDownloadLocation`](#promptfordownloadlocation)** | Ask where to save each file before downloading.
  87 | **[`Proxy`](#proxy)** | Configure proxy settings.
  88 | **[`RequestedLocales`](#requestedlocales)** | Set the the list of requested locales for the application in order of preference.
  89 | **[`SanitizeOnShutdown` (All)](#sanitizeonshutdown-all)** | Clear all data on shutdown.
  90 | **[`SanitizeOnShutdown` (Selective)](#sanitizeonshutdown-selective)** | Clear data on shutdown.
  91 | **[`SearchBar`](#searchbar)** | Set whether or not search bar is displayed.
  92 | **[`SearchEngines`](#searchengines-this-policy-is-only-available-on-the-esr)** |
  93 | **[`SearchEngines -> Default`](#searchengines--default)** | Set the default search engine.
  94 | **[`SearchEngines -> PreventInstalls`](#searchengines--preventinstalls)** | Prevent installing search engines from webpages.
  95 | **[`SearchEngines -> Remove`](#searchengines--remove)** | Hide built-in search engines.
  96 | **[`SearchEngines -> Add`](#searchengines--add)** | Add new search engines.
  97 | **[`SearchSuggestEnabled`](#searchsuggestenabled)** | Enable search suggestions.
  98 | **[`SecurityDevices`](#securitydevices)** | Install PKCS #11 modules.
  99 | **[`ShowHomeButton`](#showhomebutton)** | Show the home button on the toolbar.
 100 | **[`SSLVersionMax`](#sslversionmax)** | Set and lock the maximum version of TLS.
 101 | **[`SSLVersionMin`](#sslversionmin)** | Set and lock the minimum version of TLS.
 102 | **[`SupportMenu`](#supportmenu)** | Add a menuitem to the help menu for specifying support information.
 103 | **[`UserMessaging`](#usermessaging)** | Don't show certain messages to the user.
 104 | **[`WebsiteFilter`](#websitefilter)** | Block websites from being visited.
 105 | **[`WindowsSSO`](#windowssso)** | Allow Windows single sign-on for Microsoft, work, and school accounts.
 106
 107 ### 3rdparty
 108
 109 Allow WebExtensions to configure policy. For more information, see [Adding policy support to your extension](https://extensionworkshop.com/documentation/enterprise/adding-policy-support-to-your-extension/).
 110
 111 ### AppAutoUpdate
 112
 113 Enable or disable **automatic** application update.
 114
 115 If set to true, application updates are installed without user approval within Firefox. The operating system might still require approval.
 116
 117 If set to false, application updates are downloaded but the user can choose when to install the update.
 118
 119 If you have disabled updates via DisableAppUpdate, this policy has no effect.
 120
 121 **Compatibility:** Firefox 75, Firefox ESR 68.7\
 122 **CCK2 Equivalent:** N/A\
 123 **Preferences Affected:** app.update.auto
 124
 125 #### Windows (GPO)
 126 ```
 127 Software\Policies\Mozilla\Firefox\AppAutoUpdate = 0x1 | 0x0
 128 ```
 129 #### Windows (Intune)
 130 OMA-URI:
 131 ```
 132 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox/AppAutoUpdate
 133 ```
 134 Value (string):
 135 ```
 136 <enabled/> or <disabled/>
 137 ```
 138 #### macOS
 139 ```
 140 <dict>
 141   <key>AppAutoUpdate</key>
 142   <true/> | <false/>
 143 </dict>
 144 ```
 145 #### policies.json
 146 ```
 147 {
 148   "policies": {
 149     "AppAutoUpdate": true | false
 150   }
 151 }
 152 ```
 153 ### AllowedDomainsForApps
 154
 155 Define domains allowed to access Google Workspace.
 156
 157 This policy is based on the [Chrome policy](https://chromeenterprise.google/policies/#AllowedDomainsForApps) of the same name.
 158
 159 If this policy is enabled, users can only access Google Workspace using accounts from the specified domains. If you want to allow Gmail, you can add ```consumer_accounts``` to the list.
 160
 161 **Compatibility:** Firefox 89, Firefox ESR 78.11\
 162 **CCK2 Equivalent:** N/A\
 163 **Preferences Affected:** N/A
 164
 165 #### Windows (GPO)
 166 ```
 167 Software\Policies\Mozilla\Firefox\AllowedDomainsForApps = "managedfirefox.com,example.com"
 168 ```
 169 #### Windows (Intune)
 170 OMA-URI:
 171 ```
 172 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox/AllowedDomainsForApps
 173 ```
 174 Value (string):
 175 ```
 176 <enabled/>
 177 <data id="AllowedDomainsForApps" value="managedfirefox.com,example.com"/>
 178 ```
 179 #### macOS
 180 ```
 181 <dict>
 182   <key>AllowedDomainsForApps</key>
 183   <string>managedfirefox.com,example.com</string>
 184 </dict>
 185 ```
 186 #### policies.json
 187 ```
 188 {
 189   "policies": {
 190     "AllowedDomainsForApps": "managedfirefox.com,example.com"
 191   }
 192 }
 193 ```
 194 ### AppUpdateURL
 195
 196 Change the URL for application update if you are providing Firefox updates from a custom update server.
 197
 198 **Compatibility:** Firefox 62, Firefox ESR 60.2\
 199 **CCK2 Equivalent:** N/A\
 200 **Preferences Affected:** `app.update.url`
 201
 202 #### Windows (GPO)
 203 ```
 204 Software\Policies\Mozilla\Firefox\AppUpdateURL = "https://yoursite.com"
 205 ```
 206 #### Windows (Intune)
 207 OMA-URI:
 208 ```
 209 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox/AppUpdateURL
 210 ```
 211 Value (string):
 212 ```
 213 <enabled/>
 214 <data id="AppUpdateURL" value="https://yoursite.com"/>
 215 ```
 216 #### macOS
 217 ```
 218 <dict>
 219   <key>AppUpdateURL</key>
 220   <string>https://yoursite.com</string>
 221 </dict>
 222 ```
 223 #### policies.json
 224 ```
 225 {
 226   "policies": {
 227     "AppUpdateURL": "https://yoursite.com"
 228   }
 229 }
 230 ```
 231 ### Authentication
 232
 233 Configure sites that support integrated authentication.
 234
 235 See https://developer.mozilla.org/en-US/docs/Mozilla/Integrated_authentication for more information.
 236
 237 `PrivateBrowsing` enables integrated authentication in private browsing.
 238
 239 **Compatibility:** Firefox 60, Firefox ESR 60 (AllowNonFQDN added in 62/60.2, AllowProxies added in 70/68.2, Locked added in 71/68.3, PrivateBrowsing added in 77/68.9)\
 240 **CCK2 Equivalent:** N/A\
 241 **Preferences Affected:** `network.negotiate-auth.trusted-uris`,`network.negotiate-auth.delegation-uris`,`network.automatic-ntlm-auth.trusted-uris`,`network.automatic-ntlm-auth.allow-non-fqdn`,`network.negotiate-auth.allow-non-fqdn`,`network.automatic-ntlm-auth.allow-proxies`,`network.negotiate-auth.allow-proxies`,`network.auth.private-browsing-sso`
 242
 243 #### Windows (GPO)
 244 ```
 245 Software\Policies\Mozilla\Firefox\Authentication\SPNEGO\1 = "mydomain.com"
 246 Software\Policies\Mozilla\Firefox\Authentication\SPNEGO\2 = "https://myotherdomain.com"
 247 Software\Policies\Mozilla\Firefox\Authentication\Delegated\1 = "mydomain.com"
 248 Software\Policies\Mozilla\Firefox\Authentication\Delegated\2 = "https://myotherdomain.com"
 249 Software\Policies\Mozilla\Firefox\Authentication\NTLM\1 = "mydomain.com"
 250 Software\Policies\Mozilla\Firefox\Authentication\NTLM\2 = "https://myotherdomain.com"
 251 Software\Policies\Mozilla\Firefox\Authentication\AllowNonFQDN\SPNEGO = 0x1 | 0x0
 252 Software\Policies\Mozilla\Firefox\Authentication\AllowNonFQDN\NTLM = 0x1 | 0x0
 253 Software\Policies\Mozilla\Firefox\Authentication\AllowProxies\SPNEGO = 0x1 | 0x0
 254 Software\Policies\Mozilla\Firefox\Authentication\AllowProxies\NTLM = 0x1 | 0x0
 255 Software\Policies\Mozilla\Firefox\Authentication\Locked = 0x1 | 0x0
 256 Software\Policies\Mozilla\Firefox\Authentication\PrivateBrowsing = 0x1 | 0x0
 257 ```
 258 #### Windows (Intune)
 259 OMA-URI:
 260 ```
 261 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~Authentication/Authentication_SPNEGO
 262 ```
 263 Value (string):
 264 ```
 265 <enabled/>
 266 <data id="Authentication" value="1&#xF000;mydomain&#xF000;2&#xF000;https://myotherdomain.com"/>
 267 ```
 268 OMA-URI:
 269 ```
 270 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~Authentication/Authentication_Delegated
 271 ```
 272 Value (string):
 273 ```
 274 <enabled/>
 275 <data id="Authentication" value="1&#xF000;mydomain&#xF000;2&#xF000;https://myotherdomain.com"/>
 276 ```
 277 OMA-URI:
 278 ```
 279 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~Authentication/Authentication_NTLM
 280 ```
 281 Value (string):
 282 ```
 283 <enabled/>
 284 <data id="Authentication" value="1&#xF000;mydomain&#xF000;2&#xF000;https://myotherdomain.com"/>
 285 ```
 286 OMA-URI:
 287 ```
 288 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~Authentication/Authentication_AllowNonFQDN
 289 ```
 290 Value (string):
 291 ```
 292 <enabled/>
 293 <data id="Authentication_AllowNonFQDN_NTLM" value="true | false"/>
 294 <data id="Authentication_AllowNonFQDN_SPNEGO" value="true | false"/>
 295 ```
 296 OMA-URI:
 297 ```
 298 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~Authentication/Authentication_Locked
 299 ```
 300 Value (string):
 301 ```
 302 <enabled/> or <disabled/>
 303 ```
 304 OMA-URI:
 305 ```
 306 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~Authentication/Authentication_PrivateBrowsing
 307 ```
 308 Value (string):
 309 ```
 310 <enabled/> or <disabled/>
 311 ```
 312 #### macOS
 313 ```
 314 <dict>
 315   <key>Authentication</key>
 316   <dict>
 317     <key>SPNEGO</key>
 318     <array>
 319       <string>mydomain.com</string>
 320       <string>https://myotherdomain.com</string>
 321     </array>
 322     <key>Delegated</key>
 323     <array>
 324       <string>mydomain.com</string>
 325       <string>https://myotherdomain.com</string>
 326     </array>
 327     <key>NTLM</key>
 328     <array>
 329       <string>mydomain.com</string>
 330       <string>https://myotherdomain.com</string>
 331     </array>
 332     <key>AllowNonFQDN</key>
 333       <dict>
 334       <key>SPNEGO</key>
 335       <true/> | <false/>
 336       <key>NTLM</key>
 337       <true/> | <false/>
 338     </dict>
 339     <key>AllowProxies</key>
 340       <dict>
 341       <key>SPNEGO</key>
 342       <true/> | <false/>
 343       <key>NTLM</key>
 344       <true/> | <false/>
 345     </dict>
 346     <key>Locked</key>
 347     <true/> | <false/>
 348     <key>PrivateBrowsing</key>
 349     <true/> | <false/>
 350   </dict>
 351 </dict>
 352 ```
 353 #### policies.json
 354 ```
 355 {
 356   "policies": {
 357     "Authentication": {
 358       "SPNEGO": ["mydomain.com", "https://myotherdomain.com"],
 359       "Delegated": ["mydomain.com", "https://myotherdomain.com"],
 360       "NTLM": ["mydomain.com", "https://myotherdomain.com"],
 361       "AllowNonFQDN": {
 362         "SPNEGO": true | false,
 363         "NTLM": true | false
 364       },
 365       "AllowProxies": {
 366         "SPNEGO": true | false,
 367         "NTLM": true | false
 368       },
 369       "Locked": true | false,
 370       "PrivateBrowsing": true | false
 371     }
 372   }
 373 }
 374 ```
 375 ### AutoLaunchProtocolsFromOrigins
 376 Define a list of external protocols that can be used from listed origins without prompting the user. The origin is the scheme plus the hostname.
 377
 378 The syntax of this policy is exactly the same as the [Chrome AutoLaunchProtocolsFromOrigins policy](https://cloud.google.com/docs/chrome-enterprise/policies/?policy=AutoLaunchProtocolsFromOrigins) except that you can only use valid origins (not just hostnames). This also means that you cannot specify an asterisk for all origins.
 379
 380 The schema is:
 381 ```
 382 {
 383  "items": {
 384   "properties": {
 385    "allowed_origins": {
 386     "items": {
 387      "type": "string"
 388     },
 389     "type": "array"
 390    },
 391    "protocol": {
 392     "type": "string"
 393    }
 394   },
 395   "required": [
 396    "protocol",
 397    "allowed_origins"
 398   ],
 399   "type": "object"
 400  },
 401  "type": "array"
 402 }
 403 ```
 404 **Compatibility:** Firefox 90, Firefox ESR 78.12\
 405 **CCK2 Equivalent:** N/A\
 406 **Preferences Affected:** N/A
 407
 408 #### Windows (GPO)
 409 Software\Policies\Mozilla\Firefox\AutoLaunchProtocolsFromOrigins (REG_MULTI_SZ) =
 410 ```
 411 [
 412   {
 413     "protocol": "zoommtg",
 414     "allowed_origins": [
 415       "https://somesite.zoom.us"
 416     ]
 417   }
 418 ]
 419 ```
 420 #### Windows (Intune)
 421 OMA-URI:
 422 ```
 423 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox/AutoLaunchProtocolsFromOrigins
 424 ```
 425 Value (string):
 426 ```
 427 <enabled/>
 428 <data id="JSON" value='
 429 [
 430   {
 431     "protocol": "zoommtg",
 432     "allowed_origins": [
 433       "https://somesite.zoom.us"
 434     ]
 435   }
 436 ]'/>
 437 ```
 438 #### macOS
 439 ```
 440 <dict>
 441   <key>AutoLaunchProtocolsFromOrigins</key>
 442   <array>
 443     <dict>
 444       <key>protocol</key>
 445       <string>zoommtg</string>
 446       <key>allowed_origins</key>
 447       <array>
 448         <string>https://somesite.zoom.us</string>
 449       </array>
 450     </dict>
 451   </array>
 452 </dict>
 453 ```
 454 #### policies.json
 455 ```
 456 {
 457   "policies": {
 458     "AutoLaunchProtocolsFromOrigins": [{
 459       "protocol": "zoommtg",
 460       "allowed_origins": [
 461         "https://somesite.zoom.us"
 462       ]
 463     }]
 464   }
 465 }
 466 ```
 467 ### BackgroundAppUpdate
 468
 469 Enable or disable **automatic** application update **in the background**, when the application is not running.
 470
 471 If set to true, application updates may be installed (without user approval) in the background, even when the application is not running. The operating system might still require approval.
 472
 473 If set to false, the application will not try to install updates when the application is not running.
 474
 475 If you have disabled updates via `DisableAppUpdate` or disabled automatic updates via `AppAutoUpdate`, this policy has no effect.
 476
 477 **Compatibility:** Firefox 90 (Windows only)\
 478 **CCK2 Equivalent:** N/A\
 479 **Preferences Affected:** `app.update.background.enabled`
 480
 481 #### Windows (GPO)
 482 ```
 483 Software\Policies\Mozilla\Firefox\BackgroundAppUpdate = 0x1 | 0x0
 484 ```
 485 #### Windows (Intune)
 486 OMA-URI:
 487 ```
 488 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox/BackgroundAppUpdate
 489 ```
 490 Value (string):
 491 ```
 492 <enabled/> or <disabled/>
 493 ```
 494 #### macOS
 495 ```
 496 <dict>
 497   <key>BackgroundAppUpdate</key>
 498   <true/> | <false/>
 499 </dict>
 500 ```
 501 #### policies.json
 502 ```
 503 {
 504   "policies": {
 505     "BackgroundAppUpdate": true | false
 506   }
 507 }
 508 ```
 509 ### BlockAboutAddons
 510
 511 Block access to the Add-ons Manager (about:addons).
 512
 513 **Compatibility:** Firefox 60, Firefox ESR 60\
 514 **CCK2 Equivalent:** `disableAddonsManager`\
 515 **Preferences Affected:** N/A
 516
 517 #### Windows (GPO)
 518 ```
 519 Software\Policies\Mozilla\Firefox\BlockAboutAddons = 0x1 | 0x0
 520 ```
 521 #### Windows (Intune)
 522 OMA-URI:
 523 ```
 524 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox/BlockAboutAddons
 525 ```
 526 Value (string):
 527 ```
 528 <enabled/> or <disabled/>
 529 ```
 530 #### macOS
 531 ```
 532 <dict>
 533   <key>BlockAboutAddons</key>
 534   <true/> | <false/>
 535 </dict>
 536 ```
 537 #### policies.json
 538 ```
 539 {
 540   "policies": {
 541     "BlockAboutAddons": true | false
 542   }
 543 }
 544 ```
 545 ### BlockAboutConfig
 546
 547 Block access to about:config.
 548
 549 **Compatibility:** Firefox 60, Firefox ESR 60\
 550 **CCK2 Equivalent:** `disableAboutConfig`\
 551 **Preferences Affected:** N/A
 552
 553 #### Windows (GPO)
 554 ```
 555 Software\Policies\Mozilla\Firefox\BlockAboutConfig = 0x1 | 0x0
 556 ```
 557 #### Windows (Intune)
 558 OMA-URI:
 559 ```
 560 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox/BlockAboutConfig
 561 ```
 562 Value (string):
 563 ```
 564 <enabled/> or <disabled/>
 565 ```
 566 #### macOS
 567 ```
 568 <dict>
 569   <key>BlockAboutConfig</key>
 570   <true/> | <false/>
 571 </dict>
 572 ```
 573 #### policies.json
 574 ```
 575 {
 576   "policies": {
 577     "BlockAboutConfig": true | false
 578   }
 579 }
 580 ```
 581 ### BlockAboutProfiles
 582
 583 Block access to About Profiles (about:profiles).
 584
 585 **Compatibility:** Firefox 60, Firefox ESR 60\
 586 **CCK2 Equivalent:** `disableAboutProfiles`\
 587 **Preferences Affected:** N/A
 588
 589 #### Windows (GPO)
 590 ```
 591 Software\Policies\Mozilla\Firefox\BlockAboutProfiles = 0x1 | 0x0
 592 ```
 593 #### Windows (Intune)
 594 OMA-URI:
 595 ```
 596 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox/BlockAboutProfiles
 597 ```
 598 Value (string):
 599 ```
 600 <enabled/> or <disabled/>
 601 ```
 602 #### macOS
 603 ```
 604 <dict>
 605   <key>BlockAboutProfiles</key>
 606   <true/> | <false/>
 607 </dict>
 608 ```
 609 #### policies.json
 610 ```
 611 {
 612   "policies": {
 613     "BlockAboutProfiles": true | false
 614   }
 615 }
 616 ```
 617 ### BlockAboutSupport
 618
 619 Block access to Troubleshooting Information (about:support).
 620
 621 **Compatibility:** Firefox 60, Firefox ESR 60\
 622 **CCK2 Equivalent:** `disableAboutSupport`\
 623 **Preferences Affected:** N/A
 624
 625 #### Windows (GPO)
 626 ```
 627 Software\Policies\Mozilla\Firefox\BlockAboutSupport = 0x1 | 0x0
 628 ```
 629 #### Windows (Intune)
 630 OMA-URI:
 631 ```
 632 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox/BlockAboutSupport
 633 ```
 634 Value (string):
 635 ```
 636 <enabled/> or <disabled/>
 637 ```
 638 #### macOS
 639 ```
 640 <dict>
 641   <key>BlockAboutSupport</key>
 642   <true/> | <false/>
 643 </dict>
 644 ```
 645 #### policies.json
 646 ```
 647 {
 648   "policies": {
 649     "BlockAboutSupport": true | false
 650   }
 651 }
 652 ```
 653 ### Bookmarks
 654
 655 Note: [`ManagedBookmarks`](#managedbookmarks) is the new recommended way to add bookmarks. This policy will continue to be supported.
 656
 657 Add bookmarks in either the bookmarks toolbar or menu. Only `Title` and `URL` are required. If `Placement` is not specified, the bookmark will be placed on the toolbar. If `Folder` is specified, it is automatically created and bookmarks with the same folder name are grouped together.
 658
 659 **Compatibility:** Firefox 60, Firefox ESR 60\
 660 **CCK2 Equivalent:** `bookmarks.toolbar`,`bookmarks.menu`\
 661 **Preferences Affected:** N/A
 662
 663 #### Windows (GPO)
 664 ```
 665 Software\Policies\Mozilla\Firefox\Bookmarks\1\Title = "Example"
 666 Software\Policies\Mozilla\Firefox\Bookmarks\1\URL = "https://example.com"
 667 Software\Policies\Mozilla\Firefox\Bookmarks\1\Favicon = "https://example.com/favicon.ico"
 668 Software\Policies\Mozilla\Firefox\Bookmarks\1\Placement = "toolbar" | "menu"
 669 Software\Policies\Mozilla\Firefox\Bookmarks\1\Folder = "FolderName"
 670 ```
 671 #### Windows (Intune)
 672 OMA-URI:
 673 ```
 674 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~Bookmarks/Bookmark01
 675 ```
 676 Value (string):
 677 ```
 678 <enabled/>
 679 <data id="BookmarkTitle" value="Example"/>
 680 <data id="BookmarkURL" value="https://example.com"/>
 681 <data id="BookmarkFavicon" value="https://example.com/favicon.ico"/>
 682 <data id="BookmarkPlacement" value="toolbar | menu"/>
 683 <data id="BookmarkFolder" value="FolderName"/>
 684 ```
 685 #### macOS
 686 ```
 687 <dict>
 688   <key>Bookmarks</key>
 689   <array>
 690     <dict>
 691       <key>Title</key>
 692       <string>Example</string>
 693       <key>URL</key>
 694       <string>https://example.com</string>
 695       <key>Favicon</key>
 696       <string>https://example.com/favicon.ico</string>
 697       <key>Placement</key>
 698       <string>toolbar | menu</string>
 699       <key>Folder</key>
 700       <string>FolderName</string>
 701     </dict>
 702   </array>
 703 </dict>
 704 ```
 705 #### policies.json
 706 ```
 707 {
 708   "policies": {
 709     "Bookmarks": [
 710       {
 711         "Title": "Example",
 712         "URL": "https://example.com",
 713         "Favicon": "https://example.com/favicon.ico",
 714         "Placement": "toolbar" | "menu",
 715         "Folder": "FolderName"
 716       }
 717     ]
 718   }
 719 }
 720 ```
 721 ### CaptivePortal
 722 Enable or disable the detection of captive portals.
 723
 724 **Compatibility:** Firefox 67, Firefox ESR 60.7\
 725 **CCK2 Equivalent:** N/A\
 726 **Preferences Affected:** `network.captive-portal-service.enabled`
 727
 728 #### Windows (GPO)
 729 ```
 730 Software\Policies\Mozilla\Firefox\CaptivePortal = 0x1 | 0x0
 731 ```
 732 #### Windows (Intune)
 733 OMA-URI:
 734 ```
 735 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox/CaptivePortal
 736 ```
 737 Value (string):
 738 ```
 739 <enabled/> or <disabled/>
 740 ```
 741 #### macOS
 742 ```
 743 <dict>
 744   <key>CaptivePortal</key>
 745   <true/> | <false/>
 746 </dict>
 747 ```
 748 #### policies.json
 749 ```
 750 {
 751   "policies": {
 752     "CaptivePortal": true | false
 753   }
 754 }
 755 ```
 756 ### Certificates
 757
 758 ### Certificates | ImportEnterpriseRoots
 759
 760 Trust certificates that have been added to the operating system certificate store by a user or administrator.
 761
 762 Note: This policy only works on Windows and macOS. For Linux discussion, see [bug 1600509](https://bugzilla.mozilla.org/show_bug.cgi?id=1600509).
