docs/index.md

   1 Firefox policies can be specified using the [Group Policy templates on Windows](https://github.com/mozilla/policy-templates/tree/master/windows), [Intune on Windows](https://support.mozilla.org/kb/managing-firefox-intune), [configuration profiles on macOS](https://github.com/mozilla/policy-templates/tree/master/mac), or by creating a file called `policies.json`. On Windows, create a directory called `distribution` where the EXE is located and place the file there. On Mac, the file goes into `Firefox.app/Contents/Resources/distribution`.  On Linux, the file goes into `firefox/distribution`, where `firefox` is the installation directory for firefox, which varies by distribution or you can specify system-wide policy by placing the file in `/etc/firefox/policies`.
   2
   3 Unfortunately, JSON files do not support comments, but you can add extra entries to the JSON to use as comments. You will see an error in about:policies, but the policies will still work properly. For example:
   4 ```
   5 {
   6   "policies": {
   7     "Authentication": {
   8       "SPNEGO": ["mydomain.com", "https://myotherdomain.com"]
   9     }
  10     "Authentication_Comment": "These domains are required for us"
  11   }
  12 }
  13 ```
  14 Note: The `policies.json` must use the UTF-8 encoding.
  15
  16 | Policy Name | Description
  17 | --- | --- |
  18 | **[`3rdparty`](#3rdparty)** | Set policies that WebExtensions can access via chrome.storage.managed.
  19 | **[`AllowedDomainsForApps`](#alloweddomainsforapps)** | Define domains allowed to access Google Workspace.
  20 | **[`AllowFileSelectionDialogs`](#allowfileselectiondialogs)** | Allow file selection dialogs.
  21 | **[`AppAutoUpdate`](#appautoupdate)** | Enable or disable automatic application update.
  22 | **[`AppUpdatePin`](#appupdatepin)** | Prevent Firefox from being updated beyond the specified version.
  23 | **[`AppUpdateURL`](#appupdateurl)** | Change the URL for application update.
  24 | **[`Authentication`](#authentication)** | Configure sites that support integrated authentication.
  25 | **[`AutofillAddressEnabled`](#autofilladdressenabled)** | Enable autofill for addresses.
  26 | **[`AutofillCreditCardEnabled`](#autofillcreditcardenabled)** | Enable autofill for payment methods.
  27 | **[`AutoLaunchProtocolsFromOrigins`](#autolaunchprotocolsfromorigins)** | Define a list of external protocols that can be used from listed origins without prompting the user.
  28 | **[`BackgroundAppUpdate`](#backgroundappupdate)** | Enable or disable the background updater (Windows only).
  29 | **[`BlockAboutAddons`](#blockaboutaddons)** | Block access to the Add-ons Manager (about:addons).
  30 | **[`BlockAboutConfig`](#blockaboutconfig)** | Block access to about:config.
  31 | **[`BlockAboutProfiles`](#blockaboutprofiles)** | Block access to About Profiles (about:profiles).
  32 | **[`BlockAboutSupport`](#blockaboutsupport)** | Block access to Troubleshooting Information (about:support).
  33 | **[`Bookmarks`](#bookmarks)** | Add bookmarks in either the bookmarks toolbar or menu.
  34 | **[`CaptivePortal`](#captiveportal)** | Enable or disable the detection of captive portals.
  35 | **[`Certificates`](#certificates)** |
  36 | **[`Certificates -> ImportEnterpriseRoots`](#certificates--importenterpriseroots)** | Trust certificates that have been added to the operating system certificate store by a user or administrator.
  37 | **[`Certificates -> Install`](#certificates--install)** | Install certificates into the Firefox certificate store.
  38 | **[`Containers`](#containers)** | Set policies related to [containers](https://addons.mozilla.org/firefox/addon/multi-account-containers/).
  39 | **[`ContentAnalysis`](#contentanalysis)** | Configure Firefox to use an agent for Data Loss Prevention (DLP) that is compatible with the [Google Chrome Content Analysis Connector Agent SDK](https://github.com/chromium/content_analysis_sdk).
  40 | **[`Cookies`](#cookies)** | Configure cookie preferences.
  41 | **[`DefaultDownloadDirectory`](#defaultdownloaddirectory)** | Set the default download directory.
  42 | **[`DisableAppUpdate`](#disableappupdate)** | Turn off application updates.
  43 | **[`DisableBuiltinPDFViewer`](#disablebuiltinpdfviewer)** | Disable the built in PDF viewer.
  44 | **[`DisabledCiphers`](#disabledciphers)** | Disable ciphers.
  45 | **[`DisableDefaultBrowserAgent`](#disabledefaultbrowseragent)** | Prevent the default browser agent from taking any actions (Windows only).
  46 | **[`DisableDeveloperTools`](#disabledevelopertools)** | Remove access to all developer tools.
  47 | **[`DisableEncryptedClientHello`](#disableencryptedclienthello)** | Disable the TLS Feature Encrypted Client Hello (ECH).
  48 | **[`DisableFeedbackCommands`](#disablefeedbackcommands)** | Disable the menus for reporting sites.
  49 | **[`DisableFirefoxAccounts`](#disablefirefoxaccounts)** | Disable Firefox Accounts integration (Sync).
  50 | **[`DisableFirefoxScreenshots`](#disablefirefoxscreenshots)** | Remove access to Firefox Screenshots.
  51 | **[`DisableFirefoxStudies`](#disablefirefoxstudies)** | Disable Firefox studies (Shield).
  52 | **[`DisableForgetButton`](#disableforgetbutton)** | Disable the "Forget" button.
  53 | **[`DisableFormHistory`](#disableformhistory)** | Turn off saving information on web forms and the search bar.
  54 | **[`DisableMasterPasswordCreation`](#disablemasterpasswordcreation)** | Remove the master password functionality.
  55 | **[`DisablePasswordReveal`](#disablepasswordreveal)** | Do not allow passwords to be revealed in saved logins.
  56 | **[`DisablePocket`](#disablepocket)** | Remove Pocket in the Firefox UI.
  57 | **[`DisablePrivateBrowsing`](#disableprivatebrowsing)** | Remove access to private browsing.
  58 | **[`DisableProfileImport`](#disableprofileimport)** | Disables the "Import data from another browser" option in the bookmarks window.
  59 | **[`DisableProfileRefresh`](#disableprofilerefresh)** | Disable the Refresh Firefox button on about:support and support.mozilla.org
  60 | **[`DisableSafeMode`](#disablesafemode)** | Disable safe mode within the browser.
  61 | **[`DisableSecurityBypass`](#disablesecuritybypass)** | Prevent the user from bypassing security in certain cases.
  62 | **[`DisableSetDesktopBackground`](#disablesetdesktopbackground)** | Remove the "Set As Desktop Background..." menuitem when right clicking on an image.
  63 | **[`DisableSystemAddonUpdate`](#disablesystemaddonupdate)** | Prevent system add-ons from being installed or updated.
  64 | **[`DisableTelemetry`](#disabletelemetry)** | DisableTelemetry
  65 | **[`DisableThirdPartyModuleBlocking`](#disablethirdpartymoduleblocking)** | Do not allow blocking third-party modules.
  66 | **[`DisplayBookmarksToolbar`](#displaybookmarkstoolbar)** | Set the initial state of the bookmarks toolbar.
  67 | **[`DisplayMenuBar`](#displaymenubar)** | Set the state of the menubar.
  68 | **[`DNSOverHTTPS`](#dnsoverhttps)** | Configure DNS over HTTPS.
  69 | **[`DontCheckDefaultBrowser`](#dontcheckdefaultbrowser)** | Don't check if Firefox is the default browser at startup.
  70 | **[`DownloadDirectory`](#downloaddirectory)** | Set and lock the download directory.
  71 | **[`EnableTrackingProtection`](#enabletrackingprotection)** | Configure tracking protection.
  72 | **[`EncryptedMediaExtensions`](#encryptedmediaextensions)** | Enable or disable Encrypted Media Extensions and optionally lock it.
  73 | **[`EnterprisePoliciesEnabled`](#enterprisepoliciesenabled)** | Enable policy support on macOS.
  74 | **[`ExemptDomainFileTypePairsFromFileTypeDownloadWarnings`](#exemptdomainfiletypepairsfromfiletypedownloadwarnings)** | Disable warnings based on file extension for specific file types on domains.
  75 | **[`Extensions`](#extensions)** | Control the installation, uninstallation and locking of extensions.
  76 | **[`ExtensionSettings`](#extensionsettings)** | Manage all aspects of extensions.
  77 | **[`ExtensionUpdate`](#extensionupdate)** | Control extension updates.
  78 | **[`FirefoxHome`](#firefoxhome)** | Customize the Firefox Home page.
  79 | **[`FirefoxSuggest`](#firefoxsuggest)** | Customize Firefox Suggest.
  80 | **[`GoToIntranetSiteForSingleWordEntryInAddressBar`](#gotointranetsiteforsinglewordentryinaddressbar)** | Force direct intranet site navigation instead of searching when typing single word entries in the address bar.
  81 | **[`Handlers`](#handlers)** | Configure default application handlers.
  82 | **[`HardwareAcceleration`](#hardwareacceleration)** | Control hardware acceleration.
  83 | **[`Homepage`](#homepage)** | Configure the default homepage and how Firefox starts.
  84 | **[`HttpAllowlist`](#httpallowlist)** | Configure origins that will not be upgraded to HTTPS.
  85 | **[`HttpsOnlyMode`](#httpsonlymode)** | Configure HTTPS-Only Mode.
  86 | **[`InstallAddonsPermission`](#installaddonspermission)** | Configure the default extension install policy as well as origins for extension installs are allowed.
  87 | **[`LegacyProfiles`](#legacyprofiles)** | Disable the feature enforcing a separate profile for each installation.
  88 | **[`LegacySameSiteCookieBehaviorEnabled`](#legacysamesitecookiebehaviorenabled)** | Enable default legacy SameSite cookie behavior setting.
  89 | **[`LegacySameSiteCookieBehaviorEnabledForDomainList`](#legacysamesitecookiebehaviorenabledfordomainlist)** | Revert to legacy SameSite behavior for cookies on specified sites.
  90 | **[`LocalFileLinks`](#localfilelinks)** | Enable linking to local files by origin.
  91 | **[`ManagedBookmarks`](#managedbookmarks)** | Configures a list of bookmarks managed by an administrator that cannot be changed by the user.
  92 | **[`ManualAppUpdateOnly`](#manualappupdateonly)** | Allow manual updates only and do not notify the user about updates.
  93 | **[`MicrosoftEntraSSO`](#microsoftentrasso)** | Allow single sign-on for Microsoft Entra accounts on macOS.
  94 | **[`NetworkPrediction`](#networkprediction)** | Enable or disable network prediction (DNS prefetching).
  95 | **[`NewTabPage`](#newtabpage)** | Enable or disable the New Tab page.
  96 | **[`NoDefaultBookmarks`](#nodefaultbookmarks)** | Disable the creation of default bookmarks.
  97 | **[`OfferToSaveLogins`](#offertosavelogins)** | Control whether or not Firefox offers to save passwords.
  98 | **[`OfferToSaveLoginsDefault`](#offertosaveloginsdefault)** | Set the default value for whether or not Firefox offers to save passwords.
  99 | **[`OverrideFirstRunPage`](#overridefirstrunpage)** | Override the first run page.
 100 | **[`OverridePostUpdatePage`](#overridepostupdatepage)** | Override the upgrade page.
 101 | **[`PasswordManagerEnabled`](#passwordmanagerenabled)** | Remove (some) access to the password manager.
 102 | **[`PasswordManagerExceptions`](#passwordmanagerexceptions)** | Prevent Firefox from saving passwords for specific sites.
 103 | **[`PDFjs`](#pdfjs)** | Disable or configure PDF.js, the built-in PDF viewer.
 104 | **[`Permissions`](#permissions)** | Set permissions associated with camera, microphone, location, and notifications.
 105 | **[`PictureInPicture`](#pictureinpicture)** | Enable or disable Picture-in-Picture.
 106 | **[`PopupBlocking`](#popupblocking)** | Configure the default pop-up window policy as well as origins for which pop-up windows are allowed.
 107 | **[`PostQuantumKeyAgreementEnabled`](#postquantumkeyagreementenabled)** | Enable post-quantum key agreement for TLS.
 108 | **[`Preferences`](#preferences)** | Set and lock preferences.
 109 | **[`PrimaryPassword`](#primarypassword)** | Require or prevent using a primary (formerly master) password.
 110 | **[`PrintingEnabled`](#printingenabled)** | Enable or disable printing.
 111 | **[`PrivateBrowsingModeAvailability`](#privatebrowsingmodeavailability)** | Set availability of private browsing mode.
 112 | **[`PromptForDownloadLocation`](#promptfordownloadlocation)** | Ask where to save each file before downloading.
 113 | **[`Proxy`](#proxy)** | Configure proxy settings.
 114 | **[`RequestedLocales`](#requestedlocales)** | Set the the list of requested locales for the application in order of preference.
 115 | **[`SanitizeOnShutdown` (All)](#sanitizeonshutdown-all)** | Clear all data on shutdown.
 116 | **[`SanitizeOnShutdown` (Selective)](#sanitizeonshutdown-selective)** | Clear data on shutdown.
 117 | **[`SearchBar`](#searchbar)** | Set whether or not search bar is displayed.
 118 | **[`SearchEngines`](#searchengines-this-policy-is-only-available-on-the-esr)** |
 119 | **[`SearchEngines -> Add`](#searchengines--add)** | Add new search engines.
 120 | **[`SearchEngines -> Default`](#searchengines--default)** | Set the default search engine.
 121 | **[`SearchEngines -> PreventInstalls`](#searchengines--preventinstalls)** | Prevent installing search engines from webpages.
 122 | **[`SearchEngines -> Remove`](#searchengines--remove)** | Hide built-in search engines.
 123 | **[`SearchSuggestEnabled`](#searchsuggestenabled)** | Enable search suggestions.
 124 | **[`SecurityDevices`](#securitydevices)** | Install PKCS #11 modules.
 125 | **[`ShowHomeButton`](#showhomebutton)** | Show the home button on the toolbar.
 126 | **[`SSLVersionMax`](#sslversionmax)** | Set and lock the maximum version of TLS.
 127 | **[`SSLVersionMin`](#sslversionmin)** | Set and lock the minimum version of TLS.
 128 | **[`StartDownloadsInTempDirectory`](#startdownloadsintempdirectory)** | Force downloads to start off in a local, temporary location rather than the default download directory.
 129 | **[`SupportMenu`](#supportmenu)** | Add a menuitem to the help menu for specifying support information.
 130 | **[`TranslateEnabled`](#translateenabled)** | Enable or disable webpage translation.
 131 | **[`UserMessaging`](#usermessaging)** | Don't show certain messages to the user.
 132 | **[`UseSystemPrintDialog`](#usesystemprintdialog)** | Print using the system print dialog instead of print preview.
 133 | **[`WebsiteFilter`](#websitefilter)** | Block websites from being visited.
 134 | **[`WindowsSSO`](#windowssso)** | Allow Windows single sign-on for Microsoft, work, and school accounts.
 135
 136 ### 3rdparty
 137
 138 Allow WebExtensions to configure policy. For more information, see [Adding policy support to your extension](https://extensionworkshop.com/documentation/enterprise/enterprise-development/#how-to-add-policy).
 139
 140 For GPO and Intune, the extension developer should provide an ADMX file.
 141
 142 **Compatibility:** Firefox 68\
 143 **CCK2 Equivalent:** N/A\
 144 **Preferences Affected:** N/A
 145
 146 #### macOS
 147 ```
 148 <dict>
 149   <key>3rdparty</key>
 150   <dict>
 151     <key>Extensions</key>
 152     <dict>
 153       <key>uBlock0@raymondhill.net</key>
 154       <dict>
 155         <key>adminSettings</key>
 156         <dict>
 157           <key>selectedFilterLists</key>
 158           <array>
 159             <string>ublock-privacy</string>
 160             <string>ublock-badware</string>
 161             <string>ublock-filters</string>
 162             <string>user-filters</string>
 163           </array>
 164         </dict>
 165       </dict>
 166     </dict>
 167   </dict>
 168 </dict>
 169 ```
 170 #### policies.json
 171 ```
 172 {
 173   "policies": {
 174     "3rdparty": {
 175       "Extensions": {
 176         "uBlock0@raymondhill.net": {
 177           "adminSettings": {
 178             "selectedFilterLists": [
 179               "ublock-privacy",
 180               "ublock-badware",
 181               "ublock-filters",
 182               "user-filters"
 183             ]
 184           }
 185         }
 186       }
 187     }
 188   }
 189 }
 190 ```
 191
 192 ### AllowedDomainsForApps
 193
 194 Define domains allowed to access Google Workspace.
 195
 196 This policy is based on the [Chrome policy](https://chromeenterprise.google/policies/#AllowedDomainsForApps) of the same name.
 197
 198 If this policy is enabled, users can only access Google Workspace using accounts from the specified domains. If you want to allow Gmail, you can add ```consumer_accounts``` to the list.
 199
 200 **Compatibility:** Firefox 89, Firefox ESR 78.11\
 201 **CCK2 Equivalent:** N/A\
 202 **Preferences Affected:** N/A
 203
 204 #### Windows (GPO)
 205 ```
 206 Software\Policies\Mozilla\Firefox\AllowedDomainsForApps = "managedfirefox.com,example.com"
 207 ```
 208 #### Windows (Intune)
 209 OMA-URI:
 210 ```
 211 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox/AllowedDomainsForApps
 212 ```
 213 Value (string):
 214 ```
 215 <enabled/>
 216 <data id="AllowedDomainsForApps" value="managedfirefox.com,example.com"/>
 217 ```
 218 #### macOS
 219 ```
 220 <dict>
 221   <key>AllowedDomainsForApps</key>
 222   <string>managedfirefox.com,example.com</string>
 223 </dict>
 224 ```
 225 #### policies.json
 226 ```
 227 {
 228   "policies": {
 229     "AllowedDomainsForApps": "managedfirefox.com,example.com"
 230   }
 231 }
 232 ```
 233 ### AllowFileSelectionDialogs
 234
 235 Enable or disable file selection dialogs.
 236
 237 **Compatibility:** Firefox 124\
 238 **CCK2 Equivalent:** N/A\
 239 **Preferences Affected:** `widget.disable_file_pickers`
 240
 241 #### Windows (GPO)
 242 ```
 243 Software\Policies\Mozilla\Firefox\AllowFileSelectionDialogs = 0x1 | 0x0
 244 ```
 245 #### Windows (Intune)
 246 OMA-URI:
 247 ```
 248 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox/AppAutoAllowFileSelectionDialogsUpdate
 249 ```
 250 Value (string):
 251 ```
 252 <enabled/> or <disabled/>
 253 ```
 254 #### macOS
 255 ```
 256 <dict>
 257   <key>AllowFileSelectionDialogs</key>
 258   <true/> | <false/>
 259 </dict>
 260 ```
 261 #### policies.json
 262 ```
 263 {
 264   "policies": {
 265     "AllowFileSelectionDialogs": true | false
 266   }
 267 }
 268 ```
 269 ### AppAutoUpdate
 270
 271 Enable or disable **automatic** application update.
 272
 273 If set to true, application updates are installed without user approval within Firefox. The operating system might still require approval.
 274
 275 If set to false, application updates are downloaded but the user can choose when to install the update.
 276
 277 If you have disabled updates via `DisableAppUpdate`, this policy has no effect.
 278
 279 **Compatibility:** Firefox 75, Firefox ESR 68.7\
 280 **CCK2 Equivalent:** N/A\
 281 **Preferences Affected:** `app.update.auto`
 282
 283 #### Windows (GPO)
 284 ```
 285 Software\Policies\Mozilla\Firefox\AppAutoUpdate = 0x1 | 0x0
 286 ```
 287 #### Windows (Intune)
 288 OMA-URI:
 289 ```
 290 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox/AppAutoUpdate
 291 ```
 292 Value (string):
 293 ```
 294 <enabled/> or <disabled/>
 295 ```
 296 #### macOS
 297 ```
 298 <dict>
 299   <key>AppAutoUpdate</key>
 300   <true/> | <false/>
 301 </dict>
 302 ```
 303 #### policies.json
 304 ```
 305 {
 306   "policies": {
 307     "AppAutoUpdate": true | false
 308   }
 309 }
 310 ```
 311 ### AppUpdatePin
 312
 313 Prevent Firefox from being updated beyond the specified version.
 314
 315 You can specify the any version as ```xx.``` and Firefox will be updated with all minor versions, but will not be updated beyond the major version.
 316
 317 You can also specify the version as ```xx.xx``` and Firefox will be updated with all patch versions, but will not be updated beyond the minor version.
 318
 319 You should specify a version that exists or is guaranteed to exist. If you specify a version that doesn't end up existing, Firefox will update beyond that version.
 320
 321 **Compatibility:** Firefox 102,\
 322 **CCK2 Equivalent:** N/A\
 323 **Preferences Affected:** N/A
 324
 325 #### Windows (GPO)
 326 ```
 327 Software\Policies\Mozilla\Firefox\AppUpdatePin = "106."
 328 ```
 329 #### Windows (Intune)
 330 OMA-URI:
 331 ```
 332 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox/AppUpdatePin
 333 ```
 334 Value (string):
 335 ```
 336 <enabled/>
 337 <data id="String" value="106."/>
 338 ```
 339 #### macOS
 340 ```
 341 <dict>
 342   <key>AppUpdatePin</key>
 343   <string>106.</string>
 344 </dict>
 345 ```
 346 #### policies.json
 347 ```
 348 {
 349   "policies": {
 350     "AppUpdatePin": "106."
 351   }
 352 }
 353 ```
 354 ### AppUpdateURL
 355
 356 Change the URL for application update if you are providing Firefox updates from a custom update server.
 357
 358 **Compatibility:** Firefox 62, Firefox ESR 60.2\
 359 **CCK2 Equivalent:** N/A\
 360 **Preferences Affected:** `app.update.url`
 361
 362 #### Windows (GPO)
 363 ```
 364 Software\Policies\Mozilla\Firefox\AppUpdateURL = "https://yoursite.com"
 365 ```
 366 #### Windows (Intune)
 367 OMA-URI:
 368 ```
 369 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox/AppUpdateURL
 370 ```
 371 Value (string):
 372 ```
 373 <enabled/>
 374 <data id="AppUpdateURL" value="https://yoursite.com"/>
 375 ```
 376 #### macOS
 377 ```
 378 <dict>
 379   <key>AppUpdateURL</key>
 380   <string>https://yoursite.com</string>
 381 </dict>
 382 ```
 383 #### policies.json
 384 ```
 385 {
 386   "policies": {
 387     "AppUpdateURL": "https://yoursite.com"
 388   }
 389 }
 390 ```
 391 ### Authentication
 392
 393 Configure sites that support integrated authentication.
 394
 395 See [Integrated authentication](https://htmlpreview.github.io/?https://github.com/mdn/archived-content/blob/main/files/en-us/mozilla/integrated_authentication/raw.html) for more information.
 396
 397 `PrivateBrowsing` enables integrated authentication in private browsing.
 398
 399 **Compatibility:** Firefox 60, Firefox ESR 60 (AllowNonFQDN added in 62/60.2, AllowProxies added in 70/68.2, Locked added in 71/68.3, PrivateBrowsing added in 77/68.9)\
 400 **CCK2 Equivalent:** N/A\
 401 **Preferences Affected:** `network.negotiate-auth.trusted-uris`,`network.negotiate-auth.delegation-uris`,`network.automatic-ntlm-auth.trusted-uris`,`network.automatic-ntlm-auth.allow-non-fqdn`,`network.negotiate-auth.allow-non-fqdn`,`network.automatic-ntlm-auth.allow-proxies`,`network.negotiate-auth.allow-proxies`,`network.auth.private-browsing-sso`
 402
 403 #### Windows (GPO)
 404 ```
 405 Software\Policies\Mozilla\Firefox\Authentication\SPNEGO\1 = "mydomain.com"
 406 Software\Policies\Mozilla\Firefox\Authentication\SPNEGO\2 = "https://myotherdomain.com"
 407 Software\Policies\Mozilla\Firefox\Authentication\Delegated\1 = "mydomain.com"
 408 Software\Policies\Mozilla\Firefox\Authentication\Delegated\2 = "https://myotherdomain.com"
 409 Software\Policies\Mozilla\Firefox\Authentication\NTLM\1 = "mydomain.com"
 410 Software\Policies\Mozilla\Firefox\Authentication\NTLM\2 = "https://myotherdomain.com"
 411 Software\Policies\Mozilla\Firefox\Authentication\AllowNonFQDN\SPNEGO = 0x1 | 0x0
 412 Software\Policies\Mozilla\Firefox\Authentication\AllowNonFQDN\NTLM = 0x1 | 0x0
 413 Software\Policies\Mozilla\Firefox\Authentication\AllowProxies\SPNEGO = 0x1 | 0x0
 414 Software\Policies\Mozilla\Firefox\Authentication\AllowProxies\NTLM = 0x1 | 0x0
 415 Software\Policies\Mozilla\Firefox\Authentication\Locked = 0x1 | 0x0
 416 Software\Policies\Mozilla\Firefox\Authentication\PrivateBrowsing = 0x1 | 0x0
 417 ```
 418 #### Windows (Intune)
 419 OMA-URI:
 420 ```
 421 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~Authentication/Authentication_SPNEGO
 422 ```
 423 Value (string):
 424 ```
 425 <enabled/>
 426 <data id="Authentication" value="1&#xF000;mydomain&#xF000;2&#xF000;https://myotherdomain.com"/>
 427 ```
 428 OMA-URI:
 429 ```
 430 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~Authentication/Authentication_Delegated
 431 ```
 432 Value (string):
 433 ```
 434 <enabled/>
 435 <data id="Authentication" value="1&#xF000;mydomain&#xF000;2&#xF000;https://myotherdomain.com"/>
 436 ```
 437 OMA-URI:
 438 ```
 439 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~Authentication/Authentication_NTLM
 440 ```
 441 Value (string):
 442 ```
 443 <enabled/>
 444 <data id="Authentication" value="1&#xF000;mydomain&#xF000;2&#xF000;https://myotherdomain.com"/>
 445 ```
 446 OMA-URI:
 447 ```
 448 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~Authentication/Authentication_AllowNonFQDN
 449 ```
 450 Value (string):
 451 ```
 452 <enabled/>
 453 <data id="Authentication_AllowNonFQDN_NTLM" value="true | false"/>
 454 <data id="Authentication_AllowNonFQDN_SPNEGO" value="true | false"/>
 455 ```
 456 OMA-URI:
 457 ```
 458 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~Authentication/Authentication_Locked
 459 ```
 460 Value (string):
 461 ```
 462 <enabled/> or <disabled/>
 463 ```
 464 OMA-URI:
 465 ```
 466 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~Authentication/Authentication_PrivateBrowsing
 467 ```
 468 Value (string):
 469 ```
 470 <enabled/> or <disabled/>
 471 ```
 472 #### macOS
 473 ```
 474 <dict>
 475   <key>Authentication</key>
 476   <dict>
 477     <key>SPNEGO</key>
 478     <array>
 479       <string>mydomain.com</string>
 480       <string>https://myotherdomain.com</string>
 481     </array>
 482     <key>Delegated</key>
 483     <array>
 484       <string>mydomain.com</string>
 485       <string>https://myotherdomain.com</string>
 486     </array>
 487     <key>NTLM</key>
 488     <array>
 489       <string>mydomain.com</string>
 490       <string>https://myotherdomain.com</string>
 491     </array>
 492     <key>AllowNonFQDN</key>
 493       <dict>
 494       <key>SPNEGO</key>
 495       <true/> | <false/>
 496       <key>NTLM</key>
 497       <true/> | <false/>
 498     </dict>
 499     <key>AllowProxies</key>
 500       <dict>
 501       <key>SPNEGO</key>
 502       <true/> | <false/>
 503       <key>NTLM</key>
 504       <true/> | <false/>
 505     </dict>
 506     <key>Locked</key>
 507     <true/> | <false/>
 508     <key>PrivateBrowsing</key>
 509     <true/> | <false/>
 510   </dict>
 511 </dict>
 512 ```
 513 #### policies.json
 514 ```
 515 {
 516   "policies": {
 517     "Authentication": {
 518       "SPNEGO": ["mydomain.com", "https://myotherdomain.com"],
 519       "Delegated": ["mydomain.com", "https://myotherdomain.com"],
 520       "NTLM": ["mydomain.com", "https://myotherdomain.com"],
 521       "AllowNonFQDN": {
 522         "SPNEGO": true | false,
 523         "NTLM": true | false
 524       },
 525       "AllowProxies": {
 526         "SPNEGO": true | false,
 527         "NTLM": true | false
 528       },
 529       "Locked": true | false,
 530       "PrivateBrowsing": true | false
 531     }
 532   }
 533 }
 534 ```
 535 ### AutofillAddressEnabled
 536
 537 Enables or disables autofill for addresses.
 538
 539 This only applies when address autofill is enabled for a particular Firefox version or region. See [this page](https://support.mozilla.org/kb/automatically-fill-your-address-web-forms) for more information.
 540
 541 **Compatibility:** Firefox 125, Firefox ESR 115.10\
 542 **CCK2 Equivalent:** N/A\
 543 **Preferences Affected:** `extensions.formautofill.addresses.enabled`
 544
 545 #### Windows (GPO)
 546 ```
 547 Software\Policies\Mozilla\Firefox\AutofillAddressEnabled = 0x1 | 0x0
 548 ```
 549 #### Windows (Intune)
 550 OMA-URI:
 551 ```
 552 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox/AutofillAddressEnabled
 553 ```
 554 Value (string):
 555 ```
 556 <enabled/> or <disabled/>
 557 ```
 558 #### macOS
 559 ```
 560 <dict>
 561   <key>AutofillAddressEnabled</key>
 562   <true/> | <false/>
 563 </dict>
 564 ```
 565 #### policies.json
 566 ```
 567 {
 568   "policies": {
 569     "AutofillAddressEnabled": true | false
 570   }
 571 }
 572 ```
 573 ### AutofillCreditCardEnabled
 574
 575 Enables or disables autofill for payment methods.
 576
 577 This only applies when payment method autofill is enabled for a particular Firefox version or region. See [this page](https://support.mozilla.org/kb/credit-card-autofill) for more information.
 578
 579 **Compatibility:** Firefox 125, Firefox ESR 115.10\
 580 **CCK2 Equivalent:** N/A\
 581 **Preferences Affected:** `extensions.formautofill.creditCards.enabled`
 582
 583 #### Windows (GPO)
 584 ```
 585 Software\Policies\Mozilla\Firefox\AutofillCreditCardEnabled = 0x1 | 0x0
 586 ```
 587 #### Windows (Intune)
 588 OMA-URI:
 589 ```
 590 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox/AutofillCreditCardEnabled
 591 ```
 592 Value (string):
 593 ```
 594 <enabled/> or <disabled/>
 595 ```
 596 #### macOS
 597 ```
 598 <dict>
 599   <key>AutofillCreditCardEnabled</key>
 600   <true/> | <false/>
 601 </dict>
 602 ```
 603 #### policies.json
 604 ```
 605 {
 606   "policies": {
 607     "AutofillCreditCardEnabled": true | false
 608   }
 609 }
 610 ```
 611 ### AutoLaunchProtocolsFromOrigins
 612 Define a list of external protocols that can be used from listed origins without prompting the user. The origin is the scheme plus the hostname.
 613
 614 The syntax of this policy is exactly the same as the [Chrome AutoLaunchProtocolsFromOrigins policy](https://cloud.google.com/docs/chrome-enterprise/policies/?policy=AutoLaunchProtocolsFromOrigins) except that you can only use valid origins (not just hostnames). This also means that you cannot specify an asterisk for all origins.