 763
 764 See https://support.mozilla.org/kb/setting-certificate-authorities-firefox for more detail.
 765
 766 **Compatibility:** Firefox 60, Firefox ESR 60 (macOS support in Firefox 63, Firefox ESR 68)\
 767 **CCK2 Equivalent:** N/A\
 768 **Preferences Affected:** `security.enterprise_roots.enabled`
 769
 770 #### Windows (GPO)
 771 ```
 772 Software\Policies\Mozilla\Firefox\Certificates\ImportEnterpriseRoots = 0x1 | 0x0
 773 ```
 774 #### Windows (Intune)
 775 OMA-URI:
 776 ```
 777 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~Certificates/Certificates_ImportEnterpriseRoots
 778 ```
 779 Value (string):
 780 ```
 781 <enabled/> or <disabled/>
 782 ```
 783 #### macOS
 784 ```
 785 <dict>
 786   <key>Certificates</key>
 787   <dict>
 788     <key>ImportEnterpriseRoots</key>
 789     <true/> | <false/>
 790   </dict>
 791 </dict>
 792 ```
 793 #### policies.json
 794 ```
 795 {
 796   "policies": {
 797     "Certificates": {
 798       "ImportEnterpriseRoots": true | false
 799     }
 800   }
 801 }
 802 ```
 803 ### Certificates | Install
 804
 805 Install certificates into the Firefox certificate store. If only a filename is specified, Firefox searches for the file in the following locations:
 806
 807 - Windows
 808   - %USERPROFILE%\AppData\Local\Mozilla\Certificates
 809   - %USERPROFILE%\AppData\Roaming\Mozilla\Certificates
 810 - macOS
 811   - /Library/Application Support/Mozilla/Certificates
 812   - ~/Library/Application Support/Mozilla/Certificates
 813 - Linux
 814   - /usr/lib/mozilla/certificates
 815   - /usr/lib64/mozilla/certificates
 816   - ~/.mozilla/certificates
 817
 818 Starting with Firefox 65, Firefox 60.5 ESR, a fully qualified path can be used, including UNC paths. You should use the native path style for your operating system. We do not support using %USERPROFILE% or other environment variables on Windows.
 819
 820 If you are specifying the path in the policies.json file on Windows, you need to escape your backslashes (`\\`) which means that for UNC paths, you need to escape both (`\\\\`). If you use group policy, you only need one backslash.
 821
 822 Certificates are installed using the trust string `CT,CT,`.
 823
 824 Binary (DER) and ASCII (PEM) certificates are both supported.
 825
 826 **Compatibility:** Firefox 64, Firefox ESR 64\
 827 **CCK2 Equivalent:** `certs.ca`\
 828 **Preferences Affected:** N/A
 829
 830 #### Windows (GPO)
 831 ```
 832 Software\Policies\Mozilla\Firefox\Certificates\Install\1 = "cert1.der"
 833 Software\Policies\Mozilla\Firefox\Certificates\Install\2 = "C:\Users\username\cert2.pem"
 834 ```
 835 #### Windows (Intune)
 836 OMA-URI:
 837 ```
 838 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~Certificates/Certificates_Install
 839 ```
 840 Value (string):
 841 ```
 842 <enabled/>
 843 <data id="Certificates_Install" value="1&#xF000;cert1.der&#xF000;2&#xF000;C:\Users\username\cert2.pem"/>
 844 ```
 845 #### macOS
 846 ```
 847 <dict>
 848   <key>Certificates</key>
 849   <dict>
 850     <key>Install</key>
 851     <array>
 852       <string>cert1.der</string>
 853       <string>/Users/username/cert2.pem</string>
 854     </array>
 855   </dict>
 856 </dict>
 857 ```
 858 #### policies.json
 859 ```
 860 {
 861   "policies": {
 862     "Certificates": {
 863       "Install": ["cert1.der", "/home/username/cert2.pem"]
 864     }
 865   }
 866 }
 867 ```
 868 ### Cookies
 869 Configure cookie preferences.
 870
 871 `Allow` is a list of origins (not domains) where cookies are always allowed. You must include http or https.
 872
 873 `AllowSession` is a list of origins (not domains) where cookies are only allowed for the current session. You must include http or https.
 874
 875 `Block` is a list of origins (not domains) where cookies are always blocked. You must include http or https.
 876
 877 `Default` determines whether cookies are accepted at all.
 878
 879 `AcceptThirdParty` determines how third-party cookies are handled.
 880
 881 `ExpireAtSessionEnd` determines when cookies expire.
 882
 883 `RejectTracker` only rejects cookies for trackers.
 884
 885 `Locked` prevents the user from changing cookie preferences.
 886
 887 **Compatibility:** Firefox 60, Firefox ESR 60 (RejectTracker added in Firefox 63, AllowSession added in Firefox 79/78.1)\
 888 **CCK2 Equivalent:** N/A\
 889 **Preferences Affected:** `network.cookie.cookieBehavior`,`network.cookie.lifetimePolicy`
 890
 891 #### Windows (GPO)
 892 ```
 893 Software\Policies\Mozilla\Firefox\Cookies\Allow\1 = "https://example.com"
 894 Software\Policies\Mozilla\Firefox\Cookies\AllowSession\1 = "https://example.edu"
 895 Software\Policies\Mozilla\Firefox\Cookies\Block\1 = "https://example.org"
 896 Software\Policies\Mozilla\Firefox\Cookies\Default = 0x1 | 0x0
 897 Software\Policies\Mozilla\Firefox\Cookies\AcceptThirdParty = "always" | "never" | "from-visited"
 898 Software\Policies\Mozilla\Firefox\Cookies\ExpireAtSessionEnd = 0x1 | 0x0
 899 Software\Policies\Mozilla\Firefox\Cookies\RejectTracker = 0x1 | 0x0
 900 Software\Policies\Mozilla\Firefox\Cookies\Locked = 0x1 | 0x0
 901 ```
 902 #### Windows (Intune)
 903 OMA-URI:
 904 ```
 905 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~Cookies/Cookies_Allow
 906 ```
 907 Value (string):
 908 ```
 909 <enabled/>
 910 <data id="Cookies_Allow" value="1&#xF000;https://example.com"/>
 911 ```
 912 OMA-URI:
 913 ```
 914 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~Cookies/Cookies_AllowSession
 915 ```
 916 Value (string):
 917 ```
 918 <enabled/>
 919 <data id="Cookies_Allow" value="1&#xF000;https://example.edu"/>
 920 ```
 921 OMA-URI:
 922 ```
 923 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~Cookies/Cookies_Block
 924 ```
 925 Value (string):
 926 ```
 927 <enabled/>
 928 <data id="Cookies_Block" value="1&#xF000;https://example.org"/>
 929 ```
 930 OMA-URI:
 931 ```
 932 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~Cookies/Cookies_Default
 933 ```
 934 Value (string):
 935 ```
 936 <enabled/> or <disabled/>
 937 ```
 938 OMA-URI:
 939 ```
 940 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~Cookies/Cookies_AcceptThirdParty
 941 ```
 942 Value (string):
 943 ```
 944 <enabled/>
 945 <data id="Cookies_AcceptThirdParty" value="always | never | from-visited"/>
 946 ```
 947 OMA-URI:
 948 ```
 949 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~Cookies/Cookies_ExpireAtSessionEnd
 950 ```
 951 Value (string):
 952 ```
 953 <enabled/> or <disabled/>
 954 ```
 955 OMA-URI:
 956 ```
 957 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~Cookies/Cookies_RejectTracker
 958 ```
 959 Value (string):
 960 ```
 961 <enabled/> or <disabled/>
 962 ```
 963 OMA-URI:
 964 ```
 965 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~Cookies/Cookies_Locked
 966 ```
 967 Value (string):
 968 ```
 969 <enabled/> or <disabled/>
 970 ```
 971 #### macOS
 972 ```
 973 <dict>
 974   <key>Cookies</key>
 975   <dict>
 976     <key>Allow</key>
 977     <array>
 978       <string>http://example.com</string>
 979     </array>
 980     <key>AllowSession</key>
 981     <array>
 982       <string>http://example.edu</string>
 983     </array>
 984     <key>Block</key>
 985     <array>
 986       <string>http://example.org</string>
 987     </array>
 988     <key>Default</key>
 989     <true/> | <false/>
 990     <key>AcceptThirdParty</key>
 991     <string>always | never | from-visited</string>
 992     <key>ExpireAtSessionEnd</key>
 993     <true/> | <false/>
 994     <key>RejectTracker</key>
 995     <true/> | <false/>
 996     <key>Locked</key>
 997     <true/> | <false/>
 998   </dict>
 999 </dict>
1000 ```
1001 #### policies.json
1002 ```
1003 {
1004   "policies": {
1005     "Cookies": {
1006       "Allow": ["http://example.org/"],
1007       "AllowSession": ["http://example.edu/"],
1008       "Block": ["http://example.edu/"],
1009       "Default": true | false,
1010       "AcceptThirdParty": "always" | "never" | "from-visited",
1011       "ExpireAtSessionEnd": true | false,
1012       "RejectTracker": true | false,
1013       "Locked": true | false
1014     }
1015   }
1016 }
1017 ```
1018 ### DisableSetDesktopBackground
1019 Remove the "Set As Desktop Background..." menuitem when right clicking on an image.
1020
1021 **Compatibility:** Firefox 60, Firefox ESR 60\
1022 **CCK2 Equivalent:** `removeSetDesktopBackground`\
1023 **Preferences Affected:** N/A
1024
1025 #### Windows (GPO)
1026 ```
1027 Software\Policies\Mozilla\Firefox\DisableSetDesktopBackground = 0x1 | 0x0
1028 ```
1029 #### Windows (Intune)
1030 OMA-URI:
1031 ```
1032 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox/DisableSetDesktopBackground
1033 ```
1034 Value (string):
1035 ```
1036 <enabled/> or <disabled/>
1037 ```
1038 #### macOS
1039 ```
1040 <dict>
1041   <key>DisableSetDesktopBackground</key>
1042   <true/> | <false/>
1043 </dict>
1044 ```
1045 #### policies.json
1046 ```
1047 {
1048   "policies": {
1049     "DisableSetDesktopBackground": true | false
1050   }
1051 }
1052 ```
1053 ### DisableMasterPasswordCreation
1054 Remove the master password functionality.
1055
1056 If this value is true, it works the same as setting [`PrimaryPassword`](#primarypassword) to false and removes the primary password functionality.
1057
1058 If both DisableMasterPasswordCreation and PrimaryPassword are used, DisableMasterPasswordCreation takes precedent.
1059
1060 **Compatibility:** Firefox 60, Firefox ESR 60\
1061 **CCK2 Equivalent:** `noMasterPassword`\
1062 **Preferences Affected:** N/A
1063
1064 #### Windows (GPO)
1065 ```
1066 Software\Policies\Mozilla\Firefox\DisableMasterPasswordCreation = 0x1 | 0x0
1067 ```
1068 #### Windows (Intune)
1069 OMA-URI:
1070 ```
1071 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox/DisableMasterPasswordCreation
1072 ```
1073 Value (string):
1074 ```
1075 <enabled/> or <disabled/>
1076 ```
1077 #### macOS
1078 ```
1079 <dict>
1080   <key>DisableMasterPasswordCreation</key>
1081   <true/> | <false/>
1082 </dict>
1083 ```
1084 #### policies.json
1085 ```
1086 {
1087   "policies": {
1088     "DisableMasterPasswordCreation": true | false
1089   }
1090 }
1091 ```
1092 ### DisableAppUpdate
1093 Turn off application updates within Firefox.
1094
1095 **Compatibility:** Firefox 60, Firefox ESR 60\
1096 **CCK2 Equivalent:** `disableFirefoxUpdates`\
1097 **Preferences Affected:** N/A
1098
1099 #### Windows (GPO)
1100 ```
1101 Software\Policies\Mozilla\Firefox\DisableAppUpdate = 0x1 | 0x0
1102 ```
1103 #### Windows (Intune)
1104 OMA-URI:
1105 ```
1106 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox/DisableAppUpdate
1107 ```
1108 Value (string):
1109 ```
1110 <enabled/> or <disabled/>
1111 ```
1112 #### macOS
1113 ```
1114 <dict>
1115   <key>DisableAppUpdate</key>
1116   <true/> | <false/>
1117 </dict>
1118 ```
1119 #### policies.json
1120 ```
1121 {
1122   "policies": {
1123     "DisableAppUpdate": true | false
1124   }
1125 }
1126 ```
1127 ### DisableBuiltinPDFViewer
1128 Disable the built in PDF viewer. PDF files are downloaded and sent externally.
1129
1130 **Compatibility:** Firefox 60, Firefox ESR 60\
1131 **CCK2 Equivalent:** `disablePDFjs`\
1132 **Preferences Affected:** `pdfjs.disabled`
1133
1134 #### Windows (GPO)
1135 ```
1136 Software\Policies\Mozilla\Firefox\DisableBuiltinPDFViewer = 0x1 | 0x0
1137 ```
1138 #### Windows (Intune)
1139 OMA-URI:
1140 ```
1141 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox/DisableBuiltinPDFViewer
1142 ```
1143 Value (string):
1144 ```
1145 <enabled/> or <disabled/>
1146 ```
1147 #### macOS
1148 ```
1149 <dict>
1150   <key>DisableBuiltinPDFViewer</key>
1151   <true/> | <false/>
1152 </dict>
1153 ```
1154 #### policies.json
1155 ```
1156 {
1157   "policies": {
1158     "DisableBuiltinPDFViewer": true | false
1159   }
1160 }
1161 ```
1162 ### DisabledCiphers
1163 Disable specific cryptographic ciphers.
1164
1165 **Preferences Affected:** `security.ssl3.dhe_rsa_aes_128_sha`, `security.ssl3.dhe_rsa_aes_256_sha`, `security.ssl3.ecdhe_ecdsa_aes_128_gcm_sha256`, `security.ssl3.ecdhe_rsa_aes_128_gcm_sha256`, `security.ssl3.ecdhe_rsa_aes_128_sha`, `security.ssl3.ecdhe_rsa_aes_256_sha`, `security.ssl3.rsa_aes_128_gcm_sha256`, `security.ssl3.rsa_aes_128_sha`, `security.ssl3.rsa_aes_256_gcm_sha384`, `security.ssl3.rsa_aes_256_sha`, `security.ssl3.rsa_des_ede3_sha`
1166
1167 ---
1168 **Note:**
1169
1170 This policy was updated in Firefox 78 to allow enabling ciphers as well. Setting the value to true disables the cipher, setting the value to false enables the cipher. Previously setting the value to true or false disabled the cipher.
1171
1172 ---
1173 **Compatibility:** Firefox 76, Firefox ESR 68.8 (TLS_RSA_WITH_AES_128_GCM_SHA256 and TLS_RSA_WITH_AES_256_GCM_SHA384 were added in Firefox 78)\
1174 **CCK2 Equivalent:** N/A\
1175 **Preferences Affected:** N/A
1176
1177 #### Windows (GPO)
1178 ```
1179 Software\Policies\Mozilla\Firefox\DisabledCiphers\TLS_DHE_RSA_WITH_AES_128_CBC_SHA = 0x1 | 0x0
1180 Software\Policies\Mozilla\Firefox\DisabledCiphers\TLS_DHE_RSA_WITH_AES_256_CBC_SHA = 0x1 | 0x0
1181 Software\Policies\Mozilla\Firefox\DisabledCiphers\TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA = 0x1 | 0x0
1182 Software\Policies\Mozilla\Firefox\DisabledCiphers\TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA = 0x1 | 0x0
1183 Software\Policies\Mozilla\Firefox\DisabledCiphers\TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 = 0x1 | 0x0
1184 Software\Policies\Mozilla\Firefox\DisabledCiphers\TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256 = 0x1 | 0x0
1185 Software\Policies\Mozilla\Firefox\DisabledCiphers\TLS_RSA_WITH_AES_128_CBC_SHA = 0x1 | 0x0
1186 Software\Policies\Mozilla\Firefox\DisabledCiphers\TLS_RSA_WITH_AES_256_CBC_SHA = 0x1 | 0x0
1187 Software\Policies\Mozilla\Firefox\DisabledCiphers\TLS_RSA_WITH_3DES_EDE_CBC_SHA = 0x1 | 0x0
1188 Software\Policies\Mozilla\Firefox\DisabledCiphers\TLS_RSA_WITH_AES_128_GCM_SHA256 = 0x1 | 0x0
1189 Software\Policies\Mozilla\Firefox\DisabledCiphers\TLS_RSA_WITH_AES_256_GCM_SHA384 = 0x1 | 0x0
1190 ```
1191 #### Windows (Intune)
1192 OMA-URI:
1193 ```
1194 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~DisabledCiphers/DisabledCiphers_TLS_DHE_RSA_WITH_AES_128_CBC_SHA
1195 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~DisabledCiphers/DisabledCiphers_TLS_DHE_RSA_WITH_AES_256_CBC_SHA
1196 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~DisabledCiphers/DisabledCiphers_TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA
1197 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~DisabledCiphers/DisabledCiphers_TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA
1198 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~DisabledCiphers/DisabledCiphers_TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256
1199 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~DisabledCiphers/DisabledCiphers_TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256
1200 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~DisabledCiphers/DisabledCiphers_TLS_RSA_WITH_AES_128_CBC_SHA
1201 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~DisabledCiphers/DisabledCiphers_TLS_RSA_WITH_AES_256_CBC_SHA
1202 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~DisabledCiphers/DisabledCiphers_TLS_RSA_WITH_3DES_EDE_CBC_SHA
1203 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~DisabledCiphers/DisabledCiphers_TLS_RSA_WITH_AES_128_GCM_SHA256
1204 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~DisabledCiphers/DisabledCiphers_TLS_RSA_WITH_AES_256_GCM_SHA384
1205 ```
1206 Value (string):
1207 ```
1208 <enabled/> or <disabled/>
1209 ```
1210 #### macOS
1211 ```
1212 <dict>
1213   <key>DisabledCiphers</key>
1214     <dict>
1215       <key>TLS_DHE_RSA_WITH_AES_128_CBC_SHA</key>
1216       <true/> | <false/>
1217       <key>TLS_DHE_RSA_WITH_AES_256_CBC_SHA</key>
1218       <true/> | <false/>
1219       <key>TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA</key>
1220       <true/> | <false/>
1221       <key>TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA</key>
1222       <true/> | <false/>
1223       <key>TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256</key>
1224       <true/> | <false/>
1225       <key>TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256</key>
1226       <true/> | <false/>
1227       <key>TLS_RSA_WITH_AES_128_CBC_SHA</key>
1228       <true/> | <false/>
1229       <key>TLS_RSA_WITH_AES_256_CBC_SHA</key>
1230       <true/> | <false/>
1231       <key>TLS_RSA_WITH_3DES_EDE_CBC_SHA</key>
1232       <true/> | <false/>
1233       <key>TLS_RSA_WITH_AES_128_GCM_SHA256</key>
1234       <true/> | <false/>
1235       <key>TLS_RSA_WITH_AES_256_GCM_SHA384</key>
1236       <true/> | <false/>
1237     </dict>
1238 </dict>
1239 ```
1240 #### policies.json
1241 ```
1242 {
1243   "policies": {
1244     "DisabledCiphers": {
1245       "TLS_DHE_RSA_WITH_AES_128_CBC_SHA": true | false,
1246       "TLS_DHE_RSA_WITH_AES_256_CBC_SHA": true | false,
1247       "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA": true | false,
1248       "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA": true | false,
1249       "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256": true | false,
1250       "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256": true | false,
1251       "TLS_RSA_WITH_AES_128_CBC_SHA": true | false,
1252       "TLS_RSA_WITH_AES_256_CBC_SHA": true | false,
1253       "TLS_RSA_WITH_3DES_EDE_CBC_SHA": true | false,
1254       "TLS_RSA_WITH_AES_128_GCM_SHA256": true | false,
1255       "TLS_RSA_WITH_AES_256_GCM_SHA384": true | false
1256     }
1257   }
1258 }
1259 ```
1260 ### DisableDefaultBrowserAgent
1261 Prevent the default browser agent from taking any actions. Only applicable to Windows; other platforms don’t have the agent.
1262
1263 The browser agent is a Windows-only scheduled task which runs in the background to collect and submit data about the browser that the user has set as their OS default. More information is available [here](https://firefox-source-docs.mozilla.org/toolkit/mozapps/defaultagent/default-browser-agent/index.html).
1264
1265 **Compatibility:** Firefox 75, Firefox ESR 68.7 (Windows only)\
1266 **CCK2 Equivalent:** N/A\
1267 **Preferences Affected:** N/A
1268
1269 #### Windows (GPO)
1270 ```
1271 Software\Policies\Mozilla\Firefox\DisableDefaultBrowserAgent = 0x1 | 0x0
1272 ```
1273 #### Windows (Intune)
1274 OMA-URI:
1275 ```
1276 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox/DisableDefaultBrowserAgent
1277 ```
1278 Value (string):
1279 ```
1280 <enabled/> or <disabled/>
1281 ```
1282 #### policies.json
1283 ```
1284 {
1285   "policies": {
1286     "DisableDefaultBrowserAgent": true | false
1287   }
1288 }
1289 ```
1290 ### DisableDeveloperTools
1291 Remove access to all developer tools.
1292
1293 **Compatibility:** Firefox 60, Firefox ESR 60\
1294 **CCK2 Equivalent:** `removeDeveloperTools`\
1295 **Preferences Affected:** `devtools.policy.disabled`
1296
1297 #### Windows (GPO)
1298 ```
1299 Software\Policies\Mozilla\Firefox\DisableDeveloperTools = 0x1 | 0x0`
1300 ```
1301 #### Windows (Intune)
1302 OMA-URI:
1303 ```
1304 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox/DisableDeveloperTools
1305 ```
1306 Value (string):
1307 ```
1308 <enabled/> or <disabled/>
1309 ```
1310 #### macOS
1311 ```
1312 <dict>
1313   <key>DisableDeveloperTools</key>
1314   <true/> | <false/>
1315 </dict>
1316 ```
1317 #### policies.json
1318 ```
1319 {
1320   "policies": {
1321     "DisableDeveloperTools": true | false
1322   }
1323 }
1324 ```
1325 ### DisableFeedbackCommands
1326 Disable the menus for reporting sites (Submit Feedback, Report Deceptive Site).
1327
1328 **Compatibility:** Firefox 60, Firefox ESR 60\
1329 **CCK2 Equivalent:** N/A\
1330 **Preferences Affected:** N/A
1331
1332 #### Windows (GPO)
1333 ```
1334 Software\Policies\Mozilla\Firefox\DisableFeedbackCommands = 0x1 | 0x0
1335 ```
1336 #### Windows (Intune)
1337 OMA-URI:
1338 ```
1339 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox/DisableFeedbackCommands
1340 ```
1341 Value (string):
1342 ```
1343 <enabled/> or <disabled/>
1344 ```
1345 #### macOS
1346 ```
1347 <dict>
1348   <key>DisableFeedbackCommands</key>
1349   <true/> | <false/>
1350 </dict>
1351 ```
1352 #### policies.json
1353 ```
1354 {
1355   "policies": {
1356     "DisableFeedbackCommands": true | false
1357   }
1358 }
1359 ```
1360 ### DisableFirefoxScreenshots
1361 Remove access to Firefox Screenshots.
1362
1363 **Compatibility:** Firefox 60, Firefox ESR 60\
1364 **CCK2 Equivalent:** N/A\
1365 **Preferences Affected:** `extensions.screenshots.disabled`
1366
1367 #### Windows (GPO)
1368 ```
1369 Software\Policies\Mozilla\Firefox\DisableFirefoxScreenshots = 0x1 | 0x0
1370 ```
1371 #### Windows (Intune)
1372 OMA-URI:
1373 ```
1374 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox/DisableFirefoxScreenshots
1375 ```
1376 Value (string):
1377 ```
1378 <enabled/> or <disabled/>
1379 ```
1380 #### macOS
1381 ```
1382 <dict>
1383   <key>DisableFirefoxScreenshots</key>
1384   <true/> | <false/>
1385 </dict>
1386 ```
1387 #### policies.json
1388 ```
1389 {
1390   "policies": {
1391     "DisableFirefoxScreenshots": true | false
1392   }
1393 }
1394 ```
1395 ### DisableFirefoxAccounts
1396 Disable Firefox Accounts integration (Sync).
1397
1398 **Compatibility:** Firefox 60, Firefox ESR 60\
1399 **CCK2 Equivalent:** `disableSync`\
1400 **Preferences Affected:** `identity.fxaccounts.enabled`
1401
1402 #### Windows (GPO)
1403 ```
1404 Software\Policies\Mozilla\Firefox\DisableFirefoxAccounts = 0x1 | 0x0
1405 ```
1406 #### Windows (Intune)
1407 OMA-URI:
1408 ```
1409 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox/DisableFirefoxAccounts
1410 ```
1411 Value (string):
1412 ```
1413 <enabled/> or <disabled/>
1414 ```
1415 #### macOS
1416 ```
1417 <dict>
1418   <key>DisableFirefoxAccounts</key>
1419   <true/> | <false/>
1420 </dict>
1421 ```
1422 #### policies.json
1423 ```
1424 {
1425   "policies": {
1426     "DisableFirefoxAccounts": true | false
1427   }
1428 }
1429 ```
1430 ### DisableFirefoxStudies
1431 Disable Firefox studies (Shield).
1432
1433 **Compatibility:** Firefox 60, Firefox ESR 60\
1434 **CCK2 Equivalent:** N/A\
1435 **Preferences Affected:** N/A
1436
1437 #### Windows (GPO)
1438 ```
1439 Software\Policies\Mozilla\Firefox\DisableFirefoxStudies = 0x1 | 0x0
1440 ```
1441 #### Windows (Intune)
1442 OMA-URI:
1443 ```
1444 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox/DisableFirefoxStudies