 615
 616 The schema is:
 617 ```
 618 {
 619  "items": {
 620   "properties": {
 621    "allowed_origins": {
 622     "items": {
 623      "type": "string"
 624     },
 625     "type": "array"
 626    },
 627    "protocol": {
 628     "type": "string"
 629    }
 630   },
 631   "required": [
 632    "protocol",
 633    "allowed_origins"
 634   ],
 635   "type": "object"
 636  },
 637  "type": "array"
 638 }
 639 ```
 640 **Compatibility:** Firefox 90, Firefox ESR 78.12\
 641 **CCK2 Equivalent:** N/A\
 642 **Preferences Affected:** N/A
 643
 644 #### Windows (GPO)
 645 Software\Policies\Mozilla\Firefox\AutoLaunchProtocolsFromOrigins (REG_MULTI_SZ) =
 646 ```
 647 [
 648   {
 649     "protocol": "zoommtg",
 650     "allowed_origins": [
 651       "https://somesite.zoom.us"
 652     ]
 653   }
 654 ]
 655 ```
 656 #### Windows (Intune)
 657 OMA-URI:
 658 ```
 659 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox/AutoLaunchProtocolsFromOrigins
 660 ```
 661 Value (string):
 662 ```
 663 <enabled/>
 664 <data id="JSON" value='
 665 [
 666   {
 667     "protocol": "zoommtg",
 668     "allowed_origins": [
 669       "https://somesite.zoom.us"
 670     ]
 671   }
 672 ]'/>
 673 ```
 674 If you are using custom ADMX and ADML administrative templates in Intune, you can use this OMA-URI instead
 675 to workaround the limit on the length of strings. Put all of your JSON on one line.
 676
 677 OMA-URI:
 678 ```
 679 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~Extensions/AutoLaunchProtocolsFromOriginsOneLine
 680 ```
 681 Value (string):
 682 ```
 683 <enabled/>
 684 <data id="JSONOneLine" value='[]'/>
 685 ```
 686 #### macOS
 687 ```
 688 <dict>
 689   <key>AutoLaunchProtocolsFromOrigins</key>
 690   <array>
 691     <dict>
 692       <key>protocol</key>
 693       <string>zoommtg</string>
 694       <key>allowed_origins</key>
 695       <array>
 696         <string>https://somesite.zoom.us</string>
 697       </array>
 698     </dict>
 699   </array>
 700 </dict>
 701 ```
 702 #### policies.json
 703 ```
 704 {
 705   "policies": {
 706     "AutoLaunchProtocolsFromOrigins": [{
 707       "protocol": "zoommtg",
 708       "allowed_origins": [
 709         "https://somesite.zoom.us"
 710       ]
 711     }]
 712   }
 713 }
 714 ```
 715 ### BackgroundAppUpdate
 716
 717 Enable or disable **automatic** application update **in the background**, when the application is not running.
 718
 719 If set to true, application updates may be installed (without user approval) in the background, even when the application is not running. The operating system might still require approval.
 720
 721 If set to false, the application will not try to install updates when the application is not running.
 722
 723 If you have disabled updates via `DisableAppUpdate` or disabled automatic updates via `AppAutoUpdate`, this policy has no effect.
 724
 725 If you are having trouble getting the background task to run, verify your configuration with the ["Requirements to run" section in this support document](https://support.mozilla.org/en-US/kb/enable-background-updates-firefox-windows).
 726
 727 **Compatibility:** Firefox 90 (Windows only)\
 728 **CCK2 Equivalent:** N/A\
 729 **Preferences Affected:** `app.update.background.enabled`
 730
 731 #### Windows (GPO)
 732 ```
 733 Software\Policies\Mozilla\Firefox\BackgroundAppUpdate = 0x1 | 0x0
 734 ```
 735 #### Windows (Intune)
 736 OMA-URI:
 737 ```
 738 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox/BackgroundAppUpdate
 739 ```
 740 Value (string):
 741 ```
 742 <enabled/> or <disabled/>
 743 ```
 744 #### macOS
 745 ```
 746 <dict>
 747   <key>BackgroundAppUpdate</key>
 748   <true/> | <false/>
 749 </dict>
 750 ```
 751 #### policies.json
 752 ```
 753 {
 754   "policies": {
 755     "BackgroundAppUpdate": true | false
 756   }
 757 }
 758 ```
 759 ### BlockAboutAddons
 760
 761 Block access to the Add-ons Manager (about:addons).
 762
 763 **Compatibility:** Firefox 60, Firefox ESR 60\
 764 **CCK2 Equivalent:** `disableAddonsManager`\
 765 **Preferences Affected:** N/A
 766
 767 #### Windows (GPO)
 768 ```
 769 Software\Policies\Mozilla\Firefox\BlockAboutAddons = 0x1 | 0x0
 770 ```
 771 #### Windows (Intune)
 772 OMA-URI:
 773 ```
 774 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox/BlockAboutAddons
 775 ```
 776 Value (string):
 777 ```
 778 <enabled/> or <disabled/>
 779 ```
 780 #### macOS
 781 ```
 782 <dict>
 783   <key>BlockAboutAddons</key>
 784   <true/> | <false/>
 785 </dict>
 786 ```
 787 #### policies.json
 788 ```
 789 {
 790   "policies": {
 791     "BlockAboutAddons": true | false
 792   }
 793 }
 794 ```
 795 ### BlockAboutConfig
 796
 797 Block access to about:config.
 798
 799 **Compatibility:** Firefox 60, Firefox ESR 60\
 800 **CCK2 Equivalent:** `disableAboutConfig`\
 801 **Preferences Affected:** N/A
 802
 803 #### Windows (GPO)
 804 ```
 805 Software\Policies\Mozilla\Firefox\BlockAboutConfig = 0x1 | 0x0
 806 ```
 807 #### Windows (Intune)
 808 OMA-URI:
 809 ```
 810 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox/BlockAboutConfig
 811 ```
 812 Value (string):
 813 ```
 814 <enabled/> or <disabled/>
 815 ```
 816 #### macOS
 817 ```
 818 <dict>
 819   <key>BlockAboutConfig</key>
 820   <true/> | <false/>
 821 </dict>
 822 ```
 823 #### policies.json
 824 ```
 825 {
 826   "policies": {
 827     "BlockAboutConfig": true | false
 828   }
 829 }
 830 ```
 831 ### BlockAboutProfiles
 832
 833 Block access to About Profiles (about:profiles).
 834
 835 **Compatibility:** Firefox 60, Firefox ESR 60\
 836 **CCK2 Equivalent:** `disableAboutProfiles`\
 837 **Preferences Affected:** N/A
 838
 839 #### Windows (GPO)
 840 ```
 841 Software\Policies\Mozilla\Firefox\BlockAboutProfiles = 0x1 | 0x0
 842 ```
 843 #### Windows (Intune)
 844 OMA-URI:
 845 ```
 846 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox/BlockAboutProfiles
 847 ```
 848 Value (string):
 849 ```
 850 <enabled/> or <disabled/>
 851 ```
 852 #### macOS
 853 ```
 854 <dict>
 855   <key>BlockAboutProfiles</key>
 856   <true/> | <false/>
 857 </dict>
 858 ```
 859 #### policies.json
 860 ```
 861 {
 862   "policies": {
 863     "BlockAboutProfiles": true | false
 864   }
 865 }
 866 ```
 867 ### BlockAboutSupport
 868
 869 Block access to Troubleshooting Information (about:support).
 870
 871 **Compatibility:** Firefox 60, Firefox ESR 60\
 872 **CCK2 Equivalent:** `disableAboutSupport`\
 873 **Preferences Affected:** N/A
 874
 875 #### Windows (GPO)
 876 ```
 877 Software\Policies\Mozilla\Firefox\BlockAboutSupport = 0x1 | 0x0
 878 ```
 879 #### Windows (Intune)
 880 OMA-URI:
 881 ```
 882 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox/BlockAboutSupport
 883 ```
 884 Value (string):
 885 ```
 886 <enabled/> or <disabled/>
 887 ```
 888 #### macOS
 889 ```
 890 <dict>
 891   <key>BlockAboutSupport</key>
 892   <true/> | <false/>
 893 </dict>
 894 ```
 895 #### policies.json
 896 ```
 897 {
 898   "policies": {
 899     "BlockAboutSupport": true | false
 900   }
 901 }
 902 ```
 903 ### Bookmarks
 904
 905 Note: [`ManagedBookmarks`](#managedbookmarks) is the new recommended way to add bookmarks. This policy will continue to be supported.
 906
 907 Add bookmarks in either the bookmarks toolbar or menu. Only `Title` and `URL` are required. If `Placement` is not specified, the bookmark will be placed on the toolbar. If `Folder` is specified, it is automatically created and bookmarks with the same folder name are grouped together.
 908
 909 If you want to clear all bookmarks set with this policy, you can set the value to an empty array (```[]```). This can be on Windows via the new Bookmarks (JSON) policy available with GPO and Intune.
 910
 911 **Compatibility:** Firefox 60, Firefox ESR 60\
 912 **CCK2 Equivalent:** `bookmarks.toolbar`,`bookmarks.menu`\
 913 **Preferences Affected:** N/A
 914
 915 #### Windows (GPO)
 916 ```
 917 Software\Policies\Mozilla\Firefox\Bookmarks\1\Title = "Example"
 918 Software\Policies\Mozilla\Firefox\Bookmarks\1\URL = "https://example.com"
 919 Software\Policies\Mozilla\Firefox\Bookmarks\1\Favicon = "https://example.com/favicon.ico"
 920 Software\Policies\Mozilla\Firefox\Bookmarks\1\Placement = "toolbar" | "menu"
 921 Software\Policies\Mozilla\Firefox\Bookmarks\1\Folder = "FolderName"
 922
 923 Software\Policies\Mozilla\Firefox\Bookmarks (REG_MULTI_SZ) =
 924 ```
 925 []
 926 ```
 927
 928 ```
 929 #### Windows (Intune)
 930 OMA-URI:
 931 ```
 932 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~Bookmarks/Bookmark01
 933 ```
 934 Value (string):
 935 ```
 936 <enabled/>
 937 <data id="BookmarkTitle" value="Example"/>
 938 <data id="BookmarkURL" value="https://example.com"/>
 939 <data id="BookmarkFavicon" value="https://example.com/favicon.ico"/>
 940 <data id="BookmarkPlacement" value="toolbar | menu"/>
 941 <data id="BookmarkFolder" value="FolderName"/>
 942 ```
 943 OMA-URI:
 944 ```
 945 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox/Bookmarks
 946 ```
 947 Value (string):
 948 ```
 949 <enabled/>
 950 <data id="JSON" value='[]'/>
 951 ```
 952 If you are using custom ADMX and ADML administrative templates in Intune, you can use this OMA-URI instead
 953 to workaround the limit on the length of strings. Put all of your JSON on one line.
 954
 955 OMA-URI:
 956 ```
 957 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~Extensions/BookmarksOneLine
 958 ```
 959 Value (string):
 960 ```
 961 <enabled/>
 962 <data id="JSONOneLine" value='[]'/>
 963 ```
 964 #### macOS
 965 ```
 966 <dict>
 967   <key>Bookmarks</key>
 968   <array>
 969     <dict>
 970       <key>Title</key>
 971       <string>Example</string>
 972       <key>URL</key>
 973       <string>https://example.com</string>
 974       <key>Favicon</key>
 975       <string>https://example.com/favicon.ico</string>
 976       <key>Placement</key>
 977       <string>toolbar | menu</string>
 978       <key>Folder</key>
 979       <string>FolderName</string>
 980     </dict>
 981   </array>
 982 </dict>
 983 ```
 984 #### policies.json
 985 ```
 986 {
 987   "policies": {
 988     "Bookmarks": [
 989       {
 990         "Title": "Example",
 991         "URL": "https://example.com",
 992         "Favicon": "https://example.com/favicon.ico",
 993         "Placement": "toolbar" | "menu",
 994         "Folder": "FolderName"
 995       }
 996     ]
 997   }
 998 }
 999 ```
1000 ### CaptivePortal
1001 Enable or disable the detection of captive portals.
1002
1003 **Compatibility:** Firefox 67, Firefox ESR 60.7\
1004 **CCK2 Equivalent:** N/A\
1005 **Preferences Affected:** `network.captive-portal-service.enabled`
1006
1007 #### Windows (GPO)
1008 ```
1009 Software\Policies\Mozilla\Firefox\CaptivePortal = 0x1 | 0x0
1010 ```
1011 #### Windows (Intune)
1012 OMA-URI:
1013 ```
1014 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox/CaptivePortal
1015 ```
1016 Value (string):
1017 ```
1018 <enabled/> or <disabled/>
1019 ```
1020 #### macOS
1021 ```
1022 <dict>
1023   <key>CaptivePortal</key>
1024   <true/> | <false/>
1025 </dict>
1026 ```
1027 #### policies.json
1028 ```
1029 {
1030   "policies": {
1031     "CaptivePortal": true | false
1032   }
1033 }
1034 ```
1035 ### Certificates
1036
1037 ### Certificates | ImportEnterpriseRoots
1038
1039 Trust certificates that have been added to the operating system certificate store by a user or administrator.
1040
1041 Note: This policy only works on Windows and macOS. For Linux discussion, see [bug 1600509](https://bugzilla.mozilla.org/show_bug.cgi?id=1600509).
1042
1043 See https://support.mozilla.org/kb/setting-certificate-authorities-firefox for more detail.
1044
1045 **Compatibility:** Firefox 60, Firefox ESR 60 (macOS support in Firefox 63, Firefox ESR 68)\
1046 **CCK2 Equivalent:** N/A\
1047 **Preferences Affected:** `security.enterprise_roots.enabled`
1048
1049 #### Windows (GPO)
1050 ```
1051 Software\Policies\Mozilla\Firefox\Certificates\ImportEnterpriseRoots = 0x1 | 0x0
1052 ```
1053 #### Windows (Intune)
1054 OMA-URI:
1055 ```
1056 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~Certificates/Certificates_ImportEnterpriseRoots
1057 ```
1058 Value (string):
1059 ```
1060 <enabled/> or <disabled/>
1061 ```
1062 #### macOS
1063 ```
1064 <dict>
1065   <key>Certificates</key>
1066   <dict>
1067     <key>ImportEnterpriseRoots</key>
1068     <true/> | <false/>
1069   </dict>
1070 </dict>
1071 ```
1072 #### policies.json
1073 ```
1074 {
1075   "policies": {
1076     "Certificates": {
1077       "ImportEnterpriseRoots": true | false
1078     }
1079   }
1080 }
1081 ```
1082 ### Certificates | Install
1083
1084 Install certificates into the Firefox certificate store. If only a filename is specified, Firefox searches for the file in the following locations:
1085
1086 - Windows
1087   - %USERPROFILE%\AppData\Local\Mozilla\Certificates
1088   - %USERPROFILE%\AppData\Roaming\Mozilla\Certificates
1089 - macOS
1090   - /Library/Application Support/Mozilla/Certificates
1091   - ~/Library/Application Support/Mozilla/Certificates
1092 - Linux
1093   - /usr/lib/mozilla/certificates
1094   - /usr/lib64/mozilla/certificates
1095   - ~/.mozilla/certificates
1096
1097 Starting with Firefox 65, Firefox 60.5 ESR, a fully qualified path can be used, including UNC paths. You should use the native path style for your operating system. We do not support using %USERPROFILE% or other environment variables on Windows.
1098
1099 If you are specifying the path in the policies.json file on Windows, you need to escape your backslashes (`\\`) which means that for UNC paths, you need to escape both (`\\\\`). If you use group policy, you only need one backslash.
1100
1101 Certificates are installed using the trust string `CT,CT,`.
1102
1103 Binary (DER) and ASCII (PEM) certificates are both supported.
1104
1105 **Compatibility:** Firefox 64, Firefox ESR 64\
1106 **CCK2 Equivalent:** `certs.ca`\
1107 **Preferences Affected:** N/A
1108
1109 #### Windows (GPO)
1110 ```
1111 Software\Policies\Mozilla\Firefox\Certificates\Install\1 = "cert1.der"
1112 Software\Policies\Mozilla\Firefox\Certificates\Install\2 = "C:\Users\username\cert2.pem"
1113 ```
1114 #### Windows (Intune)
1115 OMA-URI:
1116 ```
1117 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~Certificates/Certificates_Install
1118 ```
1119 Value (string):
1120 ```
1121 <enabled/>
1122 <data id="Certificates_Install" value="1&#xF000;cert1.der&#xF000;2&#xF000;C:\Users\username\cert2.pem"/>
1123 ```
1124 #### macOS
1125 ```
1126 <dict>
1127   <key>Certificates</key>
1128   <dict>
1129     <key>Install</key>
1130     <array>
1131       <string>cert1.der</string>
1132       <string>/Users/username/cert2.pem</string>
1133     </array>
1134   </dict>
1135 </dict>
1136 ```
1137 #### policies.json
1138 ```
1139 {
1140   "policies": {
1141     "Certificates": {
1142       "Install": ["cert1.der", "/home/username/cert2.pem"]
1143     }
1144   }
1145 }
1146 ```
1147 ### Containers
1148 Set policies related to [containers](https://addons.mozilla.org/firefox/addon/multi-account-containers/).
1149
1150 Currently you can set the initial set of containers.
1151
1152 For each container, you can specify the name, icon, and color.
1153
1154 | Name | Description |
1155 | --- | --- |
1156 | `name`| Name of container
1157 | `icon` | Can be `fingerprint`, `briefcase`, `dollar`, `cart`, `vacation`, `gift`, `food`, `fruit`, `pet`, `tree`, `chill`, `circle`, `fence`
1158 | `color` | Can be `blue`, `turquoise`, `green`, `yellow`, `orange`, `red`, `pink`, `purple`, `toolbar`
1159
1160 **Compatibility:** Firefox 113\
1161 **CCK2 Equivalent:** N/A\
1162 **Preferences Affected:** N/A
1163
1164 #### Windows (GPO)
1165 Software\Policies\Mozilla\Firefox\Containers (REG_MULTI_SZ) =
1166 ```
1167 {
1168   "Default": [
1169     {
1170       "name": "My container",
1171       "icon": "pet",
1172       "color": "turquoise"
1173     }
1174   ]
1175 }
1176 ```
1177 #### Windows (Intune)
1178 OMA-URI:
1179 ```
1180 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox/Containers
1181 ```
1182 Value (string):
1183 ```
1184 <enabled/>
1185 <data id="JSON" value='
1186 {
1187   "Default": [
1188     {
1189       "name": "My container",
1190       "icon": "pet",
1191       "color": "turquoise"
1192     }
1193   ]
1194 }
1195 '/>
1196 ```
1197 If you are using custom ADMX and ADML administrative templates in Intune, you can use this OMA-URI instead
1198 to workaround the limit on the length of strings. Put all of your JSON on one line.
1199
1200 OMA-URI:
1201 ```
1202 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~Extensions/ContainersOneLine
1203 ```
1204 Value (string):
1205 ```
1206 <enabled/>
1207 <data id="JSONOneLine" value='{}'/>
1208 ```
1209 #### macOS
1210 ```
1211 <dict>
1212   <key>Default</key>
1213   <dict>
1214     <key>Containers</key>
1215     <array>
1216       <dict>
1217         <key>name</key>
1218         <string>My container</string>
1219         <key>icon</key>
1220         <string>pet</string>
1221         <key>color</key>
1222         <string>turquoise</string>
1223       </dict>
1224     </array>
1225   </dict>
1226 </dict>
1227 ```
1228 #### policies.json
1229 ```
1230 {
1231   "policies": {
1232     "Containers": {
1233       "Default": [
1234         {
1235           "name": "My container",
1236           "icon": "pet",
1237           "color": "turquoise"
1238         }
1239       ]
1240     }
1241   }
1242 }
1243 ```
1244 ### ContentAnalysis
1245 Configure Firefox to use an agent for Data Loss Prevention (DLP) that is compatible with the [Google Chrome Content Analysis Connector Agent SDK](https://github.com/chromium/content_analysis_sdk).
1246
1247 `AgentName` is the name of the DLP agent. This is used in dialogs and notifications about DLP operations. The default is "A DLP Agent".
1248
1249 `AgentTimeout` is the timeout in number of seconds after a DLP request is sent to the agent. After this timeout, the request will be denied unless `DefaultResult` is set to 1 or 2. The default is 30.
1250
1251 `AllowUrlRegexList` is a space-separated list of regular expressions that indicates URLs for which DLP operations will always be allowed without consulting the agent. The default is "^about:(?!blank&#124;srcdoc).*", meaning that any pages that start with "about:" will be exempt from DLP except for "about:blank" and "about:srcdoc", as these can be controlled by web content.
1252
1253 `BypassForSameTabOperations` indicates whether Firefox will automatically allow DLP requests whose data comes from the same tab and frame - for example, if data is copied to the clipboard and then pasted on the same page. The default is false.
1254
1255 `ClientSignature` indicates the required signature of the DLP agent connected to the pipe. If this is a non-empty string and the DLP agent does not have a signature with a Subject Name that exactly matches this value, Firefox will not connect to the pipe. The default is the empty string.
1256
1257 `DefaultResult` indicates the desired behavior for DLP requests if there is a problem connecting to the DLP agent. The default is 0.
1258
1259 | Value | Description
1260 | --- | --- |
1261 | 0 | Deny the request (default)
1262 | 1 | Warn the user and allow them to choose whether to allow or deny
1263 | 2 | Allow the request
1264
1265 `DenyUrlRegexList` is a space-separated list of regular expressions that indicates URLs for which DLP operations will always be denied without consulting the agent. The default is the empty string.
1266
1267 `Enabled` indicates whether Firefox should use DLP. Note that if this value is true and no DLP agent is running, all DLP requests will be denied unless `DefaultResult` is set to 1 or 2.
1268
1269 `IsPerUser` indicates whether the pipe the DLP agent has created is per-user or per-system. The default is true, meaning per-user.
1270
1271 `PipePathName` is the name of the pipe the DLP agent has created and Firefox will connect to. The default is "path_user".
1272
1273 `ShowBlockedResult` indicates whether Firefox should show a notification when a DLP request is denied. The default is true.
1274
1275 **Compatibility:** Firefox 132\
1276 **CCK2 Equivalent:** N/A\
1277 **Preferences Affected:** `browser.contentanalysis.agent_name`, `browser.contentanalysis.agent_timeout`, `browser.contentanalysis.allow_url_regex_list`, `browser.contentanalysis.bypass_for_same_tab_operations`, `browser.contentanalysis.client_signature`, `browser.contentanalysis.default_result`, `browser.contentanalysis.deny_url_regex_list`, `browser.contentanalysis.enabled`, `browser.contentanalysis.is_per_user`, `browser.contentanalysis.pipe_path_name`, `browser.contentanalysis.show_blocked_result`
1278
1279 #### Windows (GPO)
1280 ```
1281 Software\Policies\Mozilla\Firefox\ContentAnalysis\AgentName = "My DLP Product"
1282 Software\Policies\Mozilla\Firefox\ContentAnalysis\AgentTimeout = 60
1283 Software\Policies\Mozilla\Firefox\ContentAnalysis\AllowUrlRegexList = "https://example\.com/.* https://subdomain\.example\.com/.*"
1284 Software\Policies\Mozilla\Firefox\ContentAnalysis\BypassForSameTabOperations = 0x1 | 0x0
1285 Software\Policies\Mozilla\Firefox\ContentAnalysis\ClientSignature = "My DLP Company"
1286 Software\Policies\Mozilla\Firefox\ContentAnalysis\DefaultResult = 0x0 | 0x1 | 0x2
1287 Software\Policies\Mozilla\Firefox\ContentAnalysis\DenyUrlRegexList = "https://example\.com/.* https://subdomain\.example\.com/.*"
1288 Software\Policies\Mozilla\Firefox\ContentAnalysis\Enabled = 0x1 | 0x0
1289 Software\Policies\Mozilla\Firefox\ContentAnalysis\IsPerUser = 0x1 | 0x0
1290 Software\Policies\Mozilla\Firefox\ContentAnalysis\PipePathName = "pipe_custom_name"
1291 Software\Policies\Mozilla\Firefox\ContentAnalysis\ShowBlockedResult = 0x1 | 0x0
1292 ```
1293
1294 #### Windows (Intune)
1295 OMA-URI:
1296 ```
1297 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~ContentAnalysis/ContentAnalysis_AgentName
1298 ```
1299 Value (string):
1300 ```
1301 <enabled/>
1302 <data id="ContentAnalysis_AgentName" value="My DLP Product"/>
1303 ```
1304 OMA-URI:
1305 ```
1306 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~ContentAnalysis/ContentAnalysis_AgentTimeout
1307 ```
1308 Value (string):
1309 ```
1310 <enabled/>
1311 <data id="ContentAnalysis_AgentTimeout" value="60"/>
1312 ```
1313 OMA-URI:
1314 ```
1315 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~ContentAnalysis/ContentAnalysis_AllowUrlRegexList
1316 ```
1317 Value (string):
1318 ```
1319 <enabled/>
1320 <data id="ContentAnalysis_AllowUrlRegexList" value="https://example\.com/.* https://subdomain\.example\.com/.*"/>
1321 ```
1322 OMA-URI:
1323 ```
1324 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~ContentAnalysis/ContentAnalysis_BypassForSameTabOperations
1325 ```
1326 Value (string):
1327 ```
1328 <enabled/> or <disabled/>
1329 ```
1330 OMA-URI:
1331 ```
1332 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~ContentAnalysis/ContentAnalysis_ClientSignature
1333 ```
1334 Value (string):
1335 ```
1336 <enabled/>
1337 <data id="ContentAnalysis_ClientSignature" value="My DLP Company"/>
1338 ```
1339 OMA-URI:
1340 ```
1341 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~ContentAnalysis/ContentAnalysis_DefaultResult
1342 ```
1343 Value (string):
1344 ```
1345 <enabled/>
1346 <data id="ContentAnalysis_DefaultResult" value="1"/>
1347 ```
1348 OMA-URI:
1349 ```
1350 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~ContentAnalysis/ContentAnalysis_DenyUrlRegexList
1351 ```
1352 Value (string):
1353 ```
1354 <enabled/>
1355 <data id="ContentAnalysis_DenyUrlRegexList" value="https://example\.com/.* https://subdomain\.example\.com/.*"/>
1356 ```
1357 OMA-URI:
1358 ```
1359 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~ContentAnalysis/ContentAnalysis_Enabled
1360 ```
1361 Value (string):
1362 ```
1363 <enabled/> or <disabled/>
1364 ```
1365 OMA-URI:
1366 ```
1367 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~ContentAnalysis/ContentAnalysis_IsPerUser
1368 ```
1369 Value (string):
1370 ```
1371 <enabled/> or <disabled/>
1372 ```
1373 OMA-URI:
1374 ```
1375 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~ContentAnalysis/ContentAnalysis_PipePathName
1376 ```
1377 Value (string):
1378 ```
1379 <enabled/>
1380 <data id="ContentAnalysis_PipePathName" value="pipe_custom_name"/>
1381 ```
1382 OMA-URI:
1383 ```
1384 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~ContentAnalysis/ContentAnalysis_ShowBlockedResult
1385 ```
1386 Value (string):
1387 ```
1388 <enabled/> or <disabled/>
1389 ```
1390
1391 #### policies.json
1392 ```
1393 {
1394   "policies": {
1395     "ContentAnalysis": {
1396       "AgentName": "My DLP Product",
1397       "AgentTimeout": 60,
1398       "AllowUrlRegexList": "https://example\.com/.* https://subdomain\.example\.com/.*",
1399       "BypassForSameTabOperations": true | false,
1400       "ClientSignature": "My DLP Company",
1401       "DefaultResult": 0 | 1 | 2,
1402       "DenyUrlRegexList": "https://example\.com/.* https://subdomain\.example\.com/.*",
1403       "Enabled": true | false,
1404       "IsPerUser": true | false,
1405       "PipePathName": "pipe_custom_name",
1406       "ShowBlockedResult": true | false,
1407     }
1408   }
1409 }
1410 ```
1411
1412 ### Cookies
1413 Configure cookie preferences.
1414
1415 `Allow` is a list of origins (not domains) where cookies are always allowed. You must include http or https.
1416
1417 `AllowSession` is a list of origins (not domains) where cookies are only allowed for the current session. You must include http or https.
1418
1419 `Block` is a list of origins (not domains) where cookies are always blocked. You must include http or https.
1420
1421 `Behavior` sets the default behavior for cookies based on the values below.
1422
1423 `BehaviorPrivateBrowsing` sets the default behavior for cookies in private browsing based on the values below.
1424
1425 | Value | Description
1426 | --- | --- |
1427 | accept | Accept all cookies
1428 | reject-foreign | Reject third party cookies
1429 | reject | Reject all cookies
1430 | limit-foreign | Reject third party cookies for sites you haven't visited
1431 | reject-tracker | Reject cookies for known trackers (default)
1432 | reject-tracker-and-partition-foreign | Reject cookies for known trackers and partition third-party cookies (Total Cookie Protection) (default for private browsing)
1433
1434 `Locked` prevents the user from changing cookie preferences.