1445 ```
1446 Value (string):
1447 ```
1448 <enabled/> or <disabled/>
1449 ```
1450 #### macOS
1451 ```
1452 <dict>
1453   <key>DisableFirefoxStudies</key>
1454   <true/> | <false/>
1455 </dict>
1456 ```
1457 #### policies.json
1458 ```
1459 {
1460   "policies": {
1461     "DisableFirefoxStudies": true | false
1462   }
1463 }
1464 ```
1465 ### DisableForgetButton
1466 Disable the "Forget" button.
1467
1468 **Compatibility:** Firefox 60, Firefox ESR 60\
1469 **CCK2 Equivalent:** `disableForget`\
1470 **Preferences Affected:** N/A
1471
1472 #### Windows (GPO)
1473 ```
1474 Software\Policies\Mozilla\Firefox\DisableForgetButton = 0x1 | 0x0
1475 ```
1476 #### Windows (Intune)
1477 OMA-URI:
1478 ```
1479 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox/DisableForgetButton
1480 ```
1481 Value (string):
1482 ```
1483 <enabled/> or <disabled/>
1484 ```
1485 #### macOS
1486 ```
1487 <dict>
1488   <key>DisableForgetButton</key>
1489   <true/> | <false/>
1490 </dict>
1491 ```
1492 #### policies.json
1493 ```
1494 {
1495   "policies": {
1496     "DisableForgetButton": true | false
1497   }
1498 }
1499 ```
1500 ### DisableFormHistory
1501 Turn off saving information on web forms and the search bar.
1502
1503 **Compatibility:** Firefox 60, Firefox ESR 60\
1504 **CCK2 Equivalent:** `disableFormFill`\
1505 **Preferences Affected:** ` browser.formfill.enable`
1506
1507 #### Windows (GPO)
1508 ```
1509 Software\Policies\Mozilla\Firefox\DisableFormHistory = 0x1 | 0x0
1510 ```
1511 #### Windows (Intune)
1512 OMA-URI:
1513 ```
1514 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox/DisableFormHistory
1515 ```
1516 Value (string):
1517 ```
1518 <enabled/> or <disabled/>
1519 ```
1520 #### macOS
1521 ```
1522 <dict>
1523   <key>DisableFormHistory</key>
1524   <true/> | <false/>
1525 </dict>
1526 ```
1527 #### policies.json
1528 ```
1529 {
1530   "policies": {
1531     "DisableFormHistory": true | false
1532   }
1533 }
1534 ```
1535 ### DisablePasswordReveal
1536 Do not allow passwords to be shown in saved logins
1537
1538 **Compatibility:** Firefox 71, Firefox ESR 68.3\
1539 **CCK2 Equivalent:** N/A
1540 **Preferences Affected:** N/A
1541
1542 #### Windows (GPO)
1543 ```
1544 Software\Policies\Mozilla\Firefox\DisablePasswordReveal = 0x1 | 0x0
1545 ```
1546 #### Windows (Intune)
1547 OMA-URI:
1548 ```
1549 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox/DisablePasswordReveal
1550 ```
1551 Value (string):
1552 ```
1553 <enabled/> or <disabled/>
1554 ```
1555 #### macOS
1556 ```
1557 <dict>
1558   <key>DisablePasswordReveal</key>
1559   <true/> | <false/>
1560 </dict>
1561 ```
1562 #### policies.json
1563 ```
1564 {
1565   "policies": {
1566     "DisablePasswordReveal": true | false
1567   }
1568 }
1569 ```
1570 ### DisablePocket
1571 Remove Pocket in the Firefox UI. It does not remove it from the new tab page.
1572
1573 **Compatibility:** Firefox 60, Firefox ESR 60\
1574 **CCK2 Equivalent:** `disablePocket`\
1575 **Preferences Affected:** `extensions.pocket.enabled`
1576
1577 #### Windows (GPO)
1578 ```
1579 Software\Policies\Mozilla\Firefox\DisablePocket = 0x1 | 0x0
1580 ```
1581 #### Windows (Intune)
1582 OMA-URI:
1583 ```
1584 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox/DisablePocket
1585 ```
1586 Value (string):
1587 ```
1588 <enabled/> or <disabled/>
1589 ```
1590 #### macOS
1591 ```
1592 <dict>
1593   <key>DisablePocket</key>
1594   <true/> | <false/>
1595 </dict>
1596 ```
1597 #### policies.json
1598 ```
1599 {
1600   "policies": {
1601     "DisablePocket": true | false
1602   }
1603 }
1604 ```
1605 ### DisablePrivateBrowsing
1606 Remove access to private browsing.
1607
1608 **Compatibility:** Firefox 60, Firefox ESR 60\
1609 **CCK2 Equivalent:** `disablePrivateBrowsing`\
1610 **Preferences Affected:** N/A
1611
1612 #### Windows (GPO)
1613 ```
1614 Software\Policies\Mozilla\Firefox\DisablePrivateBrowsing = 0x1 | 0x0
1615 ```
1616 #### Windows (Intune)
1617 OMA-URI:
1618 ```
1619 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox/DisablePrivateBrowsing
1620 ```
1621 Value (string):
1622 ```
1623 <enabled/> or <disabled/>
1624 ```
1625 #### macOS
1626 ```
1627 <dict>
1628   <key>DisablePrivateBrowsing</key>
1629   <true/> | <false/>
1630 </dict>
1631 ```
1632 #### policies.json
1633 ```
1634 {
1635   "policies": {
1636     "DisablePrivateBrowsing": true | false
1637   }
1638 }
1639 ```
1640 ### DisableProfileImport
1641 Disables the "Import data from another browser" option in the bookmarks window.
1642
1643 **Compatibility:** Firefox 60, Firefox ESR 60\
1644 **CCK2 Equivalent:** N/A\
1645 **Preferences Affected:** N/A
1646
1647 #### Windows (GPO)
1648 ```
1649 Software\Policies\Mozilla\Firefox\DisableProfileImport = 0x1 | 0x0
1650 ```
1651 #### Windows (Intune)
1652 OMA-URI:
1653 ```
1654 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox/DisableProfileImport
1655 ```
1656 Value (string):
1657 ```
1658 <enabled/> or <disabled/>
1659 ```
1660 #### macOS
1661 ```
1662 <dict>
1663   <key>DisableProfileImport</key>
1664   <true/> | <false/>
1665 </dict>
1666 ```
1667 #### policies.json
1668 ```
1669 {
1670   "policies": {
1671     "DisableProfileImport": true | false
1672   }
1673 }
1674 ```
1675 ### DisableProfileRefresh
1676 Disable the Refresh Firefox button on about:support and support.mozilla.org, as well as the prompt that displays offering to refresh Firefox when you haven't used it in a while.
1677
1678 **Compatibility:** Firefox 60, Firefox ESR 60\
1679 **CCK2 Equivalent:** `disableResetFirefox`\
1680 **Preferences Affected:** `browser.disableResetPrompt`
1681
1682 #### Windows (GPO)
1683 ```
1684 Software\Policies\Mozilla\Firefox\DisableProfileRefresh = 0x1 | 0x0
1685 ```
1686 #### Windows (Intune)
1687 OMA-URI:
1688 ```
1689 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox/DisableProfileRefresh
1690 ```
1691 Value (string):
1692 ```
1693 <enabled/> or <disabled/>
1694 ```
1695 #### macOS
1696 ```
1697 <dict>
1698   <key>DisableProfileRefresh</key>
1699   <true/> | <false/>
1700 </dict>
1701 ```
1702 #### policies.json
1703 ```
1704 {
1705   "policies": {
1706     "DisableProfileRefresh": true | false
1707   }
1708 }
1709 ```
1710 ### DisableSafeMode
1711 Disable safe mode within the browser.
1712
1713 On Windows, this disables safe mode via the command line as well.
1714
1715 **Compatibility:** Firefox 60, Firefox ESR 60 (Windows, macOS)\
1716 **CCK2 Equivalent:** `disableSafeMode`\
1717 **Preferences Affected:** N/A
1718
1719 #### Windows (GPO)
1720 ```
1721 Software\Policies\Mozilla\Firefox\DisableSafeMode = 0x1 | 0x0
1722 ```
1723 #### Windows (Intune)
1724 OMA-URI:
1725 ```
1726 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox/DisableSafeMode
1727 ```
1728 Value (string):
1729 ```
1730 <enabled/> or <disabled/>
1731 ```
1732 #### macOS
1733 ```
1734 <dict>
1735   <key>DisableSafeMode</key>
1736   <true/> | <false/>
1737 </dict>
1738 ```
1739 #### policies.json
1740 ```
1741 {
1742   "policies": {
1743     "DisableSafeMode": true | false
1744   }
1745 }
1746 ```
1747 ### DisableSecurityBypass
1748 Prevent the user from bypassing security in certain cases.
1749
1750 `InvalidCertificate` prevents adding an exception when an invalid certificate is shown.
1751
1752 `SafeBrowsing` prevents selecting "ignore the risk" and visiting a harmful site anyway.
1753
1754 **Compatibility:** Firefox 60, Firefox ESR 60\
1755 **CCK2 Equivalent:** N/A\
1756 **Preferences Affected:** `security.certerror.hideAddException`,`browser.safebrowsing.allowOverride`
1757
1758 #### Windows (GPO)
1759 ```
1760 Software\Policies\Mozilla\Firefox\DisableSecurityBypass\InvalidCertificate = 0x1 | 0x0
1761 Software\Policies\Mozilla\Firefox\DisableSecurityBypass\SafeBrowsing = 0x1 | 0x0
1762 ```
1763 #### Windows (Intune)
1764 OMA-URI:
1765 ```
1766 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox/P_DisableSecurityBypass_InvalidCertificate
1767 ```
1768 Value (string):
1769 ```
1770 <enabled/> or <disabled/>
1771 ```
1772 OMA-URI:
1773 ```
1774 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox/P_DisableSecurityBypass_SafeBrowsing
1775 ```
1776 Value (string):
1777 ```
1778 <enabled/> or <disabled/>
1779 ```
1780
1781 #### macOS
1782 ```
1783 <dict>
1784   <key>DisableSecurityBypass</key>
1785   <dict>
1786     <key>InvalidCertificate</key>
1787     <true/> | <false/>
1788     <key>SafeBrowsing</key>
1789     <true/> | <false/>
1790   </dict>
1791 </dict>
1792 ```
1793 #### policies.json
1794 ```
1795 {
1796   "policies": {
1797     "DisableSecurityBypass": {
1798       "InvalidCertificate": true | false,
1799       "SafeBrowsing": true | false
1800     }
1801   }
1802 }
1803 ```
1804 ### DisableSystemAddonUpdate
1805 Prevent system add-ons from being installed or update.
1806
1807 **Compatibility:** Firefox 60, Firefox ESR 60\
1808 **CCK2 Equivalent:** N/A\
1809 **Preferences Affected:** N/A
1810
1811 #### Windows (GPO)
1812 ```
1813 Software\Policies\Mozilla\Firefox\DisableSystemAddonUpdate = 0x1 | 0x0
1814 ```
1815 #### Windows (Intune)
1816 OMA-URI:
1817 ```
1818 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox/DisableSystemAddonUpdate
1819 ```
1820 Value (string):
1821 ```
1822 <enabled/> or <disabled/>
1823 ```
1824 #### macOS
1825 ```
1826 <dict>
1827   <key>DisableSystemAddonUpdate</key>
1828   <true/> | <false/>
1829 </dict>
1830 ```
1831 #### policies.json
1832 ```
1833 {
1834   "policies": {
1835     "DisableSystemAddonUpdate": true | false
1836   }
1837 }
1838 ```
1839 ### DisableTelemetry
1840 Prevent the upload of telemetry data.
1841
1842 As of Firefox 83 and Firefox ESR 78.5, local storage of telemetry data is disabled as well.
1843
1844 Mozilla recommends that you do not disable telemetry. Information collected through telemetry helps us build a better product for businesses like yours.
1845
1846 **Compatibility:** Firefox 60, Firefox ESR 60\
1847 **CCK2 Equivalent:** `disableTelemetry`\
1848 **Preferences Affected:** `datareporting.healthreport.uploadEnabled,datareporting.policy.dataSubmissionEnabled,toolkit.telemetry.archive.enabled`
1849
1850 #### Windows (GPO)
1851 ```
1852 Software\Policies\Mozilla\Firefox\DisableTelemetry = 0x1 | 0x0
1853 ```
1854 #### Windows (Intune)
1855 OMA-URI:
1856 ```
1857 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox/DisableTelemetry
1858 ```
1859 Value (string):
1860 ```
1861 <enabled/> or <disabled/>
1862 ```
1863 #### macOS
1864 ```
1865 <dict>
1866   <key>DisableTelemetry</key>
1867   <true/> | <false/>
1868 </dict>
1869 ```
1870 #### policies.json
1871 ```
1872 {
1873   "policies": {
1874     "DisableTelemetry": true | false
1875   }
1876 }
1877 ```
1878 ### DisplayBookmarksToolbar
1879 Set the initial state of the bookmarks toolbar. A user can still hide it and it will stay hidden.
1880
1881 **Compatibility:** Firefox 60, Firefox ESR 60\
1882 **CCK2 Equivalent:** `displayBookmarksToolbar`\
1883 **Preferences Affected:** N/A
1884
1885 #### Windows (GPO)
1886 ```
1887 Software\Policies\Mozilla\Firefox\DisplayBookmarksToolbar = 0x1 | 0x0
1888 ```
1889 #### Windows (Intune)
1890 OMA-URI:
1891 ```
1892 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox/DisplayBookmarksToolbar
1893 ```
1894 Value (string):
1895 ```
1896 <enabled/> or <disabled/>
1897 ```
1898 #### macOS
1899 ```
1900 <dict>
1901   <key>DisplayBookmarksToolbar</key>
1902   <true/> | <false/>
1903 </dict>
1904 ```
1905 #### policies.json
1906 ```
1907 {
1908   "policies": {
1909     "DisplayBookmarksToolbar": true | false
1910   }
1911 }
1912 ```
1913 ### DisplayMenuBar (Deprecated)
1914 Set the initial state of the menubar. A user can still hide it and it will stay hidden.
1915
1916 **Compatibility:** Firefox 60, Firefox ESR 60 (Windows, some Linux)\
1917 **CCK2 Equivalent:** `displayMenuBar`\
1918 **Preferences Affected:** N/A
1919
1920 #### Windows (GPO)
1921 ```
1922 Software\Policies\Mozilla\Firefox\DisplayMenuBar = 0x1 | 0x0
1923 ```
1924 #### macOS
1925 ```
1926 <dict>
1927   <key>DisplayMenuBar</key>
1928   <true/> | <false/>
1929 </dict>
1930 ```
1931 #### policies.json
1932 ```
1933 {
1934   "policies": {
1935     "DisplayMenuBar": true | false
1936   }
1937 }
1938 ```
1939 ### DisplayMenuBar
1940 Set the state of the menubar.
1941
1942 `always` means the menubar is shown and cannot be hidden.
1943
1944 `never` means the menubar is hidden and cannot be shown.
1945
1946 `default-on` means the menubar is on by default but can be hidden.
1947
1948 `default-off` means the menubar is off by default but can be shown.
1949
1950 **Compatibility:** Firefox 73, Firefox ESR 68.5 (Windows, some Linux)\
1951 **CCK2 Equivalent:** `displayMenuBar`\
1952 **Preferences Affected:** N/A
1953
1954 #### Windows (GPO)
1955 ```
1956 Software\Policies\Mozilla\Firefox\DisplayMenuBar = "always", "never", "default-on", "default-off"
1957 ```
1958 #### Windows (Intune)
1959 OMA-URI:
1960 ```
1961 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox/DisplayMenuBar_Enum
1962 ```
1963 Value (string):
1964 ```
1965 <enabled/>
1966 <data id="DisplayMenuBar" value="always | never | default-on | default-off"/>
1967 ```
1968 #### macOS
1969 ```
1970 <dict>
1971   <key>DisplayMenuBar</key>
1972   <string>always | never | default-on | default-off</string>
1973 </dict>
1974 ```
1975 #### policies.json
1976 ```
1977 {
1978   "policies": {
1979     "DisplayMenuBar": "always", "never", "default-on", "default-off"
1980   }
1981 }
1982 ```
1983 ### DNSOverHTTPS
1984 Configure DNS over HTTPS.
1985
1986 `Enabled` determines whether DNS over HTTPS is enabled
1987
1988 `ProviderURL` is a URL to another provider.
1989
1990 `Locked` prevents the user from changing DNS over HTTPS preferences.
1991
1992 `ExcludedDomains` excludes domains from DNS over HTTPS.
1993
1994 **Compatibility:** Firefox 63, Firefox ESR 68 (ExcludedDomains added in 75/68.7)\
1995 **CCK2 Equivalent:** N/A\
1996 **Preferences Affected:** `network.trr.mode`,`network.trr.uri`
1997
1998 #### Windows (GPO)
1999 ```
2000 Software\Policies\Mozilla\Firefox\DNSOverHTTPS\Enabled = 0x1 | 0x0
2001 Software\Policies\Mozilla\Firefox\DNSOverHTTPS\ProviderURL = "URL_TO_ALTERNATE_PROVIDER"
2002 Software\Policies\Mozilla\Firefox\DNSOverHTTPS\Locked = 0x1 | 0x0
2003 Software\Policies\Mozilla\Firefox\DNSOverHTTPS\ExcludedDomains\1 = "example.com"
2004 ```
2005 #### Windows (Intune)
2006 OMA-URI:
2007 ```
2008 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~DNSOverHTTPS/DNSOverHTTPS_Enabled
2009 ```
2010 Value (string):
2011 ```
2012 <enabled/> or <disabled/>
2013 ```
2014 OMA-URI:
2015 ```
2016 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~DNSOverHTTPS/DNSOverHTTPS_ProviderURL
2017 ```
2018 Value (string):
2019 ```
2020 <enabled/>
2021 <data id="String" value="URL_TO_ALTERNATE_PROVIDER"/>
2022 ```
2023 OMA-URI:
2024 ```
2025 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~DNSOverHTTPS/DNSOverHTTPS_Locked
2026 ```
2027 Value (string):
2028 ```
2029 <enabled/> or <disabled/>
2030 ```
2031 OMA-URI:
2032 ```
2033 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~DNSOverHTTPS/DNSOverHTTPS_ExcludedDomains
2034 ```
2035 Value (string):
2036 ```
2037 <enabled/>
2038 <data id="List" value="1&#xF000;example.com"/>
2039 ```
2040 #### macOS
2041 ```
2042 <dict>
2043   <key>DNSOverHTTPS</key>
2044   <dict>
2045     <key>Enabled</key>
2046     <true/> | <false/>
2047     <key>ProviderURL</key>
2048     <string>URL_TO_ALTERNATE_PROVIDER</string>
2049     <key>Locked</key>
2050     <true/> | <false/>
2051     <key>ExcludedDomains</key>
2052     <array>
2053       <string>example.com</string>
2054     </array>
2055   </dict>
2056 </dict>
2057 ```
2058 #### policies.json
2059 ```
2060 {
2061   "policies": {
2062     "DNSOverHTTPS": {
2063       "Enabled":  true | false,
2064       "ProviderURL": "URL_TO_ALTERNATE_PROVIDER",
2065       "Locked": true | false,
2066       "ExcludedDomains": ["example.com"]
2067     }
2068   }
2069 }
2070 ```
2071 ### DontCheckDefaultBrowser
2072 Don't check if Firefox is the default browser at startup.
2073
2074 **Compatibility:** Firefox 60, Firefox ESR 60\
2075 **CCK2 Equivalent:** `dontCheckDefaultBrowser`\
2076 **Preferences Affected:** `browser.shell.checkDefaultBrowser`
2077
2078 #### Windows (GPO)
2079 ```
2080 Software\Policies\Mozilla\Firefox\DontCheckDefaultBrowser = 0x1 | 0x0
2081 ```
2082 #### Windows (Intune)
2083 OMA-URI:
2084 ```
2085 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox/DontCheckDefaultBrowser
2086 ```
2087 Value (string):
2088 ```
2089 <enabled/> or <disabled/>
2090 ```
2091 #### macOS
2092 ```
2093 <dict>
2094   <key>DontCheckDefaultBrowser</key>
2095   <true/> | <false/>
2096 </dict>
2097 ```
2098 #### policies.json
2099 ```
2100 {
2101   "policies": {
2102     "DontCheckDefaultBrowser": true | false
2103   }
2104 }
2105 ```
2106 ### DefaultDownloadDirectory
2107 Set the default download directory.
2108
2109 You can use ${home} for the native home directory.
2110
2111 **Compatibility:** Firefox 68, Firefox ESR 68\
2112 **CCK2 Equivalent:** N/A\
2113 **Preferences Affected:** `browser.download.dir`,`browser.download.folderList`
2114
2115 #### Windows (GPO)
2116 ```
2117 Software\Policies\Mozilla\Firefox\DefaultDownloadDirectory = "${home}\Downloads"
2118 ```
2119 #### Windows (Intune)
2120 OMA-URI:
2121 ```
2122 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox/DefaultDownloadDirectory
2123 ```
2124 Value (string):
2125 ```
2126 <enabled/>
2127 <data id="Preferences_String" value="${home}\Downloads"/>
2128 ```
2129 #### macOS
2130 ```
2131 <dict>
2132   <key>DefaultDownloadDirectory</key>
2133   <string>${home}/Downloads</string>
2134 </dict>
2135 ```
2136 #### policies.json (macOS and Linux)
2137 ```
2138 {
2139   "policies": {
2140     "DefaultDownloadDirectory": "${home}/Downloads"
2141 }
2142 ```
2143 #### policies.json (Windows)
2144 ```
2145 {
2146   "policies": {
2147     "DefaultDownloadDirectory": "${home}\\Downloads"
2148 }
2149 ```
2150 ### DownloadDirectory
2151 Set and lock the download directory.
2152
2153 You can use ${home} for the native home directory.
2154
2155 **Compatibility:** Firefox 68, Firefox ESR 68\
2156 **CCK2 Equivalent:** N/A\
2157 **Preferences Affected:** `browser.download.dir`,`browser.download.folderList`,`browser.download.useDownloadDir`
2158
2159 #### Windows (GPO)
2160 ```
2161 Software\Policies\Mozilla\Firefox\DownloadDirectory = "${home}\Downloads"
2162 ```
2163 #### Windows (Intune)
2164 OMA-URI:
2165 ```
2166 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox/DownloadDirectory
2167 ```
2168 Value (string):
2169 ```
2170 <enabled/>
2171 <data id="Preferences_String" value="${home}\Downloads"/>
2172 ```
2173 #### macOS
2174 ```
2175 <dict>
2176   <key>DownloadDirectory</key>
2177   <string>${home}/Downloads</string>
2178 </dict>
2179 ```
2180 #### policies.json (macOS and Linux)
2181 ```
2182 {
2183   "policies": {
2184     "DownloadDirectory": "${home}/Downloads"
2185 }
2186 ```
2187 #### policies.json (Windows)
2188 ```
2189 {
2190   "policies": {
2191     "DownloadDirectory": "${home}\\Downloads"
2192 }
2193 ```
2194 ### EnableTrackingProtection
2195 Configure tracking protection.
2196
2197 If this policy is not configured, tracking protection is not enabled by default in the browser, but it is enabled by default in private browsing and the user can change it.
2198
2199 If `Value` is set to false, tracking protection is disabled and locked in both the regular browser and private browsing.
2200
2201 If `Value` is set to true, tracking protection is enabled by default in both the regular browser and private browsing and the `Locked` value determines whether or not a user can change it.
2202
2203 If `Cryptomining` is set to true, cryptomining scripts on websites are blocked.
2204
2205 If `Fingerprinting` is set to true, fingerprinting scripts on websites are blocked.
2206
2207 `Exceptions` are origins for which tracking protection is not enabled.
2208
2209 **Compatibility:** Firefox 60, Firefox ESR 60 (Cryptomining and Fingerprinting added in 70/68.2, Exceptions added in 73/68.5)\
2210 **CCK2 Equivalent:** N/A\
2211 **Preferences Affected:** `privacy.trackingprotection.enabled`,`privacy.trackingprotection.pbmode.enabled`,`privacy.trackingprotection.cryptomining.enabled`,`privacy.trackingprotection.fingerprinting.enabled`
2212
2213 #### Windows (GPO)
2214 ```
2215 Software\Policies\Mozilla\Firefox\EnableTrackingProtection\Value = 0x1 | 0x0
2216 Software\Policies\Mozilla\Firefox\EnableTrackingProtection\Locked = 0x1 | 0x0
2217 Software\Policies\Mozilla\Firefox\EnableTrackingProtection\Cryptomining = 0x1 | 0x0
2218 Software\Policies\Mozilla\Firefox\EnableTrackingProtection\Fingerprinting = 0x1 | 0x0
2219 Software\Policies\Mozilla\Firefox\EnableTrackingProtection\Exceptions\1 = "https://example.com"
2220 ```
2221 #### Windows (Intune)
2222 OMA-URI:
2223 ```
2224 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~TrackingProtection/A_TrackingProtection_Value
2225 ```
2226 Value (string):
2227 ```
2228 <enabled/> or <disabled/>
2229 ```
2230 OMA-URI:
2231 ```
2232 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~TrackingProtection/B_TrackingProtection_Cryptomining
2233 ```
2234 Value (string):
2235 ```
2236 <enabled/> or <disabled/>
2237 ```
2238 OMA-URI:
2239 ```
2240 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~TrackingProtection/C_TrackingProtection_Fingerprinting
2241 ```
2242 Value (string):
2243 ```
2244 <enabled/> or <disabled/>
2245 ```
2246 OMA-URI:
2247 ```
2248 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~TrackingProtection/D_TrackingProtection_Exceptions
2249 ```
2250 Value (string):
2251 ```
2252 <data id="TrackingProtection_Exceptions" value="1&#xF000;https://example.com"/>
2253 ```
2254 OMA-URI:
2255 ```
2256 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~TrackingProtection/E_TrackingProtection_Locked
2257 ```
2258 Value (string):
2259 ```
2260 <enabled/> or <disabled/>
2261 ```
2262 #### macOS
2263 ```
2264 <dict>
2265   <key>EnableTrackingProtection</key>
2266   <dict>
2267     <key>Value</key>
2268     <true/> | <false/>
2269     <key>Locked</key>
2270     <true/> | <false/>
2271     <key>Cryptomining</key>
2272     <true/> | <false/>
2273     <key>Fingerprinting</key>
2274     <true/> | <false/>
2275     <key>Exceptions</key>
2276     <array>
2277       <string>https://example.com</string>
2278     </array>
2279   </dict>
2280 </dict>
2281 ```
2282 #### policies.json
2283 ```
2284 {
2285   "policies": {
2286     "EnableTrackingProtection": {
2287       "Value": true | false,
2288       "Locked": true | false,
2289       "Cryptomining": true | false,
2290       "Fingerprinting": true | false,
2291       "Exceptions": ["https://example.com"]
2292     }
2293   }
2294 }
2295 ```
2296 ### EncryptedMediaExtensions
2297 Enable or disable Encrypted Media Extensions and optionally lock it.
2298
2299 If `Enabled` is set to false, encrypted media extensions (like Widevine) are not downloaded by Firefox unless the user consents to installing them.
2300
2301 If `Locked` is set to true and `Enabled` is set to false, Firefox will not download encrypted media extensions (like Widevine) or ask the user to install them.
2302
2303 **Compatibility:** Firefox 77, Firefox ESR 68.9\
2304 **CCK2 Equivalent:** N/A\
2305 **Preferences Affected:** `media.eme.enabled`
2306
2307 #### Windows (GPO)
2308 ```
2309 Software\Policies\Mozilla\Firefox\EncryptedMediaExtensions\Enabled = 0x1 | 0x0
2310 Software\Policies\Mozilla\Firefox\EncryptedMediaExtensions\Locked = 0x1 | 0x0
2311 ```
2312 #### Windows (Intune)
2313 OMA-URI:
2314 ```
2315 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~EncryptedMediaExtensions/EncryptedMediaExtensions_Enabled
2316 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~EncryptedMediaExtensions/EncryptedMediaExtensions_Locked
2317 ```
2318 Value (string):
2319 ```
2320 <enabled/>or <disabled/>
2321 ```
2322 #### macOS
2323 ```
2324 <dict>
2325   <key>EncryptedMediaExtensions</key>
2326   <dict>
2327     <key>Enabled</key>
2328     <true/> | <false/>
2329     <key>Locked</key>
2330     <true/> | <false/>
2331   </dict>
2332 </dict>
2333 ```
2334 #### policies.json
2335 ```
2336 {
2337   "policies": {
2338     "EncryptedMediaExtensions": {
2339       "Enabled": true | false,
2340       "Locked": true | false
2341     }
2342   }
2343 }
2344 ```
2345 ### EnterprisePoliciesEnabled
2346 Enable policy support on macOS.
2347
2348 **Compatibility:** Firefox 63, Firefox ESR 60.3 (macOS only)\
2349 **CCK2 Equivalent:** N/A\
2350 **Preferences Affected:** N/A
2351
2352 #### macOS
2353 ```
2354 <dict>
2355   <key>EnterprisePoliciesEnabled</key>
2356   <true/>
2357 </dict>
2358 ```
2359 ### Extensions
2360 Control the installation, uninstallation and locking of extensions.
2361
2362 While this policy is not technically deprecated, it is recommended that you use the **[`ExtensionSettings`](#extensionsettings)** policy. It has the same functionality and adds more. It does not support native paths, though, so you'll have to use file:/// URLs.
2363
2364 `Install` is a list of URLs or native paths for extensions to be installed.
2365
2366 `Uninstall` is a list of extension IDs that should be uninstalled if found.
2367
2368 `Locked` is a list of extension IDs that the user cannot disable or uninstall.
2369
2370 **Compatibility:** Firefox 60, Firefox ESR 60\
2371 **CCK2 Equivalent:** `addons`\
2372 **Preferences Affected:** N/A
2373
2374 #### Windows (GPO)
2375 ```
2376 Software\Policies\Mozilla\Firefox\Extensions\Install\1 = "https://addons.mozilla.org/firefox/downloads/somefile.xpi"
2377 Software\Policies\Mozilla\Firefox\Extensions\Install\2 = "//path/to/xpi"
2378 Software\Policies\Mozilla\Firefox\Extensions\Uninstall\1 = "bad_addon_id@mozilla.org"
2379 Software\Policies\Mozilla\Firefox\Extensions\Locked\1 = "addon_id@mozilla.org"
2380 ```
2381 #### Windows (Intune)
2382 OMA-URI:
2383 ```
2384 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~Extensions/Extensions_Install
2385 ```
2386 Value (string):
2387 ```
2388 <enabled/>
2389 <data id="Extensions" value="1&#xF000;https://addons.mozilla.org/firefox/downloads/somefile.xpi&#xF000;2&#xF000;//path/to/xpi"/>
2390 ```
2391 OMA-URI:
2392 ```
2393 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~Extensions/Extensions_Uninstall
2394 ```
2395 Value (string):
2396 ```
2397 <enabled/>
2398 <data id="Extensions" value="1&#xF000;bad_addon_id@mozilla.org"/>
2399 ```
2400 OMA-URI:
2401 ```
2402 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~Extensions/Extensions_Locked
2403 ```
2404 Value (string):
2405 ```
2406 <enabled/>
2407 <data id="Extensions" value="1&#xF000;addon_id@mozilla.org"/>
2408 ```
2409 #### macOS
2410 ```
2411 <dict>
2412   <key>Extensions</key>
2413   <dict>
2414     <key>Install</key>
2415     <array>
2416       <string>https://addons.mozilla.org/firefox/downloads/somefile.xpi</string>
2417       <string>//path/to/xpi</string>
2418     </array>
2419     <key>Uninstall</key>
2420     <array>
2421       <string>bad_addon_id@mozilla.org</string>
2422     </array>
2423     <key>Locked</key>
2424     <array>
2425       <string>addon_id@mozilla.org</string>
2426     </array>
2427   </dict>
2428 </dict>
2429 ```
2430 #### policies.json
2431 ```
2432 {
2433   "policies": {
2434     "Extensions": {
2435       "Install": ["https://addons.mozilla.org/firefox/downloads/somefile.xpi", "//path/to/xpi"],
2436       "Uninstall": ["bad_addon_id@mozilla.org"],
2437       "Locked":  ["addon_id@mozilla.org"]
2438     }
2439   }
2440 }
2441 ```
2442 ### ExtensionSettings
2443 Manage all aspects of extensions. This policy is based heavily on the [Chrome policy](https://dev.chromium.org/administrators/policy-list-3/extension-settings-full) of the same name.
2444
2445 This policy maps an extension ID to its configuration. With an extension ID, the configuration will be applied to the specified extension only. A default configuration can be set for the special ID "*", which will apply to all extensions that don't have a custom configuration set in this policy.
2446
2447 To obtain an extension ID, install the extension and go to about:support. You will see the ID in the Extensions section. I've also created an extension that makes it easy to find the ID of extensions on AMO. You can download it [here](https://github.com/mkaply/queryamoid/releases/tag/v0.1).
2448
2449 The configuration for each extension is another dictionary that can contain the fields documented below.
2450
2451 | Name | Description |
2452 | --- | --- |
2453 | `installation_mode` | Maps to a string indicating the installation mode for the extension. The valid strings are `allowed`,`blocked`,`force_installed`, and `normal_installed`.
2454 | &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;`allowed` | Allows the extension to be installed by the user. This is the default behavior. There is no need for an install_url; it will automatically be allowed based on the ID.
2455 | &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;`blocked`| Blocks installation of the extension and removes it from the device if already installed.
2456 | &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;`force_installed`| The extension is automatically installed and can't be removed by the user. This option is not valid for the default configuration and requires an install_url.
2457 | &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;`normal_installed`| The extension is automatically installed but can be disabled by the user. This option is not valid for the default configuration and requires an install_url.
2458 | `install_url`| Maps to a URL indicating where Firefox can download a force_installed or normal_installed extension.  If installing from the local file system, use a [```file:///``` URL](https://en.wikipedia.org/wiki/File_URI_scheme). If installing from the addons.mozilla.org, use the following URL (substituting SHORT_NAME from the URL on AMO), https://addons.mozilla.org/firefox/downloads/latest/SHORT_NAME/latest.xpi. Languages packs are available from https://releases.mozilla.org/pub/firefox/releases/VERSION/PLATFORM/xpi/LANGUAGE.xpi. If you need to update the extension, you can change the name of the extension and it will be automatically updated. Extensions installed from file URLs will additional be updated when their internal version changes.
2459 | `install_sources` | A list of sources from which installing extensions is allowed. **This is unnecessary if you are only allowing the installation of certain extensions by ID.** Each item in this list is an extension-style match pattern. Users will be able to easily install items from any URL that matches an item in this list. Both the location of the *.xpi file and the page where the download is started from (i.e.  the referrer) must be allowed by these patterns. This setting can be used only for the default configuration.
2460 | `allowed_types` | This setting whitelists the allowed types of extension/apps that can be installed in Firefox. The value is a list of strings, each of which should be one of the following: "extension", "theme", "dictionary", "locale" This setting can be used only for the default configuration.
2461 | `blocked_install_message` | This maps to a string specifying the error message to display to users if they're blocked from installing an extension. This setting allows you to append text to the generic error message displayed when the extension is blocked. This could be be used to direct users to your help desk, explain why a particular extension is blocked, or something else. This setting can be used only for the default configuration.
2462 | `restricted_domains` | An array of domains on which content scripts can't be run. This setting can be used only for the default configuration.
2463 | `updates_disabled` | (Firefox 89, Firefox ESR 78.11) Boolean that indicates whether or not to disable automatic updates for an individual extension.
2464
2465 **Compatibility:** Firefox 69, Firefox ESR 68.1 (As of Firefox 85, Firefox ESR 78.7, installing a theme makes it the default.)\
2466 **CCK2 Equivalent:** N/A\
2467 **Preferences Affected:** N/A
2468
2469 #### Windows (GPO)
2470 Software\Policies\Mozilla\Firefox\ExtensionSettings (REG_MULTI_SZ) =
2471 ```
2472 {
2473   "*": {
2474     "blocked_install_message": "Custom error message.",
2475     "install_sources": ["about:addons","https://addons.mozilla.org/"],
2476     "installation_mode": "blocked",
2477     "allowed_types": ["extension"]
2478   },
2479   "uBlock0@raymondhill.net": {
2480     "installation_mode": "force_installed",
2481     "install_url": "https://addons.mozilla.org/firefox/downloads/latest/ublock-origin/latest.xpi"
2482   },
2483   "https-everywhere@eff.org": {
2484     "installation_mode": "allowed"
2485   }
2486 }
2487 ```
2488 #### Windows (Intune)
2489 OMA-URI:
2490 ```
2491 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~Extensions/ExtensionSettings
2492 ```
2493 Value (string):
2494 ```
2495 <enabled/>
2496 <data id="ExtensionSettings" value='
2497 {
2498   "*": {
2499     "blocked_install_message": "Custom error message.",
2500     "install_sources": ["about:addons","https://addons.mozilla.org/"],
2501     "installation_mode": "blocked",
2502     "allowed_types": ["extension"]
2503   },
2504   "uBlock0@raymondhill.net": {
2505     "installation_mode": "force_installed",
2506     "install_url": "https://addons.mozilla.org/firefox/downloads/latest/ublock-origin/latest.xpi"
2507   },
2508     "https-everywhere@eff.org": {
2509     "installation_mode": "allowed"
2510   }
2511 }'/>
2512 ```
2513 #### macOS
2514 ```
2515 <dict>
2516   <key>ExtensionSettings</key>
2517   <dict>
2518     <key>*</key>
2519     <dict>
2520       <key>blocked_install_message</key>
2521       <string>Custom error message.</string>
2522       <key>install_sources</key>
2523       <array>
2524         <string>about:addons</string>
2525         <string>https://addons.mozilla.org/</string>
2526       </array>
2527       <key>installation_mode</key>
2528       <string>blocked</string>
2529       <key>allowed_types</key>
2530       <array>
2531         <string>extension</string>
2532       </array>
2533     </dict>
2534     <key>uBlock0@raymondhill.net</key>
2535     <dict>
2536       <key>installation_mode</key>
2537        <string>force_installed</string>
2538       <key>install_url</key>
2539       <string>https://addons.mozilla.org/firefox/downloads/latest/ublock-origin/latest.xpi</string>
2540     </dict>
2541     <key>https-everywhere@eff.org</key>
2542     <dict>
2543       <key>installation_mode</key>
2544        <string>allowed</string>
2545     </dict>
2546   </dict>
2547 </dict>
2548 ```
2549 #### policies.json
2550 ```
2551 {
2552   "policies": {
2553     "ExtensionSettings": {
2554       "*": {
2555         "blocked_install_message": "Custom error message.",
2556         "install_sources": ["about:addons","https://addons.mozilla.org/"],
2557         "installation_mode": "blocked",
2558         "allowed_types": ["extension"]
2559       },
2560       "uBlock0@raymondhill.net": {
2561         "installation_mode": "force_installed",
2562         "install_url": "https://addons.mozilla.org/firefox/downloads/latest/ublock-origin/latest.xpi"
2563       },
2564       "https-everywhere@eff.org": {
2565         "installation_mode": "allowed"
2566       }
2567     }
2568   }
2569 }
2570 ```
2571 ### ExtensionUpdate
2572 Control extension updates.
2573
2574 **Compatibility:** Firefox 67, Firefox ESR 60.7\
2575 **CCK2 Equivalent:** N/A\
2576 **Preferences Affected:** `extensions.update.enabled`
2577
2578 #### Windows (GPO)
2579 ```
2580 Software\Policies\Mozilla\Firefox\ExtensionUpdate = 0x1 | 0x0
2581 ```
2582 #### Windows (Intune)
2583 OMA-URI:
2584 ```
2585 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~Extensions/ExtensionUpdate
2586 ```
2587 Value (string):
2588 ```
2589 <enabled/> or <disabled/>
2590 ```
2591 #### macOS
2592 ```
2593 <dict>
2594   <key>ExtensionUpdate</key>
2595   <true/> | <false/>
2596 </dict>
2597 ```
2598 #### policies.json
2599 ```
2600 {
2601   "policies": {
2602     "ExtensionUpdate": true | false
2603   }
2604 }
2605 ```
2606 ### FlashPlugin
2607 Configure the default Flash plugin policy as well as origins for which Flash is allowed.
2608
2609 `Allow` is a list of origins where Flash are allowed.
2610
2611 `Block` is a list of origins where Flash is not allowed.
2612
2613 `Default` determines whether or not Flash is allowed by default.
2614
2615 `Locked` prevents the user from changing Flash preferences.
2616
2617 **Compatibility:** Firefox 60, Firefox ESR 60\
2618 **CCK2 Equivalent:** `permissions.plugin`\
2619 **Preferences Affected:** `plugin.state.flash`
2620
2621 #### Windows (GPO)
2622 ```
2623 Software\Policies\Mozilla\Firefox\FlashPlugin\Allow\1 = "https://example.org"
2624 Software\Policies\Mozilla\Firefox\FlashPlugin\Block\1 = "https://example.edu"
2625 Software\Policies\Mozilla\Firefox\FlashPlugin\Default = 0x1 | 0x0
2626 Software\Policies\Mozilla\Firefox\FlashPlugin\Locked = 0x1 | 0x0
2627 ```
2628 #### Windows (Intune)
2629 OMA-URI:
2630 ```
2631 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~Flash/FlashPlugin_Allow
2632 ```
2633 Value (string):
2634 ```
2635 <enabled/>
2636 <data id="Permissions" value="1&#xF000;https://example.org&#xF000;2&#xF000;https://example.edu"/>
2637 ```
2638 OMA-URI:
2639 ```
2640 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~Flash/FlashPlugin_Locked
2641 ```
2642 Value (string):
2643 ```
2644 <enabled/> or <disabled/>
2645 ```
2646 OMA-URI:
2647 ```
2648 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~Flash/FlashPlugin_Default
2649 ```
2650 Value (string):
2651 ```
2652 <enabled/> or <disabled/>
2653 ```
2654 #### macOS
2655 ```
2656 <dict>
2657   <key>FlashPlugin</key>
2658   <dict>
2659     <key>Allow</key>
2660     <array>
2661       <string>http://example.org</string>
2662     </array>
2663     <key>Block</key>
2664     <array>
2665       <string>http://example.edu</string>
2666     </array>
2667     <key>Default</key>
2668     <true/> | <false/>
2669     <key>Locked</key>
2670     <true/> | <false/>
2671   </dict>
2672 </dict>
2673 ```
2674 #### policies.json
2675 ```
2676 {
2677   "policies": {
2678     "FlashPlugin": {
2679       "Allow": ["http://example.org/"],
2680       "Block": ["http://example.edu/"],
2681       "Default": true | false,
2682       "Locked": true | false
2683     }
2684   }
2685 }
2686 ```
2687
2688
2689
2690 ### Handlers
2691 Configure default application handlers. This policy is based on the internal format of `handlers.json`.
2692
2693 You can configure handlers based on a mime type (`mimeTypes`), a file's extension (`extensions`), or a protocol (`schemes`).
2694
2695 Within each handler type, you specify the given mimeType/extension/scheme as a key and use the following subkeys to describe how it is handled.
2696
2697 | Name | Description |
2698 | --- | --- |
2699 | `action`| Can be either `saveToDisk`, `useHelperApp`, `useSystemDefault`.
2700 | `ask` | If `true`, the user is asked if what they want to do with the file. If `false`, the action is taken without user intervention.
2701 | `handlers` | An array of handlers with the first one being the default. If you don't want to have a default handler, use an empty object for the first handler. Choose between path or uriTemplate.
2702 | &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;`name` | The display name of the handler (might not be used).
2703 | &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;`path`| The native path to the executable to be used.
2704 | &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;`uriTemplate`| A url to a web based application handler. The URL must be https and contain a %s to be used for substitution.
2705
2706 **Compatibility:** Firefox 78, Firefox ESR 78\
2707 **CCK2 Equivalent:** N/A\
2708 **Preferences Affected:** N/A
2709
2710 #### Windows (GPO)
2711 Software\Policies\Mozilla\Firefox\Handlers (REG_MULTI_SZ) =
2712 ```
2713 {
2714   "mimeTypes": {
2715     "application/msword": {
2716       "action": "useSystemDefault",
2717       "ask": true | false
2718     }
2719   },
2720   "schemes": {
2721     "mailto": {
2722       "action": "useHelperApp",
2723       "ask": true | false,
2724       "handlers": [{
2725         "name": "Gmail",
2726         "uriTemplate": "https://mail.google.com/mail/?extsrc=mailto&url=%s"
2727       }]
2728     }
2729   },
2730   "extensions": {
2731     "pdf": {
2732       "action": "useHelperApp",
2733       "ask": true | false,
2734       "handlers": [{
2735         "name": "Adobe Acrobat",
2736         "path": "C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\AcroRd32.exe"
2737       }]
2738     }
2739   }
2740 }
2741 ```
2742 #### Windows (Intune)
2743 OMA-URI:
2744 ```
2745 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox/Handlers
2746 ```
2747 Value (string):
2748 ```
2749 <enabled/>
2750 <data id="Handlers" value='
2751 {
2752   "mimeTypes": {
2753     "application/msword": {
2754       "action": "useSystemDefault",
2755       "ask": true | false
2756     }
2757   },
2758   "schemes": {
2759     "mailto": {
2760       "action": "useHelperApp",
2761       "ask": true | false,
2762       "handlers": [{
2763         "name": "Gmail",
2764         "uriTemplate": "https://mail.google.com/mail/?extsrc=mailto&amp;url=%s"
2765       }]
2766     }
2767   },
2768   "extensions": {
2769     "pdf": {
2770       "action": "useHelperApp",
2771       "ask": true | false,
2772       "handlers": [{
2773         "name": "Adobe Acrobat",
2774         "path": "C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\AcroRd32.exe"
2775       }]
2776     }
2777   }
2778 }
2779 '/>
2780 ```
2781 #### macOS
2782 ```
2783 <dict>
2784   <key>Handlers</key>
2785   <dict>
2786     <key>mimeTypes</key>
2787     <dict>
2788       <key>application/msword</key>
2789       <dict>
2790         <key>action</key>
2791         <string>useSystemDefault</string>
2792         <key>ask</key>
2793         <true/> | <false/>
2794       </dict>
2795     </dict>
2796     <key>schemes</key>
2797     <dict>
2798       <key>mailto</key>
2799       <dict>
2800         <key>action</key>
2801         <string>useHelperApp</string>
2802         <key>ask</key>
2803         <true/> | <false/>
2804         <key>handlers</key>
2805         <array>
2806           <dict>
2807             <key>name</key>
2808             <string>Gmail</string>
2809             <key>uriTemplate</key>
2810             <string>https://mail.google.com/mail/?extsrc=mailto&url=%s</string>
2811           </dict>
2812         </array>
2813       </dict>
2814     </dict>
2815     <key>extensions</key>
2816     <dict>
2817       <key>pdf</key>
2818       <dict>
2819         <key>action</key>
2820         <string>useHelperApp</string>
2821         <key>ask</key>
2822         <true/> | <false/>
2823         <key>handlers</key>
2824         <array>
2825           <dict>
2826             <key>name</key>
2827             <string>Adobe Acrobat</string>
2828             <key>path</key>
2829             <string>/System/Applications/Preview.app</string>
2830           </dict>
2831         </array>
2832       </dict>
2833     </dict>
2834   </dict>
2835 </dict>
2836 ```
2837 #### policies.json
2838 ```
2839 {
2840   "policies": {
2841     "Handlers": {
2842       "mimeTypes": {
2843         "application/msword": {
2844           "action": "useSystemDefault",
2845           "ask": false
2846         }
2847       },
2848       "schemes": {
2849         "mailto": {
2850           "action": "useHelperApp",
2851           "ask": true | false,
2852           "handlers": [{
2853             "name": "Gmail",
2854             "uriTemplate": "https://mail.google.com/mail/?extsrc=mailto&url=%s"
2855           }]
2856         }
2857       },
2858       "extensions": {
2859         "pdf": {
2860           "action": "useHelperApp",
2861           "ask": true | false,
2862           "handlers": [{
2863             "name": "Adobe Acrobat",
2864             "path": "/usr/bin/acroread"
2865           }]
2866         }
2867       }
2868     }
2869   }
2870 }
2871 ```
2872 ### FirefoxHome
2873 Customize the Firefox Home page.
2874
2875 **Compatibility:** Firefox 68, Firefox ESR 68\
2876 **CCK2 Equivalent:** N/A\
2877 **Preferences Affected:** `browser.newtabpage.activity-stream.showSearch`,`browser.newtabpage.activity-stream.feeds.topsites`,`browser.newtabpage.activity-stream.feeds.section.highlights`,`browser.newtabpage.activity-stream.feeds.section.topstories`,`browser.newtabpage.activity-stream.feeds.snippets`
2878
2879 #### Windows (GPO)
2880 ```
2881 Software\Policies\Mozilla\Firefox\FirefoxHome\Search = 0x1 | 0x0
2882 Software\Policies\Mozilla\Firefox\FirefoxHome\TopSites = 0x1 | 0x0
2883 Software\Policies\Mozilla\Firefox\FirefoxHome\Highlights = 0x1 | 0x0
2884 Software\Policies\Mozilla\Firefox\FirefoxHome\Pocket = 0x1 | 0x0
2885 Software\Policies\Mozilla\Firefox\FirefoxHome\Snippets = 0x1 | 0x0
2886 Software\Policies\Mozilla\Firefox\FirefoxHome\Locked = 0x1 | 0x0
2887 ```
2888 #### Windows (Intune)
2889 OMA-URI:
2890 ```
2891 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox/CustomizeFirefoxHome
2892 ```
2893 Value (string):
2894 ```
2895 <enabled/>
2896 <data id="FirefoxHome_Search"  value="true | false"/>
2897 <data id="FirefoxHome_TopSites"  value="true | false"/>
2898 <data id="FirefoxHome_Highlights"  value="true | false"/>
2899 <data id="FirefoxHome_Pocket"  value="true | false"/>
2900 <data id="FirefoxHome_Snippets"  value="true | false"/>
2901 <data id="FirefoxHome_Locked"  value="true | false"/>
2902 ```
2903 #### macOS
2904 ```
2905 <dict>
2906   <key>FirefoxHome</key>
2907   <dict>
2908     <key>Search</key>
2909     <true/> | <false/>
2910     <key>TopSites</key>
2911     <true/> | <false/>
2912     <key>Highlights</key>
2913     <true/> | <false/>
2914     <key>Pocket</key>
2915     <true/> | <false/>
2916     <key>Snippets</key>
2917     <true/> | <false/>
2918     <key>Locked</key>
2919     <true/> | <false/>
2920   </dict>
2921 </dict>
2922 ```
2923 #### policies.json
2924 ```
2925 {
2926   "policies": {
2927     "FirefoxHome": {
2928       "Search": true | false,
2929       "TopSites": true | false,
2930       "Highlights": true | false,
2931       "Pocket": true | false,
2932       "Snippets": true | false,
2933       "Locked": true | false
2934     }
2935   }
2936 }
2937 ```
2938 ### HardwareAcceleration
2939 Control hardware acceleration.
2940
2941 **Compatibility:** Firefox 60, Firefox ESR 60\
2942 **CCK2 Equivalent:** N/A\
2943 **Preferences Affected:** `layers.acceleration.disabled`
2944
2945 #### Windows (GPO)
2946 ```
2947 Software\Policies\Mozilla\Firefox\HardwareAcceleration = 0x1 | 0x0
2948 ```
2949 #### Windows (Intune)
2950 OMA-URI:
2951 ```
2952 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox/HardwareAcceleration
2953 ```
2954 Value (string):
2955 ```
2956 <enabled/> or <disabled/>
2957 ```
2958 #### macOS
2959 ```
2960 <dict>
2961   <key>HardwareAcceleration</key>
2962   <true/> | <false/>
2963 </dict>
2964 ```
2965 #### policies.json
2966 ```
2967 {
2968   "policies": {
2969     "HardwareAcceleration": true | false
2970   }
2971 }
2972 ```
2973 ### Homepage
2974 Configure the default homepage and how Firefox starts.
2975
2976 `URL` is the default homepage.