1435
1436 `Default` determines whether cookies are accepted at all. (*Deprecated*. Use `Behavior` instead)
1437
1438 `AcceptThirdParty` determines how third-party cookies are handled. (*Deprecated*. Use `Behavior` instead)
1439
1440 `RejectTracker` only rejects cookies for trackers. (*Deprecated*. Use `Behavior` instead)
1441
1442 `ExpireAtSessionEnd` determines when cookies expire. (*Deprecated*. Use [`SanitizeOnShutdown`](#sanitizeonshutdown-selective) instead)
1443
1444 **Compatibility:** Firefox 60, Firefox ESR 60 (RejectTracker added in Firefox 63, AllowSession added in Firefox 79/78.1, Behavior added in Firefox 95/91.4)\
1445 **CCK2 Equivalent:** N/A\
1446 **Preferences Affected:** `network.cookie.cookieBehavior`, `network.cookie.cookieBehavior.pbmode`, `network.cookie.lifetimePolicy`
1447
1448 #### Windows (GPO)
1449 ```
1450 Software\Policies\Mozilla\Firefox\Cookies\Allow\1 = "https://example.com"
1451 Software\Policies\Mozilla\Firefox\Cookies\AllowSession\1 = "https://example.edu"
1452 Software\Policies\Mozilla\Firefox\Cookies\Block\1 = "https://example.org"
1453 Software\Policies\Mozilla\Firefox\Cookies\Behavior = "accept" | "reject-foreign" | "reject" | "limit-foreign" | "reject-tracker" | "reject-tracker-and-partition-foreign"
1454 Software\Policies\Mozilla\Firefox\Cookies\BehaviorPrivateBrowsing = "accept" | "reject-foreign" | "reject" | "limit-foreign" | "reject-tracker" | "reject-tracker-and-partition-foreign"
1455 Software\Policies\Mozilla\Firefox\Cookies\Locked = 0x1 | 0x0
1456 ```
1457 #### Windows (Intune)
1458 OMA-URI:
1459 ```
1460 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~Cookies/Cookies_Allow
1461 ```
1462 Value (string):
1463 ```
1464 <enabled/>
1465 <data id="Permissions" value="1&#xF000;https://example.com"/>
1466 ```
1467 OMA-URI:
1468 ```
1469 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~Cookies/Cookies_AllowSession
1470 ```
1471 Value (string):
1472 ```
1473 <enabled/>
1474 <data id="Permissions" value="1&#xF000;https://example.edu"/>
1475 ```
1476 OMA-URI:
1477 ```
1478 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~Cookies/Cookies_Block
1479 ```
1480 Value (string):
1481 ```
1482 <enabled/>
1483 <data id="Permissions" value="1&#xF000;https://example.org"/>
1484 ```
1485 OMA-URI:
1486 ```
1487 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~Cookies/Cookies_Locked
1488 ```
1489 Value (string):
1490 ```
1491 <enabled/> or <disabled/>
1492 ```
1493 OMA-URI:
1494 ```
1495 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~Cookies/Cookies_Behavior
1496 ```
1497 Value (string):
1498 ```
1499 <enabled/>
1500 <data id="Cookies_Behavior" value="accept | reject-foreign | reject | limit-foreign | reject-tracker | reject-tracker-and-partition-foreign"/>
1501 ```
1502 OMA-URI:
1503 ```
1504 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~Cookies/Cookies_BehaviorPrivateBrowsing
1505 ```
1506 Value (string):
1507 ```
1508 <enabled/>
1509 <data id="Cookies_BehaviorPrivateBrowsing" value="accept | reject-foreign | reject | limit-foreign | reject-tracker | reject-tracker-and-partition-foreign"/>
1510 ```
1511 #### macOS
1512 ```
1513 <dict>
1514   <key>Cookies</key>
1515   <dict>
1516     <key>Allow</key>
1517     <array>
1518       <string>http://example.com</string>
1519     </array>
1520     <key>AllowSession</key>
1521     <array>
1522       <string>http://example.edu</string>
1523     </array>
1524     <key>Block</key>
1525     <array>
1526       <string>http://example.org</string>
1527     </array>
1528     <key>Locked</key>
1529     <true/> | <false/>
1530     <key>Behavior</key>
1531     <string>accept | reject-foreign | reject | limit-foreign | reject-tracker | reject-tracker-and-partition-foreign</string>
1532     <key>BehaviorPrivateBrowsing</key>
1533     <string>accept | reject-foreign | reject | limit-foreign | reject-tracker | reject-tracker-and-partition-foreign</string>
1534   </dict>
1535 </dict>
1536 ```
1537 #### policies.json
1538 ```
1539 {
1540   "policies": {
1541     "Cookies": {
1542       "Allow": ["http://example.org/"],
1543       "AllowSession": ["http://example.edu/"],
1544       "Block": ["http://example.edu/"],
1545       "Locked": true | false,
1546       "Behavior": "accept" | "reject-foreign" | "reject" | "limit-foreign" | "reject-tracker" | "reject-tracker-and-partition-foreign",
1547       "BehaviorPrivateBrowsing": "accept" | "reject-foreign" | "reject" | "limit-foreign" | "reject-tracker" | "reject-tracker-and-partition-foreign",
1548     }
1549   }
1550 }
1551 ```
1552 ### DefaultDownloadDirectory
1553 Set the default download directory.
1554
1555 You can use ${home} for the native home directory.
1556
1557 **Compatibility:** Firefox 68, Firefox ESR 68\
1558 **CCK2 Equivalent:** N/A\
1559 **Preferences Affected:** `browser.download.dir`, `browser.download.folderList`
1560
1561 #### Windows (GPO)
1562 ```
1563 Software\Policies\Mozilla\Firefox\DefaultDownloadDirectory = "${home}\Downloads"
1564 ```
1565 #### Windows (Intune)
1566 OMA-URI:
1567 ```
1568 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox/DefaultDownloadDirectory
1569 ```
1570 Value (string):
1571 ```
1572 <enabled/>
1573 <data id="Preferences_String" value="${home}\Downloads"/>
1574 ```
1575 #### macOS
1576 ```
1577 <dict>
1578   <key>DefaultDownloadDirectory</key>
1579   <string>${home}/Downloads</string>
1580 </dict>
1581 ```
1582 #### policies.json (macOS and Linux)
1583 ```
1584 {
1585   "policies": {
1586     "DefaultDownloadDirectory": "${home}/Downloads"
1587   }
1588 }
1589 ```
1590 #### policies.json (Windows)
1591 ```
1592 {
1593   "policies": {
1594     "DefaultDownloadDirectory": "${home}\\Downloads"
1595   }
1596 }
1597 ```
1598 ### DisableAppUpdate
1599 Turn off application updates within Firefox.
1600
1601 **Compatibility:** Firefox 60, Firefox ESR 60\
1602 **CCK2 Equivalent:** `disableFirefoxUpdates`\
1603 **Preferences Affected:** N/A
1604
1605 #### Windows (GPO)
1606 ```
1607 Software\Policies\Mozilla\Firefox\DisableAppUpdate = 0x1 | 0x0
1608 ```
1609 #### Windows (Intune)
1610 OMA-URI:
1611 ```
1612 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox/DisableAppUpdate
1613 ```
1614 Value (string):
1615 ```
1616 <enabled/> or <disabled/>
1617 ```
1618 #### macOS
1619 ```
1620 <dict>
1621   <key>DisableAppUpdate</key>
1622   <true/> | <false/>
1623 </dict>
1624 ```
1625 #### policies.json
1626 ```
1627 {
1628   "policies": {
1629     "DisableAppUpdate": true | false
1630   }
1631 }
1632 ```
1633 ### DisableBuiltinPDFViewer
1634 Disable the built in PDF viewer. PDF files are downloaded and sent externally.
1635
1636 **Compatibility:** Firefox 60, Firefox ESR 60\
1637 **CCK2 Equivalent:** `disablePDFjs`\
1638 **Preferences Affected:** `pdfjs.disabled`
1639
1640 #### Windows (GPO)
1641 ```
1642 Software\Policies\Mozilla\Firefox\DisableBuiltinPDFViewer = 0x1 | 0x0
1643 ```
1644 #### Windows (Intune)
1645 OMA-URI:
1646 ```
1647 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox/DisableBuiltinPDFViewer
1648 ```
1649 Value (string):
1650 ```
1651 <enabled/> or <disabled/>
1652 ```
1653 #### macOS
1654 ```
1655 <dict>
1656   <key>DisableBuiltinPDFViewer</key>
1657   <true/> | <false/>
1658 </dict>
1659 ```
1660 #### policies.json
1661 ```
1662 {
1663   "policies": {
1664     "DisableBuiltinPDFViewer": true | false
1665   }
1666 }
1667 ```
1668 ### DisabledCiphers
1669 Disable specific cryptographic ciphers, listed below.
1670
1671 ```
1672 TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256
1673 TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256
1674 TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256
1675 TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256
1676 TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384
1677 TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384
1678 TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA
1679 TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA
1680 TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA
1681 TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA
1682 TLS_DHE_RSA_WITH_AES_128_CBC_SHA
1683 TLS_DHE_RSA_WITH_AES_256_CBC_SHA
1684 TLS_RSA_WITH_AES_128_GCM_SHA256
1685 TLS_RSA_WITH_AES_256_GCM_SHA384
1686 TLS_RSA_WITH_AES_128_CBC_SHA
1687 TLS_RSA_WITH_AES_256_CBC_SHA
1688 TLS_RSA_WITH_3DES_EDE_CBC_SHA
1689 ```
1690
1691 **Preferences Affected:** `security.ssl3.ecdhe_rsa_aes_128_gcm_sha256`, `security.ssl3.ecdhe_ecdsa_aes_128_gcm_sha256`, `security.ssl3.ecdhe_ecdsa_chacha20_poly1305_sha256`, `security.ssl3.ecdhe_rsa_chacha20_poly1305_sha256`, `security.ssl3.ecdhe_ecdsa_aes_256_gcm_sha384`, `security.ssl3.ecdhe_rsa_aes_256_gcm_sha384`, `security.ssl3.ecdhe_rsa_aes_128_sha`, `security.ssl3.ecdhe_ecdsa_aes_128_sha`, `security.ssl3.ecdhe_rsa_aes_256_sha`, `security.ssl3.ecdhe_ecdsa_aes_256_sha`, `security.ssl3.dhe_rsa_aes_128_sha`, `security.ssl3.dhe_rsa_aes_256_sha`, `security.ssl3.rsa_aes_128_gcm_sha256`, `security.ssl3.rsa_aes_256_gcm_sha384`, `security.ssl3.rsa_aes_128_sha`, `security.ssl3.rsa_aes_256_sha`, `security.ssl3.deprecated.rsa_des_ede3_sha`
1692
1693 ---
1694 **Note:**
1695
1696 This policy was updated in Firefox 78 to allow enabling ciphers as well. Setting the value to true disables the cipher, setting the value to false enables the cipher. Previously setting the value to true or false disabled the cipher.
1697
1698 ---
1699 **Compatibility:** Firefox 76, Firefox ESR 68.8 (TLS_RSA_WITH_AES_128_GCM_SHA256 and TLS_RSA_WITH_AES_256_GCM_SHA384 were added in Firefox 78, TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA, TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA, TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA38, TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256, TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384, and TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256 were added in Firefox 97 and Firefox 91.6)\
1700 **CCK2 Equivalent:** N/A\
1701 **Preferences Affected:** N/A
1702
1703 #### Windows (GPO)
1704 ```
1705 Software\Policies\Mozilla\Firefox\DisabledCiphers\CIPHER_NAME = 0x1 | 0x0
1706 ```
1707 #### Windows (Intune)
1708 OMA-URI:
1709 ```
1710 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~DisabledCiphers/DisabledCiphers_CIPHER_NAME
1711
1712 ```
1713 Value (string):
1714 ```
1715 <enabled/> or <disabled/>
1716 ```
1717 #### macOS
1718 ```
1719 <dict>
1720   <key>DisabledCiphers</key>
1721     <dict>
1722       <key>CIPHER_NAME</key>
1723       <true/> | <false/>
1724     </dict>
1725 </dict>
1726 ```
1727 #### policies.json
1728 ```
1729 {
1730   "policies": {
1731     "DisabledCiphers": {
1732       "CIPHER_NAME": true | false,
1733     }
1734   }
1735 }
1736 ```
1737 ### DisableDefaultBrowserAgent
1738 Prevent the default browser agent from taking any actions. Only applicable to Windows; other platforms don’t have the agent.
1739
1740 The browser agent is a Windows-only scheduled task which runs in the background to collect and submit data about the browser that the user has set as their OS default. More information is available [here](https://firefox-source-docs.mozilla.org/toolkit/mozapps/defaultagent/default-browser-agent/index.html).
1741
1742 **Compatibility:** Firefox 75, Firefox ESR 68.7 (Windows only)\
1743 **CCK2 Equivalent:** N/A\
1744 **Preferences Affected:** N/A
1745
1746 #### Windows (GPO)
1747 ```
1748 Software\Policies\Mozilla\Firefox\DisableDefaultBrowserAgent = 0x1 | 0x0
1749 ```
1750 #### Windows (Intune)
1751 OMA-URI:
1752 ```
1753 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox/DisableDefaultBrowserAgent
1754 ```
1755 Value (string):
1756 ```
1757 <enabled/> or <disabled/>
1758 ```
1759 #### policies.json
1760 ```
1761 {
1762   "policies": {
1763     "DisableDefaultBrowserAgent": true | false
1764   }
1765 }
1766 ```
1767 ### DisableDeveloperTools
1768 Remove access to all developer tools.
1769
1770 **Compatibility:** Firefox 60, Firefox ESR 60\
1771 **CCK2 Equivalent:** `removeDeveloperTools`\
1772 **Preferences Affected:** `devtools.policy.disabled`
1773
1774 #### Windows (GPO)
1775 ```
1776 Software\Policies\Mozilla\Firefox\DisableDeveloperTools = 0x1 | 0x0`
1777 ```
1778 #### Windows (Intune)
1779 OMA-URI:
1780 ```
1781 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox/DisableDeveloperTools
1782 ```
1783 Value (string):
1784 ```
1785 <enabled/> or <disabled/>
1786 ```
1787 #### macOS
1788 ```
1789 <dict>
1790   <key>DisableDeveloperTools</key>
1791   <true/> | <false/>
1792 </dict>
1793 ```
1794 #### policies.json
1795 ```
1796 {
1797   "policies": {
1798     "DisableDeveloperTools": true | false
1799   }
1800 }
1801 ```
1802 ### DisableFeedbackCommands
1803 Disable the menus for reporting sites (Submit Feedback, Report Deceptive Site).
1804
1805 **Compatibility:** Firefox 60, Firefox ESR 60\
1806 **CCK2 Equivalent:** N/A\
1807 **Preferences Affected:** N/A
1808
1809 #### Windows (GPO)
1810 ```
1811 Software\Policies\Mozilla\Firefox\DisableFeedbackCommands = 0x1 | 0x0
1812 ```
1813 #### Windows (Intune)
1814 OMA-URI:
1815 ```
1816 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox/DisableFeedbackCommands
1817 ```
1818 Value (string):
1819 ```
1820 <enabled/> or <disabled/>
1821 ```
1822 #### macOS
1823 ```
1824 <dict>
1825   <key>DisableFeedbackCommands</key>
1826   <true/> | <false/>
1827 </dict>
1828 ```
1829 #### policies.json
1830 ```
1831 {
1832   "policies": {
1833     "DisableFeedbackCommands": true | false
1834   }
1835 }
1836 ```
1837 ### DisableEncryptedClientHello
1838 Disable the TLS Feature for Encrypted Client Hello. Note that TLS Client Hellos will still contain an ECH extension, but this extension will not be used by Firefox during the TLS handshake.
1839
1840 **Compatibility:** Firefox 127, Firefox ESR 128\
1841 **CCK2 Equivalent:** N/A\
1842 **Preferences Affected:** `network.dns.echconfig.enabled`, `network.dns.http3_echconfig.enabled`
1843
1844 #### Windows (GPO)
1845 ```
1846 Software\Policies\Mozilla\Firefox\DisableEncryptedClientHello = 0x1 | 0x0
1847 ```
1848 #### Windows (Intune)
1849 OMA-URI:
1850 ```
1851 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox/DisableEncryptedClientHello
1852 ```
1853 Value (string):
1854 ```
1855 <enabled/> or <disabled/>
1856 ```
1857 #### macOS
1858 ```
1859 <dict>
1860   <key>DisableEncryptedClientHello</key>
1861   <true/> | <false/>
1862 </dict>
1863 ```
1864 #### policies.json
1865 ```
1866 {
1867   "policies": {
1868     "DisableEncryptedClientHello": true | false
1869   }
1870 }
1871 ```
1872 ### DisableFirefoxAccounts
1873 Disable Firefox Accounts integration (Sync).
1874
1875 **Compatibility:** Firefox 60, Firefox ESR 60\
1876 **CCK2 Equivalent:** `disableSync`\
1877 **Preferences Affected:** `identity.fxaccounts.enabled`
1878
1879 #### Windows (GPO)
1880 ```
1881 Software\Policies\Mozilla\Firefox\DisableFirefoxAccounts = 0x1 | 0x0
1882 ```
1883 #### Windows (Intune)
1884 OMA-URI:
1885 ```
1886 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox/DisableFirefoxAccounts
1887 ```
1888 Value (string):
1889 ```
1890 <enabled/> or <disabled/>
1891 ```
1892 #### macOS
1893 ```
1894 <dict>
1895   <key>DisableFirefoxAccounts</key>
1896   <true/> | <false/>
1897 </dict>
1898 ```
1899 #### policies.json
1900 ```
1901 {
1902   "policies": {
1903     "DisableFirefoxAccounts": true | false
1904   }
1905 }
1906 ```
1907 ### DisableFirefoxScreenshots
1908 Remove access to Firefox Screenshots.
1909
1910 **Compatibility:** Firefox 60, Firefox ESR 60\
1911 **CCK2 Equivalent:** N/A\
1912 **Preferences Affected:** `extensions.screenshots.disabled`
1913
1914 #### Windows (GPO)
1915 ```
1916 Software\Policies\Mozilla\Firefox\DisableFirefoxScreenshots = 0x1 | 0x0
1917 ```
1918 #### Windows (Intune)
1919 OMA-URI:
1920 ```
1921 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox/DisableFirefoxScreenshots
1922 ```
1923 Value (string):
1924 ```
1925 <enabled/> or <disabled/>
1926 ```
1927 #### macOS
1928 ```
1929 <dict>
1930   <key>DisableFirefoxScreenshots</key>
1931   <true/> | <false/>
1932 </dict>
1933 ```
1934 #### policies.json
1935 ```
1936 {
1937   "policies": {
1938     "DisableFirefoxScreenshots": true | false
1939   }
1940 }
1941 ```
1942 ### DisableFirefoxStudies
1943 Disable Firefox studies (Shield).
1944
1945 **Compatibility:** Firefox 60, Firefox ESR 60\
1946 **CCK2 Equivalent:** N/A\
1947 **Preferences Affected:** `browser.newtabpage.activity-stream.asrouter.userprefs.cfr.addons`, `browser.newtabpage.activity-stream.asrouter.userprefs.cfr.features`
1948
1949 #### Windows (GPO)
1950 ```
1951 Software\Policies\Mozilla\Firefox\DisableFirefoxStudies = 0x1 | 0x0
1952 ```
1953 #### Windows (Intune)
1954 OMA-URI:
1955 ```
1956 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox/DisableFirefoxStudies
1957 ```
1958 Value (string):
1959 ```
1960 <enabled/> or <disabled/>
1961 ```
1962 #### macOS
1963 ```
1964 <dict>
1965   <key>DisableFirefoxStudies</key>
1966   <true/> | <false/>
1967 </dict>
1968 ```
1969 #### policies.json
1970 ```
1971 {
1972   "policies": {
1973     "DisableFirefoxStudies": true | false
1974   }
1975 }
1976 ```
1977 ### DisableForgetButton
1978 Disable the "Forget" button.
1979
1980 **Compatibility:** Firefox 60, Firefox ESR 60\
1981 **CCK2 Equivalent:** `disableForget`\
1982 **Preferences Affected:** N/A
1983
1984 #### Windows (GPO)
1985 ```
1986 Software\Policies\Mozilla\Firefox\DisableForgetButton = 0x1 | 0x0
1987 ```
1988 #### Windows (Intune)
1989 OMA-URI:
1990 ```
1991 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox/DisableForgetButton
1992 ```
1993 Value (string):
1994 ```
1995 <enabled/> or <disabled/>
1996 ```
1997 #### macOS
1998 ```
1999 <dict>
2000   <key>DisableForgetButton</key>
2001   <true/> | <false/>
2002 </dict>
2003 ```
2004 #### policies.json
2005 ```
2006 {
2007   "policies": {
2008     "DisableForgetButton": true | false
2009   }
2010 }
2011 ```
2012 ### DisableFormHistory
2013 Turn off saving information on web forms and the search bar.
2014
2015 **Compatibility:** Firefox 60, Firefox ESR 60\
2016 **CCK2 Equivalent:** `disableFormFill`\
2017 **Preferences Affected:** `browser.formfill.enable`
2018
2019 #### Windows (GPO)
2020 ```
2021 Software\Policies\Mozilla\Firefox\DisableFormHistory = 0x1 | 0x0
2022 ```
2023 #### Windows (Intune)
2024 OMA-URI:
2025 ```
2026 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox/DisableFormHistory
2027 ```
2028 Value (string):
2029 ```
2030 <enabled/> or <disabled/>
2031 ```
2032 #### macOS
2033 ```
2034 <dict>
2035   <key>DisableFormHistory</key>
2036   <true/> | <false/>
2037 </dict>
2038 ```
2039 #### policies.json
2040 ```
2041 {
2042   "policies": {
2043     "DisableFormHistory": true | false
2044   }
2045 }
2046 ```
2047 ### DisableMasterPasswordCreation
2048 Remove the master password functionality.
2049
2050 If this value is true, it works the same as setting [`PrimaryPassword`](#primarypassword) to false and removes the primary password functionality.
2051
2052 If both `DisableMasterPasswordCreation` and `PrimaryPassword` are used, `DisableMasterPasswordCreation` takes precedent.
2053
2054 **Compatibility:** Firefox 60, Firefox ESR 60\
2055 **CCK2 Equivalent:** `noMasterPassword`\
2056 **Preferences Affected:** N/A
2057
2058 #### Windows (GPO)
2059 ```
2060 Software\Policies\Mozilla\Firefox\DisableMasterPasswordCreation = 0x1 | 0x0
2061 ```
2062 #### Windows (Intune)
2063 OMA-URI:
2064 ```
2065 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox/DisableMasterPasswordCreation
2066 ```
2067 Value (string):
2068 ```
2069 <enabled/> or <disabled/>
2070 ```
2071 #### macOS
2072 ```
2073 <dict>
2074   <key>DisableMasterPasswordCreation</key>
2075   <true/> | <false/>
2076 </dict>
2077 ```
2078 #### policies.json
2079 ```
2080 {
2081   "policies": {
2082     "DisableMasterPasswordCreation": true | false
2083   }
2084 }
2085 ```
2086 ### DisablePasswordReveal
2087 Do not allow passwords to be shown in saved logins
2088
2089 **Compatibility:** Firefox 71, Firefox ESR 68.3\
2090 **CCK2 Equivalent:** N/A
2091 **Preferences Affected:** N/A
2092
2093 #### Windows (GPO)
2094 ```
2095 Software\Policies\Mozilla\Firefox\DisablePasswordReveal = 0x1 | 0x0
2096 ```
2097 #### Windows (Intune)
2098 OMA-URI:
2099 ```
2100 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox/DisablePasswordReveal
2101 ```
2102 Value (string):
2103 ```
2104 <enabled/> or <disabled/>
2105 ```
2106 #### macOS
2107 ```
2108 <dict>
2109   <key>DisablePasswordReveal</key>
2110   <true/> | <false/>
2111 </dict>
2112 ```
2113 #### policies.json
2114 ```
2115 {
2116   "policies": {
2117     "DisablePasswordReveal": true | false
2118   }
2119 }
2120 ```
2121 ### DisablePocket
2122 Remove Pocket in the Firefox UI. It does not remove it from the new tab page.
2123
2124 **Compatibility:** Firefox 60, Firefox ESR 60\
2125 **CCK2 Equivalent:** `disablePocket`\
2126 **Preferences Affected:** `extensions.pocket.enabled`
2127
2128 #### Windows (GPO)
2129 ```
2130 Software\Policies\Mozilla\Firefox\DisablePocket = 0x1 | 0x0
2131 ```
2132 #### Windows (Intune)
2133 OMA-URI:
2134 ```
2135 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox/DisablePocket
2136 ```
2137 Value (string):
2138 ```
2139 <enabled/> or <disabled/>
2140 ```
2141 #### macOS
2142 ```
2143 <dict>
2144   <key>DisablePocket</key>
2145   <true/> | <false/>
2146 </dict>
2147 ```
2148 #### policies.json
2149 ```
2150 {
2151   "policies": {
2152     "DisablePocket": true | false
2153   }
2154 }
2155 ```
2156 ### DisablePrivateBrowsing
2157 Remove access to private browsing.
2158
2159 This policy is superseded by [`PrivateBrowsingModeAvailability`](#privatebrowsingmodeavailability)
2160
2161 **Compatibility:** Firefox 60, Firefox ESR 60\
2162 **CCK2 Equivalent:** `disablePrivateBrowsing`\
2163 **Preferences Affected:** N/A
2164
2165 #### Windows (GPO)
2166 ```
2167 Software\Policies\Mozilla\Firefox\DisablePrivateBrowsing = 0x1 | 0x0
2168 ```
2169 #### Windows (Intune)
2170 OMA-URI:
2171 ```
2172 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox/DisablePrivateBrowsing
2173 ```
2174 Value (string):
2175 ```
2176 <enabled/> or <disabled/>
2177 ```
2178 #### macOS
2179 ```
2180 <dict>
2181   <key>DisablePrivateBrowsing</key>
2182   <true/> | <false/>
2183 </dict>
2184 ```
2185 #### policies.json
2186 ```
2187 {
2188   "policies": {
2189     "DisablePrivateBrowsing": true | false
2190   }
2191 }
2192 ```
2193 ### DisableProfileImport
2194 Disables the "Import data from another browser" option in the bookmarks window.
2195
2196 **Compatibility:** Firefox 60, Firefox ESR 60\
2197 **CCK2 Equivalent:** N/A\
2198 **Preferences Affected:** N/A
2199
2200 #### Windows (GPO)
2201 ```
2202 Software\Policies\Mozilla\Firefox\DisableProfileImport = 0x1 | 0x0
2203 ```
2204 #### Windows (Intune)
2205 OMA-URI:
2206 ```
2207 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox/DisableProfileImport
2208 ```
2209 Value (string):
2210 ```
2211 <enabled/> or <disabled/>
2212 ```
2213 #### macOS
2214 ```
2215 <dict>
2216   <key>DisableProfileImport</key>
2217   <true/> | <false/>
2218 </dict>
2219 ```
2220 #### policies.json
2221 ```
2222 {
2223   "policies": {
2224     "DisableProfileImport": true | false
2225   }
2226 }
2227 ```
2228 ### DisableProfileRefresh
2229 Disable the Refresh Firefox button on about:support and support.mozilla.org, as well as the prompt that displays offering to refresh Firefox when you haven't used it in a while.
2230
2231 **Compatibility:** Firefox 60, Firefox ESR 60\
2232 **CCK2 Equivalent:** `disableResetFirefox`\
2233 **Preferences Affected:** `browser.disableResetPrompt`
2234
2235 #### Windows (GPO)
2236 ```
2237 Software\Policies\Mozilla\Firefox\DisableProfileRefresh = 0x1 | 0x0
2238 ```
2239 #### Windows (Intune)
2240 OMA-URI:
2241 ```
2242 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox/DisableProfileRefresh
2243 ```
2244 Value (string):
2245 ```
2246 <enabled/> or <disabled/>
2247 ```
2248 #### macOS
2249 ```
2250 <dict>
2251   <key>DisableProfileRefresh</key>
2252   <true/> | <false/>
2253 </dict>
2254 ```
2255 #### policies.json
2256 ```
2257 {
2258   "policies": {
2259     "DisableProfileRefresh": true | false
2260   }
2261 }
2262 ```
2263 ### DisableSafeMode
2264 Disable safe mode within the browser.
2265
2266 On Windows, this disables safe mode via the command line as well.
2267
2268 **Compatibility:** Firefox 60, Firefox ESR 60 (Windows, macOS)\
2269 **CCK2 Equivalent:** `disableSafeMode`\
2270 **Preferences Affected:** N/A
2271
2272 #### Windows (GPO)
2273 ```
2274 Software\Policies\Mozilla\Firefox\DisableSafeMode = 0x1 | 0x0
2275 ```
2276 #### Windows (Intune)
2277 OMA-URI:
2278 ```
2279 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox/DisableSafeMode
2280 ```
2281 Value (string):
2282 ```
2283 <enabled/> or <disabled/>
2284 ```
2285 #### macOS
2286 ```
2287 <dict>
2288   <key>DisableSafeMode</key>
2289   <true/> | <false/>
2290 </dict>
2291 ```
2292 #### policies.json
2293 ```
2294 {
2295   "policies": {
2296     "DisableSafeMode": true | false
2297   }
2298 }
2299 ```
2300 ### DisableSecurityBypass
2301 Prevent the user from bypassing security in certain cases.
2302
2303 `InvalidCertificate` prevents adding an exception when an invalid certificate is shown.
2304
2305 `SafeBrowsing` prevents selecting "ignore the risk" and visiting a harmful site anyway.
2306
2307 These policies only affect what happens when an error is shown, they do not affect any settings in preferences.
2308
2309 **Compatibility:** Firefox 60, Firefox ESR 60\
2310 **CCK2 Equivalent:** N/A\
2311 **Preferences Affected:** `security.certerror.hideAddException`, `browser.safebrowsing.allowOverride`
2312
2313 #### Windows (GPO)
2314 ```
2315 Software\Policies\Mozilla\Firefox\DisableSecurityBypass\InvalidCertificate = 0x1 | 0x0
2316 Software\Policies\Mozilla\Firefox\DisableSecurityBypass\SafeBrowsing = 0x1 | 0x0
2317 ```
2318 #### Windows (Intune)
2319 OMA-URI:
2320 ```
2321 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox/P_DisableSecurityBypass_InvalidCertificate
2322 ```
2323 Value (string):
2324 ```
2325 <enabled/> or <disabled/>
2326 ```
2327 OMA-URI:
2328 ```
2329 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox/P_DisableSecurityBypass_SafeBrowsing
2330 ```
2331 Value (string):
2332 ```
2333 <enabled/> or <disabled/>
2334 ```
2335
2336 #### macOS
2337 ```
2338 <dict>
2339   <key>DisableSecurityBypass</key>
2340   <dict>
2341     <key>InvalidCertificate</key>
2342     <true/> | <false/>
2343     <key>SafeBrowsing</key>
2344     <true/> | <false/>
2345   </dict>
2346 </dict>
2347 ```
2348 #### policies.json
2349 ```
2350 {
2351   "policies": {
2352     "DisableSecurityBypass": {
2353       "InvalidCertificate": true | false,
2354       "SafeBrowsing": true | false
2355     }
2356   }
2357 }
2358 ```
2359 ### DisableSetDesktopBackground
2360 Remove the "Set As Desktop Background..." menuitem when right clicking on an image.
2361
2362 **Compatibility:** Firefox 60, Firefox ESR 60\
2363 **CCK2 Equivalent:** `removeSetDesktopBackground`\
2364 **Preferences Affected:** N/A
2365
2366 #### Windows (GPO)
2367 ```
2368 Software\Policies\Mozilla\Firefox\DisableSetDesktopBackground = 0x1 | 0x0
2369 ```
2370 #### Windows (Intune)
2371 OMA-URI:
2372 ```
2373 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox/DisableSetDesktopBackground
2374 ```
2375 Value (string):
2376 ```
2377 <enabled/> or <disabled/>
2378 ```
2379 #### macOS
2380 ```
2381 <dict>
2382   <key>DisableSetDesktopBackground</key>
2383   <true/> | <false/>
2384 </dict>
2385 ```
2386 #### policies.json
2387 ```
2388 {
2389   "policies": {
2390     "DisableSetDesktopBackground": true | false
2391   }
2392 }
2393 ```
2394 ### DisableSystemAddonUpdate
2395 Prevent system add-ons from being installed or updated.
2396
2397 **Compatibility:** Firefox 60, Firefox ESR 60\
2398 **CCK2 Equivalent:** N/A\
2399 **Preferences Affected:** N/A
2400
2401 #### Windows (GPO)
2402 ```
2403 Software\Policies\Mozilla\Firefox\DisableSystemAddonUpdate = 0x1 | 0x0
2404 ```
2405 #### Windows (Intune)
2406 OMA-URI:
2407 ```
2408 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox/DisableSystemAddonUpdate
2409 ```
2410 Value (string):
2411 ```
2412 <enabled/> or <disabled/>
2413 ```
2414 #### macOS
2415 ```
2416 <dict>
2417   <key>DisableSystemAddonUpdate</key>
2418   <true/> | <false/>
2419 </dict>
2420 ```
2421 #### policies.json
2422 ```
2423 {
2424   "policies": {
2425     "DisableSystemAddonUpdate": true | false
2426   }
2427 }
2428 ```
2429 ### DisableTelemetry
2430 Prevent the upload of telemetry data.
2431
2432 As of Firefox 83 and Firefox ESR 78.5, local storage of telemetry data is disabled as well.
2433
2434 Mozilla recommends that you do not disable telemetry. Information collected through telemetry helps us build a better product for businesses like yours.
2435
2436 **Compatibility:** Firefox 60, Firefox ESR 60\
2437 **CCK2 Equivalent:** `disableTelemetry`\
2438 **Preferences Affected:** `datareporting.healthreport.uploadEnabled`, `datareporting.policy.dataSubmissionEnabled`, `toolkit.telemetry.archive.enabled`
2439
2440 #### Windows (GPO)
2441 ```
2442 Software\Policies\Mozilla\Firefox\DisableTelemetry = 0x1 | 0x0
2443 ```
2444 #### Windows (Intune)
2445 OMA-URI:
2446 ```
2447 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox/DisableTelemetry
2448 ```
2449 Value (string):
2450 ```
2451 <enabled/> or <disabled/>
2452 ```
2453 #### macOS
2454 ```
2455 <dict>
2456   <key>DisableTelemetry</key>
2457   <true/> | <false/>
2458 </dict>
2459 ```
2460 #### policies.json
2461 ```
2462 {
2463   "policies": {
2464     "DisableTelemetry": true | false
2465   }
2466 }
2467 ```
2468 ### DisableThirdPartyModuleBlocking
2469 Do not allow blocking third-party modules from the `about:third-party` page.
2470
2471 This policy only works on Windows through GPO (not policies.json).
2472
2473 **Compatibility:** Firefox 110 (Windows only, GPO only)\
2474 **CCK2 Equivalent:** N/A\
2475 **Preferences Affected:** N/A
2476
2477 #### Windows (GPO)
2478 ```
2479 Software\Policies\Mozilla\Firefox\DisableThirdPartyModuleBlocking = = 0x1 | 0x0
2480 ```
2481 #### Windows (Intune)
2482 OMA-URI:
2483 ```
2484 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox/DisableThirdPartyModuleBlocking
2485 ```
2486 Value (string):
2487 ```
2488 <enabled/> or <disabled/>
2489 ```
2490 ### DisplayBookmarksToolbar
2491 Set the initial state of the bookmarks toolbar. A user can still change how it is displayed.
2492
2493 `always` means the bookmarks toolbar is always shown.
2494
2495 `never` means the bookmarks toolbar is not shown.
2496
2497 `newtab` means the bookmarks toolbar is only shown on the new tab page.
2498
2499 **Compatibility:** Firefox 109, Firefox ESR 102.7\
2500 **CCK2 Equivalent:** N/A\
2501 **Preferences Affected:** N/A
2502
2503 #### Windows (GPO)
2504 ```
2505 Software\Policies\Mozilla\Firefox\DisplayBookmarksToolbar = "always", "never", "newtab"
2506 ```
2507 #### Windows (Intune)
2508 OMA-URI:
2509 ```
2510 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox/DisplayBookmarksToolbar_Enum
2511 ```
2512 Value (string):
2513 ```
2514 <enabled/>
2515 <data id="DisplayBookmarksToolbar" value="always | never | newtab"/>
2516 ```
2517 #### macOS
2518 ```
2519 <dict>
2520   <key>DisplayBookmarksToolbar</key>
2521   <string>always | never | newtab</string>
2522 </dict>
2523 ```
2524 #### policies.json
2525 ```
2526 {
2527   "policies": {
2528     "DisplayBookmarksToolbar": "always" | "never" | "newtab"
2529   }
2530 }
2531 ```
2532 ### DisplayMenuBar
2533 Set the state of the menubar.
2534
2535 `always` means the menubar is shown and cannot be hidden.
2536
2537 `never` means the menubar is hidden and cannot be shown.
2538
2539 `default-on` means the menubar is on by default but can be hidden.
2540
2541 `default-off` means the menubar is off by default but can be shown.
2542
2543 **Compatibility:** Firefox 73, Firefox ESR 68.5 (Windows, some Linux)\
2544 **CCK2 Equivalent:** `displayMenuBar`\
2545 **Preferences Affected:** N/A
2546
2547 #### Windows (GPO)
2548 ```
2549 Software\Policies\Mozilla\Firefox\DisplayMenuBar = "always", "never", "default-on", "default-off"
2550 ```
2551 #### Windows (Intune)
2552 OMA-URI:
2553 ```
2554 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox/DisplayMenuBar_Enum
2555 ```
2556 Value (string):
2557 ```
2558 <enabled/>
2559 <data id="DisplayMenuBar" value="always | never | default-on | default-off"/>
2560 ```
2561 #### macOS
2562 ```
2563 <dict>
2564   <key>DisplayMenuBar</key>
2565   <string>always | never | default-on | default-off</string>
2566 </dict>
2567 ```
2568 #### policies.json
2569 ```
2570 {
2571   "policies": {
2572     "DisplayMenuBar": "always", "never", "default-on", "default-off"
2573   }
2574 }
2575 ```
2576 ### DNSOverHTTPS
2577 Configure DNS over HTTPS.
2578
2579 `Enabled` determines whether DNS over HTTPS is enabled
2580
2581 `ProviderURL` is a URL to another provider.
2582
2583 `Locked` prevents the user from changing DNS over HTTPS preferences.
2584
2585 `ExcludedDomains` excludes domains from DNS over HTTPS.
2586
2587 `Fallback` determines whether or not Firefox will use your default DNS resolver if there is a problem with the secure DNS provider.
2588
2589 **Compatibility:** Firefox 63, Firefox ESR 68 (ExcludedDomains added in 75/68.7) (Fallback added in 124)\
2590 **CCK2 Equivalent:** N/A\
2591 **Preferences Affected:** `network.trr.mode`, `network.trr.uri`
2592
2593 #### Windows (GPO)
2594 ```
2595 Software\Policies\Mozilla\Firefox\DNSOverHTTPS\Enabled = 0x1 | 0x0
2596 Software\Policies\Mozilla\Firefox\DNSOverHTTPS\ProviderURL = "URL_TO_ALTERNATE_PROVIDER"
2597 Software\Policies\Mozilla\Firefox\DNSOverHTTPS\Locked = 0x1 | 0x0
2598 Software\Policies\Mozilla\Firefox\DNSOverHTTPS\ExcludedDomains\1 = "example.com"
2599 Software\Policies\Mozilla\Firefox\DNSOverHTTPS\Fallback = 0x1 | 0x0
2600 ```
2601 #### Windows (Intune)
2602 OMA-URI:
2603 ```
2604 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~DNSOverHTTPS/DNSOverHTTPS_Enabled
2605 ```
2606 Value (string):
2607 ```
2608 <enabled/> or <disabled/>
2609 ```
2610 OMA-URI:
2611 ```
2612 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~DNSOverHTTPS/DNSOverHTTPS_ProviderURL
2613 ```
2614 Value (string):
2615 ```
2616 <enabled/>
2617 <data id="String" value="URL_TO_ALTERNATE_PROVIDER"/>
2618 ```
2619 OMA-URI:
2620 ```
2621 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~DNSOverHTTPS/DNSOverHTTPS_Locked
2622 ```
2623 Value (string):
2624 ```
2625 <enabled/> or <disabled/>
2626 ```
2627 OMA-URI:
2628 ```
2629 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~DNSOverHTTPS/DNSOverHTTPS_ExcludedDomains
2630 ```
2631 Value (string):
2632 ```
2633 <enabled/>
2634 <data id="List" value="1&#xF000;example.com"/>
2635 ```
2636 OMA-URI:
2637 ```
2638 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~DNSOverHTTPS/DNSOverHTTPS_Fallback
2639 ```
2640 Value (string):
2641 ```
2642 <enabled/> or <disabled/>
2643 ```
2644 #### macOS
2645 ```
2646 <dict>
2647   <key>DNSOverHTTPS</key>
2648   <dict>
2649     <key>Enabled</key>
2650     <true/> | <false/>
2651     <key>ProviderURL</key>
2652     <string>URL_TO_ALTERNATE_PROVIDER</string>
2653     <key>Locked</key>
2654     <true/> | <false/>
2655     <key>ExcludedDomains</key>
2656     <array>
2657       <string>example.com</string>
2658     </array>
2659     <key>Fallback</key>
2660     <true/> | <false/>
2661   </dict>
2662 </dict>
2663 ```
2664 #### policies.json
2665 ```
2666 {
2667   "policies": {
2668     "DNSOverHTTPS": {
2669       "Enabled":  true | false,
2670       "ProviderURL": "URL_TO_ALTERNATE_PROVIDER",
2671       "Locked": true | false,
2672       "ExcludedDomains": ["example.com"],
2673       "Fallback": true | false,
2674     }
2675   }
2676 }
2677 ```
2678 ### DontCheckDefaultBrowser
2679 Don't check if Firefox is the default browser at startup.
2680
2681 **Compatibility:** Firefox 60, Firefox ESR 60\
2682 **CCK2 Equivalent:** `dontCheckDefaultBrowser`\
2683 **Preferences Affected:** `browser.shell.checkDefaultBrowser`
2684
2685 #### Windows (GPO)
2686 ```
2687 Software\Policies\Mozilla\Firefox\DontCheckDefaultBrowser = 0x1 | 0x0
2688 ```
2689 #### Windows (Intune)
2690 OMA-URI:
2691 ```
2692 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox/DontCheckDefaultBrowser
2693 ```
2694 Value (string):
2695 ```
2696 <enabled/> or <disabled/>
2697 ```
2698 #### macOS
2699 ```
2700 <dict>
2701   <key>DontCheckDefaultBrowser</key>
2702   <true/> | <false/>
2703 </dict>
2704 ```
2705 #### policies.json
2706 ```
2707 {
2708   "policies": {
2709     "DontCheckDefaultBrowser": true | false
2710   }
2711 }
2712 ```
2713 ### DownloadDirectory
2714 Set and lock the download directory.
2715
2716 You can use ${home} for the native home directory.
2717
2718 **Compatibility:** Firefox 68, Firefox ESR 68\
2719 **CCK2 Equivalent:** N/A\
2720 **Preferences Affected:** `browser.download.dir`, `browser.download.folderList`, `browser.download.useDownloadDir`
2721
2722 #### Windows (GPO)
2723 ```
2724 Software\Policies\Mozilla\Firefox\DownloadDirectory = "${home}\Downloads"
2725 ```
2726 #### Windows (Intune)
2727 OMA-URI:
2728 ```
2729 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox/DownloadDirectory
2730 ```
2731 Value (string):
2732 ```
2733 <enabled/>
2734 <data id="Preferences_String" value="${home}\Downloads"/>
2735 ```
2736 #### macOS
2737 ```
2738 <dict>
2739   <key>DownloadDirectory</key>
2740   <string>${home}/Downloads</string>
2741 </dict>
2742 ```
2743 #### policies.json (macOS and Linux)
2744 ```
2745 {
2746   "policies": {
2747     "DownloadDirectory": "${home}/Downloads"
2748 }
2749 ```
2750 #### policies.json (Windows)
2751 ```
2752 {
2753   "policies": {
2754     "DownloadDirectory": "${home}\\Downloads"
2755 }
2756 ```
2757 ### EnableTrackingProtection
2758 Configure tracking protection.
2759
2760 If this policy is not configured, tracking protection is not enabled by default in the browser, but it is enabled by default in private browsing and the user can change it.
2761
2762 If `Value` is set to false, tracking protection is disabled and locked in both the regular browser and private browsing.
2763
2764 If `Value` is set to true, tracking protection is enabled by default in both the regular browser and private browsing and the `Locked` value determines whether or not a user can change it.
2765
2766 If `Cryptomining` is set to true, cryptomining scripts on websites are blocked.
2767
2768 If `Fingerprinting` is set to true, fingerprinting scripts on websites are blocked.
2769
2770 If `EmailTracking` is set to true, hidden email tracking pixels and scripts on websites are blocked. (Firefox 112)
2771
2772 `Exceptions` are origins for which tracking protection is not enabled.
2773
2774 **Compatibility:** Firefox 60, Firefox ESR 60 (Cryptomining and Fingerprinting added in 70/68.2, Exceptions added in 73/68.5)\
2775 **CCK2 Equivalent:** N/A\
2776 **Preferences Affected:** `privacy.trackingprotection.enabled`, `privacy.trackingprotection.pbmode.enabled`, `privacy.trackingprotection.cryptomining.enabled`, `privacy.trackingprotection.fingerprinting.enabled`
2777
2778 #### Windows (GPO)
2779 ```
2780 Software\Policies\Mozilla\Firefox\EnableTrackingProtection\Value = 0x1 | 0x0
2781 Software\Policies\Mozilla\Firefox\EnableTrackingProtection\Locked = 0x1 | 0x0
2782 Software\Policies\Mozilla\Firefox\EnableTrackingProtection\Cryptomining = 0x1 | 0x0
2783 Software\Policies\Mozilla\Firefox\EnableTrackingProtection\Fingerprinting = 0x1 | 0x0
2784 Software\Policies\Mozilla\Firefox\EnableTrackingProtection\Exceptions\1 = "https://example.com"
2785 ```
2786 #### Windows (Intune)
2787 OMA-URI:
2788 ```
2789 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~TrackingProtection/A_TrackingProtection_Value
2790 ```
2791 Value (string):
2792 ```
2793 <enabled/> or <disabled/>
2794 ```
2795 OMA-URI:
2796 ```
2797 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~TrackingProtection/B_TrackingProtection_Cryptomining
2798 ```
2799 Value (string):
2800 ```
2801 <enabled/> or <disabled/>
2802 ```
2803 OMA-URI:
2804 ```
2805 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~TrackingProtection/C_TrackingProtection_Fingerprinting
2806 ```
2807 Value (string):
2808 ```
2809 <enabled/> or <disabled/>
2810 ```
2811 OMA-URI:
2812 ```
2813 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~TrackingProtection/D_TrackingProtection_Exceptions
2814 ```
2815 Value (string):
2816 ```
2817 <enabled/>
2818 <data id="TrackingProtection_Exceptions" value="1&#xF000;https://example.com"/>
2819 ```
2820 OMA-URI:
2821 ```
2822 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~TrackingProtection/E_TrackingProtection_Locked
2823 ```
2824 Value (string):
2825 ```
2826 <enabled/> or <disabled/>
2827 ```
2828 #### macOS
2829 ```
2830 <dict>
2831   <key>EnableTrackingProtection</key>
2832   <dict>
2833     <key>Value</key>
2834     <true/> | <false/>
2835     <key>Locked</key>
2836     <true/> | <false/>
2837     <key>Cryptomining</key>
2838     <true/> | <false/>
2839     <key>Fingerprinting</key>
2840     <true/> | <false/>
2841     <key>Exceptions</key>
2842     <array>
2843       <string>https://example.com</string>
2844     </array>
2845   </dict>
2846 </dict>
2847 ```
2848 #### policies.json
2849 ```
2850 {
2851   "policies": {
2852     "EnableTrackingProtection": {
2853       "Value": true | false,
2854       "Locked": true | false,
2855       "Cryptomining": true | false,
2856       "Fingerprinting": true | false,
2857       "Exceptions": ["https://example.com"]
2858     }
2859   }
2860 }
2861 ```
2862 ### EncryptedMediaExtensions
2863 Enable or disable Encrypted Media Extensions and optionally lock it.
2864
2865 If `Enabled` is set to false, encrypted media extensions (like Widevine) are not downloaded by Firefox unless the user consents to installing them.
2866
2867 If `Locked` is set to true and `Enabled` is set to false, Firefox will not download encrypted media extensions (like Widevine) or ask the user to install them.
2868
2869 **Compatibility:** Firefox 77, Firefox ESR 68.9\
2870 **CCK2 Equivalent:** N/A\
2871 **Preferences Affected:** `media.eme.enabled`
2872
2873 #### Windows (GPO)
2874 ```
2875 Software\Policies\Mozilla\Firefox\EncryptedMediaExtensions\Enabled = 0x1 | 0x0
2876 Software\Policies\Mozilla\Firefox\EncryptedMediaExtensions\Locked = 0x1 | 0x0
2877 ```
2878 #### Windows (Intune)
2879 OMA-URI:
2880 ```
2881 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~EncryptedMediaExtensions/EncryptedMediaExtensions_Enabled
2882 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~EncryptedMediaExtensions/EncryptedMediaExtensions_Locked
2883 ```
2884 Value (string):
2885 ```
2886 <enabled/>or <disabled/>
2887 ```
2888 #### macOS
2889 ```
2890 <dict>
2891   <key>EncryptedMediaExtensions</key>
2892   <dict>
2893     <key>Enabled</key>
2894     <true/> | <false/>
2895     <key>Locked</key>
2896     <true/> | <false/>
2897   </dict>
2898 </dict>
2899 ```
2900 #### policies.json
2901 ```
2902 {
2903   "policies": {
2904     "EncryptedMediaExtensions": {
2905       "Enabled": true | false,
2906       "Locked": true | false
2907     }
2908   }
2909 }
2910 ```
2911 ### EnterprisePoliciesEnabled
2912 Enable policy support on macOS.
2913
2914 **Compatibility:** Firefox 63, Firefox ESR 60.3 (macOS only)\
2915 **CCK2 Equivalent:** N/A\
2916 **Preferences Affected:** N/A
2917
2918 #### macOS
2919 ```
2920 <dict>
2921   <key>EnterprisePoliciesEnabled</key>
2922   <true/>
2923 </dict>
2924 ```
2925 ### ExemptDomainFileTypePairsFromFileTypeDownloadWarnings
2926
2927 Disable warnings based on file extension for specific file types on domains.
2928
2929 This policy is based on the [Chrome policy](https://chromeenterprise.google/policies/#ExemptDomainFileTypePairsFromFileTypeDownloadWarnings) of the same name.
2930
2931 Important: The documentation for the policy for both Edge and Chrome is incorrect. The ```domains``` value must be a domain, not a URL pattern. Also, we do not support using ```*``` to mean all domains.
2932
2933 **Compatibility:** Firefox 102\
2934 **CCK2 Equivalent:** N/A\
2935 **Preferences Affected:** N/A
2936
2937 #### Windows (GPO)
2938 Software\Policies\Mozilla\Firefox\ExemptDomainFileTypePairsFromFileTypeDownloadWarnings (REG_MULTI_SZ) =
2939 ```
2940 [
2941   {
2942      "file_extension": "jnlp",
2943      "domains": ["example.com"]
2944   }
2945 ]
2946 ```
2947 #### Windows (Intune)
2948 OMA-URI:
2949 ```
2950 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox/ExemptDomainFileTypePairsFromFileTypeDownloadWarnings
2951 ```
2952 Value (string):
2953 ```
2954 <enabled/>
2955 <data id="JSON" value='
2956 [
2957   {
2958      "file_extension": "jnlp",
2959      "domains": ["example.com"]
2960   }
2961 ]
2962 '/>
2963 ```
2964 If you are using custom ADMX and ADML administrative templates in Intune, you can use this OMA-URI instead
2965 to workaround the limit on the length of strings. Put all of your JSON on one line.
2966
2967 OMA-URI:
2968 ```
2969 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~Extensions/ExemptDomainFileTypePairsFromFileTypeDownloadWarningsOneLine
2970 ```
2971 Value (string):
2972 ```
2973 <enabled/>
2974 <data id="JSONOneLine" value='[]'/>
2975 ```
2976 #### macOS
2977 ```
2978 <dict>
2979   <key>ExemptDomainFileTypePairsFromFileTypeDownloadWarnings</key>
2980   <array>
2981     <dict>
2982       <key>file_extension</key>
2983       <string>jnlp</string>
2984       <key>domains</key>
2985       <array>
2986         <string>example.com</string>
2987       </array>
2988     </dict>
2989   </array>
2990 </dict>
2991 ```
2992 #### policies.json
2993 ```
2994 {
2995   "policies": {
2996     "ExemptDomainFileTypePairsFromFileTypeDownloadWarnings": [{
2997       "file_extension": "jnlp",
2998       "domains": ["example.com"]
2999     }]
3000   }
3001 }
3002 ```
3003 ### Extensions
3004 Control the installation, uninstallation and locking of extensions.
3005
3006 We strongly recommend that you use the **[`ExtensionSettings`](#extensionsettings)** policy. It has the same functionality and adds more. It does not support native paths, though, so you'll have to use file:/// URLs.
3007
3008 This method will be deprecated in the near future.
3009
3010 `Install` is a list of URLs or native paths for extensions to be installed.
3011
3012 `Uninstall` is a list of extension IDs that should be uninstalled if found.
3013
3014 `Locked` is a list of extension IDs that the user cannot disable or uninstall.
3015
3016 **Compatibility:** Firefox 60, Firefox ESR 60\
3017 **CCK2 Equivalent:** `addons`\
3018 **Preferences Affected:** N/A
3019
3020 #### Windows (GPO)
3021 ```
3022 Software\Policies\Mozilla\Firefox\Extensions\Install\1 = "https://addons.mozilla.org/firefox/downloads/somefile.xpi"
3023 Software\Policies\Mozilla\Firefox\Extensions\Install\2 = "//path/to/xpi"
3024 Software\Policies\Mozilla\Firefox\Extensions\Uninstall\1 = "bad_addon_id@mozilla.org"
3025 Software\Policies\Mozilla\Firefox\Extensions\Locked\1 = "addon_id@mozilla.org"
3026 ```
3027 #### Windows (Intune)
3028 OMA-URI:
3029 ```
3030 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~Extensions/Extensions_Install
3031 ```
3032 Value (string):
3033 ```
3034 <enabled/>
3035 <data id="Extensions" value="1&#xF000;https://addons.mozilla.org/firefox/downloads/somefile.xpi&#xF000;2&#xF000;//path/to/xpi"/>
3036 ```
3037 OMA-URI:
3038 ```
3039 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~Extensions/Extensions_Uninstall
3040 ```
3041 Value (string):
3042 ```
3043 <enabled/>
3044 <data id="Extensions" value="1&#xF000;bad_addon_id@mozilla.org"/>
3045 ```
3046 OMA-URI:
3047 ```
3048 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~Extensions/Extensions_Locked
3049 ```
3050 Value (string):
3051 ```
3052 <enabled/>
3053 <data id="Extensions" value="1&#xF000;addon_id@mozilla.org"/>
3054 ```
3055 #### macOS
3056 ```
3057 <dict>
3058   <key>Extensions</key>
3059   <dict>
3060     <key>Install</key>
3061     <array>
3062       <string>https://addons.mozilla.org/firefox/downloads/somefile.xpi</string>
3063       <string>//path/to/xpi</string>
3064     </array>
3065     <key>Uninstall</key>
3066     <array>
3067       <string>bad_addon_id@mozilla.org</string>
3068     </array>
3069     <key>Locked</key>
3070     <array>
3071       <string>addon_id@mozilla.org</string>
3072     </array>
3073   </dict>
3074 </dict>
3075 ```
3076 #### policies.json
3077 ```
3078 {
3079   "policies": {
3080     "Extensions": {
3081       "Install": ["https://addons.mozilla.org/firefox/downloads/somefile.xpi", "//path/to/xpi"],
3082       "Uninstall": ["bad_addon_id@mozilla.org"],
3083       "Locked":  ["addon_id@mozilla.org"]
3084     }
3085   }
3086 }
3087 ```
3088 ### ExtensionSettings
3089 Manage all aspects of extensions. This policy is based heavily on the [Chrome policy](https://dev.chromium.org/administrators/policy-list-3/extension-settings-full) of the same name.
3090
3091 This policy maps an extension ID to its configuration. With an extension ID, the configuration will be applied to the specified extension only. A default configuration can be set for the special ID "*", which will apply to all extensions that don't have a custom configuration set in this policy.
3092
3093 To obtain an extension ID, install the extension and go to about:support. You will see the ID in the Extensions section. I've also created an extension that makes it easy to find the ID of extensions on AMO. You can download it [here](https://github.com/mkaply/queryamoid/releases/tag/v0.1).
3094 Or you can ask the Mozilla Addons API, see [docs](https://mozilla.github.io/addons-server/topics/api/addons.html#detail), which returns the ID as `guid`: https://addons.mozilla.org/api/v5/addons/addon/ublock-origin/
3095
3096 **Note:**
3097 If the extension ID is a UUID ({12345678-1234-1234-1234-1234567890ab}), you must include the curly braces around the ID.
3098
3099 The configuration for each extension is another dictionary that can contain the fields documented below.
3100
3101 | Name | Description |
3102 | --- | --- |
3103 | `installation_mode` | Maps to a string indicating the installation mode for the extension. The valid strings are `allowed`,`blocked`,`force_installed`, and `normal_installed`.
3104 | &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;`allowed` | Allows the extension to be installed by the user. This is the default behavior. There is no need for an install_url; it will automatically be allowed based on the ID.
3105 | &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;`blocked`| Blocks installation of the extension and removes it from the device if already installed.
3106 | &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;`force_installed`| The extension is automatically installed and can't be removed by the user. This option is not valid for the default configuration and requires an install_url.
3107 | &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;`normal_installed`| The extension is automatically installed but can be disabled by the user. This option is not valid for the default configuration and requires an install_url.
3108 | `install_url`| Maps to a URL indicating where Firefox can download a force_installed or normal_installed extension.  If installing from the local file system, use a [```file:///``` URL](https://en.wikipedia.org/wiki/File_URI_scheme). If installing from the addons.mozilla.org, use the following URL (substituting ID with the extension ID or with the short name from the URL on AMO), https://addons.mozilla.org/firefox/downloads/latest/ID/latest.xpi. Languages packs are available from https://releases.mozilla.org/pub/firefox/releases/VERSION/PLATFORM/xpi/LANGUAGE.xpi. If you need to update the extension, you can change the name of the extension and it will be automatically updated. Extensions installed from file URLs will additional be updated when their internal version changes.
3109 | `install_sources` | A list of sources from which installing extensions is allowed using URL match patterns. **This is unnecessary if you are only allowing the installation of certain extensions by ID.** Each item in this list is an extension-style match pattern. Users will be able to easily install items from any URL that matches an item in this list. Both the location of the *.xpi file and the page where the download is started from (i.e.  the referrer) must be allowed by these patterns. This setting can be used only for the default configuration.
3110 | `allowed_types` | This setting whitelists the allowed types of extension/apps that can be installed in Firefox. The value is a list of strings, each of which should be one of the following: "extension", "theme", "dictionary", "locale" This setting can be used only for the default configuration.
3111 | `blocked_install_message` | This maps to a string specifying the error message to display to users if they're blocked from installing an extension. This setting allows you to append text to the generic error message displayed when the extension is blocked. This could be be used to direct users to your help desk, explain why a particular extension is blocked, or something else. This setting can be used only for the default configuration.
3112 | `restricted_domains` | An array of domains on which content scripts can't be run. This setting can be used only for the default configuration.
3113 | `updates_disabled` | (Firefox 89, Firefox ESR 78.11) Boolean that indicates whether or not to disable automatic updates for an individual extension.
3114 | `default_area` | (Firefox 113) String that indicates where to place the extension icon by default. Possible values are `navbar` and `menupanel`.
3115 | `temporarily_allow_weak_signatures`| (Firefox 127) A boolean that indicates whether to allow installing extensions signed using deprecated signature algorithms.
3116
3117 **Compatibility:** Firefox 69, Firefox ESR 68.1 (As of Firefox 85, Firefox ESR 78.7, installing a theme makes it the default.)\
3118 **CCK2 Equivalent:** N/A\
3119 **Preferences Affected:** N/A
3120
3121 #### Windows (GPO)
3122 Software\Policies\Mozilla\Firefox\ExtensionSettings (REG_MULTI_SZ) =
3123 ```
3124 {
3125   "*": {
3126     "blocked_install_message": "Custom error message.",
3127     "install_sources": ["https://yourwebsite.com/*"],
3128     "installation_mode": "blocked",
3129     "allowed_types": ["extension"]
3130   },
3131   "uBlock0@raymondhill.net": {
3132     "installation_mode": "force_installed",
3133     "install_url": "https://addons.mozilla.org/firefox/downloads/latest/ublock-origin/latest.xpi"  # using slug / short name
3134   },
3135   "adguardadblocker@adguard.com": {
3136     "installation_mode": "force_installed",
3137     "install_url": "https://addons.mozilla.org/firefox/downloads/latest/adguardadblocker@adguard.com/latest.xpi"  # using extension ID
3138   },
3139   "https-everywhere@eff.org": {
3140     "installation_mode": "allowed",
3141     "updates_disabled": false
3142   }
3143 }
3144 ```
3145 #### Windows (Intune)
3146 OMA-URI:
3147 ```
3148 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~Extensions/ExtensionSettings
3149 ```
3150 Value (string):
3151 ```
3152 <enabled/>
3153 <data id="ExtensionSettings" value='
3154 {
3155   "*": {
3156     "blocked_install_message": "Custom error message.",
3157     "install_sources": ["https://yourwebsite.com/*"],
3158     "installation_mode": "blocked",
3159     "allowed_types": ["extension"]
3160   },
3161   "uBlock0@raymondhill.net": {
3162     "installation_mode": "force_installed",
3163     "install_url": "https://addons.mozilla.org/firefox/downloads/latest/ublock-origin/latest.xpi"
3164   },
3165   "adguardadblocker@adguard.com": {
3166     "installation_mode": "force_installed",
3167     "install_url": "https://addons.mozilla.org/firefox/downloads/latest/adguardadblocker@adguard.com/latest.xpi"
3168   },
3169   {
3170     "https-everywhere@eff.org": {
3171     "installation_mode": "allowed",
3172     "updates_disabled": false
3173   }
3174 }'/>
3175 ```
3176 If you are using custom ADMX and ADML administrative templates in Intune, you can use this OMA-URI instead
3177 to workaround the limit on the length of strings. Put all of your JSON on one line.
3178
3179 OMA-URI:
3180 ```
3181 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~Extensions/ExtensionSettingsOneLine
3182 ```
3183 Value (string):
3184 ```
3185 <enabled/>
3186 <data id="JSONOneLine" value='{}'/>
3187 ```
3188 #### macOS
3189 ```
3190 <dict>
3191   <key>ExtensionSettings</key>
3192   <dict>
3193     <key>*</key>
3194     <dict>
3195       <key>blocked_install_message</key>
3196       <string>Custom error message.</string>
3197       <key>install_sources</key>
3198       <array>
3199         <string>"https://yourwebsite.com/*"</string>
3200       </array>
3201       <key>installation_mode</key>
3202       <string>blocked</string>
3203       <key>allowed_types</key>
3204       <array>
3205         <string>extension</string>
3206       </array>
3207     </dict>
3208     <key>uBlock0@raymondhill.net</key>
3209     <dict>
3210       <key>installation_mode</key>
3211       <string>force_installed</string>
3212       <key>install_url</key>
3213       <string>https://addons.mozilla.org/firefox/downloads/latest/ublock-origin/latest.xpi</string>
3214     </dict>
3215     <key>adguardadblocker@adguard.com</key>
3216     <dict>
3217       <key>installation_mode</key>
3218       <string>force_installed</string>
3219       <key>install_url</key>
3220       <string>https://addons.mozilla.org/firefox/downloads/latest/adguardadblocker@adguard.com/latest.xpi</string>
3221     </dict>
3222     <key>https-everywhere@eff.org</key>
3223     <dict>
3224       <key>installation_mode</key>
3225       <string>allowed</string>
3226       <key>updates_disabled</key>
3227       <true/> | <false/>
3228     </dict>
3229   </dict>
3230 </dict>
3231 ```
3232 #### policies.json
3233 ```
3234 {
3235   "policies": {
3236     "ExtensionSettings": {
3237       "*": {
3238         "blocked_install_message": "Custom error message.",
3239         "install_sources": ["https://yourwebsite.com/*"],
3240         "installation_mode": "blocked",
3241         "allowed_types": ["extension"]
3242       },
3243       "uBlock0@raymondhill.net": {
3244         "installation_mode": "force_installed",
3245         "install_url": "https://addons.mozilla.org/firefox/downloads/latest/ublock-origin/latest.xpi"
3246       },
3247       "adguardadblocker@adguard.com": {
3248         "installation_mode": "force_installed",
3249         "install_url": "https://addons.mozilla.org/firefox/downloads/latest/adguardadblocker@adguard.com/latest.xpi"
3250       },
3251       "https-everywhere@eff.org": {
3252         "installation_mode": "allowed",
3253         "updates_disabled": false
3254       }
3255     }
3256   }
3257 }
3258 ```
3259 ### ExtensionUpdate
3260 Control extension updates.
3261
3262 **Compatibility:** Firefox 67, Firefox ESR 60.7\
3263 **CCK2 Equivalent:** N/A\
3264 **Preferences Affected:** `extensions.update.enabled`
3265
3266 #### Windows (GPO)
3267 ```
3268 Software\Policies\Mozilla\Firefox\ExtensionUpdate = 0x1 | 0x0
3269 ```
3270 #### Windows (Intune)
3271 OMA-URI:
3272 ```
3273 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~Extensions/ExtensionUpdate
3274 ```
3275 Value (string):
3276 ```
3277 <enabled/> or <disabled/>
3278 ```
3279 #### macOS
3280 ```
3281 <dict>
3282   <key>ExtensionUpdate</key>
3283   <true/> | <false/>
3284 </dict>
3285 ```
3286 #### policies.json
3287 ```
3288 {
3289   "policies": {
3290     "ExtensionUpdate": true | false
3291   }
3292 }
3293 ```
3294 ### FirefoxHome
3295 Customize the Firefox Home page.
3296
3297 **Compatibility:** Firefox 68, Firefox ESR 68 (SponsoredTopSites and SponsoredPocket were added in Firefox 95, Firefox ESR 91.4, Snippets was deprecated in Firefox 122)
3298 **CCK2 Equivalent:** N/A\
3299 **Preferences Affected:** `browser.newtabpage.activity-stream.showSearch`, `browser.newtabpage.activity-stream.feeds.topsites`, `browser.newtabpage.activity-stream.feeds.section.highlights`, `browser.newtabpage.activity-stream.feeds.section.topstories`, `browser.newtabpage.activity-stream.feeds.snippets`, `browser.newtabpage.activity-stream.showSponsoredTopSites`, `browser.newtabpage.activity-stream.showSponsored`
3300
3301 #### Windows (GPO)
3302 ```
3303 Software\Policies\Mozilla\Firefox\FirefoxHome\Search = 0x1 | 0x0
3304 Software\Policies\Mozilla\Firefox\FirefoxHome\TopSites = 0x1 | 0x0
3305 Software\Policies\Mozilla\Firefox\FirefoxHome\SponsoredTopSites = 0x1 | 0x0
3306 Software\Policies\Mozilla\Firefox\FirefoxHome\Highlights = 0x1 | 0x0
3307 Software\Policies\Mozilla\Firefox\FirefoxHome\Pocket = 0x1 | 0x0
3308 Software\Policies\Mozilla\Firefox\FirefoxHome\SponsoredPocket = 0x1 | 0x0
3309 Software\Policies\Mozilla\Firefox\FirefoxHome\Snippets = 0x1 | 0x0
3310 Software\Policies\Mozilla\Firefox\FirefoxHome\Locked = 0x1 | 0x0
3311 ```
3312 #### Windows (Intune)
3313 OMA-URI:
3314 ```
3315 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox/CustomizeFirefoxHome
3316 ```
3317 Value (string):
3318 ```
3319 <enabled/>
3320 <data id="FirefoxHome_Search"  value="true | false"/>
3321 <data id="FirefoxHome_TopSites"  value="true | false"/>
3322 <data id="FirefoxHome_SponsoredTopSites"  value="true | false"/>
3323 <data id="FirefoxHome_Highlights"  value="true | false"/>
3324 <data id="FirefoxHome_Pocket"  value="true | false"/>
3325 <data id="FirefoxHome_SponsoredPocket"  value="true | false"/>
3326 <data id="FirefoxHome_Snippets"  value="true | false"/>
3327 <data id="FirefoxHome_Locked"  value="true | false"/>
3328 ```
3329 #### macOS
3330 ```
3331 <dict>
3332   <key>FirefoxHome</key>
3333   <dict>
3334     <key>Search</key>
3335     <true/> | <false/>
3336     <key>TopSites</key>
3337     <true/> | <false/>
3338     <key>SponsoredTopSites</key>
3339     <true/> | <false/>
3340     <key>Highlights</key>
3341     <true/> | <false/>
3342     <key>Pocket</key>
3343     <true/> | <false/>
3344     <key>SponsoredPocket</key>
3345     <true/> | <false/>
3346     <key>Snippets</key>
3347     <true/> | <false/>
3348     <key>Locked</key>
3349     <true/> | <false/>
3350   </dict>
3351 </dict>
3352 ```
3353 #### policies.json
3354 ```
3355 {
3356   "policies": {
3357     "FirefoxHome": {
3358       "Search": true | false,
3359       "TopSites": true | false,
3360       "SponsoredTopSites": true | false,
3361       "Highlights": true | false,
3362       "Pocket": true | false,
3363       "SponsoredPocket": true | false,
3364       "Snippets": true | false,
3365       "Locked": true | false
3366     }
3367   }
3368 }
3369 ```
3370 ### FirefoxSuggest
3371 Customize Firefox Suggest (US only).
3372
3373 **Compatibility:** Firefox 118, Firefox ESR 115.3.