2977
2978 `Locked` prevents the user from changing homepage preferences.
2979
2980 `Additional` allows for more than one homepage.
2981
2982 `StartPage` is how Firefox starts. The choices are no homepage, the default homepage or the previous session.
2983
2984 With Firefox 78, an additional option as added for `Startpage`, `homepage-locked`. If this is value is set for the Startpage, the user will always get the homepage at startup and cannot choose to restore their session.
2985
2986 **Compatibility:** Firefox 60, Firefox ESR 60 (StartPage was added in Firefox 60, Firefox ESR 60.4, homepage-locked added in Firefox 78)\
2987 **CCK2 Equivalent:** `homePage`,`lockHomePage`\
2988 **Preferences Affected:** `browser.startup.homepage`,`browser.startup.page`
2989
2990 #### Windows (GPO)
2991 ```
2992 Software\Policies\Mozilla\Firefox\Homepage\URL = "https://example.com"
2993 Software\Policies\Mozilla\Firefox\Homepage\Locked = 0x1 | 0x0
2994 Software\Policies\Mozilla\Firefox\Homepage\Additional\1 = "https://example.org"
2995 Software\Policies\Mozilla\Firefox\Homepage\Additional\2 = "https://example.edu"
2996 Software\Policies\Mozilla\Firefox\Homepage\StartPage = "none" | "homepage" | "previous-session" | "homepage-locked"
2997 ```
2998 #### Windows (Intune)
2999 OMA-URI:
3000 ```
3001 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~Homepage/HomepageURL
3002 ```
3003 Value (string):
3004 ```
3005 <enabled/>
3006
3007 <data id="HomepageURL" value="https://example.com"/>
3008 <data id="HomepageLocked" value="true | false"/>
3009 ```
3010 OMA-URI:
3011 ```
3012 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~Homepage/HomepageAdditional
3013 ```
3014 Value (string):
3015 ```
3016 <enabled/>
3017
3018 <data id="HomepageAdditional" value="1&#xF000;http://example.org&#xF000;2&#xF000;http://example.edu"/>
3019 ```
3020 OMA-URI:
3021 ```
3022 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~Homepage/HomepageStartPage
3023 ```
3024 Value (string):
3025 ```
3026 <enabled/>
3027
3028 <data id="StartPage" value="none | homepage | previous-session"/>
3029 ```
3030 #### macOS
3031 ```
3032 <dict>
3033   <key>Homepage</key>
3034   <dict>
3035     <key>URL</key>
3036     <string>http://example.com</string>
3037     <key>Locked</key>
3038     <true/> | <false/>
3039     <key>Additional</key>
3040     <array>
3041       <string>http://example.org</string>
3042       <string>http://example.edu</string>
3043     </array>
3044     <key>StartPage</key>
3045     <string>none | homepage | previous-session | homepage-locked</string>
3046   </dict>
3047 </dict>
3048 ```
3049 #### policies.json
3050 ```
3051 {
3052   "policies": {
3053     "Homepage": {
3054       "URL": "http://example.com/",
3055       "Locked": true | false,
3056       "Additional": ["http://example.org/",
3057                      "http://example.edu/"],
3058       "StartPage": "none" | "homepage" | "previous-session" | "homepage-locked"
3059     }
3060   }
3061 }
3062 ```
3063 ### InstallAddonsPermission
3064 Configure the default extension install policy as well as origins for extension installs are allowed. This policy does not override turning off all extension installs.
3065
3066 `Allow` is a list of origins where extension installs are allowed.
3067
3068 `Default` determines whether or not extension installs are allowed by default.
3069
3070 **Compatibility:** Firefox 60, Firefox ESR 60\
3071 **CCK2 Equivalent:** `permissions.install`\
3072 **Preferences Affected:** `xpinstall.enabled`
3073
3074 #### Windows (GPO)
3075 ```
3076 Software\Policies\Mozilla\Firefox\InstallAddonsPermission\Allow\1 = "https://example.org"
3077 Software\Policies\Mozilla\Firefox\InstallAddonsPermission\Allow\2 = "https://example.edu"
3078 Software\Policies\Mozilla\Firefox\InstallAddonsPermission\Default = 0x1 | 0x0
3079 ```
3080 #### Windows (Intune)
3081 OMA-URI:
3082 ```
3083 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~Addons/InstallAddonsPermission_Allow
3084 ```
3085 Value (string):
3086 ```
3087 <enabled/>
3088 <data id="Permissions" value="1&#xF000;https://example.org&#xF000;2&#xF000;https://example.edu"/>
3089 ```
3090 OMA-URI:
3091 ```
3092 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~Addons/InstallAddonsPermission_Default
3093 ```
3094 Value (string):
3095 ```
3096 <enabled/>
3097 ```
3098 #### macOS
3099 ```
3100 <dict>
3101   <key>InstallAddonsPermission</key>
3102   <dict>
3103     <key>Allow</key>
3104     <array>
3105       <string>http://example.org</string>
3106       <string>http://example.edu</string>
3107     </array>
3108     <key>Default</key>
3109     <true/> | <false/>
3110   </dict>
3111 </dict>
3112 ```
3113 #### policies.json
3114 ```
3115 {
3116   "policies": {
3117     "InstallAddonsPermission": {
3118       "Allow": ["http://example.org/",
3119                 "http://example.edu/"],
3120       "Default": true | false
3121     }
3122   }
3123 }
3124 ```
3125 ### LegacyProfiles
3126 Disable the feature enforcing a separate profile for each installation.
3127
3128 If this policy set to true, Firefox will not try to create different profiles for installations of Firefox in different directories. This is the equivalent of the MOZ_LEGACY_PROFILES environment variable.
3129
3130 If this policy set to false, Firefox will create a new profile for each unique installation of Firefox.
3131
3132 This policy only work on Windows via GPO (not policies.json).
3133
3134 **Compatibility:** Firefox 70, Firefox ESR 68.2 (Windows only, GPO only)\
3135 **CCK2 Equivalent:** N/A\
3136 **Preferences Affected:** N/A
3137
3138 #### Windows (GPO)
3139 ```
3140 Software\Policies\Mozilla\Firefox\LegacyProfiles = = 0x1 | 0x0
3141 ```
3142 #### Windows (Intune)
3143 OMA-URI:
3144 ```
3145 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox/LegacyProfiles
3146 ```
3147 Value (string):
3148 ```
3149 <enabled/> or <disabled/>
3150 ```
3151 ### LocalFileLinks
3152 Enable linking to local files by origin.
3153
3154 **Compatibility:** Firefox 68, Firefox ESR 68\
3155 **CCK2 Equivalent:** N/A\
3156 **Preferences Affected:** `capability.policy.localfilelinks.*`
3157
3158 #### Windows (GPO)
3159 ```
3160 Software\Policies\Mozilla\Firefox\LocalFileLinks\1 = "https://example.org"
3161 Software\Policies\Mozilla\Firefox\LocalFileLinks\2 = "https://example.edu"
3162 ```
3163 #### Windows (Intune)
3164 OMA-URI:
3165 ```
3166 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox/LocalFileLinks
3167 ```
3168 Value (string):
3169 ```
3170 <enabled/>
3171 <data id="LocalFileLinks" value="1&#xF000;https://example.org&#xF000;2&#xF000;https://example.edu"/>
3172 ```
3173 #### macOS
3174 ```
3175 <dict>
3176   <key>LocalFileLinks</key>
3177   <array>
3178     <string>http://example.org</string>
3179     <string>http://example.edu</string>
3180   </array>
3181 </dict>
3182 ```
3183 #### policies.json
3184 ```
3185 {
3186   "policies": {
3187     "LocalFileLinks": ["http://example.org/",
3188                        "http://example.edu/"]
3189   }
3190 }
3191 ```
3192 ### ManagedBookmarks
3193 Configures a list of bookmarks managed by an administrator that cannot be changed by the user.
3194
3195 The bookmarks are only added as a button on the personal toolbar. They are not in the bookmarks folder.
3196
3197 The syntax of this policy is exactly the same as the [Chrome ManagedBookmarks policy](https://cloud.google.com/docs/chrome-enterprise/policies/?policy=ManagedBookmarks). The schema is:
3198 ```
3199 {
3200  "items": {
3201   "id": "BookmarkType",
3202   "properties": {
3203    "children": {
3204     "items": {
3205      "$ref": "BookmarkType"
3206     },
3207     "type": "array"
3208    },
3209    "name": {
3210     "type": "string"
3211    },
3212    "toplevel_name": {
3213     "type": "string"
3214    },
3215    "url": {
3216     "type": "string"
3217    }
3218   },
3219   "type": "object"
3220  },
3221  "type": "array"
3222 }
3223 ```
3224 **Compatibility:** Firefox 83, Firefox ESR 78.5\
3225 **CCK2 Equivalent:** N/A\
3226 **Preferences Affected:** N/A
3227
3228 #### Windows (GPO)
3229 Software\Policies\Mozilla\Firefox\ManagedBookmarks (REG_MULTI_SZ) =
3230 ```
3231 [
3232   {
3233     "toplevel_name": "My managed bookmarks folder"
3234   },
3235   {
3236     "url": "example.com",
3237     "name": "Example"
3238   },
3239   {
3240     "name": "Mozilla links",
3241     "children": [
3242       {
3243         "url": "https://mozilla.org",
3244         "name": "Mozilla.org"
3245       },
3246       {
3247         "url": "https://support.mozilla.org/",
3248         "name": "SUMO"
3249       }
3250     ]
3251   }
3252 ]
3253 ```
3254 #### Windows (Intune)
3255 OMA-URI:
3256 ```
3257 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox/ManagedBookmarks
3258 ```
3259 Value (string):
3260 ```
3261 <enabled/>
3262 <data id="JSON" value='
3263 [
3264   {
3265     "toplevel_name": "My managed bookmarks folder"
3266   },
3267   {
3268     "url": "example.com",
3269     "name": "Example"
3270   },
3271   {
3272     "name": "Mozilla links",
3273     "children": [
3274       {
3275         "url": "https://mozilla.org",
3276         "name": "Mozilla.org"
3277       },
3278       {
3279         "url": "https://support.mozilla.org/",
3280         "name": "SUMO"
3281       }
3282     ]
3283   }
3284 ]'/>
3285 ```
3286 #### macOS
3287 ```
3288 <dict>
3289   <key>ManagedBookmarks</key>
3290   <array>
3291     <dict>
3292       <key>toplevel_name</key>
3293       <string>My managed bookmarks folder</string>
3294       <dict>
3295         <key>url</key>
3296         <string>example.com</string>
3297         <key>name</key>
3298         <string>Example</string>
3299       </dict>
3300       <dict>
3301       <key>name</key>
3302       <string>Mozilla links</string>
3303       <key>children</key>
3304       <array>
3305         <dict>
3306           <key>url</key>
3307           <string>https://mozilla.org</string>
3308           <key>name</key>
3309           <string>Mozilla</string>
3310         </dict>
3311         <dict>
3312           <key>url</key>
3313           <string>https://support.mozilla.org/</string>
3314           <key>name</key>
3315           <string>SUMO</string>
3316         </dict>
3317       </array>
3318     </dict>
3319   </array>
3320 </dict>
3321 ```
3322 #### policies.json
3323 ```
3324 {
3325   "policies": {
3326     "ManagedBookmarks": [
3327       {
3328         "toplevel_name": "My managed bookmarks folder"
3329       },
3330       {
3331         "url": "example.com",
3332         "name": "Example"
3333       },
3334       {
3335         "name": "Mozilla links",
3336         "children": [
3337           {
3338             "url": "https://mozilla.org",
3339             "name": "Mozilla.org"
3340           },
3341           {
3342             "url": "https://support.mozilla.org/",
3343             "name": "SUMO"
3344           }
3345         ]
3346       }
3347     ]
3348   }
3349 }
3350 ```
3351 ### ManualAppUpdateOnly
3352
3353 Switch to manual updates only.
3354
3355 If this policy is enabled:
3356  1. The user will never be prompted to install updates
3357  2. Firefox will not check for updates in the background, though it will check automatically when an update UI is displayed (such as the one in the About dialog). This check will be used to show "Update to version X" in the UI, but will not automatically download the update or prompt the user to update in any other way.
3358  3. The update UI will work as expected, unlike when using DisableAppUpdate.
3359
3360 This policy is primarily intended for advanced end users, not for enterprises.
3361
3362 **Compatibility:** Firefox 87\
3363 **CCK2 Equivalent:** N/A\
3364 **Preferences Affected:** N/A
3365
3366 #### policies.json
3367 ```
3368 {
3369   "policies": {
3370     "ManualAppUpdateOnly": true | false
3371   }
3372 }
3373 ```
3374 ### PrimaryPassword
3375 Require or prevent using a primary (formerly master) password.
3376
3377 If this value is true, a primary password is required. If this value is false, it works the same as if [`DisableMasterPasswordCreation`](#disablemasterpasswordcreation) was true and removes the primary password functionality.
3378
3379 If both DisableMasterPasswordCreation and PrimaryPassword are used, DisableMasterPasswordCreation takes precedent.
3380
3381 **Compatibility:** Firefox 79, Firefox ESR 78.1\
3382 **CCK2 Equivalent:** `noMasterPassword`\
3383 **Preferences Affected:** N/A
3384
3385 #### Windows (GPO)
3386 ```
3387 Software\Policies\Mozilla\Firefox\PrimaryPassword = 0x1 | 0x0
3388 ```
3389 #### Windows (Intune)
3390 OMA-URI:
3391 ```
3392 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox/PrimaryPassword
3393 ```
3394 Value (string):
3395 ```
3396 <enabled/> or <disabled/>
3397 ```
3398 #### macOS
3399 ```
3400 <dict>
3401   <key>PrimaryPassword</key>
3402   <true/> | <false/>
3403 </dict>
3404 ```
3405 #### policies.json
3406 ```
3407 {
3408   "policies": {
3409     "PrimaryPassword": true | false
3410   }
3411 }
3412 ```
3413 ### NetworkPrediction
3414 Enable or disable network prediction (DNS prefetching).
3415
3416 **Compatibility:** Firefox 67, Firefox ESR 60.7\
3417 **CCK2 Equivalent:** N/A\
3418 **Preferences Affected:** `network.dns.disablePrefetch`,`network.dns.disablePrefetchFromHTTPS`
3419
3420 #### Windows (GPO)
3421 ```
3422 Software\Policies\Mozilla\Firefox\NetworkPrediction = 0x1 | 0x0
3423 ```
3424 #### Windows (Intune)
3425 OMA-URI:
3426 ```
3427 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox/NetworkPrediction
3428 ```
3429 Value (string):
3430 ```
3431 <enabled/> or <disabled/>
3432 ```
3433 #### macOS
3434 ```
3435 <dict>
3436   <key>NetworkPrediction</key>
3437   <true/> | <false/>
3438 </dict>
3439 ```
3440 #### policies.json
3441 ```
3442 {
3443   "policies": {
3444     "NetworkPrediction": true | false
3445 }
3446 ```
3447 ### NewTabPage
3448 Enable or disable the New Tab page.
3449
3450 **Compatibility:** Firefox 68, Firefox ESR 68\
3451 **CCK2 Equivalent:** N/A\
3452 **Preferences Affected:** `browser.newtabpage.enabled`
3453
3454 #### Windows (GPO)
3455 ```
3456 Software\Policies\Mozilla\Firefox\NewTabPage = 0x1 | 0x0
3457 ```
3458 #### Windows (Intune)
3459 OMA-URI:
3460 ```
3461 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox/NewTabPage
3462 ```
3463 Value (string):
3464 ```
3465 <enabled/> or <disabled/>
3466 ```
3467 #### macOS
3468 ```
3469 <dict>
3470   <key>NewTabPage</key>
3471   <true/> | <false/>
3472 </dict>
3473 ```
3474 #### policies.json
3475 ```
3476 {
3477   "policies": {
3478     "NewTabPage": true | false
3479 }
3480 ```
3481 ### NoDefaultBookmarks
3482 Disable the creation of default bookmarks.
3483
3484 This policy is only effective if the user profile has not been created yet.
3485
3486 **Compatibility:** Firefox 60, Firefox ESR 60\
3487 **CCK2 Equivalent:** `removeDefaultBookmarks`\
3488 **Preferences Affected:** N/A
3489
3490 #### Windows (GPO)
3491 ```
3492 Software\Policies\Mozilla\Firefox\NoDefaultBookmarks = 0x1 | 0x0
3493 ```
3494 #### Windows (Intune)
3495 OMA-URI:
3496 ```
3497 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox/NoDefaultBookmarks
3498 ```
3499 Value (string):
3500 ```
3501 <enabled/> or <disabled/>
3502 ```
3503 #### macOS
3504 ```
3505 <dict>
3506   <key>NoDefaultBookmarks</key>
3507   <true/> | <false/>
3508 </dict>
3509 ```
3510 #### policies.json
3511 ```
3512 {
3513   "policies": {
3514     "NoDefaultBookmarks": true | false
3515   }
3516 }
3517 ```
3518 ### OfferToSaveLogins
3519 Control whether or not Firefox offers to save passwords.
3520
3521 **Compatibility:** Firefox 60, Firefox ESR 60\
3522 **CCK2 Equivalent:** `dontRememberPasswords`\
3523 **Preferences Affected:** `signon.rememberSignons`
3524
3525 #### Windows (GPO)
3526 ```
3527 Software\Policies\Mozilla\Firefox\OfferToSaveLogins = 0x1 | 0x0
3528 ```
3529 #### Windows (Intune)
3530 OMA-URI:
3531 ```
3532 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox/OfferToSaveLogins
3533 ```
3534 Value (string):
3535 ```
3536 <enabled/> or <disabled/>
3537 ```
3538 #### macOS
3539 ```
3540 <dict>
3541   <key>OfferToSaveLogins</key>
3542   <true/> | <false/>
3543 </dict>
3544 ```
3545 #### policies.json
3546 ```
3547 {
3548   "policies": {
3549     "OfferToSaveLogins": true | false
3550   }
3551 }
3552 ```
3553 ### OfferToSaveLoginsDefault
3554 Sets the default value of signon.rememberSignons without locking it.
3555
3556 **Compatibility:** Firefox 70, Firefox ESR 60.2\
3557 **CCK2 Equivalent:** `dontRememberPasswords`\
3558 **Preferences Affected:** `signon.rememberSignons`
3559
3560 #### Windows (GPO)
3561 ```
3562 Software\Policies\Mozilla\Firefox\OfferToSaveLoginsDefault = 0x1 | 0x0
3563 ```
3564 #### Windows (Intune)
3565 OMA-URI:
3566 ```
3567 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox/OfferToSaveLoginsDefault
3568 ```
3569 Value (string):
3570 ```
3571 <enabled/> or <disabled/>
3572 ```
3573 #### macOS
3574 ```
3575 <dict>
3576   <key>OfferToSaveLoginsDefault</key>
3577   <true/> | <false/>
3578 </dict>
3579 ```
3580 #### policies.json
3581 ```
3582 {
3583   "policies": {
3584     "OfferToSaveLoginsDefault": true | false
3585   }
3586 }
3587 ```
3588 ### OverrideFirstRunPage
3589 Override the first run page. If the value is an empty string (""), the first run page is not displayed.
3590
3591 Starting with Firefox 83, Firefox ESR 78.5, you can also specify multiple URLS separated by a vertical bar (|).
3592
3593 **Compatibility:** Firefox 60, Firefox ESR 60\
3594 **CCK2 Equivalent:** `welcomePage`,`noWelcomePage`\
3595 **Preferences Affected:** `startup.homepage_welcome_url`
3596
3597 #### Windows (GPO)
3598 ```
3599 Software\Policies\Mozilla\Firefox\OverrideFirstRunPage = "http://example.org"
3600 ```
3601 #### Windows (Intune)
3602 OMA-URI:
3603 ```
3604 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox/OverrideFirstRunPage
3605 ```
3606 Value (string):
3607 ```
3608 <enabled/>
3609 <data id="OverridePage" value="https://example.com"/>
3610 ```
3611 #### macOS
3612 ```
3613 <dict>
3614   <key>OverrideFirstRunPage</key>
3615   <string>http://example.org</string>
3616 </dict>
3617 ```
3618 #### policies.json
3619 ```
3620 {
3621   "policies": {
3622     "OverrideFirstRunPage": "http://example.org"
3623   }
3624 }
3625 ```
3626 ### OverridePostUpdatePage
3627 Override the upgrade page. If the value is an empty string (""), no extra pages are displayed when Firefox is upgraded.
3628
3629 **Compatibility:** Firefox 60, Firefox ESR 60\
3630 **CCK2 Equivalent:** `upgradePage`,`noUpgradePage`\
3631 **Preferences Affected:** `startup.homepage_override_url`
3632
3633 #### Windows (GPO)
3634 ```
3635 Software\Policies\Mozilla\Firefox\OverridePostUpdatePage = "http://example.org"
3636 ```
3637 #### Windows (Intune)
3638 OMA-URI:
3639 ```
3640 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox/OverridePostUpdatePage
3641 ```
3642 Value (string):
3643 ```
3644 <enabled/>
3645 <data id="OverridePage" value="https://example.com"/>
3646 ```
3647 #### macOS
3648 ```
3649 <dict>
3650   <key>OverridePostUpdatePage</key>
3651   <string>http://example.org</string>
3652 </dict>
3653 ```
3654 #### policies.json
3655 ```
3656 {
3657   "policies": {
3658     "OverridePostUpdatePage": "http://example.org"
3659   }
3660 }
3661 ```
3662 ### PasswordManagerEnabled
3663 Remove access to the password manager via preferences and blocks about:logins on Firefox 70.
3664
3665 **Compatibility:** Firefox 70, Firefox ESR 60.2\
3666 **CCK2 Equivalent:** N/A\
3667 **Preferences Affected:** `pref.privacy.disable_button.view_passwords`
3668
3669 #### Windows (GPO)
3670 ```
3671 Software\Policies\Mozilla\Firefox\PasswordManagerEnabled = 0x1 | 0x0
3672 ```
3673 #### Windows (Intune)
3674 OMA-URI:
3675 ```
3676 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox/PasswordManagerEnabled
3677 ```
3678 Value (string):
3679 ```
3680 <enabled/> or <disabled/>
3681 ```
3682 #### macOS
3683 ```
3684 <dict>
3685   <key>PasswordManagerEnabled</key>
3686   <true/> | <false/>
3687 </dict>
3688 ```
3689 #### policies.json
3690 ```
3691 {
3692   "policies": {
3693     "PasswordManagerEnabled": true | false
3694   }
3695 }
3696 ```
3697 ### PDFjs
3698 Disable or configure PDF.js, the built-in PDF viewer.
3699
3700 If `Enabled` is set to false, the built-in PDF viewer is disabled.
3701
3702 If `EnablePermissions` is set to true, the built-in PDF viewer will honor document permissions like preventing the copying of text.
3703
3704 Note: DisableBuiltinPDFViewer has not been deprecated. You can either continue to use it, or switch to using PDFjs->Enabled to disable the built-in PDF viewer. This new permission was added because we needed a place for PDFjs->EnabledPermissions.