3374 **CCK2 Equivalent:** N/A\
3375 **Preferences Affected:** `browser.urlbar.suggest.quicksuggest.nonsponsored`, `browser.urlbar.suggest.quicksuggest.sponsored`, `browser.urlbar.quicksuggest.dataCollection.enabled`
3376
3377 #### Windows (GPO)
3378 ```
3379 Software\Policies\Mozilla\Firefox\FirefoxSuggest\WebSuggestions = 0x1 | 0x0
3380 Software\Policies\Mozilla\Firefox\FirefoxSuggest\SponsoredSuggestions = 0x1 | 0x0
3381 Software\Policies\Mozilla\Firefox\FirefoxSuggest\ImproveSuggest = 0x1 | 0x0
3382 Software\Policies\Mozilla\Firefox\FirefoxSuggest\Locked = 0x1 | 0x0
3383 ```
3384 #### Windows (Intune)
3385 OMA-URI:
3386 ```
3387 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~FirefoxSuggest/FirefoxSuggest_WebSuggestions
3388 ```
3389 Value (string):
3390 ```
3391 <enabled/> or <disabled/>
3392 ```
3393 OMA-URI:
3394 ```
3395 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~FirefoxSuggest/FirefoxSuggest_SponsoredSuggestions
3396 ```
3397 Value (string):
3398 ```
3399 <enabled/> or <disabled/>
3400 ```
3401 OMA-URI:
3402 ```
3403 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~FirefoxSuggest/FirefoxSuggest_ImproveSuggest
3404 ```
3405 Value (string):
3406 ```
3407 <enabled/> or <disabled/>
3408 ```
3409 OMA-URI:
3410 ```
3411 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~FirefoxSuggest/FirefoxSuggest_Locked
3412 ```
3413 Value (string):
3414 ```
3415 <enabled/> or <disabled/>
3416 ```
3417 #### macOS
3418 ```
3419 <dict>
3420   <key>FirefoxSuggest</key>
3421   <dict>
3422     <key>WebSuggestions</key>
3423     <true/> | <false/>
3424     <key>SponsoredSuggestions</key>
3425     <true/> | <false/>
3426     <key>ImproveSuggest</key>
3427     <true/> | <false/>
3428     <key>Locked</key>
3429     <true/> | <false/>
3430   </dict>
3431 </dict>
3432 ```
3433 #### policies.json
3434 ```
3435 {
3436   "policies": {
3437     "FirefoxSuggest": {
3438       "WebSuggestions": true | false,
3439       "SponsoredSuggestions": true | false,
3440       "ImproveSuggest": true | false,
3441       "Locked": true | false
3442     }
3443   }
3444 }
3445 ```
3446 ### GoToIntranetSiteForSingleWordEntryInAddressBar
3447 Whether to always go through the DNS server before sending a single word search string to a search engine.
3448
3449 If the site exists, it will navigate to the website. If the intranet responds with a 404, the page will show a 404. If the intranet does not respond, the browser will attempt a search.
3450
3451 The second result in the URL bar will be a search result to allow users to conduct a web search exactly as it was entered.
3452
3453 If instead you would like to enable the ability to have your domain appear as a valid URL and to disallow the browser from ever searching that term using the first result that matches it, add the pref `browser.fixup.domainwhitelist.YOUR_DOMAIN` (where `YOUR_DOMAIN` is the name of the domain you'd like to add), and set the pref to `true`. The URL bar will then suggest `YOUR_DOMAIN` when the user fully types `YOUR_DOMAIN`. If the user attempts to load that domain and it fails to load, it will show an "Unable to connect" error page.
3454
3455 You can also whitelist a domain suffix that is not part of the [Public Suffix List](https://publicsuffix.org/) by adding the pref `browser.fixup.domainsuffixwhitelist.YOUR_DOMAIN_SUFFIX` with a value of `true`.
3456
3457 Additionally, if you want users to see a "Did you mean to go to 'YOUR_DOMAIN'" prompt below the URL bar if they land on a search results page instead of an intranet domain that provides a response, set the pref `browser.urlbar.dnsResolveSingleWordsAfterSearch` to `1`. Enabling this will cause the browser to commit a DNS check after every single word search. If the browser receives a response from the intranet, a prompt will ask the user if they'd like to instead navigate to `YOUR_DOMAIN`. If the user presses the **yes** button, `browser.fixup.domainwhitelist.YOUR_DOMAIN` will be set to `true`.
3458
3459 **Compatibility:** Firefox 104, Firefox ESR 102.2\
3460 **CCK2 Equivalent:** `N/A`\
3461 **Preferences Affected:** `browser.fixup.dns_first_for_single_words`
3462
3463 #### Windows (GPO)
3464 ```
3465 Software\Policies\Mozilla\Firefox\GoToIntranetSiteForSingleWordEntryInAddressBar = 0x1 | 0x0
3466 ```
3467 #### Windows (Intune)
3468 OMA-URI:
3469 ```
3470 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox/GoToIntranetSiteForSingleWordEntryInAddressBar
3471 ```
3472 Value (string):
3473 ```
3474 <enabled/> or <disabled/>
3475 ```
3476 #### macOS
3477 ```
3478 <dict>
3479   <key>GoToIntranetSiteForSingleWordEntryInAddressBar</key>
3480   <true/> | <false/>
3481 </dict>
3482 ```
3483 #### policies.json
3484 ```
3485 {
3486   "policies": {
3487     "GoToIntranetSiteForSingleWordEntryInAddressBar": true | false
3488   }
3489 }
3490 ```
3491 ### Handlers
3492 Configure default application handlers. This policy is based on the internal format of `handlers.json`.
3493
3494 You can configure handlers based on a mime type (`mimeTypes`), a file's extension (`extensions`), or a protocol (`schemes`).
3495
3496 Within each handler type, you specify the given mimeType/extension/scheme as a key and use the following subkeys to describe how it is handled.
3497
3498 | Name | Description |
3499 | --- | --- |
3500 | `action`| Can be either `saveToDisk`, `useHelperApp`, `useSystemDefault`.
3501 | `ask` | If `true`, the user is asked if what they want to do with the file. If `false`, the action is taken without user intervention.
3502 | `handlers` | An array of handlers with the first one being the default. If you don't want to have a default handler, use an empty object for the first handler. Choose between path or uriTemplate.
3503 | &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;`name` | The display name of the handler (might not be used).
3504 | &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;`path`| The native path to the executable to be used.
3505 | &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;`uriTemplate`| A url to a web based application handler. The URL must be https and contain a %s to be used for substitution.
3506
3507 **Compatibility:** Firefox 78, Firefox ESR 78\
3508 **CCK2 Equivalent:** N/A\
3509 **Preferences Affected:** N/A
3510
3511 #### Windows (GPO)
3512 Software\Policies\Mozilla\Firefox\Handlers (REG_MULTI_SZ) =
3513 ```
3514 {
3515   "mimeTypes": {
3516     "application/msword": {
3517       "action": "useSystemDefault",
3518       "ask": true | false
3519     }
3520   },
3521   "schemes": {
3522     "mailto": {
3523       "action": "useHelperApp",
3524       "ask": true | false,
3525       "handlers": [{
3526         "name": "Gmail",
3527         "uriTemplate": "https://mail.google.com/mail/?extsrc=mailto&url=%s"
3528       }]
3529     }
3530   },
3531   "extensions": {
3532     "pdf": {
3533       "action": "useHelperApp",
3534       "ask": true | false,
3535       "handlers": [{
3536         "name": "Adobe Acrobat",
3537         "path": "C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\AcroRd32.exe"
3538       }]
3539     }
3540   }
3541 }
3542 ```
3543 #### Windows (Intune)
3544 OMA-URI:
3545 ```
3546 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox/Handlers
3547 ```
3548 Value (string):
3549 ```
3550 <enabled/>
3551 <data id="Handlers" value='
3552 {
3553   "mimeTypes": {
3554     "application/msword": {
3555       "action": "useSystemDefault",
3556       "ask": true | false
3557     }
3558   },
3559   "schemes": {
3560     "mailto": {
3561       "action": "useHelperApp",
3562       "ask": true | false,
3563       "handlers": [{
3564         "name": "Gmail",
3565         "uriTemplate": "https://mail.google.com/mail/?extsrc=mailto&amp;url=%s"
3566       }]
3567     }
3568   },
3569   "extensions": {
3570     "pdf": {
3571       "action": "useHelperApp",
3572       "ask": true | false,
3573       "handlers": [{
3574         "name": "Adobe Acrobat",
3575         "path": "C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\AcroRd32.exe"
3576       }]
3577     }
3578   }
3579 }
3580 '/>
3581 ```
3582 If you are using custom ADMX and ADML administrative templates in Intune, you can use this OMA-URI instead
3583 to workaround the limit on the length of strings. Put all of your JSON on one line.
3584
3585 OMA-URI:
3586 ```
3587 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~Extensions/HandlersOneLine
3588 ```
3589 Value (string):
3590 ```
3591 <enabled/>
3592 <data id="JSONOneLine" value='{}'/>
3593 ```
3594 #### macOS
3595 ```
3596 <dict>
3597   <key>Handlers</key>
3598   <dict>
3599     <key>mimeTypes</key>
3600     <dict>
3601       <key>application/msword</key>
3602       <dict>
3603         <key>action</key>
3604         <string>useSystemDefault</string>
3605         <key>ask</key>
3606         <true/> | <false/>
3607       </dict>
3608     </dict>
3609     <key>schemes</key>
3610     <dict>
3611       <key>mailto</key>
3612       <dict>
3613         <key>action</key>
3614         <string>useHelperApp</string>
3615         <key>ask</key>
3616         <true/> | <false/>
3617         <key>handlers</key>
3618         <array>
3619           <dict>
3620             <key>name</key>
3621             <string>Gmail</string>
3622             <key>uriTemplate</key>
3623             <string>https://mail.google.com/mail/?extsrc=mailto&url=%s</string>
3624           </dict>
3625         </array>
3626       </dict>
3627     </dict>
3628     <key>extensions</key>
3629     <dict>
3630       <key>pdf</key>
3631       <dict>
3632         <key>action</key>
3633         <string>useHelperApp</string>
3634         <key>ask</key>
3635         <true/> | <false/>
3636         <key>handlers</key>
3637         <array>
3638           <dict>
3639             <key>name</key>
3640             <string>Adobe Acrobat</string>
3641             <key>path</key>
3642             <string>/System/Applications/Preview.app</string>
3643           </dict>
3644         </array>
3645       </dict>
3646     </dict>
3647   </dict>
3648 </dict>
3649 ```
3650 #### policies.json
3651 ```
3652 {
3653   "policies": {
3654     "Handlers": {
3655       "mimeTypes": {
3656         "application/msword": {
3657           "action": "useSystemDefault",
3658           "ask": false
3659         }
3660       },
3661       "schemes": {
3662         "mailto": {
3663           "action": "useHelperApp",
3664           "ask": true | false,
3665           "handlers": [{
3666             "name": "Gmail",
3667             "uriTemplate": "https://mail.google.com/mail/?extsrc=mailto&url=%s"
3668           }]
3669         }
3670       },
3671       "extensions": {
3672         "pdf": {
3673           "action": "useHelperApp",
3674           "ask": true | false,
3675           "handlers": [{
3676             "name": "Adobe Acrobat",
3677             "path": "/usr/bin/acroread"
3678           }]
3679         }
3680       }
3681     }
3682   }
3683 }
3684 ```
3685 ### HardwareAcceleration
3686 Control hardware acceleration.
3687
3688 **Compatibility:** Firefox 60, Firefox ESR 60\
3689 **CCK2 Equivalent:** N/A\
3690 **Preferences Affected:** `layers.acceleration.disabled`
3691
3692 #### Windows (GPO)
3693 ```
3694 Software\Policies\Mozilla\Firefox\HardwareAcceleration = 0x1 | 0x0
3695 ```
3696 #### Windows (Intune)
3697 OMA-URI:
3698 ```
3699 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox/HardwareAcceleration
3700 ```
3701 Value (string):
3702 ```
3703 <enabled/> or <disabled/>
3704 ```
3705 #### macOS
3706 ```
3707 <dict>
3708   <key>HardwareAcceleration</key>
3709   <true/> | <false/>
3710 </dict>
3711 ```
3712 #### policies.json
3713 ```
3714 {
3715   "policies": {
3716     "HardwareAcceleration": true | false
3717   }
3718 }
3719 ```
3720 ### Homepage
3721 Configure the default homepage and how Firefox starts.
3722
3723 `URL` is the default homepage.
3724
3725 `Locked` prevents the user from changing homepage preferences.
3726
3727 `Additional` allows for more than one homepage.
3728
3729 `StartPage` is how Firefox starts. The choices are no homepage, the default homepage or the previous session.
3730
3731 With Firefox 78, an additional option as added for `Startpage`, `homepage-locked`. If this is value is set for the Startpage, the user will always get the homepage at startup and cannot choose to restore their session.
3732
3733 **Compatibility:** Firefox 60, Firefox ESR 60 (StartPage was added in Firefox 60, Firefox ESR 60.4, homepage-locked added in Firefox 78)\
3734 **CCK2 Equivalent:** `homePage`,`lockHomePage`\
3735 **Preferences Affected:** `browser.startup.homepage`, `browser.startup.page`
3736
3737 #### Windows (GPO)
3738 ```
3739 Software\Policies\Mozilla\Firefox\Homepage\URL = "https://example.com"
3740 Software\Policies\Mozilla\Firefox\Homepage\Locked = 0x1 | 0x0
3741 Software\Policies\Mozilla\Firefox\Homepage\Additional\1 = "https://example.org"
3742 Software\Policies\Mozilla\Firefox\Homepage\Additional\2 = "https://example.edu"
3743 Software\Policies\Mozilla\Firefox\Homepage\StartPage = "none" | "homepage" | "previous-session" | "homepage-locked"
3744 ```
3745 #### Windows (Intune)
3746 OMA-URI:
3747 ```
3748 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~Homepage/HomepageURL
3749 ```
3750 Value (string):
3751 ```
3752 <enabled/>
3753
3754 <data id="HomepageURL" value="https://example.com"/>
3755 <data id="HomepageLocked" value="true | false"/>
3756 ```
3757 OMA-URI:
3758 ```
3759 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~Homepage/HomepageAdditional
3760 ```
3761 Value (string):
3762 ```
3763 <enabled/>
3764
3765 <data id="HomepageAdditional" value="1&#xF000;http://example.org&#xF000;2&#xF000;http://example.edu"/>
3766 ```
3767 OMA-URI:
3768 ```
3769 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~Homepage/HomepageStartPage
3770 ```
3771 Value (string):
3772 ```
3773 <enabled/>
3774
3775 <data id="StartPage" value="none | homepage | previous-session"/>
3776 ```
3777 #### macOS
3778 ```
3779 <dict>
3780   <key>Homepage</key>
3781   <dict>
3782     <key>URL</key>
3783     <string>http://example.com</string>
3784     <key>Locked</key>
3785     <true/> | <false/>
3786     <key>Additional</key>
3787     <array>
3788       <string>http://example.org</string>
3789       <string>http://example.edu</string>
3790     </array>
3791     <key>StartPage</key>
3792     <string>none | homepage | previous-session | homepage-locked</string>
3793   </dict>
3794 </dict>
3795 ```
3796 #### policies.json
3797 ```
3798 {
3799   "policies": {
3800     "Homepage": {
3801       "URL": "http://example.com/",
3802       "Locked": true | false,
3803       "Additional": ["http://example.org/",
3804                      "http://example.edu/"],
3805       "StartPage": "none" | "homepage" | "previous-session" | "homepage-locked"
3806     }
3807   }
3808 }
3809 ```
3810 ### HttpAllowlist
3811 Configure sites that will not be upgraded to HTTPS.
3812
3813 The sites are specified as a list of origins.
3814
3815 **Compatibility:** Firefox 127\
3816 **CCK2 Equivalent:** N/A\
3817 **Preferences Affected:** N/A
3818
3819 #### Windows (GPO)
3820 ```
3821 Software\Policies\Mozilla\Firefox\HttpAllowlist\1 = "http://example.org"
3822 Software\Policies\Mozilla\Firefox\HttpAllowlist\2 = "http://example.edu"
3823 ```
3824 #### Windows (Intune)
3825 OMA-URI:
3826 ```
3827 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox/HttpAllowlist
3828 ```
3829 Value (string):
3830 ```
3831 <enabled/>
3832 <data id="List" value="1&#xF000;http://example.org&#xF000;2&#xF000;http://example.edu"/>
3833 ```
3834 #### macOS
3835 ```
3836 <dict>
3837   <key>HttpAllowlist</key>
3838   <array>
3839     <string>http://example.org</string>
3840     <string>http://example.edu</string>
3841   </array>
3842 </dict>
3843 ```
3844 #### policies.json
3845 ```
3846 {
3847   "policies": {
3848     "HttpAllowlist": ["http://example.org",
3849                        "http://example.edu"]
3850   }
3851 }
3852 ```
3853 ### HttpsOnlyMode
3854 Configure HTTPS-Only Mode.
3855
3856 | Value | Description
3857 | --- | --- |
3858 | allowed | HTTPS-Only Mode is off by default, but the user can turn it on.
3859 | disallowed | HTTPS-Only Mode is off and the user can't turn it on.
3860 | enabled | HTTPS-Only Mode is on by default, but the user can turn it off.
3861 | force_enabled | HTTPS-Only Mode is on and the user can't turn it off.
3862
3863 **Compatibility:** Firefox 127\
3864 **CCK2 Equivalent:** N/A\
3865 **Preferences Affected:** `dom.security.https_only_mode`
3866
3867 #### Windows (GPO)
3868 ```
3869 Software\Policies\Mozilla\Firefox\HttpsOnlyMode = "allowed", "disallowed", "enabled", "force_enabled"
3870 ```
3871 #### Windows (Intune)
3872 OMA-URI:
3873 ```
3874 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox/HttpsOnlyMode
3875 ```
3876 Value (string):
3877 ```
3878 <enabled/>
3879 <data id="HttpsOnlyMode" value="allowed | disallowed | enabled | force_enabled"/>
3880 ```
3881 #### macOS
3882 ```
3883 <dict>
3884   <key>HttpsOnlyMode</key>
3885   <string>allowed | disallowed | enabled | force_enabled</string>
3886 </dict>
3887 ```
3888 #### policies.json
3889 ```
3890 {
3891   "policies": {
3892     "HttpsOnlyMode": "allowed" | "disallowed" | "enabled" | "force_enabled"
3893   }
3894 }
3895 ```
3896 ### InstallAddonsPermission
3897 Configure the default extension install policy as well as origins for extension installs are allowed. This policy does not override turning off all extension installs.
3898
3899 `Allow` is a list of origins where extension installs are allowed.
3900
3901 `Default` determines whether or not extension installs are allowed by default.
3902
3903 **Compatibility:** Firefox 60, Firefox ESR 60\
3904 **CCK2 Equivalent:** `permissions.install`\
3905 **Preferences Affected:** `xpinstall.enabled`, `browser.newtabpage.activity-stream.asrouter.userprefs.cfr.addons`, `browser.newtabpage.activity-stream.asrouter.userprefs.cfr.features`
3906
3907 #### Windows (GPO)
3908 ```
3909 Software\Policies\Mozilla\Firefox\InstallAddonsPermission\Allow\1 = "https://example.org"
3910 Software\Policies\Mozilla\Firefox\InstallAddonsPermission\Allow\2 = "https://example.edu"
3911 Software\Policies\Mozilla\Firefox\InstallAddonsPermission\Default = 0x1 | 0x0
3912 ```
3913 #### Windows (Intune)
3914 OMA-URI:
3915 ```
3916 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~Addons/InstallAddonsPermission_Allow
3917 ```
3918 Value (string):
3919 ```
3920 <enabled/>
3921 <data id="Permissions" value="1&#xF000;https://example.org&#xF000;2&#xF000;https://example.edu"/>
3922 ```
3923 OMA-URI:
3924 ```
3925 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~Addons/InstallAddonsPermission_Default
3926 ```
3927 Value (string):
3928 ```
3929 <enabled/>
3930 ```
3931 #### macOS
3932 ```
3933 <dict>
3934   <key>InstallAddonsPermission</key>
3935   <dict>
3936     <key>Allow</key>
3937     <array>
3938       <string>http://example.org</string>
3939       <string>http://example.edu</string>
3940     </array>
3941     <key>Default</key>
3942     <true/> | <false/>
3943   </dict>
3944 </dict>
3945 ```
3946 #### policies.json
3947 ```
3948 {
3949   "policies": {
3950     "InstallAddonsPermission": {
3951       "Allow": ["http://example.org/",
3952                 "http://example.edu/"],
3953       "Default": true | false
3954     }
3955   }
3956 }
3957 ```
3958 ### LegacyProfiles
3959 Disable the feature enforcing a separate profile for each installation.
3960
3961 If this policy set to true, Firefox will not try to create different profiles for installations of Firefox in different directories. This is the equivalent of the MOZ_LEGACY_PROFILES environment variable.
3962
3963 If this policy set to false, Firefox will create a new profile for each unique installation of Firefox.
3964
3965 This policy only work on Windows via GPO (not policies.json).
3966
3967 **Compatibility:** Firefox 70, Firefox ESR 68.2 (Windows only, GPO only)\
3968 **CCK2 Equivalent:** N/A\
3969 **Preferences Affected:** N/A
3970
3971 #### Windows (GPO)
3972 ```
3973 Software\Policies\Mozilla\Firefox\LegacyProfiles = = 0x1 | 0x0
3974 ```
3975 #### Windows (Intune)
3976 OMA-URI:
3977 ```
3978 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox/LegacyProfiles
3979 ```
3980 Value (string):
3981 ```
3982 <enabled/> or <disabled/>
3983 ```
3984 ### LegacySameSiteCookieBehaviorEnabled
3985 Enable default legacy SameSite cookie behavior setting.
3986
3987 If this policy is set to true, it reverts all cookies to legacy SameSite behavior which means that cookies that don't explicitly specify a ```SameSite``` attribute are treated as if they were ```SameSite=None```.
3988
3989 **Compatibility:** Firefox 96\
3990 **CCK2 Equivalent:** N/A\
3991 **Preferences Affected:** `network.cookie.sameSite.laxByDefault`
3992
3993 #### Windows (GPO)
3994 ```
3995 Software\Policies\Mozilla\Firefox\LegacySameSiteCookieBehaviorEnabled = = 0x1 | 0x0
3996 ```
3997 #### Windows (Intune)
3998 OMA-URI:
3999 ```
4000 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox/LegacySameSiteCookieBehaviorEnabled
4001 ```
4002 Value (string):
4003 ```
4004 <enabled/> or <disabled/>
4005 ```
4006 #### macOS
4007 ```
4008 <dict>
4009   <key>LegacySameSiteCookieBehaviorEnabled</key>
4010   <true/> | <false/>
4011 </dict>
4012 ```
4013 #### policies.json
4014 ```
4015 {
4016   "policies": {
4017     "LegacySameSiteCookieBehaviorEnabled": true | false
4018 }
4019 ```
4020 ### LegacySameSiteCookieBehaviorEnabledForDomainList
4021 Revert to legacy SameSite behavior for cookies on specified sites.
4022
4023 If this policy is set to true, cookies set for domains in this list will revert to legacy SameSite behavior which means that cookies that don't explicitly specify a ```SameSite``` attribute are treated as if they were ```SameSite=None```.
4024
4025 **Compatibility:** Firefox 96\
4026 **CCK2 Equivalent:** N/A\
4027 **Preferences Affected:** `network.cookie.sameSite.laxByDefault.disabledHosts`
4028
4029 #### Windows (GPO)
4030 ```
4031 Software\Policies\Mozilla\Firefox\LegacySameSiteCookieBehaviorEnabledForDomainList\1 = "example.org"
4032 Software\Policies\Mozilla\Firefox\LegacySameSiteCookieBehaviorEnabledForDomainList\2 = "example.edu"
4033 ```
4034 #### Windows (Intune)
4035 OMA-URI:
4036 ```
4037 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox/LegacySameSiteCookieBehaviorEnabledForDomainList
4038 ```
4039 Value (string):
4040 ```
4041 <enabled/>
4042 <data id="LegacySameSiteCookieBehaviorEnabledForDomainList" value="1&#xF000;example.org&#xF000;2&#xF000;example.edu"/>
4043 ```
4044 #### macOS
4045 ```
4046 <dict>
4047   <key>LegacySameSiteCookieBehaviorEnabledForDomainList</key>
4048   <array>
4049     <string>example.org</string>
4050     <string>example.edu</string>
4051   </array>
4052 </dict>
4053 ```
4054 #### policies.json
4055 ```
4056 {
4057   "policies": {
4058     "LegacySameSiteCookieBehaviorEnabledForDomainList": ["example.org",
4059                                                          "example.edu"]
4060   }
4061 }
4062 ```
4063 ### LocalFileLinks
4064 Enable linking to local files by origin.
4065
4066 **Compatibility:** Firefox 68, Firefox ESR 68\
4067 **CCK2 Equivalent:** N/A\
4068 **Preferences Affected:** `capability.policy.localfilelinks.*`
4069
4070 #### Windows (GPO)
4071 ```
4072 Software\Policies\Mozilla\Firefox\LocalFileLinks\1 = "https://example.org"
4073 Software\Policies\Mozilla\Firefox\LocalFileLinks\2 = "https://example.edu"
4074 ```
4075 #### Windows (Intune)
4076 OMA-URI:
4077 ```
4078 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox/LocalFileLinks
4079 ```
4080 Value (string):
4081 ```
4082 <enabled/>
4083 <data id="LocalFileLinks" value="1&#xF000;https://example.org&#xF000;2&#xF000;https://example.edu"/>
4084 ```
4085 #### macOS
4086 ```
4087 <dict>
4088   <key>LocalFileLinks</key>
4089   <array>
4090     <string>http://example.org</string>
4091     <string>http://example.edu</string>
4092   </array>
4093 </dict>
4094 ```
4095 #### policies.json
4096 ```
4097 {
4098   "policies": {
4099     "LocalFileLinks": ["http://example.org/",
4100                        "http://example.edu/"]
4101   }
4102 }
4103 ```
4104 ### ManagedBookmarks
4105 Configures a list of bookmarks managed by an administrator that cannot be changed by the user.
4106
4107 The bookmarks are only added as a button on the personal toolbar. They are not in the bookmarks folder.
4108
4109 The syntax of this policy is exactly the same as the [Chrome ManagedBookmarks policy](https://cloud.google.com/docs/chrome-enterprise/policies/?policy=ManagedBookmarks). The schema is:
4110 ```
4111 {
4112  "items": {
4113   "id": "BookmarkType",
4114   "properties": {
4115    "children": {
4116     "items": {
4117      "$ref": "BookmarkType"
4118     },
4119     "type": "array"
4120    },
4121    "name": {
4122     "type": "string"
4123    },
4124    "toplevel_name": {
4125     "type": "string"
4126    },
4127    "url": {
4128     "type": "string"
4129    }
4130   },
4131   "type": "object"
4132  },
4133  "type": "array"
4134 }
4135 ```
4136 **Compatibility:** Firefox 83, Firefox ESR 78.5\
4137 **CCK2 Equivalent:** N/A\
4138 **Preferences Affected:** N/A
4139
4140 #### Windows (GPO)
4141 Software\Policies\Mozilla\Firefox\ManagedBookmarks (REG_MULTI_SZ) =
4142 ```
4143 [
4144   {
4145     "toplevel_name": "My managed bookmarks folder"
4146   },
4147   {
4148     "url": "example.com",
4149     "name": "Example"
4150   },
4151   {
4152     "name": "Mozilla links",
4153     "children": [
4154       {
4155         "url": "https://mozilla.org",
4156         "name": "Mozilla.org"
4157       },
4158       {
4159         "url": "https://support.mozilla.org/",
4160         "name": "SUMO"
4161       }
4162     ]
4163   }
4164 ]
4165 ```
4166 #### Windows (Intune)
4167 OMA-URI:
4168 ```
4169 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox/ManagedBookmarks
4170 ```
4171 Value (string):
4172 ```
4173 <enabled/>
4174 <data id="JSON" value='
4175 [
4176   {
4177     "toplevel_name": "My managed bookmarks folder"
4178   },
4179   {
4180     "url": "example.com",
4181     "name": "Example"
4182   },
4183   {
4184     "name": "Mozilla links",
4185     "children": [
4186       {
4187         "url": "https://mozilla.org",
4188         "name": "Mozilla.org"
4189       },
4190       {
4191         "url": "https://support.mozilla.org/",
4192         "name": "SUMO"
4193       }
4194     ]
4195   }
4196 ]'/>
4197 ```
4198 If you are using custom ADMX and ADML administrative templates in Intune, you can use this OMA-URI instead
4199 to workaround the limit on the length of strings. Put all of your JSON on one line.
4200
4201 OMA-URI:
4202 ```
4203 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~Extensions/ManagedBoomarksOneLine
4204 ```
4205 Value (string):
4206 ```
4207 <enabled/>
4208 <data id="JSONOneLine" value='[]'/>
4209 ```
4210 #### macOS
4211 ```
4212 <dict>
4213   <key>ManagedBookmarks</key>
4214   <array>
4215     <dict>
4216       <key>toplevel_name</key>
4217       <string>My managed bookmarks folder</string>
4218       <dict>
4219         <key>url</key>
4220         <string>example.com</string>
4221         <key>name</key>
4222         <string>Example</string>
4223       </dict>
4224       <dict>
4225       <key>name</key>
4226       <string>Mozilla links</string>
4227       <key>children</key>
4228       <array>
4229         <dict>
4230           <key>url</key>
4231           <string>https://mozilla.org</string>
4232           <key>name</key>
4233           <string>Mozilla</string>
4234         </dict>
4235         <dict>
4236           <key>url</key>
4237           <string>https://support.mozilla.org/</string>
4238           <key>name</key>
4239           <string>SUMO</string>
4240         </dict>
4241       </array>
4242     </dict>
4243   </array>
4244 </dict>
4245 ```
4246 #### policies.json
4247 ```
4248 {
4249   "policies": {
4250     "ManagedBookmarks": [
4251       {
4252         "toplevel_name": "My managed bookmarks folder"
4253       },
4254       {
4255         "url": "example.com",
4256         "name": "Example"
4257       },
4258       {
4259         "name": "Mozilla links",
4260         "children": [
4261           {
4262             "url": "https://mozilla.org",
4263             "name": "Mozilla.org"
4264           },
4265           {
4266             "url": "https://support.mozilla.org/",
4267             "name": "SUMO"
4268           }
4269         ]
4270       }
4271     ]
4272   }
4273 }
4274 ```
4275 ### ManualAppUpdateOnly
4276
4277 Switch to manual updates only.
4278
4279 If this policy is enabled:
4280  1. The user will never be prompted to install updates
4281  2. Firefox will not check for updates in the background, though it will check automatically when an update UI is displayed (such as the one in the About dialog). This check will be used to show "Update to version X" in the UI, but will not automatically download the update or prompt the user to update in any other way.
4282  3. The update UI will work as expected, unlike when using DisableAppUpdate.
4283
4284 This policy is primarily intended for advanced end users, not for enterprises, but it is available via GPO.
4285
4286 **Compatibility:** Firefox 87\
4287 **CCK2 Equivalent:** N/A\
4288 **Preferences Affected:** N/A
4289
4290 #### Windows (GPO)
4291 ```
4292 Software\Policies\Mozilla\Firefox\ManualAppUpdateOnly = 0x1 | 0x0
4293 ```
4294 #### Windows (Intune)
4295 OMA-URI:
4296 ```
4297 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox/ManualAppUpdateOnly
4298 ```
4299 Value (string):
4300 ```
4301 <enabled/> or <disabled/>
4302 ```
4303 #### macOS
4304 ```
4305 <dict>
4306   <key>ManualAppUpdateOnly</key>
4307   <true/> | <false/>
4308 </dict>
4309 ```
4310 #### policies.json
4311 ```
4312 {
4313   "policies": {
4314     "ManualAppUpdateOnly": true | false
4315   }
4316 }
4317 ```
4318 ### MicrosoftEntraSSO
4319 Allow single sign-on for Microsoft Entra accounts on macOS.
4320
4321 If this policy is set to true, Firefox will use credentials stored in the Company Portal to sign in to Microsoft Entra accounts.
4322
4323 **Compatibility:** Firefox 132.0.1, Firefox ESR 128.5\
4324 **CCK2 Equivalent:** N/A\
4325 **Preferences Affected:** `network.http.microsoft-entra-sso.enabled`
4326
4327 #### macOS
4328 ```
4329 <dict>
4330   <key>MicrosoftEntraSSO</key>
4331   <true/> | <false/>
4332 </dict>
4333 ```
4334 #### policies.json
4335 ```
4336 {
4337   "policies": {
4338     "MicrosoftEntraSSO": true | false
4339   }
4340 }
4341 ```
4342 ### NetworkPrediction
4343 Enable or disable network prediction (DNS prefetching).
4344
4345 **Compatibility:** Firefox 67, Firefox ESR 60.7\
4346 **CCK2 Equivalent:** N/A\
4347 **Preferences Affected:** `network.dns.disablePrefetch`, `network.dns.disablePrefetchFromHTTPS`
4348
4349 #### Windows (GPO)
4350 ```
4351 Software\Policies\Mozilla\Firefox\NetworkPrediction = 0x1 | 0x0
4352 ```
4353 #### Windows (Intune)
4354 OMA-URI:
4355 ```
4356 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox/NetworkPrediction
4357 ```
4358 Value (string):
4359 ```
4360 <enabled/> or <disabled/>
4361 ```
4362 #### macOS
4363 ```
4364 <dict>
4365   <key>NetworkPrediction</key>
4366   <true/> | <false/>
4367 </dict>
4368 ```
4369 #### policies.json
4370 ```
4371 {
4372   "policies": {
4373     "NetworkPrediction": true | false
4374 }
4375 ```
4376 ### NewTabPage
4377 Enable or disable the New Tab page.
4378
4379 **Compatibility:** Firefox 68, Firefox ESR 68\
4380 **CCK2 Equivalent:** N/A\
4381 **Preferences Affected:** `browser.newtabpage.enabled`
4382
4383 #### Windows (GPO)
4384 ```
4385 Software\Policies\Mozilla\Firefox\NewTabPage = 0x1 | 0x0
4386 ```
4387 #### Windows (Intune)
4388 OMA-URI:
4389 ```
4390 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox/NewTabPage
4391 ```
4392 Value (string):
4393 ```
4394 <enabled/> or <disabled/>
4395 ```
4396 #### macOS
4397 ```
4398 <dict>
4399   <key>NewTabPage</key>
4400   <true/> | <false/>
4401 </dict>
4402 ```
4403 #### policies.json
4404 ```
4405 {
4406   "policies": {
4407     "NewTabPage": true | false
4408 }
4409 ```
4410 ### NoDefaultBookmarks
4411 Disable the creation of default bookmarks.
4412
4413 This policy is only effective if the user profile has not been created yet.
4414
4415 **Compatibility:** Firefox 60, Firefox ESR 60\
4416 **CCK2 Equivalent:** `removeDefaultBookmarks`\
4417 **Preferences Affected:** N/A
4418
4419 #### Windows (GPO)
4420 ```
4421 Software\Policies\Mozilla\Firefox\NoDefaultBookmarks = 0x1 | 0x0
4422 ```
4423 #### Windows (Intune)
4424 OMA-URI:
4425 ```
4426 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox/NoDefaultBookmarks
4427 ```
4428 Value (string):
4429 ```
4430 <enabled/> or <disabled/>
4431 ```
4432 #### macOS
4433 ```
4434 <dict>
4435   <key>NoDefaultBookmarks</key>
4436   <true/> | <false/>
4437 </dict>
4438 ```
4439 #### policies.json
4440 ```
4441 {
4442   "policies": {
4443     "NoDefaultBookmarks": true | false
4444   }
4445 }
4446 ```
4447 ### OfferToSaveLogins
4448 Control whether or not Firefox offers to save passwords.
4449
4450 **Compatibility:** Firefox 60, Firefox ESR 60\
4451 **CCK2 Equivalent:** `dontRememberPasswords`\
4452 **Preferences Affected:** `signon.rememberSignons`
4453
4454 #### Windows (GPO)
4455 ```
4456 Software\Policies\Mozilla\Firefox\OfferToSaveLogins = 0x1 | 0x0
4457 ```
4458 #### Windows (Intune)
4459 OMA-URI:
4460 ```
4461 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox/OfferToSaveLogins
4462 ```
4463 Value (string):
4464 ```
4465 <enabled/> or <disabled/>
4466 ```
4467 #### macOS
4468 ```
4469 <dict>
4470   <key>OfferToSaveLogins</key>
4471   <true/> | <false/>
4472 </dict>
4473 ```
4474 #### policies.json
4475 ```
4476 {
4477   "policies": {
4478     "OfferToSaveLogins": true | false
4479   }
4480 }
4481 ```
4482 ### OfferToSaveLoginsDefault
4483 Sets the default value of signon.rememberSignons without locking it.
4484
4485 **Compatibility:** Firefox 70, Firefox ESR 60.2\
4486 **CCK2 Equivalent:** `dontRememberPasswords`\
4487 **Preferences Affected:** `signon.rememberSignons`
4488
4489 #### Windows (GPO)
4490 ```
4491 Software\Policies\Mozilla\Firefox\OfferToSaveLoginsDefault = 0x1 | 0x0
4492 ```
4493 #### Windows (Intune)
4494 OMA-URI:
4495 ```
4496 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox/OfferToSaveLoginsDefault
4497 ```
4498 Value (string):
4499 ```
4500 <enabled/> or <disabled/>
4501 ```
4502 #### macOS
4503 ```
4504 <dict>
4505   <key>OfferToSaveLoginsDefault</key>
4506   <true/> | <false/>
4507 </dict>
4508 ```
4509 #### policies.json
4510 ```
4511 {
4512   "policies": {
4513     "OfferToSaveLoginsDefault": true | false
4514   }
4515 }
4516 ```
4517 ### OverrideFirstRunPage
4518 Override the first run page. If the value is an empty string (""), the first run page is not displayed.
4519
4520 Starting with Firefox 83, Firefox ESR 78.5, you can also specify multiple URLS separated by a vertical bar (|).
4521
4522 **Compatibility:** Firefox 60, Firefox ESR 60\
4523 **CCK2 Equivalent:** `welcomePage`,`noWelcomePage`\
4524 **Preferences Affected:** `startup.homepage_welcome_url`
4525
4526 #### Windows (GPO)
4527 ```
4528 Software\Policies\Mozilla\Firefox\OverrideFirstRunPage = "http://example.org"
4529 ```
4530 #### Windows (Intune)
4531 OMA-URI:
4532 ```
4533 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox/OverrideFirstRunPage
4534 ```
4535 Value (string):
4536 ```
4537 <enabled/>
4538 <data id="OverridePage" value="https://example.com"/>
4539 ```
4540 #### macOS
4541 ```
4542 <dict>
4543   <key>OverrideFirstRunPage</key>
4544   <string>http://example.org</string>
4545 </dict>
4546 ```
4547 #### policies.json
4548 ```
4549 {
4550   "policies": {
4551     "OverrideFirstRunPage": "http://example.org"
4552   }
4553 }
4554 ```
4555 ### OverridePostUpdatePage
4556 Override the upgrade page. If the value is an empty string (""), no extra pages are displayed when Firefox is upgraded.
4557
4558 **Compatibility:** Firefox 60, Firefox ESR 60\
4559 **CCK2 Equivalent:** `upgradePage`,`noUpgradePage`\
4560 **Preferences Affected:** `startup.homepage_override_url`
4561
4562 #### Windows (GPO)
4563 ```
4564 Software\Policies\Mozilla\Firefox\OverridePostUpdatePage = "http://example.org"
4565 ```
4566 #### Windows (Intune)
4567 OMA-URI:
4568 ```
4569 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox/OverridePostUpdatePage
4570 ```
4571 Value (string):
4572 ```
4573 <enabled/>
4574 <data id="OverridePage" value="https://example.com"/>
4575 ```
4576 #### macOS
4577 ```
4578 <dict>
4579   <key>OverridePostUpdatePage</key>
4580   <string>http://example.org</string>
4581 </dict>
4582 ```
4583 #### policies.json
4584 ```
4585 {
4586   "policies": {
4587     "OverridePostUpdatePage": "http://example.org"
4588   }
4589 }
4590 ```
4591 ### PasswordManagerEnabled
4592 Remove access to the password manager via preferences and blocks about:logins on Firefox 70.
4593
4594 **Compatibility:** Firefox 70, Firefox ESR 60.2\
4595 **CCK2 Equivalent:** N/A\
4596 **Preferences Affected:** `pref.privacy.disable_button.view_passwords`, `signon.rememberSignons`
4597
4598 #### Windows (GPO)
4599 ```
4600 Software\Policies\Mozilla\Firefox\PasswordManagerEnabled = 0x1 | 0x0
4601 ```
4602 #### Windows (Intune)
4603 OMA-URI:
4604 ```
4605 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox/PasswordManagerEnabled
4606 ```
4607 Value (string):
4608 ```
4609 <enabled/> or <disabled/>
4610 ```
4611 #### macOS
4612 ```
4613 <dict>
4614   <key>PasswordManagerEnabled</key>
4615   <true/> | <false/>
4616 </dict>
4617 ```
4618 #### policies.json
4619 ```
4620 {
4621   "policies": {
4622     "PasswordManagerEnabled": true | false
4623   }
4624 }
4625 ```
4626 ### PasswordManagerExceptions
4627 Prevent Firefox from saving passwords for specific sites.
4628
4629 The sites are specified as a list of origins.
4630
4631 **Compatibility:** Firefox 101\
4632 **CCK2 Equivalent:** N/A\
4633 **Preferences Affected:** N/A
4634
4635 #### Windows (GPO)
4636 ```
4637 Software\Policies\Mozilla\Firefox\PasswordManagerExceptions\1 = "https://example.org"
4638 Software\Policies\Mozilla\Firefox\PasswordManagerExceptions\2 = "https://example.edu"
4639 ```
4640 #### Windows (Intune)
4641 OMA-URI:
4642 ```
4643 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox/PasswordManagerExceptions
4644 ```
4645 Value (string):
4646 ```
4647 <enabled/>
4648 <data id="List" value="1&#xF000;https://example.org&#xF000;2&#xF000;https://example.edu"/>
4649 ```
4650 #### macOS
4651 ```
4652 <dict>
4653   <key>PasswordManagerExceptions</key>
4654   <array>
4655     <string>https://example.org</string>
4656     <string>https://example.edu</string>
4657   </array>
4658 </dict>
4659 ```
4660 #### policies.json
4661 ```
4662 {
4663   "policies": {
4664     "PasswordManagerExceptions": ["https://example.org",
4665                                   "https://example.edu"]
4666   }
4667 }
4668 ```
4669 ### PDFjs
4670 Disable or configure PDF.js, the built-in PDF viewer.
4671
4672 If `Enabled` is set to false, the built-in PDF viewer is disabled.
4673
4674 If `EnablePermissions` is set to true, the built-in PDF viewer will honor document permissions like preventing the copying of text.
4675
4676 Note: DisableBuiltinPDFViewer has not been deprecated. You can either continue to use it, or switch to using PDFjs->Enabled to disable the built-in PDF viewer. This new permission was added because we needed a place for PDFjs->EnabledPermissions.
4677
4678 **Compatibility:** Firefox 77, Firefox ESR 68.9\
4679 **CCK2 Equivalent:** N/A\
4680 **Preferences Affected:** `pdfjs.disabled`, `pdfjs.enablePermissions`
4681
4682 #### Windows (GPO)
4683 ```
4684 Software\Policies\Mozilla\Firefox\PDFjs\Enabled = 0x1 | 0x0
4685 Software\Policies\Mozilla\Firefox\PDFjs\EnablePermissions = 0x1 | 0x0
4686 ```
4687 #### Windows (Intune)
4688 OMA-URI:
4689 ```
4690 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~PDFjs/PDFjs_Enabled
4691 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~PDFjs/PDFjs_EnablePermissions
4692 ```
4693 Value (string):
4694 ```
4695 <enabled/>or <disabled/>
4696 ```
4697 #### macOS
4698 ```
4699 <dict>
4700   <key>PDFjs</key>
4701   <dict>
4702     <key>Enabled</key>
4703     <true/> | <false/>
4704     <key>EnablePermissions</key>
4705     <true/> | <false/>
4706   </dict>
4707 </dict>
4708 ```
4709 #### policies.json
4710 ```
4711 {
4712   "policies": {
4713     "PDFjs": {
4714       "Enabled": true | false,
4715       "EnablePermissions": true | false
4716     }
4717   }
4718 }
4719 ```
4720 ### Permissions
4721 Set permissions associated with camera, microphone, location, notifications, autoplay, and virtual reality. Because these are origins, not domains, entries with unique ports must be specified separately. This explicitly means that it is not possible to add wildcards. See examples below.
4722
4723 `Allow` is a list of origins where the feature is allowed.
4724
4725 `Block` is a list of origins where the feature is not allowed.
4726
4727 `BlockNewRequests` determines whether or not new requests can be made for the feature.
4728
4729 `Locked` prevents the user from changing preferences for the feature.
4730
4731 `Default` specifies the default value for Autoplay. block-audio-video is not supported on Firefox ESR 68.
4732
4733 **Compatibility:** Firefox 62, Firefox ESR 60.2 (Autoplay added in Firefox 74, Firefox ESR 68.6, Autoplay Default/Locked added in Firefox 76, Firefox ESR 68.8, VirtualReality added in Firefox 80, Firefox ESR 78.2)\
4734 **CCK2 Equivalent:** N/A\
4735 **Preferences Affected:** `permissions.default.camera`, `permissions.default.microphone`, `permissions.default.geo`, `permissions.default.desktop-notification`, `media.autoplay.default`, `permissions.default.xr`
4736
4737 #### Windows (GPO)
4738 ```
4739 Software\Policies\Mozilla\Firefox\Permissions\Camera\Allow\1 = "https://example.org"
4740 Software\Policies\Mozilla\Firefox\Permissions\Camera\Allow\2 = "https://example.com"
4741 Software\Policies\Mozilla\Firefox\Permissions\Camera\Block\1 = "https://example.edu"
4742 Software\Policies\Mozilla\Firefox\Permissions\Camera\BlockNewRequests = 0x1 | 0x0
4743 Software\Policies\Mozilla\Firefox\Permissions\Camera\Locked = 0x1 | 0x0
4744 Software\Policies\Mozilla\Firefox\Permissions\Microphone\Allow\1 = "https://example.org"
4745 Software\Policies\Mozilla\Firefox\Permissions\Microphone\Allow\2 = "https://example.com"
4746 Software\Policies\Mozilla\Firefox\Permissions\Microphone\Block\1 = "https://example.edu"
4747 Software\Policies\Mozilla\Firefox\Permissions\Microphone\BlockNewRequests = 0x1 | 0x0
4748 Software\Policies\Mozilla\Firefox\Permissions\Microphone\Locked = 0x1 | 0x0
4749 Software\Policies\Mozilla\Firefox\Permissions\Location\Allow\1 = "https://example.org"
4750 Software\Policies\Mozilla\Firefox\Permissions\Location\Allow\2 = "https://example.com"
4751 Software\Policies\Mozilla\Firefox\Permissions\Location\Block\1 = "https://example.edu"
4752 Software\Policies\Mozilla\Firefox\Permissions\Location\BlockNewRequests = 0x1 | 0x0
4753 Software\Policies\Mozilla\Firefox\Permissions\Location\Locked = 0x1 | 0x0
4754 Software\Policies\Mozilla\Firefox\Permissions\Notifications\Allow\1 = "https://example.org"
4755 Software\Policies\Mozilla\Firefox\Permissions\Notifications\Allow\2 = "https://example.com"
4756 Software\Policies\Mozilla\Firefox\Permissions\Notifications\Block\1 = "https://example.edu"
4757 Software\Policies\Mozilla\Firefox\Permissions\Notifications\BlockNewRequests = 0x1 | 0x0
4758 Software\Policies\Mozilla\Firefox\Permissions\Notifications\Locked = 0x1 | 0x0
4759 Software\Policies\Mozilla\Firefox\Permissions\Autoplay\Allow\1 = "https://example.org"
4760 Software\Policies\Mozilla\Firefox\Permissions\Autoplay\Allow\2 = "https://example.com"
4761 Software\Policies\Mozilla\Firefox\Permissions\Autoplay\Block\1 = "https://example.edu"
4762 Software\Policies\Mozilla\Firefox\Permissions\Autoplay\Default = "allow-audio-video" | "block-audio" | "block-audio-video"
4763 Software\Policies\Mozilla\Firefox\Permissions\Autoplay\Locked = 0x1 | 0x0
4764 Software\Policies\Mozilla\Firefox\Permissions\VirtualReality\Allow\1 = "https://example.org"
4765 Software\Policies\Mozilla\Firefox\Permissions\VirtualReality\Allow\2 = "https://example.com"
4766 Software\Policies\Mozilla\Firefox\Permissions\VirtualReality\Block\1 = "https://example.edu"
4767 Software\Policies\Mozilla\Firefox\Permissions\VirtualReality\BlockNewRequests = 0x1 | 0x0
4768 Software\Policies\Mozilla\Firefox\Permissions\VirtualReality\Locked = 0x1 | 0x0
4769 ```
4770 #### Windows (Intune)
4771 OMA-URI:
4772 ```
4773 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~Permissions~Camera/Camera_Allow
4774 ```
4775 Value (string):
4776 ```
4777 <enabled/>
4778 <data id="Permissions" value="1&#xF000;https://example.org&#xF000;2&#xF000;https://example.com"/>
4779 ```
4780 OMA-URI:
4781 ```
4782 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~Permissions~Camera/Camera_Block
4783 ```
4784 Value (string):
4785 ```
4786 <enabled/>
4787 <data id="Permissions" value="1&#xF000;https://example.edu"/>
4788 ```
4789 OMA-URI:
4790 ```
4791 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~Permissions~Camera/Camera_BlockNewRequests
4792 ```
4793 Value (string):
4794 ```
4795 <enabled/> or <disabled/>
4796 ```
4797 OMA-URI:
4798 ```
4799 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~Permissions~Camera/Camera_Locked
4800 ```
4801 Value (string):
4802 ```
4803 <enabled/> or <disabled/>
4804 ```
4805 OMA-URI:
4806 ```
4807 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~Permissions~Microphone/Microphone_Allow
4808 ```
4809 Value (string):
4810 ```
4811 <enabled/>
4812 <data id="Permissions" value="1&#xF000;https://example.org&#xF000;2&#xF000;https://example.com"/>
4813 ```
4814 OMA-URI:
4815 ```
4816 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~Permissions~Microphone/Microphone_Block
4817 ```
4818 Value (string):
4819 ```
4820 <enabled/>
4821 <data id="Permissions" value="1&#xF000;https://example.edu"/>
4822 ```
4823 OMA-URI:
4824 ```
4825 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~Permissions~Microphone/Microphone_BlockNewRequests
4826 ```
4827 Value (string):
4828 ```
4829 <enabled/> or <disabled/>
4830 ```
4831 OMA-URI:
4832 ```
4833 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~Permissions~Microphone/Microphone_Locked
4834 ```
4835 Value (string):
4836 ```
4837 <enabled/> or <disabled/>
4838 ```
4839 OMA-URI:
4840 ```
4841 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~Permissions~Location/Location_Allow
4842 ```
4843 Value (string):
4844 ```
4845 <enabled/>
4846 <data id="Permissions" value="1&#xF000;https://example.org&#xF000;2&#xF000;https://example.com"/>
4847 ```
4848 OMA-URI:
4849 ```
4850 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~Permissions~Location/Location_Block
4851 ```
4852 Value (string):
4853 ```
4854 <enabled/>
4855 <data id="Permissions" value="1&#xF000;https://example.edu"/>
4856 ```
4857 OMA-URI:
4858 ```
4859 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~Permissions~Location/Location_BlockNewRequests
4860 ```
4861 Value (string):
4862 ```
4863 <enabled/> or <disabled/>
4864 ```
4865 OMA-URI:
4866 ```
4867 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~Permissions~Location/Location_Locked
4868 ```
4869 Value (string):
4870 ```
4871 <enabled/> or <disabled/>
4872 ```
4873 OMA-URI:
4874 ```
4875 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~Permissions~Notifications/Notifications_Allow
4876 ```
4877 Value (string):
4878 ```
4879 <enabled/>
4880 <data id="Permissions" value="1&#xF000;https://example.org&#xF000;2&#xF000;https://example.com"/>
4881 ```
4882 OMA-URI:
4883 ```
4884 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~Permissions~Notifications/Notifications_BlockNewRequests
4885 ```
4886 Value (string):
4887 ```
4888 <enabled/> or <disabled/>
4889 ```
4890 OMA-URI:
4891 ```
4892 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~Permissions~Notifications/Notifications_Locked
4893 ```
4894 Value (string):
4895 ```
4896 <enabled/> or <disabled/>
4897 ```
4898 OMA-URI:
4899 ```
4900 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~Permissions~Autoplay/Autoplay_Allow
4901 ```
4902 Value (string):
4903 ```
4904 <enabled/>
4905 <data id="Permissions" value="1&#xF000;https://example.org&#xF000;2&#xF000;https://example.com"/>
4906 ```
4907 OMA-URI:
4908 ```
4909 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~Permissions~Autoplay/Autoplay_Block
4910 ```
4911 Value (string):
4912 ```
4913 <enabled/>
4914 <data id="Permissions" value="1&#xF000;https://example.edu"/>
4915 ```
4916 OMA-URI:
4917 ```
4918 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~Permissions~Autoplay/Autoplay_Default
4919 ```
4920 Value (string):
4921 ```
4922 <enabled/>
4923 <data id="Autoplay_Default" value="allow-audio-video | block-audio | block-audio-video"/>
4924 ```
4925 OMA-URI:
4926 ```
4927 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~Permissions~Autoplay/Autoplay_Locked
4928 ```
4929 Value (string):
4930 ```
4931 <enabled/> or <disabled/>
4932 ```
4933 OMA-URI:
4934 ```
4935 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~Permissions~VirtualReality/VirtualReality_Allow
4936 ```
4937 Value (string):
4938 ```
4939 <enabled/>
4940 <data id="Permissions" value="1&#xF000;https://example.org&#xF000;2&#xF000;https://example.com"/>
4941 ```
4942 OMA-URI:
4943 ```
4944 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~Permissions~VirtualReality/VirtualReality_Block
4945 ```
4946 Value (string):
4947 ```
4948 <enabled/>
4949 <data id="Permissions" value="1&#xF000;https://example.edu"/>
4950 ```
4951 OMA-URI:
4952 ```
4953 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~Permissions~VirtualReality/VirtualReality_BlockNewRequests
4954 ```
4955 Value (string):
4956 ```
4957 <enabled/> or <disabled/>
4958 ```
4959 OMA-URI:
4960 ```
4961 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~Permissions~Notifications/VirtualReality_Locked
4962 ```
4963 Value (string):
4964 ```
4965 <enabled/> or <disabled/>
4966 ```
4967 #### macOS
4968 ```
4969 <dict>
4970   <key>Permissions</key>
4971   <dict>
4972     <key>Camera</key>
4973     <dict>
4974       <key>Allow</key>
4975       <array>
4976         <string>https://example.org</string>
4977         <string>https://example.org:1234</string>
4978       </array>
4979       <key>Block</key>
4980       <array>
4981         <string>https://example.edu</string>
4982       </array>
4983       <key>BlockNewRequests</key>
4984       <true/> | <false/>
4985       <key>Locked</key>
4986       <true/> | <false/>
4987     </dict>
4988     <key>Microphone</key>
4989     <dict>
4990       <key>Allow</key>
4991       <array>
4992         <string>https://example.org</string>
4993       </array>
4994       <key>Block</key>
4995       <array>
4996         <string>https://example.edu</string>
4997       </array>
4998       <key>BlockNewRequests</key>
4999       <true/> | <false/>
5000       <key>Locked</key>
5001       <true/> | <false/>
5002     </dict>
5003     <key>Location</key>
5004     <dict>
5005       <key>Allow</key>
5006       <array>
5007         <string>https://example.org</string>
5008       </array>
5009       <key>Block</key>
5010       <array>
5011         <string>https://example.edu</string>
5012       </array>
5013       <key>BlockNewRequests</key>
5014       <true/> | <false/>
5015       <key>Locked</key>
5016       <true/> | <false/>
5017     </dict>
5018     <key>Notifications</key>
5019     <dict>
5020       <key>Allow</key>
5021       <array>
5022         <string>https://example.org</string>
5023       </array>
5024       <key>Block</key>
5025       <array>
5026         <string>https://example.edu</string>
5027       </array>
5028       <key>BlockNewRequests</key>
5029       <true/>
5030       <key>Locked</key>
5031       <true/>
5032     </dict>
5033     <key>Autoplay</key>
5034     <dict>
5035       <key>Allow</key>
5036       <array>
5037         <string>https://example.org</string>
5038       </array>
5039       <key>Block</key>
5040       <array>
5041         <string>https://example.edu</string>
5042       </array>
5043       <key>Default</key>
5044       <string>allow-audio-video | block-audio | block-audio-video</string>
5045       <key>Locked</key>
5046       <true/> | <false/>
5047     </dict>
5048   </dict>
5049 </dict>
5050 ```
5051 #### policies.json
5052 ```
5053 {
5054   "policies": {
5055     "Permissions": {
5056       "Camera": {
5057         "Allow": ["https://example.org","https://example.org:1234"],
5058         "Block": ["https://example.edu"],
5059         "BlockNewRequests": true | false,
5060         "Locked": true | false
5061       },
5062       "Microphone": {
5063         "Allow": ["https://example.org"],
5064         "Block": ["https://example.edu"],
5065         "BlockNewRequests": true | false,
5066         "Locked": true | false
5067       },
5068       "Location": {
5069         "Allow": ["https://example.org"],
5070         "Block": ["https://example.edu"],
5071         "BlockNewRequests": true | false,
5072         "Locked": true | false
5073       },
5074       "Notifications": {
5075         "Allow": ["https://example.org"],
5076         "Block": ["https://example.edu"],
5077         "BlockNewRequests": true | false,
5078         "Locked": true | false
5079       },
5080       "Autoplay": {
5081         "Allow": ["https://example.org"],
5082         "Block": ["https://example.edu"],
5083         "Default": "allow-audio-video" | "block-audio" | "block-audio-video",
5084         "Locked": true | false
5085       }
5086     }
5087   }
5088 }
5089 ```
5090 ### PictureInPicture
5091
5092 Enable or disable Picture-in-Picture as well as prevent the user from enabling or disabling it (Locked).
5093
5094 **Compatibility:** Firefox 78, Firefox ESR 78\
5095 **CCK2 Equivalent:** N/A\
5096 **Preferences Affected:** `media.videocontrols.picture-in-picture.video-toggle.enabled`
5097
5098 #### Windows (GPO)
5099 ```
5100 Software\Policies\Mozilla\Firefox\PictureInPicture\Enabled = 0x1 | 0x0
5101 Software\Policies\Mozilla\Firefox\PictureInPicture\Locked = 0x1 | 0x0
5102
5103 ```
5104 #### Windows (Intune)
5105 OMA-URI:
5106 ```
5107 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~PictureInPicture/PictureInPicture_Enabled
5108 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~PictureInPicture/PictureInPicture_Locked
5109 ```
5110 Value (string):
5111 ```
5112 <enabled/> or <disabled/>
5113 ```
5114 #### macOS
5115 ```
5116 <dict>
5117   <key>PictureInPicture</key>
5118   <dict>
5119     <key>Enabled</key>
5120     <true/> | <false/>
5121     <key>Locked</key>
5122     <true/> | <false/>
5123   </dict>
5124 </dict>
5125 ```
5126 #### policies.json
5127 ```
5128 {
5129   "policies": {
5130     "PictureInPicture": {
5131       "Enabled": true | false,
5132       "Locked": true | false
5133     }
5134   }
5135 }
5136 ```
5137 ### PopupBlocking
5138 Configure the default pop-up window policy as well as origins for which pop-up windows are allowed.
5139
5140 `Allow` is a list of origins where popup-windows are allowed.
5141
5142 `Default` determines whether or not pop-up windows are allowed by default.
5143
5144 `Locked` prevents the user from changing pop-up preferences.