3705
3706 **Compatibility:** Firefox 77, Firefox ESR 68.9\
3707 **CCK2 Equivalent:** N/A\
3708 **Preferences Affected:** `pdfjs.diabled`,`pdfjs.enablePermissions`
3709
3710 #### Windows (GPO)
3711 ```
3712 Software\Policies\Mozilla\Firefox\PDFjs\Enabled = 0x1 | 0x0
3713 Software\Policies\Mozilla\Firefox\PDFjs\EnablePermissions = 0x1 | 0x0
3714 ```
3715 #### Windows (Intune)
3716 OMA-URI:
3717 ```
3718 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~PDFjs/PDFjs_Enabled
3719 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~PDFjs/PDFjs_EnablePermissions
3720 ```
3721 Value (string):
3722 ```
3723 <enabled/>or <disabled/>
3724 ```
3725 #### macOS
3726 ```
3727 <dict>
3728   <key>PDFjs</key>
3729   <dict>
3730     <key>Enabled</key>
3731     <true/> | <false/>
3732     <key>EnablePermissions</key>
3733     <true/> | <false/>
3734   </dict>
3735 </dict>
3736 ```
3737 #### policies.json
3738 ```
3739 {
3740   "policies": {
3741     "PDFjs": {
3742       "Enabled": true | false,
3743       "EnablePermissions": true | false
3744     }
3745   }
3746 }
3747 ```
3748 ### Permissions
3749 Set permissions associated with camera, microphone, location, notifications, autoplay, and virtual reality. Because these are origins, not domains, entries with unique ports must be specified separately. This explicitly means that it is not possible to add wildcards. See examples below.
3750
3751 `Allow` is a list of origins where the feature is allowed.
3752
3753 `Block` is a list of origins where the feature is not allowed.
3754
3755 `BlockNewRequests` determines whether or not new requests can be made for the feature.
3756
3757 `Locked` prevents the user from changing preferences for the feature.
3758
3759 `Default` specifies the default value for Autoplay. block-audio-video is not supported on Firefox ESR 68.
3760
3761 **Compatibility:** Firefox 62, Firefox ESR 60.2 (Autoplay added in Firefox 74, Firefox ESR 68.6, Autoplay Default/Locked added in Firefox 76, Firefox ESR 68.8, VirtualReality added in Firefox 80, Firefox ESR 78.2)\
3762 **CCK2 Equivalent:** N/A\
3763 **Preferences Affected:** `permissions.default.camera`,`permissions.default.microphone`,`permissions.default.geo`,`permissions.default.desktop-notification`,`media.autoplay.default`.`permissions.default.xr`
3764
3765 #### Windows (GPO)
3766 ```
3767 Software\Policies\Mozilla\Firefox\Permissions\Camera\Allow\1 = "https://example.org"
3768 Software\Policies\Mozilla\Firefox\Permissions\Camera\Allow\2 = "https://example.org:1234"
3769 Software\Policies\Mozilla\Firefox\Permissions\Camera\Block\1 = "https://example.edu"
3770 Software\Policies\Mozilla\Firefox\Permissions\Camera\BlockNewRequests = 0x1 | 0x0
3771 Software\Policies\Mozilla\Firefox\Permissions\Camera\Locked = 0x1 | 0x0
3772 Software\Policies\Mozilla\Firefox\Permissions\Microphone\Allow\1 = "https://example.org"
3773 Software\Policies\Mozilla\Firefox\Permissions\Microphone\Block\1 = "https://example.edu"
3774 Software\Policies\Mozilla\Firefox\Permissions\Microphone\BlockNewRequests = 0x1 | 0x0
3775 Software\Policies\Mozilla\Firefox\Permissions\Microphone\Locked = 0x1 | 0x0
3776 Software\Policies\Mozilla\Firefox\Permissions\Location\Allow\1 = "https://example.org"
3777 Software\Policies\Mozilla\Firefox\Permissions\Location\Block\1 = "https://example.edu"
3778 Software\Policies\Mozilla\Firefox\Permissions\Location\BlockNewRequests = 0x1 | 0x0
3779 Software\Policies\Mozilla\Firefox\Permissions\Location\Locked = 0x1 | 0x0
3780 Software\Policies\Mozilla\Firefox\Permissions\Notifications\Allow\1 = "https://example.org"
3781 Software\Policies\Mozilla\Firefox\Permissions\Notifications\Block\1 = "https://example.edu"
3782 Software\Policies\Mozilla\Firefox\Permissions\Notifications\BlockNewRequests = 0x1 | 0x0
3783 Software\Policies\Mozilla\Firefox\Permissions\Notifications\Locked = 0x1 | 0x0
3784 Software\Policies\Mozilla\Firefox\Permissions\Autoplay\Allow\1 = "https://example.org"
3785 Software\Policies\Mozilla\Firefox\Permissions\Autoplay\Block\1 = "https://example.edu"
3786 Software\Policies\Mozilla\Firefox\Permissions\Autoplay\Default = "allow-audio-video" | "block-audio" | "block-audio-video"
3787 Software\Policies\Mozilla\Firefox\Permissions\Autoplay\Locked = 0x1 | 0x0
3788 Software\Policies\Mozilla\Firefox\Permissions\VirtualReality\Allow\1 = "https://example.org"
3789 Software\Policies\Mozilla\Firefox\Permissions\VirtualReality\Block\1 = "https://example.edu"
3790 Software\Policies\Mozilla\Firefox\Permissions\VirtualReality\BlockNewRequests = 0x1 | 0x0
3791 Software\Policies\Mozilla\Firefox\Permissions\VirtualReality\Locked = 0x1 | 0x0
3792 ```
3793 #### Windows (Intune)
3794 OMA-URI:
3795 ```
3796 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~Permissions~Location/Location_BlockNewRequests
3797 ```
3798 Value (string):
3799 ```
3800 <enabled/> or <disabled/>
3801 ```
3802 OMA-URI:
3803 ```
3804 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~Permissions~Location/Location_Locked
3805 ```
3806 Value (string):
3807 ```
3808 <enabled/> or <disabled/>
3809 ```
3810 OMA-URI:
3811 ```
3812 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~Permissions~Notifications/Notifications_Allow
3813 ```
3814 Value (string):
3815 ```
3816 <enabled/>
3817 <data id="Permissions" value="1&#xF000;https://example.org"/>
3818 ```
3819 OMA-URI:
3820 ```
3821 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~Permissions~Notifications/Notifications_BlockNewRequests
3822 ```
3823 Value (string):
3824 ```
3825 <enabled/> or <disabled/>
3826 ```
3827 OMA-URI:
3828 ```
3829 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~Permissions~Notifications/Notifications_Locked
3830 ```
3831 Value (string):
3832 ```
3833 <enabled/> or <disabled/>
3834 ```
3835 OMA-URI:
3836 ```
3837 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~Permissions~Autoplay/Autoplay_Allow
3838 ```
3839 Value (string):
3840 ```
3841 <enabled/>
3842 <data id="Permissions" value="1&#xF000;https://example.org"/>
3843 ```
3844 OMA-URI:
3845 ```
3846 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~Permissions~Autoplay/Autoplay_Block
3847 ```
3848 Value (string):
3849 ```
3850 <enabled/>
3851 <data id="Permissions" value="1&#xF000;https://example.edu"/>
3852 ```
3853 OMA-URI:
3854 ```
3855 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~Permissions~Autoplay/Autoplay_Default
3856 ```
3857 Value (string):
3858 ```
3859 <enabled/>
3860 <data id="Autoplay_Default" value="allow-audio-video | block-audio | block-audio-video"/>
3861 ```
3862 OMA-URI:
3863 ```
3864 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~Permissions~Autoplay/Autoplay_Locked
3865 ```
3866 Value (string):
3867 ```
3868 <enabled/> or <disabled/>
3869 ```
3870 OMA-URI:
3871 ```
3872 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~Permissions~Notifications/VirtualReality_Allow
3873 ```
3874 Value (string):
3875 ```
3876 <enabled/>
3877 <data id="Permissions" value="1&#xF000;https://example.org"/>
3878 ```
3879 OMA-URI:
3880 ```
3881 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~Permissions~Notifications/VirtualReality_Block
3882 ```
3883 Value (string):
3884 ```
3885 <enabled/>
3886 <data id="Permissions" value="1&#xF000;https://example.edu"/>
3887 ```
3888 OMA-URI:
3889 ```
3890 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~Permissions~Notifications/VirtualReality_BlockNewRequests
3891 ```
3892 Value (string):
3893 ```
3894 <enabled/> or <disabled/>
3895 ```
3896 OMA-URI:
3897 ```
3898 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~Permissions~Notifications/VirtualReality_Locked
3899 ```
3900 Value (string):
3901 ```
3902 <enabled/> or <disabled/>
3903 ```
3904 #### macOS
3905 ```
3906 <dict>
3907   <key>Permissions</key>
3908   <dict>
3909     <key>Camera</key>
3910     <dict>
3911       <key>Allow</key>
3912       <array>
3913         <string>https://example.org</string>
3914         <string>https://example.org:1234</string>
3915       </array>
3916       <key>Block</key>
3917       <array>
3918         <string>https://example.edu</string>
3919       </array>
3920       <key>BlockNewRequests</key>
3921       <true/> | <false/>
3922       <key>Locked</key>
3923       <true/> | <false/>
3924     </dict>
3925     <key>Microphone</key>
3926     <dict>
3927       <key>Allow</key>
3928       <array>
3929         <string>https://example.org</string>
3930       </array>
3931       <key>Block</key>
3932       <array>
3933         <string>https://example.edu</string>
3934       </array>
3935       <key>BlockNewRequests</key>
3936       <true/> | <false/>
3937       <key>Locked</key>
3938       <true/> | <false/>
3939     </dict>
3940     <key>Location</key>
3941     <dict>
3942       <key>Allow</key>
3943       <array>
3944         <string>https://example.org</string>
3945       </array>
3946       <key>Block</key>
3947       <array>
3948         <string>https://example.edu</string>
3949       </array>
3950       <key>BlockNewRequests</key>
3951       <true/> | <false/>
3952       <key>Locked</key>
3953       <true/> | <false/>
3954     </dict>
3955     <key>Notifications</key>
3956     <dict>
3957       <key>Allow</key>
3958       <array>
3959         <string>https://example.org</string>
3960       </array>
3961       <key>Block</key>
3962       <array>
3963         <string>https://example.edu</string>
3964       </array>
3965       <key>BlockNewRequests</key>
3966       <true/>
3967       <key>Locked</key>
3968       <true/>
3969     </dict>
3970     <key>Autoplay</key>
3971     <dict>
3972       <key>Allow</key>
3973       <array>
3974         <string>https://example.org</string>
3975       </array>
3976       <key>Block</key>
3977       <array>
3978         <string>https://example.edu</string>
3979       </array>
3980       <key>Default</key>
3981       <string>allow-audio-video | block-audio | block-audio-video</string>
3982       <key>Locked</key>
3983       <true/> | <false/>
3984     </dict>
3985   </dict>
3986 </dict>
3987 ```
3988 #### policies.json
3989 ```
3990 {
3991   "policies": {
3992     "Permissions": {
3993       "Camera": {
3994         "Allow": ["https://example.org","https://example.org:1234"],
3995         "Block": ["https://example.edu"],
3996         "BlockNewRequests": true | false,
3997         "Locked": true | false
3998       },
3999       "Microphone": {
4000         "Allow": ["https://example.org"],
4001         "Block": ["https://example.edu"],
4002         "BlockNewRequests": true | false,
4003         "Locked": true | false
4004       },
4005       "Location": {
4006         "Allow": ["https://example.org"],
4007         "Block": ["https://example.edu"],
4008         "BlockNewRequests": true | false,
4009         "Locked": true | false
4010       },
4011       "Notifications": {
4012         "Allow": ["https://example.org"],
4013         "Block": ["https://example.edu"],
4014         "BlockNewRequests": true | false,
4015         "Locked": true | false
4016       },
4017       "Autoplay": {
4018         "Allow": ["https://example.org"],
4019         "Block": ["https://example.edu"],
4020         "Default": "allow-audio-video" | "block-audio" | "block-audio-video",
4021         "Locked": true | false
4022       }
4023     }
4024   }
4025 }
4026 ```
4027 ### PictureInPicture
4028
4029 Enable or disable Picture-in-Picture as well as prevent the user from enabling or disabling it (Locked).
4030
4031 **Compatibility:** Firefox 78, Firefox ESR 78\
4032 **CCK2 Equivalent:** N/A\
4033 **Preferences Affected:** `media.videocontrols.picture-in-picture.video-toggle.enabled`
4034
4035 #### Windows (GPO)
4036 ```
4037 Software\Policies\Mozilla\Firefox\PictureInPicture\Enabled = 0x1 | 0x0
4038 Software\Policies\Mozilla\Firefox\PictureInPicture\Locked = 0x1 | 0x0
4039
4040 ```
4041 #### Windows (Intune)
4042 OMA-URI:
4043 ```
4044 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~PictureInPicture/PictureInPicture_Enabled
4045 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~PictureInPicture/PictureInPicture_Locked
4046 ```
4047 Value (string):
4048 ```
4049 <enabled/> or <disabled/>
4050 ```
4051 #### macOS
4052 ```
4053 <dict>
4054   <key>PictureInPicture</key>
4055   <dict>
4056     <key>Enabled</key>
4057     <true/> | <false/>
4058     <key>Locked</key>
4059     <true/> | <false/>
4060   </dict>
4061 </dict>
4062 ```
4063 #### policies.json
4064 ```
4065 {
4066   "policies": {
4067     "PictureInPicture": {
4068       "Enabled": true | false,
4069       "Locked": true | false
4070     }
4071   }
4072 }
4073 ```
4074 ### PopupBlocking
4075 Configure the default pop-up window policy as well as origins for which pop-up windows are allowed.
4076
4077 `Allow` is a list of origins where popup-windows are allowed.
4078
4079 `Default` determines whether or not pop-up windows are allowed by default.
4080
4081 `Locked` prevents the user from changing pop-up preferences.
4082
4083 **Compatibility:** Firefox 60, Firefox ESR 60\
4084 **CCK2 Equivalent:** `permissions.popup`\
4085 **Preferences Affected:** `dom.disable_open_during_load`
4086
4087 #### Windows (GPO)
4088 ```
4089 Software\Policies\Mozilla\Firefox\PopupBlocking\Allow\1 = "https://example.org"
4090 Software\Policies\Mozilla\Firefox\PopupBlocking\Allow\2 = "https://example.edu"
4091 Software\Policies\Mozilla\Firefox\PopupBlocking\Default = 0x1 | 0x0
4092 Software\Policies\Mozilla\Firefox\PopupBlocking\Locked = 0x1 | 0x0
4093 ```
4094 #### Windows (Intune)
4095 OMA-URI:
4096 ```
4097 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~Popups/PopupBlocking_Allow
4098 ```
4099 Value (string):
4100 ```
4101 <enabled/>
4102 <data id="Permissions" value="1&#xF000;https://example.org&#xF000;2&#xF000;https://example.edu"/>
4103 ```
4104 OMA-URI:
4105 ```
4106 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~Popups/PopupBlocking_Default
4107 ```
4108 Value (string):
4109 ```
4110 <enabled/> or <disabled/>
4111 ```
4112 OMA-URI:
4113 ```
4114 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~Popups/PopupBlocking_Locked
4115 ```
4116 Value (string):
4117 ```
4118 <enabled/> or <disabled/>
4119 ```
4120 #### macOS
4121 ```
4122 <dict>
4123   <key>PopupBlocking</key>
4124   <dict>
4125     <key>Allow</key>
4126     <array>
4127       <string>http://example.org</string>
4128       <string>http://example.edu</string>
4129     </array>
4130     <key>Default</key>
4131     <true/> | <false/>
4132     <key>Locked</key>
4133     <true/> | <false/>
4134   </dict>
4135 </dict>
4136 ```
4137 #### policies.json
4138 ```
4139 {
4140   "policies": {
4141     "PopupBlocking": {
4142       "Allow": ["http://example.org/",
4143                 "http://example.edu/"],
4144       "Default": true | false,
4145       "Locked": true | false
4146     }
4147   }
4148 }
4149 ```
4150 ### Preferences
4151 Set and lock preferences.
4152
4153 **NOTE** On Windows, in order to use this policy, you must clear all settings in the old **Preferences (Deprecated)** section.
4154
4155 Previously you could only set and lock a subset of preferences. Starting with Firefox 81 and Firefox ESR 78.3 you can set many more preferences. You can also set default preferences, user preferences and you can clear preferences.
4156
4157 Preferences that start with the following prefixes are supported:
4158 ```
4159 accessibility.
4160 app.update.* (Firefox 86, Firefox 78.8)
4161 browser.
4162 datareporting.policy.
4163 dom.
4164 extensions.
4165 general.autoScroll (Firefox 83, Firefox ESR 78.5)
4166 general.smoothScroll (Firefox 83, Firefox ESR 78.5)
4167 geo.
4168 gfx.
4169 intl.
4170 layers.
4171 layout.
4172 media.
4173 network.
4174 pdfjs. (Firefox 84, Firefox ESR 78.6)
4175 places.
4176 print.
4177 signon. (Firefox 83, Firefox ESR 78.5)
4178 spellchecker. (Firefox 84, Firefox ESR 78.6)
4179 ui.
4180 widget.
4181 ```
4182 as well as the following security preferences:
4183 | Preference | Type | Default
4184 | --- | --- | ---
4185 | security.default_personal_cert | string | Ask Every Time
4186 | &nbsp;&nbsp;&nbsp;&nbsp;If set to Select Automatically, Firefox automatically chooses the default personal certificate.
4187 | security.insecure_connection_text.enabled | bool | false
4188 | &nbsp;&nbsp;&nbsp;&nbsp;If set to true, adds the words "Not Secure" for insecure sites.
4189 | security.insecure_connection_text.pbmode.enabled | bool | false
4190 | &nbsp;&nbsp;&nbsp;&nbsp;If set to true, adds the words "Not Secure" for insecure sites in private browsing.
4191 | security.insecure_field_warning.contextual.enabled | bool | true
4192 | &nbsp;&nbsp;&nbsp;&nbsp;If set to false, remove the warning for inscure login fields.
4193 | security.mixed_content.block_active_content | boolean | true
4194 | &nbsp;&nbsp;&nbsp;&nbsp;If false, mixed active content (HTTP and HTTPS) is not blocked.
4195 | security.osclientcerts.autoload | boolean | false
4196 | &nbsp;&nbsp;&nbsp;&nbsp;If true, client certificates are loaded from the operating system certificate store.
4197 | security.ssl.errorReporting.enabled | boolean | true
4198 | &nbsp;&nbsp;&nbsp;&nbsp;If false, SSL errors cannot be sent to Mozilla.
4199 | security.tls.enable_0rtt_data | boolean | true
4200 | &nbsp;&nbsp;&nbsp;&nbsp;If false, TLS early data is turned off (Firefox 93, Firefox 91.2, Firefox 78.15).
4201 | security.tls.hello_downgrade_check | boolean | true
4202 | &nbsp;&nbsp;&nbsp;&nbsp;If false, the TLS 1.3 downgrade check is disabled.
4203 | security.tls.version.enable-deprecated | boolean | false
4204 | &nbsp;&nbsp;&nbsp;&nbsp;If true, browser will accept TLS 1.0. and TLS 1.1 (Firefox 86, Firefox 78.8).
4205 | security.warn_submit_secure_to_insecure | boolean | true
4206 | &nbsp;&nbsp;&nbsp;&nbsp;If false, no warning is shown when submitting s form from https to http.
4207 &nbsp;
4208
4209 Using the preference as the key, set the `Value` to the corresponding preference value.
4210
4211 `Status` can be "default", "locked", "user" or "clear"
4212
4213 Default preferences can be modified by the user.
4214
4215 If a value is locked, it is also set as the default.
4216
4217 User preferences persist across invocations of Firefox. It is the equivalent of a user setting the preference. They are most useful when a preference is needed very early in startup so it can't be set as default by policy.
4218
4219 User preferences persist even if the policy is removed, so if you need to remove them, you should use the clear policy.
4220
4221 See the examples below for more detail.
4222
4223 IMPORTANT: Make sure you're only setting a particular preference using this mechanism and not some other way.
4224
4225 Status
4226 **Compatibility:** Firefox 81, Firefox ESR 78.3\
4227 **CCK2 Equivalent:** `preferences`\
4228 **Preferences Affected:** Many
4229
4230 #### Windows (GPO)
4231 Software\Policies\Mozilla\Firefox\Preferences (REG_MULTI_SZ) =
4232 ```
4233 {
4234   "accessibility.force_disabled": {
4235     "Value": 1,
4236     "Status": "default"
4237   },
4238   "browser.cache.disk.parent_directory": {
4239     "Value": "SOME_NATIVE_PATH",
4240     "Status": "user"
4241   },
4242   "browser.tabs.warnOnClose": {
4243     "Value": false,
4244     "Status": "locked"
4245   }
4246 }
4247 ```
4248 #### Windows (Intune)
4249 OMA-URI:
4250 ```
4251 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox/Preferences
4252 ```
4253 Value (string):
4254 ```
4255 <enabled/>
4256 <data id="JSON" value='
4257 {
4258   "accessibility.force_disabled": {
4259     "Value": 1,
4260     "Status": "default"
4261   },
4262   "browser.cache.disk.parent_directory": {
4263     "Value": "SOME_NATIVE_PATH",
4264     "Status": "user"
4265   },
4266   "browser.tabs.warnOnClose": {
4267     "Value": false,
4268     "Status": "locked"
4269   }
4270 }'/>
4271 ```
4272 #### macOS
4273 ```
4274 <dict>
4275   <key>Preferences</key>
4276   <dict>
4277     <key>accessibility.force_disabled</key>
4278     <dict>
4279       <key>Value</key>
4280       <integer>1</integer>
4281       <key>Status</key>
4282       <string>default</string>
4283     </dict>
4284     <key>browser.cache.disk.parent_directory</key>
4285     <dict>
4286       <key>Value</key>
4287       <string>SOME_NATIVE_PATH</string>
4288       <key>Status</key>
4289       <string>user</string>
4290     </dict>
4291     <key>browser.tabs.warnOnClose</key>
4292     <dict>
4293       <key>Value</key>
4294       <false/>
4295       <key>Status</key>
4296       <string>locked</string>
4297     </dict>
4298   </dict>
4299 </dict>
4300 ```
4301 #### policies.json
4302 ```
4303 {
4304   "policies": {
4305     "Preferences": {
4306       "accessibility.force_disabled": {
4307         "Value": 1,
4308         "Status": "default"
4309       },
4310       "browser.cache.disk.parent_directory": {
4311         "Value": "SOME_NATIVE_PATH",
4312         "Status": "user"
4313       },
4314       "browser.tabs.warnOnClose": {
4315         "Value": false,
4316         "Status": "locked"
4317       }
4318     }
4319   }
4320 }
4321 ```
4322 ### Preferences (Deprecated)
4323 Set and lock certain preferences.
4324
4325 **Compatibility:** See below\
4326 **CCK2 Equivalent:** `preferences`\
4327 **Preferences Affected:** See below
4328
4329 | Preference | Type | Compatibility | Default
4330 | --- | --- | --- | ---
4331 | accessibility.force_disabled | integer | Firefox 70, Firefox ESR 68.2 | 0
4332 | &nbsp;&nbsp;&nbsp;&nbsp;If set to 1, platform accessibility is disabled.
4333 | app.update.auto (Deprecated - Switch to AppAutoUpdate policy) | boolean | Firefox 68, Firefox ESR 68 | true
4334 | &nbsp;&nbsp;&nbsp;&nbsp;If false, Firefox doesn't automatically install update.
4335 | browser.bookmarks.autoExportHTML | boolean | Firefox 70, Firefox ESR 68.2 | false
4336 | &nbsp;&nbsp;&nbsp;&nbsp;If true, bookmarks are exported on shutdown.
4337 | browser.bookmarks.file | string | Firefox 70, Firefox ESR 68.2 | N/A
4338 | &nbsp;&nbsp;&nbsp;&nbsp;If set, the name of the file where bookmarks are exported and imported.
4339 | browser.bookmarks.restore_default_bookmarks | boolean | Firefox 70, Firefox ESR 68.2 | N/A
4340 | &nbsp;&nbsp;&nbsp;&nbsp;If true, bookmarks are restored to their defaults.
4341 | browser.cache.disk.enable | boolean | Firefox 68, Firefox ESR 68 | true
4342 | &nbsp;&nbsp;&nbsp;&nbsp;If false, don't store cache on the hard drive.
4343 | ~browser.cache.disk.parent_directory~ | string | Firefox 68, Firefox ESR 68 | Profile temporary directory
4344 | &nbsp;&nbsp;&nbsp;&nbsp;~If set, changes the location of the disk cache.~ This policy doesn't work. It's being worked on.
4345 | browser.fixup.dns_first_for_single_words | boolean | Firefox 68, Firefox ESR 68 | false
4346 | &nbsp;&nbsp;&nbsp;&nbsp;If true, single words are sent to DNS, not directly to search.
4347 | browser.newtabpage.activity-stream.default.sites | string | Firefox 72, ESR 68.4 | Locale dependent
4348 | &nbsp;&nbsp;&nbsp;&nbsp;If set, a list of URLs to use as the default top sites on the new tab page. Due to Firefox limitations, search sites can't be added. In addition, sites with the same name but different TLDs (example.org/example.com) will not display properly.