5145
5146 **Compatibility:** Firefox 60, Firefox ESR 60\
5147 **CCK2 Equivalent:** `permissions.popup`\
5148 **Preferences Affected:** `dom.disable_open_during_load`
5149
5150 #### Windows (GPO)
5151 ```
5152 Software\Policies\Mozilla\Firefox\PopupBlocking\Allow\1 = "https://example.org"
5153 Software\Policies\Mozilla\Firefox\PopupBlocking\Allow\2 = "https://example.edu"
5154 Software\Policies\Mozilla\Firefox\PopupBlocking\Default = 0x1 | 0x0
5155 Software\Policies\Mozilla\Firefox\PopupBlocking\Locked = 0x1 | 0x0
5156 ```
5157 #### Windows (Intune)
5158 OMA-URI:
5159 ```
5160 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~Popups/PopupBlocking_Allow
5161 ```
5162 Value (string):
5163 ```
5164 <enabled/>
5165 <data id="Permissions" value="1&#xF000;https://example.org&#xF000;2&#xF000;https://example.edu"/>
5166 ```
5167 OMA-URI:
5168 ```
5169 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~Popups/PopupBlocking_Default
5170 ```
5171 Value (string):
5172 ```
5173 <enabled/> or <disabled/>
5174 ```
5175 OMA-URI:
5176 ```
5177 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~Popups/PopupBlocking_Locked
5178 ```
5179 Value (string):
5180 ```
5181 <enabled/> or <disabled/>
5182 ```
5183 #### macOS
5184 ```
5185 <dict>
5186   <key>PopupBlocking</key>
5187   <dict>
5188     <key>Allow</key>
5189     <array>
5190       <string>http://example.org</string>
5191       <string>http://example.edu</string>
5192     </array>
5193     <key>Default</key>
5194     <true/> | <false/>
5195     <key>Locked</key>
5196     <true/> | <false/>
5197   </dict>
5198 </dict>
5199 ```
5200 #### policies.json
5201 ```
5202 {
5203   "policies": {
5204     "PopupBlocking": {
5205       "Allow": ["http://example.org/",
5206                 "http://example.edu/"],
5207       "Default": true | false,
5208       "Locked": true | false
5209     }
5210   }
5211 }
5212 ```
5213 ### PostQuantumKeyAgreementEnabled
5214 Enable post-quantum key agreement for TLS.
5215
5216 **Compatibility:** Firefox 127\
5217 **CCK2 Equivalent:** N/A\
5218 **Preferences Affected:** `security.tls.enable_kyber`, `network.http.http3.enable_kyber` (Firefox 128)
5219
5220 #### Windows (GPO)
5221 ```
5222 Software\Policies\Mozilla\Firefox\PostQuantumKeyAgreementEnabled = 0x1 | 0x0
5223 ```
5224 #### Windows (Intune)
5225 OMA-URI:
5226 ```
5227 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox/PostQuantumKeyAgreementEnabled
5228 ```
5229 Value (string):
5230 ```
5231 <enabled/> or <disabled/>
5232 ```
5233 #### macOS
5234 ```
5235 <dict>
5236   <key>PostQuantumKeyAgreementEnabled</key>
5237   <true/> | <false/>
5238 </dict>
5239 ```
5240 #### policies.json
5241 ```
5242 {
5243   "policies": {
5244     "PostQuantumKeyAgreementEnabled": true | false
5245   }
5246 }
5247 ```
5248 ### Preferences
5249 Set and lock preferences.
5250
5251 **NOTE** On Windows, in order to use this policy, you must clear all settings in the old **Preferences (Deprecated)** section in group policy.
5252
5253 Previously you could only set and lock a subset of preferences. Starting with Firefox 81 and Firefox ESR 78.3 you can set many more preferences. You can also set default preferences, user preferences and you can clear preferences.
5254
5255 Preferences that start with the following prefixes are supported:
5256 ```
5257 accessibility.
5258 alerts.* (Firefox 122, Firefox ESR 115.7)
5259 app.update.* (Firefox 86, Firefox ESR 78.8)
5260 browser.
5261 datareporting.policy.
5262 dom.
5263 extensions.
5264 general.autoScroll (Firefox 83, Firefox ESR 78.5)
5265 general.smoothScroll (Firefox 83, Firefox ESR 78.5)
5266 geo.
5267 gfx.
5268 intl.
5269 keyword.enabled (Firefox 95, Firefox ESR 91.4)
5270 layers.
5271 layout.
5272 media.
5273 network.
5274 pdfjs. (Firefox 84, Firefox ESR 78.6)
5275 places.
5276 pref.
5277 print.
5278 privacy.globalprivacycontrol.enabled (Firefox 127, Firefox ESR 128.0)
5279 privacy.userContext.enabled (Firefox 126, Firefox ESR 115.11)
5280 privacy.userContext.ui.enabled (Firefox 126, Firefox ESR 115.11)
5281 signon. (Firefox 83, Firefox ESR 78.5)
5282 spellchecker. (Firefox 84, Firefox ESR 78.6)
5283 toolkit.legacyUserProfileCustomizations.stylesheets (Firefox 95, Firefox ESR 91.4)
5284 ui.
5285 widget.
5286 xpinstall.signatures.required (Firefox ESR 102.10, Firefox ESR only)
5287 xpinstall.whitelist.required (Firefox 118, Firefox ESR 115.3)
5288 ```
5289 as well as the following security preferences:
5290
5291 | Preference | Type | Default
5292 | --- | --- | --- |
5293 | security.default_personal_cert | string | Ask Every Time
5294 | &nbsp;&nbsp;&nbsp;&nbsp;If set to Select Automatically, Firefox automatically chooses the default personal certificate.
5295 | security.disable_button.openCertManager | string | N/A
5296 | &nbsp;&nbsp;&nbsp;&nbsp;If set to true and locked, the View Certificates button in preferences is disabled (Firefox 121, Firefox ESR 115.6)
5297 | security.disable_button.openDeviceManager | string | N/A
5298 | &nbsp;&nbsp;&nbsp;&nbsp;If set to true and locked, the Security Devices button in preferences is disabled (Firefox 121, Firefox ESR 115.6)
5299 | security.insecure_connection_text.enabled | bool | false
5300 | &nbsp;&nbsp;&nbsp;&nbsp;If set to true, adds the words "Not Secure" for insecure sites.
5301 | security.insecure_connection_text.pbmode.enabled | bool | false
5302 | &nbsp;&nbsp;&nbsp;&nbsp;If set to true, adds the words "Not Secure" for insecure sites in private browsing.
5303 | security.mixed_content.block_active_content | boolean | true
5304 | &nbsp;&nbsp;&nbsp;&nbsp;If set to true, mixed active content (HTTP subresources such as scripts, fetch requests, etc. on a HTTPS page) will be blocked.
5305 | security.mixed_content.block_display_content | boolean | false
5306 | &nbsp;&nbsp;&nbsp;&nbsp;If set to true, mixed passive/display content (HTTP subresources such as images, videos, etc. on a HTTPS page) will be blocked and ```security.mixed_content.upgrade_display_content``` will be ignored. (Firefox 127, Firefox ESR 128.0)
5307 | security.mixed_content.upgrade_display_content | boolean | true
5308 | &nbsp;&nbsp;&nbsp;&nbsp;If set to false, mixed passive/display content (HTTP subresources such as images, videos, etc. on a HTTPS page) will NOT be upgraded to HTTPS. (Firefox 127, Firefox ESR 128.0)
5309 | security.osclientcerts.autoload | boolean | false
5310 | &nbsp;&nbsp;&nbsp;&nbsp;If true, client certificates are loaded from the operating system certificate store.
5311 | security.OCSP.enabled | integer | 1
5312 | &nbsp;&nbsp;&nbsp;&nbsp;If 0, do not fetch OCSP. If 1, fetch OCSP for DV and EV certificates. If 2, fetch OCSP only for EV certificates.
5313 | security.OCSP.require | boolean | false
5314 | &nbsp;&nbsp;&nbsp;&nbsp; If true, if an OCSP request times out, the connection fails.
5315 | security.osclientcerts.assume_rsa_pss_support | boolean | true
5316 | &nbsp;&nbsp;&nbsp;&nbsp; If false, we don't assume an RSA key can do RSA-PSS. (Firefox 114, Firefox ESR 102.12)
5317 | security.ssl.enable_ocsp_stapling | boolean | true
5318 | &nbsp;&nbsp;&nbsp;&nbsp; If false, OCSP stapling is not enabled.
5319 | security.ssl.errorReporting.enabled | boolean | true
5320 | &nbsp;&nbsp;&nbsp;&nbsp;If false, SSL errors cannot be sent to Mozilla.
5321 | security.ssl.require_safe_negotiation | boolean | false
5322 | &nbsp;&nbsp;&nbsp;&nbsp;If true, Firefox will only negotiate TLS connections with servers that indicate they support secure renegotiation. (Firefox 118, Firefox ESR 115.3)
5323 | security.tls.enable_0rtt_data | boolean | true
5324 | &nbsp;&nbsp;&nbsp;&nbsp;If false, TLS early data is turned off. (Firefox 93, Firefox 91.2, Firefox 78.15)
5325 | security.tls.hello_downgrade_check | boolean | true
5326 | &nbsp;&nbsp;&nbsp;&nbsp;If false, the TLS 1.3 downgrade check is disabled.
5327 | security.tls.version.enable-deprecated | boolean | false
5328 | &nbsp;&nbsp;&nbsp;&nbsp;If true, browser will accept TLS 1.0. and TLS 1.1. (Firefox 86, Firefox 78.8)
5329 | security.warn_submit_secure_to_insecure | boolean | true
5330 | &nbsp;&nbsp;&nbsp;&nbsp;If false, no warning is shown when submitting a form from https to http.
5331
5332 Using the preference as the key, set the `Value` to the corresponding preference value.
5333
5334 `Status` can be "default", "locked", "user" or "clear"
5335
5336 * `"default"`: Read/Write: Settings appear as default even if factory default differs.
5337 * `"locked"`: Read-Only: Settings appear as default even if factory default differs.
5338 * `"user"`: Read/Write: Settings appear as changed if it differs from factory default.
5339 * `"clear"`: Read/Write: `Value` has no effect. Resets to factory defaults on each startup.
5340
5341 `"user"` preferences persist across invocations of Firefox. It is the equivalent of a user setting the preference. They are most useful when a preference is needed very early in startup so it can't be set as default by policy. An example of this is ```toolkit.legacyUserProfileCustomizations.stylesheets```.
5342
5343 `"user"` preferences persist even if the policy is removed, so if you need to remove them, you should use the clear policy.
5344
5345 You can also set the `Type` starting in Firefox 123 and Firefox ESR 115.8. It can be `number`, `boolean` or `string`. This is especially useful if you are seeing 0 or 1 values being converted to booleans when set as user preferences.
5346
5347 See the examples below for more detail.
5348
5349 IMPORTANT: Make sure you're only setting a particular preference using this mechanism and not some other way.
5350
5351 Status
5352 **Compatibility:** Firefox 81, Firefox ESR 78.3\
5353 **CCK2 Equivalent:** `preferences`\
5354 **Preferences Affected:** Many
5355
5356 #### Windows (GPO)
5357 Software\Policies\Mozilla\Firefox\Preferences (REG_MULTI_SZ) =
5358 ```
5359 {
5360   "accessibility.force_disabled": {
5361     "Value": 1,
5362     "Status": "default",
5363     "Type": "number"
5364
5365   },
5366   "browser.cache.disk.parent_directory": {
5367     "Value": "SOME_NATIVE_PATH",
5368     "Status": "user"
5369   },
5370   "browser.tabs.warnOnClose": {
5371     "Value": false,
5372     "Status": "locked"
5373   }
5374 }
5375 ```
5376 #### Windows (Intune)
5377 OMA-URI:
5378 ```
5379 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox/Preferences
5380 ```
5381 Value (string):
5382 ```
5383 <enabled/>
5384 <data id="JSON" value='
5385 {
5386   "accessibility.force_disabled": {
5387     "Value": 1,
5388     "Status": "default",
5389     "Type": "number"
5390   },
5391   "browser.cache.disk.parent_directory": {
5392     "Value": "SOME_NATIVE_PATH",
5393     "Status": "user"
5394   },
5395   "browser.tabs.warnOnClose": {
5396     "Value": false,
5397     "Status": "locked"
5398   }
5399 }'/>
5400 ```
5401 If you are using custom ADMX and ADML administrative templates in Intune, you can use this OMA-URI instead
5402 to workaround the limit on the length of strings. Put all of your JSON on one line.
5403
5404 OMA-URI:
5405 ```
5406 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~Extensions/PreferencesOneLine
5407 ```
5408 Value (string):
5409 ```
5410 <enabled/>
5411 <data id="JSONOneLine" value='{}'/>
5412 ```
5413 #### macOS
5414 ```
5415 <dict>
5416   <key>Preferences</key>
5417   <dict>
5418     <key>accessibility.force_disabled</key>
5419     <dict>
5420       <key>Value</key>
5421       <integer>1</integer>
5422       <key>Status</key>
5423       <string>default</string>
5424       <key>Type</key>
5425       <string>number</string>
5426     </dict>
5427     <key>browser.cache.disk.parent_directory</key>
5428     <dict>
5429       <key>Value</key>
5430       <string>SOME_NATIVE_PATH</string>
5431       <key>Status</key>
5432       <string>user</string>
5433     </dict>
5434     <key>browser.tabs.warnOnClose</key>
5435     <dict>
5436       <key>Value</key>
5437       <false/>
5438       <key>Status</key>
5439       <string>locked</string>
5440     </dict>
5441   </dict>
5442 </dict>
5443 ```
5444 #### policies.json
5445 ```
5446 {
5447   "policies": {
5448     "Preferences": {
5449       "accessibility.force_disabled": {
5450         "Value": 1,
5451         "Status": "default"
5452         "Type": "number"
5453       },
5454       "browser.cache.disk.parent_directory": {
5455         "Value": "SOME_NATIVE_PATH",
5456         "Status": "user"
5457       },
5458       "browser.tabs.warnOnClose": {
5459         "Value": false,
5460         "Status": "locked"
5461       }
5462     }
5463   }
5464 }
5465 ```
5466 ### PrimaryPassword
5467 Require or prevent using a primary (formerly master) password.
5468
5469 If this value is true, a primary password is required. If this value is false, it works the same as if [`DisableMasterPasswordCreation`](#disablemasterpasswordcreation) was true and removes the primary password functionality.
5470
5471 If both DisableMasterPasswordCreation and PrimaryPassword are used, DisableMasterPasswordCreation takes precedent.
5472
5473 **Compatibility:** Firefox 79, Firefox ESR 78.1\
5474 **CCK2 Equivalent:** `noMasterPassword`\
5475 **Preferences Affected:** N/A
5476
5477 #### Windows (GPO)
5478 ```
5479 Software\Policies\Mozilla\Firefox\PrimaryPassword = 0x1 | 0x0
5480 ```
5481 #### Windows (Intune)
5482 OMA-URI:
5483 ```
5484 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox/PrimaryPassword
5485 ```
5486 Value (string):
5487 ```
5488 <enabled/> or <disabled/>
5489 ```
5490 #### macOS
5491 ```
5492 <dict>
5493   <key>PrimaryPassword</key>
5494   <true/> | <false/>
5495 </dict>
5496 ```
5497 #### policies.json
5498 ```
5499 {
5500   "policies": {
5501     "PrimaryPassword": true | false
5502   }
5503 }
5504 ```
5505 ### PrintingEnabled
5506 Enable or disable printing.
5507
5508 **Compatibility:** Firefox 120, Firefox ESR 115.5\
5509 **CCK2 Equivalent:** N/A\
5510 **Preferences Affected:** `print.enabled`
5511
5512 #### Windows (GPO)
5513 ```
5514 Software\Policies\Mozilla\Firefox\PrintingEnabled = 0x1 | 0x0
5515 ```
5516 #### Windows (Intune)
5517 OMA-URI:
5518 ```
5519 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox/PrintingEnabled
5520 ```
5521 Value (string):
5522 ```
5523 <enabled/> or <disabled/>
5524 ```
5525 #### macOS
5526 ```
5527 <dict>
5528   <key>PrintingEnabled</key>
5529   <true/> | <false/>
5530 </dict>
5531 ```
5532 #### policies.json
5533 ```
5534 {
5535   "policies": {
5536     "PrintingEnabled": true | false
5537   }
5538 }
5539 ```
5540 ### PrivateBrowsingModeAvailability
5541 Set availability of private browsing mode.
5542
5543 Possible values are `0` (Private Browsing mode is available), `1` (Private Browsing mode not available), and `2`(Private Browsing mode is forced).
5544
5545 This policy supersedes [`DisablePrivateBrowsing`](#disableprivatebrowsing)
5546
5547 Note: This policy missed Firefox ESR 128.2, but it will be in Firefox ESR 128.3.
5548
5549 **Compatibility:** Firefox 130, Firefox ESR 128.3\
5550 **CCK2 Equivalent:** N/A\
5551 **Preferences Affected:** N/A
5552
5553 #### Windows (GPO)
5554 ```
5555 Software\Policies\Mozilla\Firefox\PrivateBrowsingModeAvailability = 0x0 | 0x1 | 0x2
5556 ```
5557 #### Windows (Intune)
5558 OMA-URI:
5559 ```
5560 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox/PrivateBrowsingModeAvailability
5561 ```
5562 Value (string):
5563 ```
5564 <enabled/>
5565 <data id="PrivateBrowsingModeAvailability" value="0 | 1 | 2"/>
5566 ```
5567 #### macOS
5568 ```
5569 <dict>
5570   <key>PrivateBrowsingModeAvailability</key>
5571   <integer>0 | 1 | 2</integer>
5572 </dict>
5573 ```
5574 #### policies.json
5575 ```
5576 {
5577   "policies": {
5578     "PrivateBrowsingModeAvailability": 0 | 1 | 2
5579   }
5580 }
5581 ```
5582 ### PromptForDownloadLocation
5583 Ask where to save each file before downloading.
5584
5585 **Compatibility:** Firefox 68, Firefox ESR 68\
5586 **CCK2 Equivalent:** N/A\
5587 **Preferences Affected:** `browser.download.useDownloadDir`
5588
5589 #### Windows (GPO)
5590 ```
5591 Software\Policies\Mozilla\Firefox\PromptForDownloadLocation = 0x1 | 0x0
5592 ```
5593 #### Windows (Intune)
5594 OMA-URI:
5595 ```
5596 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox/PromptForDownloadLocation
5597 ```
5598 Value (string):
5599 ```
5600 <enabled/> or <disabled/>
5601 ```
5602 #### macOS
5603 ```
5604 <dict>
5605   <key>PromptForDownloadLocation</key>
5606   <true/> | <false/>
5607 </dict>
5608 ```
5609 #### policies.json
5610 ```
5611 {
5612   "policies": {
5613     "PromptForDownloadLocation": true | false
5614   }
5615 }
5616 ```
5617 ### Proxy
5618 Configure proxy settings. These settings correspond to the connection settings in Firefox preferences.
5619 To specify ports, append them to the hostnames with a colon (:).
5620
5621 Unless you lock this policy, changes the user already has in place will take effect.
5622
5623 `Mode` is the proxy method being used.
5624
5625 `Locked` is whether or not proxy settings can be changed.
5626
5627 `HTTPProxy` is the HTTP proxy server.
5628
5629 `UseHTTPProxyForAllProtocols` is whether or not the HTTP proxy should be used for all other proxies.
5630
5631 `SSLProxy` is the SSL proxy server.
5632
5633 `FTPProxy` is the FTP proxy server.
5634
5635 `SOCKSProxy` is the SOCKS proxy server
5636
5637 `SOCKSVersion` is the SOCKS version (4 or 5)
5638
5639 `Passthrough` is list of hostnames or IP addresses that will not be proxied. Use `<local>` to bypass proxying for all hostnames which do not contain periods.
5640
5641 `AutoConfigURL` is a  URL for proxy configuration (only used if Mode is autoConfig).
5642
5643 `AutoLogin` means do not prompt for authentication if password is saved.
5644
5645 `UseProxyForDNS` to use proxy DNS when using SOCKS v5.
5646
5647 **Compatibility:** Firefox 60, Firefox ESR 60\
5648 **CCK2 Equivalent:** `networkProxy*`\
5649 **Preferences Affected:** `network.proxy.type`, `network.proxy.autoconfig_url`, `network.proxy.socks_remote_dns`, `signon.autologin.proxy`, `network.proxy.socks_version`, `network.proxy.no_proxies_on`, `network.proxy.share_proxy_settings`, `network.proxy.http`, `network.proxy.http_port`, `network.proxy.ftp`, `network.proxy.ftp_port`, `network.proxy.ssl`, `network.proxy.ssl_port`, `network.proxy.socks`, `network.proxy.socks_port`
5650
5651 #### Windows (GPO)
5652 ```
5653 Software\Policies\Mozilla\Firefox\Proxy\Mode = "none" | "system" | "manual" | "autoDetect" | "autoConfig"
5654 Software\Policies\Mozilla\Firefox\Proxy\Locked = 0x1 | 0x0
5655 Software\Policies\Mozilla\Firefox\Proxy\HTTPProxy = https://httpproxy.example.com
5656 Software\Policies\Mozilla\Firefox\Proxy\UseHTTPProxyForAllProtocols = 0x1 | 0x0
5657 Software\Policies\Mozilla\Firefox\Proxy\SSLProxy = https://sslproxy.example.com
5658 Software\Policies\Mozilla\Firefox\Proxy\FTPProxy = https://ftpproxy.example.com
5659 Software\Policies\Mozilla\Firefox\Proxy\SOCKSProxy = https://socksproxy.example.com
5660 Software\Policies\Mozilla\Firefox\Proxy\SOCKSVersion = 0x4 | 0x5
5661 Software\Policies\Mozilla\Firefox\Proxy\Passthrough = <local>
5662 Software\Policies\Mozilla\Firefox\Proxy\AutoConfigURL = URL_TO_AUTOCONFIG
5663 Software\Policies\Mozilla\Firefox\Proxy\AutoLogin = 0x1 | 0x0
5664 Software\Policies\Mozilla\Firefox\Proxy\UseProxyForDNS = 0x1 | 0x0
5665 ```
5666 #### Windows (Intune)
5667 **Note**
5668 These setttings were moved to a category to make them easier to configure via Intune.
5669
5670 OMA-URI:
5671 ```
5672 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~ProxySettings/Proxy_Locked
5673 ```
5674 Value (string):
5675 ```
5676 <enabled/> or <disabled/>
5677 ```
5678 OMA-URI:
5679 ```
5680 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~ProxySettings/Proxy_ConnectionType
5681 ```
5682 Value (string):
5683 ```
5684 <enabled/>
5685 <data id="Proxy_ConnectionType" value="none | system | manual | autoDetect | autoConfig"/>
5686 ```
5687 OMA-URI:
5688 ```
5689 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~ProxySettings/Proxy_HTTPProxy
5690 ```
5691 Value (string):
5692 ```
5693 <enabled/>
5694 <data id="Proxy_HTTPProxy" value="httpproxy.example.com"/>
5695 ```
5696 OMA-URI:
5697 ```
5698 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~ProxySettings/Proxy_UseHTTPProxyForAllProtocols
5699 ```
5700 Value (string):
5701 ```
5702 <enabled/> or <disabled/>
5703 ```
5704 OMA-URI:
5705 ```
5706 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~ProxySettings/Proxy_SSLProxy
5707 ```
5708 Value (string):
5709 ```
5710 <enabled/>
5711 <data id="Proxy_SSLProxy" value="sslproxy.example.com"/>
5712 ```
5713 OMA-URI:
5714 ```
5715 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~ProxySettings/Proxy_SOCKSProxy
5716 ```
5717 Value (string):
5718 ```
5719 <enabled/>
5720 <data id="Proxy_SOCKSProxy" value="socksproxy.example.com"/>
5721 <data id="Proxy_SOCKSVersion" value="4 | 5"/>
5722 ```
5723 OMA-URI:
5724 ```
5725 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~ProxySettings/Proxy_AutoConfigURL
5726 ```
5727 Value (string):
5728 ```
5729 <enabled/>
5730 <data id="Proxy_AutoConfigURL" value="URL_TO_AUTOCONFIG"/>
5731 ```
5732 OMA-URI:
5733 ```
5734 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~ProxySettings/Proxy_Passthrough
5735 ```
5736 Value (string):
5737 ```
5738 <enabled/>
5739 <data id="Proxy_Passthrough" value="&lt;local&gt;"/>
5740 ```
5741 OMA-URI:
5742 ```
5743 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~ProxySettings/Proxy_AutoLogin
5744 ```
5745 Value (string):
5746 ```
5747 <enabled/> or <disabled/>
5748 ```
5749 OMA-URI:
5750 ```
5751 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~ProxySettings/Proxy_UseProxyForDNS
5752 ```
5753 Value (string):
5754 ```
5755 <enabled/> or <disabled/>
5756 ```
5757 OMA-URI (Old way):
5758 ```
5759 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox/Proxy
5760 ```
5761 Value (string):
5762 ```
5763 <enabled/>
5764 <data id="ProxyLocked" value="true | false"/>
5765 <data id="ConnectionType" value="none | system | manual | autoDetect | autoConfig"/>
5766 <data id="HTTPProxy" value="httpproxy.example.com"/>
5767 <data id="UseHTTPProxyForAllProtocols" value="true | false"/>
5768 <data id="SSLProxy" value="sslproxy.example.com"/>
5769 <data id="FTPProxy" value="ftpproxy.example.com"/>
5770 <data id="SOCKSProxy" value="socksproxy.example.com"/>
5771 <data id="SOCKSVersion" value="4 | 5"/>
5772 <data id="AutoConfigURL" value="URL_TO_AUTOCONFIG"/>
5773 <data id="Passthrough" value="<local>"/>
5774 <data id="AutoLogin" value="true | false"/>
5775 <data id="UseProxyForDNS" value="true | false"/>
5776 ```
5777 #### macOS
5778 ```
5779 <dict>
5780   <key>Proxy</key>
5781   <dict>
5782     <key>Mode</key>
5783     <string>none | system | manual | autoDetect | autoConfig</string>
5784     <key>Locked</key>
5785     <true> | </false>
5786     <key>HTTPProxy</key>
5787     <string>https://httpproxy.example.com</string>
5788     <key>UseHTTPProxyForAllProtocols</key>
5789     <true> | </false>
5790     <key>SSLProxy</key>
5791     <string>https://sslproxy.example.com</string>
5792     <key>FTPProxy</key>
5793     <string>https://ftpproxy.example.com</string>
5794     <key>SOCKSProxy</key>
5795     <string>https://socksproxy.example.com</string>
5796     <key>SOCKSVersion</key>
5797     <string>4 | 5</string>
5798     <key>Passthrough</key>
5799     <string>&lt;local>&gt;</string>
5800     <key>AutoConfigURL</key>
5801     <string>URL_TO_AUTOCONFIG</string>
5802     <key>AutoLogin</key>
5803     <true> | </false>
5804     <key>UseProxyForDNS</key>
5805     <true> | </false>
5806   </dict>
5807 </dict>
5808 ```
5809 #### policies.json
5810 ```
5811 {
5812   "policies": {
5813     "Proxy": {
5814       "Mode": "none" | "system" | "manual" | "autoDetect" | "autoConfig",
5815       "Locked": true | false,
5816       "HTTPProxy": "hostname",
5817       "UseHTTPProxyForAllProtocols": true | false,
5818       "SSLProxy": "hostname",
5819       "FTPProxy": "hostname",
5820       "SOCKSProxy": "hostname",
5821       "SOCKSVersion": 4 | 5,
5822       "Passthrough": "<local>",
5823       "AutoConfigURL": "URL_TO_AUTOCONFIG",
5824       "AutoLogin": true | false,
5825       "UseProxyForDNS": true | false
5826     }
5827   }
5828 }
5829 ```
5830 ### RequestedLocales
5831 Set the the list of requested locales for the application in order of preference. It will cause the corresponding language pack to become active.
5832
5833 Note: For Firefox 68, this can now be a string so that you can specify an empty value.
5834
5835 **Compatibility:** Firefox 64, Firefox ESR 60.4, Updated in Firefox 68, Firefox ESR 68\
5836 **CCK2 Equivalent:** N/A\
5837 **Preferences Affected:** N/A
5838 #### Windows (GPO)
5839 ```
5840 Software\Policies\Mozilla\Firefox\RequestedLocales\1 = "de"
5841 Software\Policies\Mozilla\Firefox\RequestedLocales\2 = "en-US"
5842
5843 or
5844
5845 Software\Policies\Mozilla\Firefox\RequestedLocales = "de,en-US"
5846 ```
5847 #### Windows (Intune)
5848 OMA-URI:
5849 ```
5850 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox/RequestedLocalesString
5851 ```
5852 Value (string):
5853 ```
5854 <enabled/>
5855 <data id="Preferences_String" value="de,en-US"/>
5856 ```
5857 #### macOS
5858 ```
5859 <dict>
5860   <key>RequestedLocales</key>
5861   <array>
5862     <string>de</string>
5863     <string>en-US</string>
5864   </array>
5865 </dict>
5866
5867 or
5868
5869 <dict>
5870   <key>RequestedLocales</key>
5871   <string>de,en-US</string>
5872 </dict>
5873
5874 ```
5875 #### policies.json
5876 ```
5877 {
5878   "policies": {
5879     "RequestedLocales": ["de", "en-US"]
5880   }
5881 }
5882
5883 or
5884
5885 {
5886   "policies": {
5887     "RequestedLocales": "de,en-US"
5888   }
5889 }
5890 ```
5891 <a name="SanitizeOnShutdown"></a>
5892
5893 ### SanitizeOnShutdown (Selective)
5894 Clear data on shutdown.
5895
5896 Note: Starting with Firefox 128, History clears FormData and Downloads as well.
5897
5898 `Cache`
5899
5900 `Cookies`
5901
5902 `Downloads` Download History (*Deprecated*)
5903
5904 `FormData` Form & Search History (*Deprecated*)
5905
5906 `History` Browsing History, Download History, Form & Search History.
5907
5908 `Sessions` Active Logins
5909
5910 `SiteSettings` Site Preferences
5911
5912 `OfflineApps` Offline Website Data (*Deprecated - part of Cookies*)
5913
5914 `Locked` prevents the user from changing these preferences.
5915
5916 **Compatibility:** Firefox 68, Firefox ESR 68 (Locked added in 74/68.6, History update in Firefox 128)\
5917 **CCK2 Equivalent:** N/A\
5918 **Preferences Affected:** `privacy.sanitize.sanitizeOnShutdown`, `privacy.clearOnShutdown.cache`, `privacy.clearOnShutdown.cookies`, `privacy.clearOnShutdown.downloads`, `privacy.clearOnShutdown.formdata`, `privacy.clearOnShutdown.history`, `privacy.clearOnShutdown.sessions`, `privacy.clearOnShutdown.siteSettings`, `privacy.clearOnShutdown.offlineApps`, `privacy.clearOnShutdown_v2.historyFormDataAndDownloads` (Firefox 128), `privacy.clearOnShutdown_v2.cookiesAndStorage` (Firefox 128), `privacy.clearOnShutdown_v2.cache` (Firefox 128), `privacy.clearOnShutdown_v2.siteSettings` (Firefox 128)
5919
5920 #### Windows (GPO)
5921 ```
5922 Software\Policies\Mozilla\Firefox\SanitizeOnShutdown\Cache = 0x1 | 0x0
5923 Software\Policies\Mozilla\Firefox\SanitizeOnShutdown\Cookies = 0x1 | 0x0
5924 Software\Policies\Mozilla\Firefox\SanitizeOnShutdown\History = 0x1 | 0x0
5925 Software\Policies\Mozilla\Firefox\SanitizeOnShutdown\Sessions = 0x1 | 0x0
5926 Software\Policies\Mozilla\Firefox\SanitizeOnShutdown\SiteSettings = 0x1 | 0x0
5927 Software\Policies\Mozilla\Firefox\SanitizeOnShutdown\Locked = 0x1 | 0x0
5928 ```
5929 #### Windows (Intune)
5930 OMA-URI:
5931 ```
5932 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~SanitizeOnShutdown/A_SanitizeOnShutdown_Cache
5933 ```
5934 Value (string):
5935 ```
5936 <enabled/> or <disabled/>
5937 ```
5938 OMA-URI:
5939 ```
5940 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~SanitizeOnShutdown/B_SanitizeOnShutdown_Cookies
5941 ```
5942 Value (string):
5943 ```
5944 <enabled/> or <disabled/>
5945 ```
5946 OMA-URI:
5947 ```
5948 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~SanitizeOnShutdown/E_SanitizeOnShutdown_History
5949 ```
5950 Value (string):
5951 ```
5952 <enabled/> or <disabled/>
5953 ```
5954 OMA-URI:
5955 ```
5956 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~SanitizeOnShutdown/F_SanitizeOnShutdown_Sessions
5957 ```
5958 Value (string):
5959 ```
5960 <enabled/> or <disabled/>
5961 ```
5962 OMA-URI:
5963 ```
5964 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~SanitizeOnShutdown/G_SanitizeOnShutdown_SiteSettings
5965 ```
5966 Value (string):
5967 ```
5968 <enabled/> or <disabled/>
5969 ```
5970 OMA-URI:
5971 ```
5972 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~SanitizeOnShutdown/I_SanitizeOnShutdown_Locked
5973 ```
5974 Value (string):
5975 ```
5976 <enabled/> or <disabled/>
5977 ```
5978 #### macOS
5979 ```
5980 <dict>
5981   <key>SanitizeOnShutdown</key>
5982   <dict>
5983     <key>Cache</key>
5984     <true/> | <false/>
5985     <key>Cookies</key>
5986     <true/> | <false/>
5987     <key>History</key>
5988     <true/> | <false/>
5989     <key>Sessions</key>
5990     <true/> | <false/>
5991     <key>SiteSettings</key>
5992     <true/> | <false/>
5993     <key>Locked</key>
5994     <true/> | <false/>
5995   </dict>
5996 </dict>
5997 ```
5998 #### policies.json
5999 ```
6000 {
6001   "policies": {
6002     "SanitizeOnShutdown": {
6003       "Cache": true | false,
6004       "Cookies": true | false,
6005       "History": true | false,
6006       "Sessions": true | false,
6007       "SiteSettings": true | false,
6008       "Locked": true | false
6009     }
6010   }
6011 }
6012 ```
6013 ### SanitizeOnShutdown (All)
6014 Clear all data on shutdown, including Browsing & Download History, Cookies, Active Logins, Cache, Form & Search History, Site Preferences and Offline Website Data.
6015
6016 **Compatibility:** Firefox 60, Firefox ESR 60\
6017 **CCK2 Equivalent:** N/A\
6018 **Preferences Affected:** `privacy.sanitize.sanitizeOnShutdown`, `privacy.clearOnShutdown.cache`, `privacy.clearOnShutdown.cookies`, `privacy.clearOnShutdown.downloads`, `privacy.clearOnShutdown.formdata`, `privacy.clearOnShutdown.history`, `privacy.clearOnShutdown.sessions`, `privacy.clearOnShutdown.siteSettings`, `privacy.clearOnShutdown.offlineApps`
6019 #### Windows (GPO)
6020 ```
6021 Software\Policies\Mozilla\Firefox\SanitizeOnShutdown = 0x1 | 0x0
6022 ```
6023 #### Windows (Intune)
6024 OMA-URI:
6025 ```
6026 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox/C_SanitizeOnShutdown
6027 ```
6028 Value (string):
6029 ```
6030 <enabled/> or <disabled/>
6031 ```
6032 #### macOS
6033 ```
6034 <dict>
6035   <key>SanitizeOnShutdown</key>
6036   <true/> | <false/>
6037 </dict>
6038 ```
6039 #### policies.json
6040 ```
6041 {
6042   "policies": {
6043     "SanitizeOnShutdown": true | false
6044   }
6045 }
6046 ```
6047 ### SearchBar
6048 Set whether or not search bar is displayed.
6049
6050 **Compatibility:** Firefox 60, Firefox ESR 60\
6051 **CCK2 Equivalent:** `showSearchBar`\
6052 **Preferences Affected:** N/A
6053
6054 #### Windows (GPO)
6055 ```
6056 Software\Policies\Mozilla\Firefox\SearchBar = "unified" | "separate"
6057 ```
6058
6059 #### Windows (Intune)
6060 OMA-URI:
6061 ```
6062 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox/SearchBar
6063 ```
6064 Value (string):
6065 ```
6066 <enabled/>
6067 <data id="SearchBar" value="unified | separate"/>
6068 ```
6069 #### macOS
6070 ```
6071 <dict>
6072   <key>SearchBar</key>
6073   <string>unified | separate</string>
6074 </dict>
6075 ```
6076 #### policies.json
6077 ```
6078 {
6079   "policies": {
6080     "SearchBar": "unified" | "separate"
6081   }
6082 }
6083 ```
6084 <a name="SearchEngines"></a>
6085
6086 ### SearchEngines (This policy is only available on the ESR.)
6087
6088 ### SearchEngines | Add
6089
6090 Add new search engines. Although there are only five engines available in the ADMX template, there is no limit. To add more in the ADMX template, you can duplicate the XML.
6091
6092 This policy is only available on the ESR. `Name` and `URLTemplate` are required.
6093
6094 `Name` is the name of the search engine.
6095
6096 `URLTemplate` is the search URL with {searchTerms} to substitute for the search term.
6097
6098 `Method` is either GET or POST
6099
6100 `IconURL` is a URL for the icon to use.
6101
6102 `Alias` is a keyword to use for the engine.
6103
6104 `Description` is a description of the search engine.
6105
6106 `PostData` is the POST data as name value pairs separated by &.
6107
6108 `SuggestURLTemplate` is a search suggestions URL with {searchTerms} to substitute for the search term.
6109
6110 `Encoding` is the query charset for the engine. It defaults to UTF-8.
6111
6112 **Compatibility:** Firefox ESR 60 (POST support in Firefox ESR 68, Encoding support in Firefox 91)\
6113 **CCK2 Equivalent:** `searchplugins`\
6114 **Preferences Affected:** N/A
6115
6116 #### Windows (GPO)
6117 ```
6118 Software\Policies\Mozilla\Firefox\SearchEngines\Add\1\Name = "Example1"
6119 Software\Policies\Mozilla\Firefox\SearchEngines\Add\1\URLTemplate = "https://www.example.org/q={searchTerms}"
6120 Software\Policies\Mozilla\Firefox\SearchEngines\Add\1\Method = "GET" | "POST"
6121 Software\Policies\Mozilla\Firefox\SearchEngines\Add\1\IconURL = "https://www.example.org/favicon.ico"
6122 Software\Policies\Mozilla\Firefox\SearchEngines\Add\1\Alias = "example"
6123 Software\Policies\Mozilla\Firefox\SearchEngines\Add\1\Description = "Example Description"
6124 Software\Policies\Mozilla\Firefox\SearchEngines\Add\1\SuggestURLTemplate = "https://www.example.org/suggestions/q={searchTerms}"
6125 Software\Policies\Mozilla\Firefox\SearchEngines\Add\1\PostData = "name=value&q={searchTerms}"
6126 ```
6127 #### Windows (Intune)
6128 OMA-URI:
6129 ```
6130 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~Search/SearchEngines_1
6131 ```
6132 Value (string):
6133 ```
6134 <enabled/>
6135 <data id="SearchEngine_Name" value="Example1"/>
6136 <data id="SearchEngine_URLTemplate" value="https://www.example.org/q={searchTerms"/>
6137 <data id="SearchEngine_Method" value="GET | POST"/>
6138 <data id="SearchEngine_IconURL" value="https://www.example.org/favicon.ico"/>
6139 <data id="SearchEngine_Alias" value="example"/>
6140 <data id="SearchEngine_Description" value="Example Description"/>
6141 <data id="SearchEngine_SuggestURLTemplate" value="https://www.example.org/suggestions/q={searchTerms}"/>
6142 <data id="SearchEngine_PostData" value="name=value&amp;q={searchTerms}"/>
6143 ```
6144 #### macOS
6145 ```
6146 <dict>
6147   <key>SearchEngines</key>
6148   <dict>
6149     <key>Add</key>
6150     <array>
6151       <dict>
6152         <key>Name</key>
6153         <string>Example1</string>
6154         <key>URLTemplate</key>
6155         <string>https://www.example.org/q={searchTerms}</string>
6156         <key>Method</key>
6157         <string>GET | POST </string>
6158         <key>IconURL</key>
6159         <string>https://www.example.org/favicon.ico</string>
6160         <key>Alias</key>
6161         <string>example</string>
6162         <key>Description</key>
6163         <string>Example Description</string>
6164         <key>SuggestURLTemplate</key>
6165         <string>https://www.example.org/suggestions/q={searchTerms}</string>
6166         <key>PostData</key>
6167         <string>name=value&q={searchTerms}</string>
6168       </dict>
6169     <array>
6170   </dict>
6171 </dict>
6172 ```
6173 #### policies.json
6174 ```
6175 {
6176   "policies": {
6177     "SearchEngines": {
6178       "Add": [
6179         {
6180           "Name": "Example1",
6181           "URLTemplate": "https://www.example.org/q={searchTerms}",
6182           "Method": "GET" | "POST",
6183           "IconURL": "https://www.example.org/favicon.ico",
6184           "Alias": "example",
6185           "Description": "Description",
6186           "PostData": "name=value&q={searchTerms}",
6187           "SuggestURLTemplate": "https://www.example.org/suggestions/q={searchTerms}"
6188         }
6189       ]
6190     }
6191   }
6192 }
6193 ```
6194 ### SearchEngines | Default
6195
6196 Set the default search engine. This policy is only available on the ESR.
6197
6198 **Compatibility:** Firefox ESR 60\
6199 **CCK2 Equivalent:** `defaultSearchEngine`\
6200 **Preferences Affected:** N/A
6201
6202 #### Windows (GPO)
6203 ```
6204 Software\Policies\Mozilla\Firefox\SearchEngines\Default = NAME_OF_SEARCH_ENGINE
6205 ```
6206 #### Windows (Intune)
6207 OMA-URI:
6208 ```
6209 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~Search/SearchEngines_Default
6210 ```
6211 Value (string):
6212 ```
6213 <enabled/>
6214 <data id="SearchEngines_Default" value="NAME_OF_SEARCH_ENGINE"/>
6215 ```
6216 #### macOS
6217 ```
6218 <dict>
6219   <key>SearchEngines</key>
6220   <dict>
6221     <key>Default</key>
6222     <string>NAME_OF_SEARCH_ENGINE</string>
6223   </dict>
6224 </dict>
6225 ```
6226 #### policies.json
6227 ```
6228 {
6229   "policies": {
6230     "SearchEngines": {
6231       "Default": "NAME_OF_SEARCH_ENGINE"
6232     }
6233   }
6234 }
6235 ```
6236 ### SearchEngines | PreventInstalls
6237
6238 Prevent installing search engines from webpages.
6239
6240 **Compatibility:** Firefox ESR 60\
6241 **CCK2 Equivalent:** `disableSearchEngineInstall`\
6242 **Preferences Affected:** N/A
6243
6244 #### Windows (GPO)
6245 ```
6246 Software\Policies\Mozilla\Firefox\SearchEngines\PreventInstalls = 0x1 | 0x0
6247 ```
6248 #### Windows (Intune)
6249 OMA-URI:
6250 ```
6251 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~Search/SearchEngines_PreventInstalls
6252 ```
6253 Value (string):
6254 ```
6255 <enabled/> or <disabled/>
6256 ```
6257 #### macOS
6258 ```
6259 <dict>
6260   <key>SearchEngines</key>
6261   <dict>
6262     <key>PreventInstalls</key>
6263     <true/> | <false/>
6264   </dict>
6265 </dict>
6266 ```
6267 #### policies.json
6268 ```
6269 {
6270   "policies": {
6271     "SearchEngines": {
6272       "PreventInstalls": true | false
6273     }
6274   }
6275 }
6276 ```
6277 ### SearchEngines | Remove
6278
6279 Hide built-in search engines. This policy is only available on the ESR.
6280
6281 **Compatibility:** Firefox ESR 60.2\
6282 **CCK2 Equivalent:** `removeDefaultSearchEngines` (removed all built-in engines)\
6283 **Preferences Affected:** N/A
6284
6285 #### Windows (GPO)
6286 ```
6287 Software\Policies\Mozilla\Firefox\SearchEngines\Remove\1 = NAME_OF_SEARCH_ENGINE
6288 ```
6289 #### Windows (Intune)
6290 OMA-URI:
6291 ```
6292 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~Search/SearchEngines_Remove
6293 ```
6294 Value (string):
6295 ```
6296 <enabled/>
6297 <data id="SearchEngines_Remove" value="1&#xF000;NAME_OF_SEARCH_ENGINE"/>
6298 ```
6299 #### macOS
6300 ```
6301 <dict>
6302   <key>SearchEngines</key>
6303   <dict>
6304     <key>Remove</key>
6305     <array>
6306       <string>NAME_OF_SEARCH_ENGINE</string>
6307     </array>
6308   </dict>
6309 </dict>
6310 ```
6311 #### policies.json
6312 ```
6313 {
6314   "policies": {
6315     "SearchEngines": {
6316       "Remove": ["NAME_OF_SEARCH_ENGINE"]
6317     }
6318   }
6319 }
6320 ```
6321 ### SearchSuggestEnabled
6322
6323 Enable search suggestions.
6324
6325 **Compatibility:** Firefox 68, Firefox ESR 68\
6326 **CCK2 Equivalent:** N/A\
6327 **Preferences Affected:** `browser.urlbar.suggest.searches`, `browser.search.suggest.enabled`
6328
6329 #### Windows (GPO)
6330 ```
6331 Software\Policies\Mozilla\Firefox\SearchSuggestEnabled = 0x1 | 0x0
6332 ```
6333 #### Windows (Intune)
6334 OMA-URI:
6335 ```
6336 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~Search/SearchSuggestEnabled
6337 ```
6338 Value (string):
6339 ```
6340 <enabled/> or <disabled/>
6341 ```
6342 #### macOS
6343 ```
6344 <dict>
6345   <key>SearchSuggestEnabled</key>
6346   <true/> | <false/>
6347 </dict>
6348 ```
6349 #### policies.json
6350 ```
6351 {
6352   "policies": {
6353     "SearchSuggestEnabled": true | false
6354   }
6355 }
6356 ```
6357 ### SecurityDevices
6358
6359 Add or delete PKCS #11 modules.
6360
6361 **Compatibility:** Firefox 114, Firefox ESR 112.12\
6362 **CCK2 Equivalent:** N/A\
6363 **Preferences Affected:** N/A
6364
6365 #### Windows (GPO)
6366 ```
6367 Software\Policies\Mozilla\Firefox\SecurityDevices\Add\NAME_OF_DEVICE_TO_ADD = PATH_TO_LIBRARY_FOR_DEVICE
6368 Software\Policies\Mozilla\Firefox\SecurityDevices\Remove\1 = NAME_OF_DEVICE_TO_REMOVE
6369 ```
6370 #### Windows (Intune)
6371 OMA-URI:
6372 ```
6373 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox/SecurityDevices/SecurityDevices_Add
6374 ```
6375 Value (string):
6376 ```
6377 <enabled/>
6378 <data id="SecurityDevices" value="NAME_OF_DEVICE_TO_ADD&#xF000;PATH_TO_LIBRARY_FOR_DEVICE"/>
6379 ```
6380 OMA-URI:
6381 ```
6382 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox/SecurityDevices/SecurityDevices_Delete
6383 ```
6384 Value (string):
6385 ```
6386 <enabled/>
6387 <data id="SecurityDevices" value="1&#xF000;NAME_OF_DEVICE_TO_REMOVE"/>
6388 ```
6389 #### macOS
6390 ```
6391 <dict>
6392   <key>SecurityDevices</key>
6393   <dict>
6394     <key>Add<key>
6395     <dict>
6396       <key>NAME_OF_DEVICE_TO_ADD</key>
6397       <string>PATH_TO_LIBRARY_FOR_DEVICE</string>
6398     </dict>
6399     <key>Delete</add>
6400     <array>
6401       <string>NAME_OF_DEVICE_TO_DELETE</string>
6402     </array>
6403   </dict>
6404 </dict>
6405 ```
6406 #### policies.json
6407 ```
6408 {
6409   "policies": {
6410     "SecurityDevices": {
6411       "Add": {
6412         "NAME_OF_DEVICE_TO_ADD": "PATH_TO_LIBRARY_FOR_DEVICE"
6413       },
6414       "Delete": ["NAME_OF_DEVICE_TO_DELETE"]
6415     }
6416   }
6417 }
6418 ```
6419 ### SecurityDevices (Deprecated)
6420
6421 Install PKCS #11 modules.
6422
6423 **Compatibility:** Firefox 64, Firefox ESR 60.4\
6424 **CCK2 Equivalent:** `certs.devices`\
6425 **Preferences Affected:** N/A
6426
6427 #### Windows (GPO)
6428 ```
6429 Software\Policies\Mozilla\Firefox\SecurityDevices\NAME_OF_DEVICE = PATH_TO_LIBRARY_FOR_DEVICE
6430 ```
6431 #### Windows (Intune)
6432 OMA-URI:
6433 ```
6434 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox/SecurityDevices
6435 ```
6436 Value (string):
6437 ```
6438 <enabled/>
6439 <data id="SecurityDevices" value="NAME_OF_DEVICE&#xF000;PATH_TO_LIBRARY_FOR_DEVICE"/>
6440 ```
6441 #### macOS
6442 ```
6443 <dict>
6444   <key>SecurityDevices</key>
6445   <dict>
6446     <key>NAME_OF_DEVICE</key>
6447     <string>PATH_TO_LIBRARY_FOR_DEVICE</string>
6448   </dict>
6449 </dict>
6450 ```
6451 #### policies.json
6452 ```
6453 {
6454   "policies": {
6455     "SecurityDevices": {
6456       "NAME_OF_DEVICE": "PATH_TO_LIBRARY_FOR_DEVICE"
6457     }
6458   }
6459 }
6460 ```
6461 ### ShowHomeButton
6462 Show the home button on the toolbar.
6463
6464 Future versions of Firefox will not show the home button by default.
6465
6466 **Compatibility:** Firefox 88, Firefox ESR 78.10\
6467 **CCK2 Equivalent:** N/A\
6468 **Preferences Affected:** N/A
6469
6470 #### Windows (GPO)
6471 ```
6472 Software\Policies\Mozilla\Firefox\ShowHomeButton = 0x1 | 0x0
6473 ```
6474 #### Windows (Intune)
6475 OMA-URI:
6476 ```
6477 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~Homepage/Homepage_ShowHomeButton
6478 ```
6479 Value (string):
6480 ```
6481 <enabled/> or <disabled/>
6482 ```
6483 #### macOS
6484 ```
6485 <dict>
6486   <key>ShowHomeButton</key>
6487   <true/> | <false/>
6488 </dict>
6489 ```
6490 #### policies.json
6491 ```
6492 {
6493   "policies": {
6494     "ShowHomeButton": true | false
6495   }
6496 }
6497 ```
6498 ### SSLVersionMax
6499
6500 Set and lock the maximum version of TLS. (Firefox defaults to a maximum of TLS 1.3.)
6501
6502 **Compatibility:** Firefox 66, Firefox ESR 60.6\
6503 **CCK2 Equivalent:** N/A\
6504 **Preferences Affected:** `security.tls.version.max`
6505
6506 #### Windows (GPO)
6507 ```
6508 Software\Policies\Mozilla\Firefox\SSLVersionMax = "tls1" | "tls1.1" | "tls1.2" | "tls1.3"
6509 ```
6510 #### Windows (Intune)
6511 OMA-URI:
6512 ```
6513 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox/SSLVersionMax
6514 ```
6515 Value (string):
6516 ```
6517 <enabled/>
6518 <data id="SSLVersion" value="tls1 | tls1.2 | tls1.3"/>
6519 ```
6520 #### macOS
6521 ```
6522 <dict>
6523   <key>SSLVersionMax</key>
6524   <string>tls1 | tls1.1 | tls1.2 | tls1.3</string>
6525 </dict>
6526 ```
6527
6528 #### policies.json
6529 ```
6530 {
6531   "policies": {
6532     "SSLVersionMax": "tls1" | "tls1.1" | "tls1.2" | "tls1.3"
6533   }
6534 }
6535 ```
6536 ### SSLVersionMin
6537
6538 Set and lock the minimum version of TLS. (Firefox defaults to a minimum of TLS 1.2.)
6539
6540 **Compatibility:** Firefox 66, Firefox ESR 60.6\
6541 **CCK2 Equivalent:** N/A\
6542 **Preferences Affected:** `security.tls.version.min`
6543
6544 #### Windows (GPO)
6545 ```
6546 Software\Policies\Mozilla\Firefox\SSLVersionMin = "tls1" | "tls1.1" | "tls1.2" | "tls1.3"
6547 ```
6548 #### Windows (Intune)
6549 OMA-URI:
6550 ```
6551 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox/SSLVersionMin
6552 ```
6553 Value (string):
6554 ```
6555 <enabled/>
6556 <data id="SSLVersion" value="tls1 | tls1.2 | tls1.3"/>
6557 ```
6558 #### macOS
6559 ```
6560 <dict>
6561   <key>SSLVersionMin</key>
6562   <string>tls1 | tls1.1 | tls1.2 | tls1.3</string>
6563 </dict>
6564 ```
6565
6566 #### policies.json
6567 ```
6568 {
6569   "policies": {
6570     "SSLVersionMin": "tls1" | "tls1.1" | "tls1.2" | "tls1.3"
6571   }
6572 }
6573 ```
6574 ### StartDownloadsInTempDirectory
6575 Force downloads to start off in a local, temporary location rather than the default download directory.
6576
6577 **Compatibility:** Firefox 102\
6578 **CCK2 Equivalent:** N/A\
6579 **Preferences Affected:** `browser.download.start_downloads_in_tmp_dir`
6580
6581 #### Windows (GPO)
6582 ```
6583 Software\Policies\Mozilla\Firefox\StartDownloadsInTempDirectory = 0x1 | 0x0
6584 ```
6585 #### Windows (Intune)
6586 OMA-URI:
6587 ```
6588 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox/StartDownloadsInTempDirectory
6589 ```
6590 Value (string):
6591 ```
6592 <enabled/> or <disabled/>
6593 ```
6594 #### macOS
6595 ```
6596 <dict>
6597   <key>StartDownloadsInTempDirectory</key>
6598   <true/> | <false/>
6599 </dict>
6600 ```
6601 #### policies.json
6602 ```
6603 {
6604   "policies": {
6605     "StartDownloadsInTempDirectory": true | false
6606 }
6607 ```
6608 ### SupportMenu
6609 Add a menuitem to the help menu for specifying support information.
6610
6611 **Compatibility:** Firefox 68.0.1, Firefox ESR 68.0.1\
6612 **CCK2 Equivalent:** helpMenu\
6613 **Preferences Affected:** N/A
6614
6615 #### Windows (GPO)
6616 ```
6617 Software\Policies\Mozilla\Firefox\SupportMenu\Title = "Support Menu"
6618 Software\Policies\Mozilla\Firefox\SupportMenu\URL = "http://example.com/support"
6619 Software\Policies\Mozilla\Firefox\SupportMenu\AccessKey = "S"
6620 ```
6621 #### Windows (Intune)
6622 OMA-URI:
6623 ```
6624 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox/SupportMenu
6625 ```
6626 Value (string):
6627 ```
6628 <enabled/>
6629 <data id="SupportMenuTitle" value="Support Menu"/>
6630 <data id="SupportMenuURL" value="http://example.com/support"/>
6631 <data id="SupportMenuAccessKey" value="S"/>
6632 ```
6633 #### macOS
6634 ```
6635 <dict>
6636   <key>SupportMenu</key>
6637   <dict>
6638     <key>Title</key>
6639     <string>SupportMenu</string>
6640     <key>URL</key>
6641     <string>http://example.com/support</string>
6642     <key>AccessKey</key>
6643     <string>S</string>
6644   </dict>
6645 </dict>
6646 ```
6647 #### policies.json
6648 ```
6649 {
6650   "policies": {
6651     "SupportMenu": {
6652       "Title": "Support Menu",
6653       "URL": "http://example.com/support",
6654       "AccessKey": "S"
6655     }
6656   }
6657 }
6658 ```
6659 ### TranslateEnabled
6660 Enable or disable webpage translation.
6661
6662 Note: Web page translation is done completely on the client, so there is no data or privacy risk.
6663
6664 If you only want to disable the popup, you can set the pref `browser.translations.automaticallyPopup` to false using the [Preferences](#preferences) policy.
6665
6666 **Compatibility:** Firefox 126\
6667 **CCK2 Equivalent:** N/A\
6668 **Preferences Affected:** `browser.translations.enable`
6669
6670 #### Windows (GPO)
6671 ```
6672 Software\Policies\Mozilla\Firefox\TranslateEnabled = 0x1 | 0x0
6673 ```
6674 #### Windows (Intune)
6675 OMA-URI:
6676 ```
6677 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox/TranslateEnabled
6678 ```
6679 Value (string):
6680 ```
6681 <enabled/> or <disabled/>
6682 ```
6683 #### macOS
6684 ```
6685 <dict>
6686   <key>TranslateEnabled</key>
6687   <true/> | <false/>
6688 </dict>
6689 ```
6690 #### policies.json
6691 ```
6692 {
6693   "policies": {
6694     "TranslateEnabled": true | false
6695   }
6696 }
6697 ```
6698 ### UserMessaging
6699
6700 Prevent Firefox from messaging the user in certain situations.
6701
6702 `WhatsNew` Remove the "What's New" icon and menuitem. (*Deprecated*)
6703
6704 `ExtensionRecommendations` If false, don't recommend extensions while the user is visiting web pages.
6705
6706 `FeatureRecommendations` If false, don't recommend browser features.
6707
6708 `UrlbarInterventions` If false, Don't offer Firefox specific suggestions in the URL bar.
6709
6710 `SkipOnboarding` If true, don't show onboarding messages on the new tab page.
6711
6712 `MoreFromMozilla` If false, don't show the "More from Mozilla" section in Preferences. (Firefox 98)
6713
6714 `FirefoxLabs` If false, don't show the "Firefox Labs" section in Preferences. (Firefox 130.0.1)
6715
6716 `Locked` prevents the user from changing user messaging preferences.
6717
6718 **Compatibility:** Firefox 75, Firefox ESR 68.7\
6719 **CCK2 Equivalent:** N/A\
6720 **Preferences Affected:** `browser.newtabpage.activity-stream.asrouter.userprefs.cfr.addons`, `browser.newtabpage.activity-stream.asrouter.userprefs.cfr.features`, `browser.aboutwelcome.enabled`, `browser.preferences.moreFromMozilla`, `browser.preferences.experimental`
6721
6722 #### Windows (GPO)
6723 ```
6724 Software\Policies\Mozilla\Firefox\UserMessaging\ExtensionRecommendations = 0x1 | 0x0
6725 Software\Policies\Mozilla\Firefox\UserMessaging\FeatureRecommendations = 0x1 | 0x0
6726 Software\Policies\Mozilla\Firefox\UserMessaging\UrlbarInterventions = 0x1 | 0x0
6727 Software\Policies\Mozilla\Firefox\UserMessaging\SkipOnboarding = 0x1 | 0x0
6728 Software\Policies\Mozilla\Firefox\UserMessaging\MoreFromMozilla = 0x1 | 0x0
6729 Software\Policies\Mozilla\Firefox\UserMessaging\FirefoxLabs = 0x1 | 0x0
6730 Software\Policies\Mozilla\Firefox\UserMessaging\Locked = 0x1 | 0x0
6731 ```
6732 #### Windows (Intune)
6733 OMA-URI:
6734 ```
6735 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~UserMessaging/UserMessaging_ExtensionRecommendations
6736 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~UserMessaging/UserMessaging_FeatureRecommendations
6737 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~UserMessaging/UserMessaging_UrlbarInterventions
6738 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~UserMessaging/UserMessaging_SkipOnboarding
6739 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~UserMessaging/UserMessaging_MoreFromMozilla
6740 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~UserMessaging/UserMessaging_FirefoxLabs
6741 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~UserMessaging/UserMessaging_Locked
6742 ```
6743 Value (string):
6744 ```
6745 <enabled/> or <disabled/>
6746 ```
6747 #### macOS
6748 ```
6749 <dict>
6750   <key>UserMessaging</key>
6751   <dict>
6752     <key>ExtensionRecommendations</key>
6753     <true/> | <false/>
6754     <key>FeatureRecommendations</key>
6755     <true/> | <false/>
6756     <key>UrlbarInterventions</key>
6757     <true/> | <false/>
6758     <key>SkipOnboarding</key>
6759     <true/> | <false/>
6760     <key>MoreFromMozilla</key>
6761     <true/> | <false/>
6762     <key>FirefoxLabs</key>
6763     <true/> | <false/>
6764     <key>Locked</key>
6765     <true/> | <false/>
6766   </dict>
6767 </dict>
6768 ```
6769 #### policies.json
6770 ```
6771 {
6772   "policies": {
6773     "UserMessaging": {
6774       "ExtensionRecommendations": true | false,
6775       "FeatureRecommendations": true | false,
6776       "UrlbarInterventions": true | false,
6777       "SkipOnboarding": true | false,
6778       "MoreFromMozilla": true | false,
6779       "FirefoxLabs": true | false,
6780       "Locked": true | false
6781     }
6782   }
6783 }
6784 ```
6785 ### UseSystemPrintDialog
6786 Use the system print dialog instead of the print preview window.
6787
6788 **Compatibility:** Firefox 102\
6789 **CCK2 Equivalent:** N/A\
6790 **Preferences Affected:** `print.prefer_system_dialog`
6791
6792 #### Windows (GPO)
6793 ```
6794 Software\Policies\Mozilla\Firefox\UseSystemPrintDialog = 0x1 | 0x0
6795 ```
6796 #### Windows (Intune)
6797 OMA-URI:
6798 ```
6799 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox/UseSystemPrintDialog
6800 ```
6801 Value (string):
6802 ```
6803 <enabled/> or <disabled/>
6804 ```
6805 #### macOS
6806 ```
6807 <dict>
6808   <key>UseSystemPrintDialog</key>
6809   <true/> | <false/>
6810 </dict>
6811 ```
6812 #### policies.json
6813 ```
6814 {
6815   "policies": {
6816     "UseSystemPrintDialog": true | false
6817   }
6818 }
6819 ```
6820 ### WebsiteFilter
6821 Block websites from being visited. The parameters take an array of Match Patterns, as documented in https://developer.mozilla.org/en-US/Add-ons/WebExtensions/Match_patterns.
6822 The arrays are limited to 1000 entries each.
6823
6824 If you want to block all URLs, you can use `<all_urls>` or `*://*/*`. You can't have just a `*` on the right side.
6825
6826 For specific protocols, use `https://*/*` or `http://*/*`.
6827
6828 As of Firefox 83 and Firefox ESR 78.5, file URLs are supported.
6829
6830 **Compatibility:** Firefox 60, Firefox ESR 60\
6831 **CCK2 Equivalent:** N/A\
6832 **Preferences Affected:** N/A
6833
6834 #### Windows (GPO)
6835 ```
6836 Software\Policies\Mozilla\Firefox\WebsiteFilter\Block\1 = "<all_urls>"
6837 Software\Policies\Mozilla\Firefox\WebsiteFilter\Exceptions\1 = "http://example.org/*"
6838 ```
6839 #### Windows (Intune)
6840 OMA-URI:
6841 ```
6842 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox/B_WebsiteFilter_Block
6843 ```
6844 Value (string):
6845 ```
6846 <enabled/> <data id="WebsiteFilter" value="1&#xF000;&#60;all_urls&#62;"/>
6847 ```
6848 OMA-URI:
6849 ```
6850 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox/B_WebsiteFilter_Exceptions
6851 ```
6852 Value (string):
6853 ```
6854 <enabled/>
6855 <data id="WebsiteFilter" value="1&#xF000;http://example.org/*"/>
6856 ```
6857 If you are using custom ADMX and ADML administrative templates in Intune, you can use this OMA-URI instead
6858 to workaround the limit on the length of strings. Put all of your JSON on one line.
6859
6860 OMA-URI:
6861 ```
6862 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~Extensions/WebsiteFilterOneLine
6863 ```
6864 Value (string):
6865 ```
6866 <enabled/>
6867 <data id="JSONOneLine" value='{"Block": ["<all_urls>"],"Exceptions": ["http://example.org/*"]}'/>
6868 ```
6869 #### macOS
6870 ```
6871 <dict>
6872   <key>WebsiteFilter</key>
6873   <dict>
6874     <key>Block</key>
6875     <array>
6876       <string><all_urls></string>
6877     </array>
6878     <key>Exceptions</key>
6879     <array>
6880       <string>http://example.org/*</string>
6881     </array>
6882   </dict>
6883
6884 </dict>
6885 ```
6886 #### policies.json
6887 ```
6888 {
6889   "policies": {
6890     "WebsiteFilter": {
6891       "Block": ["<all_urls>"],
6892       "Exceptions": ["http://example.org/*"]
6893     }
6894   }
6895 }
6896 ```
6897 ### WindowsSSO
6898 Allow Windows single sign-on for Microsoft, work, and school accounts.
6899
6900 If this policy is set to true, Firefox will use credentials stored in Windows to sign in to Microsoft, work, and school accounts.
6901
6902 **Compatibility:** Firefox 91\
6903 **CCK2 Equivalent:** N/A\
6904 **Preferences Affected:** `network.http.windows-sso.enabled`
6905
6906 #### Windows (GPO)
6907 ```
6908 Software\Policies\Mozilla\Firefox\WindowsSSO = 0x1 | 0x0
6909 ```
6910 #### Windows (Intune)
6911 OMA-URI:
6912 ```
6913 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox/WindowsSSO
6914 ```
6915 Value (string):
6916 ```
6917 <enabled/> or <disabled/>
6918 ```
6919 #### policies.json
6920 ```
6921 {
6922   "policies": {
6923     "WindowsSSO": true | false
6924   }
6925 }
6926 ```