4349 | browser.places.importBookmarksHTML | boolean | Firefox 70, Firefox ESR 68.2
4350 | &nbsp;&nbsp;&nbsp;&nbsp;If true, bookmarks are always imported on startup.
4351 | browser.safebrowsing.phishing.enabled | boolean | Firefox 70, Firefox ESR 68.2 | true
4352 | &nbsp;&nbsp;&nbsp;&nbsp;If false, phishing protection is not enabled (Not recommended)
4353 | browser.safebrowsing.malware.enabled | boolean | Firefox 70, Firefox ESR 68.2 | true
4354 | &nbsp;&nbsp;&nbsp;&nbsp;If false, malware protection is not enabled (Not recommended)
4355 | browser.search.update | boolean | Firefox 68, Firefox ESR 68 | true
4356 | &nbsp;&nbsp;&nbsp;&nbsp;If false, updates for search engines are not checked.
4357 | browser.slowStartup.notificationDisabled | boolean | Firefox 70, Firefox ESR 68.2 | false
4358 | &nbsp;&nbsp;&nbsp;&nbsp;If true, a notification isn't shown if startup is slow.
4359 | browser.tabs.warnOnClose | boolean | Firefox 68, Firefox ESR 68 | true
4360 | &nbsp;&nbsp;&nbsp;&nbsp;If false, there is no warning when the browser is closed.
4361 | browser.taskbar.previews.enable | boolean | Firefox 70, Firefox ESR 68.2 (Windows only) | false
4362 | &nbsp;&nbsp;&nbsp;&nbsp;If true, tab previews are shown in the Windows taskbar.
4363 | browser.urlbar.suggest.bookmark | boolean | Firefox 68, Firefox ESR 68 | true
4364 | &nbsp;&nbsp;&nbsp;&nbsp;If false, bookmarks aren't suggested when typing in the URL bar.
4365 | browser.urlbar.suggest.history | boolean | Firefox 68, Firefox ESR 68 | true
4366 | &nbsp;&nbsp;&nbsp;&nbsp;If false, history isn't suggested when typing in the URL bar.
4367 | browser.urlbar.suggest.openpage | boolean | Firefox 68, Firefox ESR 68 | true
4368 | &nbsp;&nbsp;&nbsp;&nbsp;If false, open tabs aren't suggested when typing in the URL bar.
4369 | datareporting.policy.dataSubmissionPolicyBypassNotification | boolean | Firefox 68, Firefox ESR 68 | false
4370 | &nbsp;&nbsp;&nbsp;&nbsp;If true, don't show the privacy policy tab on first run.
4371 | dom.allow_scripts_to_close_windows | boolean | Firefox 70, Firefox ESR 68.2 | false
4372 | &nbsp;&nbsp;&nbsp;&nbsp;If false, web page can close windows.
4373 | dom.disable_window_flip | boolean | Firefox 68, Firefox ESR 68 | true
4374 | &nbsp;&nbsp;&nbsp;&nbsp;If false, web pages can focus and activate windows.
4375 | dom.disable_window_move_resize | boolean | Firefox 68, Firefox ESR 68 | false
4376 | &nbsp;&nbsp;&nbsp;&nbsp;If true, web pages can't move or resize windows.
4377 | dom.event.contextmenu.enabled | boolean | Firefox 68, Firefox ESR 68 | true
4378 | &nbsp;&nbsp;&nbsp;&nbsp;If false, web pages can't override context menus.
4379 | dom.keyboardevent.keypress.hack.dispatch_non_printable_keys.addl | string | Firefox 68, Firefox ESR 68 | N/A
4380 | &nbsp;&nbsp;&nbsp;&nbsp;See https://support.mozilla.org/en-US/kb/dom-events-changes-introduced-firefox-66
4381 | dom.keyboardevent.keypress.hack.use_legacy_keycode_and_charcode.addl | string | Firefox 68, Firefox ESR 68 | N/A
4382 | &nbsp;&nbsp;&nbsp;&nbsp;See https://support.mozilla.org/en-US/kb/dom-events-changes-introduced-firefox-66
4383 | dom.xmldocument.load.enabled | boolean | Firefox ESR 68.5 | true.
4384 | &nbsp;&nbsp;&nbsp;&nbsp;If false, XMLDocument.load is not available.
4385 | dom.xmldocument.async.enabled | boolean | Firefox ESR 68.5 | true
4386 | &nbsp;&nbsp;&nbsp;&nbsp;If false, XMLDocument.async is not available.
4387 | extensions.blocklist.enabled | boolean | Firefox 70, Firefox ESR 68.2 | true
4388 | &nbsp;&nbsp;&nbsp;&nbsp;If false, the extensions blocklist is not used (Not recommended)
4389 | extensions.getAddons.showPane | boolean | Firefox 68, Firefox ESR 68 | N/A
4390 | &nbsp;&nbsp;&nbsp;&nbsp;If false, the Recommendations tab is not displayed in the Add-ons Manager.
4391 | extensions.htmlaboutaddons.recommendations.enabled | boolean | Firefox 72, Firefox ESR 68.4 | true
4392 | &nbsp;&nbsp;&nbsp;&nbsp;If false, recommendations are not shown on the Extensions tab in the Add-ons Manager.
4393 | geo.enabled | boolean | Firefox 70, Firefox ESR 68.2 | true
4394 | &nbsp;&nbsp;&nbsp;&nbsp;If false, the geolocation API is disabled. | Language dependent
4395 | intl.accept_languages | string | Firefox 70, Firefox ESR 68.2
4396 | &nbsp;&nbsp;&nbsp;&nbsp;If set, preferred language for web pages.
4397 | media.eme.enabled (Deprecated - Switch to EncryptedMediaExtensions policy) | boolean | Firefox 70, Firefox ESR 68.2 | true
4398 | &nbsp;&nbsp;&nbsp;&nbsp;If false, Encrypted Media Extensions are not enabled.
4399 | media.gmp-gmpopenh264.enabled | boolean | Firefox 68, Firefox ESR 68 | true
4400 | &nbsp;&nbsp;&nbsp;&nbsp;If false, the OpenH264  plugin is not downloaded.
4401 | media.gmp-widevinecdm.enabled | boolean | Firefox 68, Firefox ESR 68 | true
4402 | &nbsp;&nbsp;&nbsp;&nbsp;If false, the Widevine plugin is not downloaded.
4403 | media.peerconnection.enabled | boolean | Firefox 72, Firefox ESR 68.4 | true
4404 | &nbsp;&nbsp;&nbsp;&nbsp;If false, WebRTC is disabled
4405 | media.peerconnection.ice.obfuscate_host_addresses.whitelist (Deprecated) | string | Firefox 72, Firefox ESR 68.4 | N/A
4406 | &nbsp;&nbsp;&nbsp;&nbsp;If set, a list of domains for which mDNS hostname obfuscation is
4407 disabled
4408 | media.peerconnection.ice.obfuscate_host_addresses.blocklist | string | Firefox 79, Firefox ESR 78.1 | N/A
4409 | &nbsp;&nbsp;&nbsp;&nbsp;If set, a list of domains for which mDNS hostname obfuscation is
4410 disabled
4411 | network.dns.disableIPv6 | boolean | Firefox 68, Firefox ESR 68 | false
4412 | &nbsp;&nbsp;&nbsp;&nbsp;If true, IPv6 DNS lokoups are disabled.
4413 | network.IDN_show_punycode | boolean | Firefox 68, Firefox ESR 68 | false
4414 | &nbsp;&nbsp;&nbsp;&nbsp;If true, display the punycode version of internationalized domain names.
4415 | places.history.enabled | boolean | Firefox 68, Firefox ESR 68 | true
4416 | &nbsp;&nbsp;&nbsp;&nbsp;If false, history is not enabled.
4417 | print.save_print_settings | boolean | Firefox 70, Firefox ESR 68.2 | true
4418 | &nbsp;&nbsp;&nbsp;&nbsp;If false, print settings are not saved between jobs.
4419 | security.default_personal_cert | string | Firefox 68, Firefox ESR 68 | Ask Every Time
4420 | &nbsp;&nbsp;&nbsp;&nbsp;If set to Select Automatically, Firefox automatically chooses the default personal certificate.
4421 | security.mixed_content.block_active_content | boolean | Firefox 70, Firefox ESR 68.2 | true
4422 | &nbsp;&nbsp;&nbsp;&nbsp;If false, mixed active content (HTTP and HTTPS) is not blocked.
4423 | security.osclientcerts.autoload | boolean | Firefox 72 (Windows), Firefox 75 (macOS)  | false
4424 | &nbsp;&nbsp;&nbsp;&nbsp;If true, client certificates are loaded from the operating system certificate store.
4425 | security.ssl.errorReporting.enabled | boolean | Firefox 68, Firefox ESR 68 | true
4426 | &nbsp;&nbsp;&nbsp;&nbsp;If false, SSL errors cannot be sent to Mozilla.
4427 | security.tls.hello_downgrade_check | boolean | Firefox 72, Firefox ESR 68.4 | true
4428 | &nbsp;&nbsp;&nbsp;&nbsp;If false, the TLS 1.3 downgrade check is disabled.
4429 | ui.key.menuAccessKeyFocuses | boolean | Firefox 68, Firefox ESR 68 | true
4430 | &nbsp;&nbsp;&nbsp;&nbsp;If false, the Alt key doesn't show the menubar on Windows.
4431 | widget.content.gtk-theme-override | string | Firefox 72, Firefox ESR 68.4 (Linux only) | N/A
4432 | &nbsp;&nbsp;&nbsp;&nbsp;If set, overrides the GTK theme for widgets.
4433 #### Windows (GPO)
4434 ```
4435 Software\Policies\Mozilla\Firefox\Preferences\boolean_preference_name = 0x1 | 0x0
4436 Software\Policies\Mozilla\Firefox\Preferences\string_preference_name = "string_value"
4437 ```
4438 #### Windows (Intune)
4439 OMA-URI: (periods are replaced by underscores)
4440 ```
4441 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~Preferences/boolean_preference_name
4442 ```
4443 Value (string):
4444 ```
4445 <enabled/> or <disabled/>
4446 ```
4447 OMA-URI: (periods are replaced by underscores)
4448 ```
4449 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~Preferences/string_preference_name
4450 ```
4451 Value (string):
4452 ```
4453 <enabled/>
4454 <data id="Preferences_String" value="string_value"/>
4455 ```
4456 #### macOS
4457 ```
4458 <dict>
4459   <key>Preferences</key>
4460   <dict>
4461     <key>boolean_preference_name</key>
4462     <true/> | <false/>
4463     <key>string_preference_name</key>
4464     <string>string_value</string>
4465   </dict>
4466 </dict>
4467 ```
4468 #### policies.json
4469 ```
4470 {
4471   "policies": {
4472     "Preferences": {
4473       "boolean_preference_name": true | false,
4474       "string_preference_name": "string_value"
4475     }
4476   }
4477 }
4478 ```
4479 ### PromptForDownloadLocation
4480 Ask where to save each file before downloading.
4481
4482 **Compatibility:** Firefox 68, Firefox ESR 68\
4483 **CCK2 Equivalent:** N/A\
4484 **Preferences Affected:** `browser.download.useDownloadDir`
4485
4486 #### Windows (GPO)
4487 ```
4488 Software\Policies\Mozilla\Firefox\PromptForDownloadLocation = 0x1 | 0x0
4489 ```
4490 #### Windows (Intune)
4491 OMA-URI:
4492 ```
4493 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox/PromptForDownloadLocation
4494 ```
4495 Value (string):
4496 ```
4497 <enabled/> or <disabled/>
4498 ```
4499 #### macOS
4500 ```
4501 <dict>
4502   <key>PromptForDownloadLocation</key>
4503   <true/> | <false/>
4504 </dict>
4505 ```
4506 #### policies.json
4507 ```
4508 {
4509   "policies": {
4510     "PromptForDownloadLocation": true | false
4511   }
4512 }
4513 ```
4514 ### Proxy
4515 Configure proxy settings. These settings correspond to the connection settings in Firefox preferences.
4516 To specify ports, append them to the hostnames with a colon (:).
4517
4518 `Mode` is the proxy method being used.
4519
4520 `Locked` is whether or not proxy settings can be changed.
4521
4522 `HTTPProxy` is the HTTP proxy server.
4523
4524 `UseHTTPProxyForAllProtocols` is whether or not the HTTP proxy should be used for all other proxies.
4525
4526 `SSLProxy` is the SSL proxy server.
4527
4528 `FTPProxy` is the FTP proxy server.
4529
4530 `SOCKSProxy` is the SOCKS proxy server
4531
4532 `SOCKSVersion` is the SOCKS version (4 or 5)
4533
4534 `Passthrough` is list of hostnames or IP addresses that will not be proxied. Use `<local>` to bypass proxying for all hostnames which do not contain periods.
4535
4536 `AutoConfigURL` is a  URL for proxy configuration (only used if Mode is autoConfig).
4537
4538 `AutoLogin` means do not prompt for authentication if password is saved.
4539
4540 `UseProxyForDNS` to use proxy DNS when using SOCKS v5.
4541
4542 **Compatibility:** Firefox 60, Firefox ESR 60\
4543 **CCK2 Equivalent:** `networkProxy*`\
4544 **Preferences Affected:** `network.proxy.type`,`network.proxy.autoconfig_url`,`network.proxy.socks_remote_dns`,`signon.autologin.proxy`,`network.proxy.socks_version`,`network.proxy.no_proxies_on`,`network.proxy.share_proxy_settings`,`network.proxy.http`,`network.proxy.http_port`,`network.proxy.ftp`,`network.proxy.ftp_port`,`network.proxy.ssl`,`network.proxy.ssl_port`,`network.proxy.socks`,`network.proxy.socks_port`
4545
4546 #### Windows (GPO)
4547 ```
4548 Software\Policies\Mozilla\Firefox\Proxy\Mode = "none" | "system" | "manual" | "autoDetect" | "autoConfig"
4549 Software\Policies\Mozilla\Firefox\Proxy\Locked = 0x1 | 0x0
4550 Software\Policies\Mozilla\Firefox\=Proxy\HTTPProxy = https://httpproxy.example.com
4551 Software\Policies\Mozilla\Firefox\Proxy\UseHTTPProxyForAllProtocols = 0x1 | 0x0
4552 Software\Policies\Mozilla\Firefox\Proxy\SSLProxy = https://sslproxy.example.com
4553 Software\Policies\Mozilla\Firefox\Proxy\FTPProxy = https://ftpproxy.example.com
4554 Software\Policies\Mozilla\Firefox\Proxy\SOCKSProxy = https://socksproxy.example.com
4555 Software\Policies\Mozilla\Firefox\Proxy\SOCKSVersion = 0x4 | 0x5
4556 Software\Policies\Mozilla\Firefox\Proxy\Passthrough = <local>
4557 Software\Policies\Mozilla\Firefox\Proxy\AutoConfigURL = URL_TO_AUTOCONFIG
4558 Software\Policies\Mozilla\Firefox\Proxy\AutoLogin = 0x1 | 0x0
4559 Software\Policies\Mozilla\Firefox\Proxy\UseProxyForDNS = 0x1 | 0x0
4560 ```
4561 #### Windows (Intune)
4562 OMA-URI:
4563 ```
4564 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox/Proxy
4565 ```
4566 Value (string):
4567 ```
4568 <enabled/>
4569 <data id="ProxyLocked" value="true | false"/>
4570 <data id="ConnectionType" value="none | system | manual | autoDetect | autoConfig"/>
4571 <data id="HTTPProxy" value="https://httpproxy.example.com"/>
4572 <data id="UseHTTPProxyForAllProtocols" value="true | false"/>
4573 <data id="SSLProxy" value="https://sslproxy.example.com"/>
4574 <data id="FTPProxy" value="https://ftpproxy.example.com"/>
4575 <data id="SOCKSProxy" value="https://socksproxy.example.com"/>
4576 <data id="SOCKSVersion" value="4 | 5"/>
4577 <data id="AutoConfigURL" value="URL_TO_AUTOCONFIG"/>
4578 <data id="Passthrough" value="<local>"/>
4579 <data id="AutoLogin" value="true | false"/>
4580 <data id="UseProxyForDNS" value="true | false"/>
4581 ```
4582 #### macOS
4583 ```
4584 <dict>
4585   <key>Proxy</key>
4586   <dict>
4587     <key>Mode</key>
4588     <string>none | system | manual | autoDetect | autoConfig</string>
4589     <key>Locked</key>
4590     <true> | </false>
4591     <key>HTTPProxy</key>
4592     <string>https://httpproxy.example.com</string>
4593     <key>UseHTTPProxyForAllProtocols</key>
4594     <true> | </false>
4595     <key>SSLProxy</key>
4596     <string>https://sslproxy.example.com</string>
4597     <key>FTPProxy</key>
4598     <string>https://ftpproxy.example.com</string>
4599     <key>SOCKSProxy</key>
4600     <string>https://socksproxy.example.com</string>
4601     <key>SOCKSVersion</key>
4602     <string>4 | 5</string>
4603     <key>Passthrough</key>
4604     <string>&lt;local>&gt;</string>
4605     <key>AutoConfigURL</key>
4606     <string>URL_TO_AUTOCONFIG</string>
4607     <key>AutoLogin</key>
4608     <true> | </false>
4609     <key>UseProxyForDNS</key>
4610     <true> | </false>
4611   </dict>
4612 </dict>
4613 ```
4614 #### policies.json
4615 ```
4616 {
4617   "policies": {
4618     "Proxy": {
4619       "Mode": "none" | "system" | "manual" | "autoDetect" | "autoConfig",
4620       "Locked": true | false,
4621       "HTTPProxy": "hostname",
4622       "UseHTTPProxyForAllProtocols": true | false,
4623       "SSLProxy": "hostname",
4624       "FTPProxy": "hostname",
4625       "SOCKSProxy": "hostname",
4626       "SOCKSVersion": 4 | 5,
4627       "Passthrough": "<local>",
4628       "AutoConfigURL": "URL_TO_AUTOCONFIG",
4629       "AutoLogin": true | false,
4630       "UseProxyForDNS": true | false
4631     }
4632   }
4633 }
4634 ```
4635 ### RequestedLocales
4636 Set the the list of requested locales for the application in order of preference. It will cause the corresponding language pack to become active.
4637
4638 Note: For Firefox 68, this can now be a string so that you can specify an empty value.
4639
4640 **Compatibility:** Firefox 64, Firefox ESR 60.4, Updated in Firefox 68, Firefox ESR 68\
4641 **CCK2 Equivalent:** N/A\
4642 **Preferences Affected:** N/A
4643 #### Windows (GPO)
4644 ```
4645 Software\Policies\Mozilla\Firefox\RequestedLocales\1 = "de"
4646 Software\Policies\Mozilla\Firefox\RequestedLocales\2 = "en-US"
4647
4648 or
4649
4650 Software\Policies\Mozilla\Firefox\RequestedLocales = "de,en-US"
4651 ```
4652 #### Windows (Intune)
4653 OMA-URI:
4654 ```
4655 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox/RequestedLocalesString
4656 ```
4657 Value (string):
4658 ```
4659 <enabled/>
4660 <data id="Preferences_String" value="de,en-US"/>
4661 ```
4662 #### macOS
4663 ```
4664 <dict>
4665   <key>RequestedLocales</key>
4666   <array>
4667     <string>de</string>
4668     <string>en-US</string>
4669   </array>
4670 </dict>
4671
4672 or
4673
4674 <dict>
4675   <key>RequestedLocales</key>
4676   <string>de,en-US</string>
4677 </dict>
4678
4679 ```
4680 #### policies.json
4681 ```
4682 {
4683   "policies": {
4684     "RequestedLocales": ["de", "en-US"]
4685   }
4686 }
4687
4688 or
4689
4690 {
4691   "policies": {
4692     "RequestedLocales": "de,en-US"
4693   }
4694 }
4695 ```
4696 <a name="SanitizeOnShutdown"></a>
4697
4698 ### SanitizeOnShutdown (Selective)
4699 Clear data on shutdown. Choose from Cache, Cookies, Download History, Form & Search History, Browsing History, Active Logins, Site Preferences and Offline Website Data.
4700
4701 Previously, these values were always locked. Starting with Firefox 74 and Firefox ESR 68.6, you can use the `Locked` option to either keep the values unlocked (set it to false), or lock only the values you set (set it to true). If you want the old behavior of locking everything, do not set `Locked` at all.
4702
4703 **Compatibility:** Firefox 68, Firefox ESR 68 (Locked added in 74/68.6)\
4704 **CCK2 Equivalent:** N/A\
4705 **Preferences Affected:** `privacy.sanitize.sanitizeOnShutdown`,`privacy.clearOnShutdown.cache`,`privacy.clearOnShutdown.cookies`,`privacy.clearOnShutdown.downloads`,`privacy.clearOnShutdown.formdata`,`privacy.clearOnShutdown.history`,`privacy.clearOnShutdown.sessions`,`privacy.clearOnShutdown.siteSettings`,`privacy.clearOnShutdown.offlineApps`
4706 #### Windows (GPO)
4707 ```
4708 Software\Policies\Mozilla\Firefox\SanitizeOnShutdown\Cache = 0x1 | 0x0
4709 Software\Policies\Mozilla\Firefox\SanitizeOnShutdown\Cookies = 0x1 | 0x0
4710 Software\Policies\Mozilla\Firefox\SanitizeOnShutdown\Downloads = 0x1 | 0x0
4711 Software\Policies\Mozilla\Firefox\SanitizeOnShutdown\FormData = 0x1 | 0x0
4712 Software\Policies\Mozilla\Firefox\SanitizeOnShutdown\History = 0x1 | 0x0
4713 Software\Policies\Mozilla\Firefox\SanitizeOnShutdown\Sessions = 0x1 | 0x0
4714 Software\Policies\Mozilla\Firefox\SanitizeOnShutdown\SiteSettings = 0x1 | 0x0
4715 Software\Policies\Mozilla\Firefox\SanitizeOnShutdown\OfflineApps = 0x1 | 0x0
4716 Software\Policies\Mozilla\Firefox\SanitizeOnShutdown\Locked = 0x1 | 0x0
4717 ```
4718 #### Windows (Intune)
4719 OMA-URI:
4720 ```
4721 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~SanitizeOnShutdown/A_SanitizeOnShutdown_Cache
4722 ```
4723 Value (string):
4724 ```
4725 <enabled/> or <disabled/>
4726 ```
4727 OMA-URI:
4728 ```
4729 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~SanitizeOnShutdown/B_SanitizeOnShutdown_Cookies
4730 ```
4731 Value (string):
4732 ```
4733 <enabled/> or <disabled/>
4734 ```
4735 OMA-URI:
4736 ```
4737 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~SanitizeOnShutdown/C_SanitizeOnShutdown_Downloads
4738 ```
4739 Value (string):
4740 ```
4741 <enabled/> or <disabled/>
4742 ```
4743 OMA-URI:
4744 ```
4745 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~SanitizeOnShutdown/D_SanitizeOnShutdown_FormData
4746 ```
4747 Value (string):
4748 ```
4749 <enabled/> or <disabled/>
4750 ```
4751 OMA-URI:
4752 ```
4753 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~SanitizeOnShutdown/E_SanitizeOnShutdown_History
4754 ```
4755 Value (string):
4756 ```
4757 <enabled/> or <disabled/>
4758 ```
4759 OMA-URI:
4760 ```
4761 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~SanitizeOnShutdown/F_SanitizeOnShutdown_Sessions
4762 ```
4763 Value (string):
4764 ```
4765 <enabled/> or <disabled/>
4766 ```
4767 OMA-URI:
4768 ```
4769 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~SanitizeOnShutdown/G_SanitizeOnShutdown_SiteSettings
4770 ```
4771 Value (string):
4772 ```
4773 <enabled/> or <disabled/>
4774 ```
4775 OMA-URI:
4776 ```
4777 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~SanitizeOnShutdown/H_SanitizeOnShutdown_OfflineApps
4778 ```
4779 Value (string):
4780 ```
4781 <enabled/> or <disabled/>
4782 ```
4783 OMA-URI:
4784 ```
4785 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~SanitizeOnShutdown/I_SanitizeOnShutdown_Locked
4786 ```
4787 Value (string):
4788 ```
4789 <enabled/> or <disabled/>
4790 ```
4791 #### macOS
4792 ```
4793 <dict>
4794   <key>SanitizeOnShutdown</key>
4795   <dict>
4796     <key>Cache</key>
4797     <true/> | <false/>
4798     <key>Cookies</key>
4799     <true/> | <false/>
4800     <key>Downloads</key>
4801     <true/> | <false/>
4802     <key>FormData</key>
4803     <true/> | <false/>
4804     <key>History</key>
4805     <true/> | <false/>
4806     <key>Sessions</key>
4807     <true/> | <false/>
4808     <key>SiteSettings</key>
4809     <true/> | <false/>
4810     <key>OfflineApps</key>
4811     <true/> | <false/>
4812     <key>Locked</key>
4813     <true/> | <false/>
4814   </dict>
4815 </dict>
4816 ```
4817 #### policies.json
4818 ```
4819 {
4820   "policies": {
4821     "SanitizeOnShutdown": {
4822       "Cache": true | false,
4823       "Cookies": true | false,
4824       "Downloads": true | false,
4825       "FormData": true | false,
4826       "History": true | false,
4827       "Sessions": true | false,
4828       "SiteSettings": true | false,
4829       "OfflineApps": true | false,
4830       "Locked": true | false
4831     }
4832   }
4833 }
4834 ```
4835 ### SanitizeOnShutdown (All)
4836 Clear all data on shutdown, including Browsing & Download History, Cookies, Active Logins, Cache, Form & Search History, Site Preferences and Offline Website Data.
4837
4838 **Compatibility:** Firefox 60, Firefox ESR 60\
4839 **CCK2 Equivalent:** N/A\
4840 **Preferences Affected:** `privacy.sanitize.sanitizeOnShutdown`,`privacy.clearOnShutdown.cache`,`privacy.clearOnShutdown.cookies`,`privacy.clearOnShutdown.downloads`,`privacy.clearOnShutdown.formdata`,`privacy.clearOnShutdown.history`,`privacy.clearOnShutdown.sessions`,`privacy.clearOnShutdown.siteSettings`,`privacy.clearOnShutdown.offlineApps`
4841 #### Windows (GPO)
4842 ```
4843 Software\Policies\Mozilla\Firefox\SanitizeOnShutdown = 0x1 | 0x0
4844 ```
4845 #### Windows (Intune)
4846 OMA-URI:
4847 ```
4848 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox/C_SanitizeOnShutdown
4849 ```
4850 Value (string):
4851 ```
4852 <enabled/> or <disabled/>
4853 ```
4854 #### macOS
4855 ```
4856 <dict>
4857   <key>SanitizeOnShutdown</key>
4858   <true/> | <false/>
4859 </dict>
4860 ```
4861 #### policies.json
4862 ```
4863 {
4864   "policies": {
4865     "SanitizeOnShutdown": true | false
4866   }
4867 }
4868 ```
4869 ### SearchBar
4870 Set whether or not search bar is displayed.
4871
4872 **Compatibility:** Firefox 60, Firefox ESR 60\
4873 **CCK2 Equivalent:** `showSearchBar`\
4874 **Preferences Affected:** N/A
4875
4876 #### Windows (GPO)
4877 ```
4878 Software\Policies\Mozilla\Firefox\SearchBar = "unified" | "separate"
4879 ```
4880
4881 #### Windows (Intune)
4882 OMA-URI:
4883 ```
4884 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox/SearchBar
4885 ```
4886 Value (string):
4887 ```
4888 <enabled/>
4889 <data id="SearchBar" value="unified | separate"/>
4890 ```
4891 #### macOS
4892 ```
4893 <dict>
4894   <key>SearchBar</key>
4895   <string>unified | separate</string>
4896 </dict>
4897 ```
4898 #### policies.json
4899 ```
4900 {
4901   "policies": {
4902     "SearchBar": "unified" | "separate"
4903   }
4904 }
4905 ```
4906 <a name="SearchEngines"></a>
4907
4908 ### SearchEngines (This policy is only available on the ESR.)
4909
4910 ### SearchEngines | Default
4911
4912 Set the default search engine. This policy is only available on the ESR.
4913
4914 **Compatibility:** Firefox ESR 60\
4915 **CCK2 Equivalent:** `defaultSearchEngine`\
4916 **Preferences Affected:** N/A
4917
4918 #### Windows (GPO)
4919 ```
4920 Software\Policies\Mozilla\Firefox\SearchEngines\Default = NAME_OF_SEARCH_ENGINE
4921 ```
4922 #### Windows (Intune)
4923 OMA-URI:
4924 ```
4925 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~Search/SearchEngines_Default
4926 ```
4927 Value (string):
4928 ```
4929 <enabled/>
4930 <data id="SearchEngines_Default" value="NAME_OF_SEARCH_ENGINE"/>
4931 ```
4932 #### macOS
4933 ```
4934 <dict>
4935   <key>SearchEngines</key>
4936   <dict>
4937     <key>Default</key>
4938     <string>NAME_OF_SEARCH_ENGINE</string>
4939   </dict>
4940 </dict>
4941 ```
4942 #### policies.json
4943 ```
4944 {
4945   "policies": {
4946     "SearchEngines": {
4947       "Default": "NAME_OF_SEARCH_ENGINE"
4948     }
4949   }
4950 }
4951 ```
4952 ### SearchEngines | PreventInstalls
4953
4954 Prevent installing search engines from webpages.
4955
4956 **Compatibility:** Firefox ESR 60\
4957 **CCK2 Equivalent:** `disableSearchEngineInstall`\
4958 **Preferences Affected:** N/A
4959
4960 #### Windows (GPO)
4961 ```
4962 Software\Policies\Mozilla\Firefox\SearchEngines\PreventInstalls = 0x1 | 0x0
4963 ```
4964 #### Windows (Intune)
4965 OMA-URI:
4966 ```
4967 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~Search/SearchEngines_PreventInstalls
4968 ```
4969 Value (string):
4970 ```
4971 <enabled/> or <disabled/>
4972 ```
4973 #### macOS
4974 ```
4975 <dict>
4976   <key>SearchEngines</key>
4977   <dict>
4978     <key>PreventInstalls</key>
4979     <true/> | <false/>
4980   </dict>
4981 </dict>
4982 ```
4983 #### policies.json
4984 ```
4985 {
4986   "policies": {
4987     "SearchEngines": {
4988       "PreventInstalls": true | false
4989     }
4990   }
4991 }
4992 ```
4993 ### SearchEngines | Remove
4994
4995 Hide built-in search engines. This policy is only available on the ESR.
4996
4997 **Compatibility:** Firefox ESR 60.2\
4998 **CCK2 Equivalent:** `removeDefaultSearchEngines` (removed all built-in engines)\
4999 **Preferences Affected:** N/A
5000
5001 #### Windows (GPO)
5002 ```
5003 Software\Policies\Mozilla\Firefox\SearchEngines\Remove\1 = NAME_OF_SEARCH_ENGINE
5004 ```
5005 #### Windows (Intune)
5006 OMA-URI:
5007 ```
5008 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~Search/SearchEngines_Remove
5009 ```
5010 Value (string):
5011 ```
5012 <enabled/>
5013 <data id="SearchEngines_Remove" value="1&#xF000;NAME_OF_SEARCH_ENGINE"/>
5014 ```
5015 #### macOS
5016 ```
5017 <dict>
5018   <key>SearchEngines</key>
5019   <dict>
5020     <key>Remove</key>
5021     <array>
5022       <string>NAME_OF_SEARCH_ENGINE</string>
5023     </array>
5024   </dict>
5025 </dict>
5026 ```
5027 #### policies.json
5028 ```
5029 {
5030   "policies": {
5031     "SearchEngines": {
5032       "Remove": ["NAME_OF_SEARCH_ENGINE"]
5033     }
5034   }
5035 }
5036 ```
5037 ### SearchEngines | Add
5038
5039 Add new search engines (up to five). This policy is only available on the ESR. `Name` and `URLTemplate` are required.
5040
5041 `Name` is the name of the search engine.
5042
5043 `URLTemplate` is the search URL with {searchTerms} to substitute for the search term.
5044
5045 `Method` is either GET or POST
5046
5047 `IconURL` is a URL for the icon to use.
5048
5049 `Alias` is a keyword to use for the engine.
5050
5051 `Description` is a description of the search engine.
5052
5053 `PostData` is the POST data as name value pairs separated by &.
5054
5055 `SuggestURLTemplate` is a search suggestions URL with {searchTerms} to substitute for the search term.
5056
5057 `Encoding` is the query charset for the engine. It defaults to UTF-8.
5058
5059 **Compatibility:** Firefox ESR 60 (POST support in Firefox ESR 68, Encoding support in Firefox 91)\
5060 **CCK2 Equivalent:** `searchplugins`\
5061 **Preferences Affected:** N/A
5062
5063 #### Windows (GPO)
5064 ```
5065 Software\Policies\Mozilla\Firefox\SearchEngines\Add\1\Name = "Example1"
5066 Software\Policies\Mozilla\Firefox\SearchEngines\Add\1\URLTemplate = "https://www.example.org/q={searchTerms}"
5067 Software\Policies\Mozilla\Firefox\SearchEngines\Add\1\Method = "GET" | "POST"
5068 Software\Policies\Mozilla\Firefox\SearchEngines\Add\1\IconURL = "https://www.example.org/favicon.ico"
5069 Software\Policies\Mozilla\Firefox\SearchEngines\Add\1\Alias = "example"
5070 Software\Policies\Mozilla\Firefox\SearchEngines\Add\1\Description = "Example Description"
5071 Software\Policies\Mozilla\Firefox\SearchEngines\Add\1\SuggestURLTemplate = "https://www.example.org/suggestions/q={searchTerms}"
5072 Software\Policies\Mozilla\Firefox\SearchEngines\Add\1\PostData = "name=value&q={searchTerms}"
5073 ```
5074 #### Windows (Intune)
5075 OMA-URI:
5076 ```
5077 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~Search/SearchEngines_1
5078 ```
5079 Value (string):
5080 ```
5081 <enabled/>
5082 <data id="SearchEngine_Name" value="Example1"/>
5083 <data id="SearchEngine_URLTemplate" value="https://www.example.org/q={searchTerms"/>
5084 <data id="SearchEngine_Method" value="GET | POST"/>
5085 <data id="SearchEngine_IconURL" value="https://www.example.org/favicon.ico"/>
5086 <data id="SearchEngine_Alias" value="example"/>
5087 <data id="SearchEngine_Description" value="Example Description"/>
5088 <data id="SearchEngine_SuggestURLTemplate" value="https://www.example.org/suggestions/q={searchTerms}"/>
5089 <data id="SearchEngine_PostData" value="name=value&amp;q={searchTerms}"/>
5090 ```
5091 #### macOS
5092 ```
5093 <dict>
5094   <key>SearchEngines</key>
5095   <dict>
5096     <key>Add</key>
5097     <array>
5098       <dict>
5099         <key>Name</key>
5100         <string>Example1</string>
5101         <key>URLTemplate</key>
5102         <string>https://www.example.org/q={searchTerms}</string>
5103         <key>Method</key>
5104         <string>GET | POST </string>
5105         <key>IconURL</key>
5106         <string>https://www.example.org/favicon.ico</string>
5107         <key>Alias</key>
5108         <string>example</string>
5109         <key>Description</key>
5110         <string>Example Description</string>
5111         <key>SuggestURLTemplate</key>
5112         <string>https://www.example.org/suggestions/q={searchTerms}</string>
5113         <key>PostData</key>
5114         <string>name=value&q={searchTerms}</string>
5115       </dict>
5116     <array>
5117   </dict>
5118 </dict>
5119 ```
5120 #### policies.json
5121 ```
5122 {
5123   "policies": {
5124     "SearchEngines": {
5125       "Add": [
5126         {
5127           "Name": "Example1",
5128           "URLTemplate": "https://www.example.org/q={searchTerms}",
5129           "Method": "GET" | "POST",
5130           "IconURL": "https://www.example.org/favicon.ico",
5131           "Alias": "example",
5132           "Description": "Description",
5133           "PostData": "name=value&q={searchTerms}",
5134           "SuggestURLTemplate": "https://www.example.org/suggestions/q={searchTerms}"
5135         }
5136       ]
5137     }
5138   }
5139 }
5140 ```
5141 ### SearchSuggestEnabled
5142
5143 Enable search suggestions.
5144
5145 **Compatibility:** Firefox 68, Firefox ESR 68\
5146 **CCK2 Equivalent:** N/A\
5147 **Preferences Affected:** `browser.urlbar.suggest.searches`,`browser.search.suggest.enabled`
5148
5149 #### Windows (GPO)
5150 ```
5151 Software\Policies\Mozilla\Firefox\SearchSuggestEnabled = 0x1 | 0x0
5152 ```
5153 #### Windows (Intune)
5154 OMA-URI:
5155 ```
5156 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~Search/SearchSuggestEnabled
5157 ```
5158 Value (string):
5159 ```
5160 <enabled/> or <disabled/>
5161 ```
5162 #### macOS
5163 ```
5164 <dict>
5165   <key>SearchSuggestEnabled</key>
5166   <true/> | <false/>
5167 </dict>
5168 ```
5169 #### policies.json
5170 ```
5171 {
5172   "policies": {
5173     "SearchSuggestEnabled": true | false
5174   }
5175 }
5176 ```
5177 ### SecurityDevices
5178
5179 Install PKCS #11 modules.
5180
5181 **Compatibility:** Firefox 64, Firefox ESR 60.4\
5182 **CCK2 Equivalent:** `certs.devices`\
5183 **Preferences Affected:** N/A
5184
5185 #### Windows (GPO)
5186 ```
5187 Software\Policies\Mozilla\Firefox\SecurityDevices\NAME_OF_DEVICE = PATH_TO_LIBRARY_FOR_DEVICE
5188 ```
5189 #### Windows (Intune)
5190 OMA-URI:
5191 ```
5192 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox/SecurityDevices
5193 ```
5194 Value (string):
5195 ```
5196 <enabled/>
5197 <data id="SecurityDevices" value="NAME_OF_DEVICE&#xF000;PATH_TO_LIBRARY_FOR_DEVICE"/>
5198 ```
5199 #### macOS
5200 ```
5201 <dict>
5202   <key>SecurityDevices</key>
5203   <dict>
5204     <key>NAME_OF_DEVICE</key>
5205     <string>PATH_TO_LIBRARY_FOR_DEVICE</string>
5206   </dict>
5207 </dict>
5208 ```
5209
5210 #### policies.json
5211 ```
5212 {
5213   "policies": {
5214     "SecurityDevices": {
5215       "NAME_OF_DEVICE": "PATH_TO_LIBRARY_FOR_DEVICE"
5216     }
5217   }
5218 }
5219 ```
5220 ### ShowHomeButton
5221 Show the home button on the toolbar.
5222
5223 Future versions of Firefox will not show the home button by default.
5224
5225 **Compatibility:** Firefox 88, Firefox ESR 78.10\
5226 **CCK2 Equivalent:** N/A\
5227 **Preferences Affected:** N/A
5228
5229 #### Windows (GPO)
5230 ```
5231 Software\Policies\Mozilla\Firefox\ShowHomeButton = 0x1 | 0x0
5232 ```
5233 #### Windows (Intune)
5234 OMA-URI:
5235 ```
5236 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox/ShowHomeButton
5237 ```
5238 Value (string):
5239 ```
5240 <enabled/> or <disabled/>
5241 ```
5242 #### macOS
5243 ```
5244 <dict>
5245   <key>ShowHomeButton</key>
5246   <true/> | <false/>
5247 </dict>
5248 ```
5249 #### policies.json
5250 ```
5251 {
5252   "policies": {
5253     "ShowHomeButton": true | false
5254   }
5255 }
5256 ```
5257 ### SSLVersionMax
5258
5259 Set and lock the maximum version of TLS.
5260
5261 **Compatibility:** Firefox 66, Firefox ESR 60.6\
5262 **CCK2 Equivalent:** N/A\
5263 **Preferences Affected:** `security.tls.version.max`
5264
5265 #### Windows (GPO)
5266 ```
5267 Software\Policies\Mozilla\Firefox\SSLVersionMax = "tls1" | "tls1.1" | "tls1.2" | "tls1.3"
5268 ```
5269 #### Windows (Intune)
5270 OMA-URI:
5271 ```
5272 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox/SSLVersionMax
5273 ```
5274 Value (string):
5275 ```
5276 <enabled/>
5277 <data id="SSLVersion" value="tls1 | tls1.2 | tls1.3"/>
5278 ```
5279 #### macOS
5280 ```
5281 <dict>
5282   <key>SSLVersionMax</key>
5283   <string>tls1 | tls1.1 | tls1.2 | tls1.3</string>
5284 </dict>
5285 ```
5286
5287 #### policies.json
5288 ```
5289 {
5290   "policies": {
5291     "SSLVersionMax": "tls1" | "tls1.1" | "tls1.2" | "tls1.3"
5292   }
5293 }
5294 ```
5295 ### SSLVersionMin
5296
5297 Set and lock the minimum version of TLS.
5298
5299 **Compatibility:** Firefox 66, Firefox ESR 60.6\
5300 **CCK2 Equivalent:** N/A\
5301 **Preferences Affected:** `security.tls.version.min`
5302
5303 #### Windows (GPO)
5304 ```
5305 Software\Policies\Mozilla\Firefox\SSLVersionMin = "tls1" | "tls1.1" | "tls1.2" | "tls1.3"
5306 ```
5307 #### Windows (Intune)
5308 OMA-URI:
5309 ```
5310 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox/SSLVersionMin
5311 ```
5312 Value (string):
5313 ```
5314 <enabled/>
5315 <data id="SSLVersion" value="tls1 | tls1.2 | tls1.3"/>
5316 ```
5317 #### macOS
5318 ```
5319 <dict>
5320   <key>SSLVersionMin</key>
5321   <string>tls1 | tls1.1 | tls1.2 | tls1.3</string>
5322 </dict>
5323 ```
5324
5325 #### policies.json
5326 ```
5327 {
5328   "policies": {
5329     "SSLVersionMin": "tls1" | "tls1.1" | "tls1.2" | "tls1.3"
5330   }
5331 }
5332 ```
5333 ### SupportMenu
5334 Add a menuitem to the help menu for specifying support information.
5335
5336 **Compatibility:** Firefox 68.0.1, Firefox ESR 68.0.1\
5337 **CCK2 Equivalent:** helpMenu\
5338 **Preferences Affected:** N/A
5339
5340 #### Windows (GPO)
5341 ```
5342 Software\Policies\Mozilla\Firefox\SupportMenu\Title = "Support Menu"
5343 Software\Policies\Mozilla\Firefox\SupportMenu\URL = "http://example.com/support"
5344 Software\Policies\Mozilla\Firefox\SupportMenu\AccessKey = "S"
5345 ```
5346 #### Windows (Intune)
5347 OMA-URI:
5348 ```
5349 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox/SupportMenu
5350 ```
5351 Value (string):
5352 ```
5353 <enabled/>
5354 <data id="SupportMenuTitle" value="Support Menu"/>
5355 <data id="SupportMenuURL" value="http://example.com/support"/>
5356 <data id="SupportMenuAccessKey" value="S">
5357 ```
5358 #### macOS
5359 ```
5360 <dict>
5361   <key>SupportMenu</key>
5362   <dict>
5363     <key>Title</key>
5364     <string>SupportMenu</string>
5365     <key>URL</key>
5366     <string>http://example.com/support</string>
5367     <key>AccessKey</key>
5368     <string>S</string>
5369   </dict>
5370 </dict>
5371 ```
5372 #### policies.json
5373 ```
5374 {
5375   "policies": {
5376     "SupportMenu": {
5377       "Title": "Support Menu",
5378       "URL": "http://example.com/support",
5379       "AccessKey": "S"
5380     }
5381   }
5382 }
5383 ```
5384 ### UserMessaging
5385
5386 Prevent Firefox from messaging the user in certain situations.
5387
5388 `WhatsNew` Remove the "What's New" icon and menuitem.
5389
5390 `ExtensionRecommendations` If false, don't recommend extensions while the user is visiting web pages.
5391
5392 `FeatureRecommendations` IF false, don't recommend browser features.
5393
5394 `UrlbarInterventions` If false, Don't offer Firefox specific suggestions in the URL bar.
5395
5396 `SkipOnboarding` If true, don't show onboarding messages on the new tab page.
5397
5398 **Compatibility:** Firefox 75, Firefox ESR 68.7\
5399 **CCK2 Equivalent:** N/A\
5400 **Preferences Affected:** `browser.messaging-system.whatsNewPanel.enabled`,`browser.newtabpage.activity-stream.asrouter.userprefs.cfr.addons`,`browser.newtabpage.activity-stream.asrouter.userprefs.cfr.features`,`browser.aboutwelcome.enabled`
5401
5402 #### Windows (GPO)
5403 ```
5404 Software\Policies\Mozilla\Firefox\UserMessaging\WhatsNew = 0x1 | 0x0
5405 Software\Policies\Mozilla\Firefox\UserMessaging\ExtensionRecommendations = 0x1 | 0x0
5406 Software\Policies\Mozilla\Firefox\UserMessaging\FeatureRecommendations = 0x1 | 0x0
5407 Software\Policies\Mozilla\Firefox\UserMessaging\UrlbarInterventions = 0x1 | 0x0
5408 Software\Policies\Mozilla\Firefox\UserMessaging\SkipOnboarding = 0x1 | 0x0
5409 ```
5410 #### Windows (Intune)
5411 OMA-URI:
5412 ```
5413 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~UserMessaging/UserMessaging_WhatsNew
5414 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~UserMessaging/UserMessaging_ExtensionRecommendations
5415 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~UserMessaging/UserMessaging_FeatureRecommendations
5416 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~UserMessaging/UserMessaging_UrlbarInterventions
5417 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~UserMessaging/UserMessaging_SkipOnboarding
5418 ```
5419 Value (string):
5420 ```
5421 <enabled/> or <disabled/>
5422 ```
5423 #### macOS
5424 ```
5425 <dict>
5426   <key>UserMessaging</key>
5427   <dict>
5428     <key>WhatsNew</key>
5429     <true/> | <false/>
5430     <key>ExtensionRecommendations</key>
5431     <true/> | <false/>
5432     <key>FeatureRecommendations</key>
5433     <true/> | <false/>
5434     <key>UrlbarInterventions</key>
5435     <true/> | <false/>
5436     <key>SkipOnboarding</key>
5437     <true/> | <false/>
5438   </dict>
5439 </dict>
5440 ```
5441 #### policies.json
5442 ```
5443 {
5444   "policies": {
5445     "UserMessaging": {
5446       "WhatsNew": true | false,
5447       "ExtensionRecommendations": true | false,
5448       "FeatureRecommendations": true | false,
5449       "UrlbarInterventions": true | false
5450       "SkipOnboarding": true | false
5451     }
5452   }
5453 }
5454 ```
5455 ### WebsiteFilter
5456 Block websites from being visited. The parameters take an array of Match Patterns, as documented in https://developer.mozilla.org/en-US/Add-ons/WebExtensions/Match_patterns.
5457 The arrays are limited to 1000 entries each.
5458
5459 If you want to block all URLs, you can use `<all_urls>` or `*://*/*`. You can't have just a `*` on the right side.
5460
5461 For specific protocols, use `https://*/*` or `http://*/*`.
5462
5463 As of Firefox 83 and Firefox ESR 78.5, file URLs are supported.
5464
5465 **Compatibility:** Firefox 60, Firefox ESR 60\
5466 **CCK2 Equivalent:** N/A\
5467 **Preferences Affected:** N/A
5468
5469 #### Windows (GPO)
5470 ```
5471 Software\Policies\Mozilla\Firefox\WebsiteFilter\Block\1 = "<all_urls>"
5472 Software\Policies\Mozilla\Firefox\WebsiteFilter\Exceptions\1 = "http://example.org/*"
5473 ```
5474 #### Windows (Intune)
5475 OMA-URI:
5476 ```
5477 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox/B_WebsiteFilter_Block
5478 ```
5479 Value (string):
5480 ```
5481 <enabled/> <data id="WebsiteFilter" value="1&#xF000;&#60;all_urls&#62;"/>
5482 ```
5483 OMA-URI:
5484 ```
5485 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox/B_WebsiteFilter_Exceptions
5486 ```
5487 Value (string):
5488 ```
5489 <enabled/>
5490 <data id="WebsiteFilter" value="1&#xF000;http://example.org/*"/>
5491 ```
5492 #### macOS
5493 ```
5494 <dict>
5495   <key>WebsiteFilter</key>
5496   <dict>
5497     <key>Block</key>
5498     <array>
5499       <string><all_urls></string>
5500     </array>
5501     <key>Exceptions</key>
5502     <array>
5503       <string>http://example.org/*</string>
5504     </array>
5505   </dict>
5506
5507 </dict>
5508 ```
5509 #### policies.json
5510 ```
5511 {
5512   "policies": {
5513     "WebsiteFilter": {
5514       "Block": ["<all_urls>"],
5515       "Exceptions": ["http://example.org/*"]
5516     }
5517   }
5518 }
5519 ```
5520 ### WindowsSSO
5521 Allow Windows single sign-on for Microsoft, work, and school accounts.
5522
5523 If this policy is set to true, Firefox will use credentials stored in Windows to sign in to Microsoft, work, and school accounts.
5524
5525 **Compatibility:** Firefox 91\
5526 **CCK2 Equivalent:** N/A\
5527 **Preferences Affected:** network.http.windows-sso.enabled
5528
5529 #### Windows (GPO)
5530 ```
5531 Software\Policies\Mozilla\Firefox\WindowsSSO = 0x1 | 0x0
5532 ```
5533 #### Windows (Intune)
5534 OMA-URI:
5535 ```
5536 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox/WindowsSSO
5537 ```
5538 Value (string):
5539 ```
5540 <enabled/> or <disabled/>
5541 ```
5542 #### policies.json
5543 ```
5544 {
5545   "policies": {
5546     "WindowsSSO": true | false
5547   }
5548 }
5549 ```