docs/index.md

   1 Firefox policies can be specified using the [Group Policy templates on Windows](https://github.com/mozilla/policy-templates/tree/master/windows), [Intune on Windows](https://support.mozilla.org/kb/managing-firefox-intune), [configuration profiles on macOS](https://github.com/mozilla/policy-templates/tree/master/mac), or by creating a file called `policies.json`. On Windows, create a directory called `distribution` where the EXE is located and place the file there. On Mac, the file goes into `Firefox.app/Contents/Resources/distribution`.  On Linux, the file goes into `firefox/distribution`, where `firefox` is the installation directory for firefox, which varies by distribution or you can specify system-wide policy by placing the file in `/etc/firefox/policies`.
   2
   3 Unfortunately, JSON files do not support comments, but you can add extra entries to the JSON to use as comments. You will see an error in about:policies, but the policies will still work properly. For example:
   4 ```
   5 {
   6   "policies": {
   7     "Authentication": {
   8       "SPNEGO": ["mydomain.com", "https://myotherdomain.com"]
   9     }
  10     "Authentication_Comment": "These domains are required for us"
  11   }
  12 }
  13 ```
  14 Note: The `policies.json` must use the UTF-8 encoding.
  15
  16 | Policy Name | Description
  17 | --- | --- |
  18 | **[`3rdparty`](#3rdparty)** | Set policies that WebExtensions can access via chrome.storage.managed.
  19 | **[`AllowedDomainsForApps`](#alloweddomainsforapps)** | Define domains allowed to access Google Workspace.
  20 | **[`AllowFileSelectionDialogs`](#allowfileselectiondialogs)** | Allow file selection dialogs.
  21 | **[`AppAutoUpdate`](#appautoupdate)** | Enable or disable automatic application update.
  22 | **[`AppUpdatePin`](#appupdatepin)** | Prevent Firefox from being updated beyond the specified version.
  23 | **[`AppUpdateURL`](#appupdateurl)** | Change the URL for application update.
  24 | **[`Authentication`](#authentication)** | Configure sites that support integrated authentication.
  25 | **[`AutofillAddressEnabled`](#autofilladdressenabled)** | Enable autofill for addresses.
  26 | **[`AutofillCreditCardEnabled`](#autofillcreditcardenabled)** | Enable autofill for payment methods.
  27 | **[`AutoLaunchProtocolsFromOrigins`](#autolaunchprotocolsfromorigins)** | Define a list of external protocols that can be used from listed origins without prompting the user.
  28 | **[`BackgroundAppUpdate`](#backgroundappupdate)** | Enable or disable the background updater (Windows only).
  29 | **[`BlockAboutAddons`](#blockaboutaddons)** | Block access to the Add-ons Manager (about:addons).
  30 | **[`BlockAboutConfig`](#blockaboutconfig)** | Block access to about:config.
  31 | **[`BlockAboutProfiles`](#blockaboutprofiles)** | Block access to About Profiles (about:profiles).
  32 | **[`BlockAboutSupport`](#blockaboutsupport)** | Block access to Troubleshooting Information (about:support).
  33 | **[`Bookmarks`](#bookmarks)** | Add bookmarks in either the bookmarks toolbar or menu.
  34 | **[`CaptivePortal`](#captiveportal)** | Enable or disable the detection of captive portals.
  35 | **[`Certificates`](#certificates)** |
  36 | **[`Certificates -> ImportEnterpriseRoots`](#certificates--importenterpriseroots)** | Trust certificates that have been added to the operating system certificate store by a user or administrator.
  37 | **[`Certificates -> Install`](#certificates--install)** | Install certificates into the Firefox certificate store.
  38 | **[`Containers`](#containers)** | Set policies related to [containers](https://addons.mozilla.org/firefox/addon/multi-account-containers/).
  39 | **[`Cookies`](#cookies)** | Configure cookie preferences.
  40 | **[`DefaultDownloadDirectory`](#defaultdownloaddirectory)** | Set the default download directory.
  41 | **[`DisableAppUpdate`](#disableappupdate)** | Turn off application updates.
  42 | **[`DisableBuiltinPDFViewer`](#disablebuiltinpdfviewer)** | Disable the built in PDF viewer.
  43 | **[`DisabledCiphers`](#disabledciphers)** | Disable ciphers.
  44 | **[`DisableDefaultBrowserAgent`](#disabledefaultbrowseragent)** | Prevent the default browser agent from taking any actions (Windows only).
  45 | **[`DisableDeveloperTools`](#disabledevelopertools)** | Remove access to all developer tools.
  46 | **[`DisableEncryptedClientHello`](#disableencryptedclienthello)** | Disable the TLS Feature Encrypted Client Hello (ECH).
  47 | **[`DisableFeedbackCommands`](#disablefeedbackcommands)** | Disable the menus for reporting sites.
  48 | **[`DisableFirefoxAccounts`](#disablefirefoxaccounts)** | Disable Firefox Accounts integration (Sync).
  49 | **[`DisableFirefoxScreenshots`](#disablefirefoxscreenshots)** | Remove access to Firefox Screenshots.
  50 | **[`DisableFirefoxStudies`](#disablefirefoxstudies)** | Disable Firefox studies (Shield).
  51 | **[`DisableForgetButton`](#disableforgetbutton)** | Disable the "Forget" button.
  52 | **[`DisableFormHistory`](#disableformhistory)** | Turn off saving information on web forms and the search bar.
  53 | **[`DisableMasterPasswordCreation`](#disablemasterpasswordcreation)** | Remove the master password functionality.
  54 | **[`DisablePasswordReveal`](#disablepasswordreveal)** | Do not allow passwords to be revealed in saved logins.
  55 | **[`DisablePocket`](#disablepocket)** | Remove Pocket in the Firefox UI.
  56 | **[`DisablePrivateBrowsing`](#disableprivatebrowsing)** | Remove access to private browsing.
  57 | **[`DisableProfileImport`](#disableprofileimport)** | Disables the "Import data from another browser" option in the bookmarks window.
  58 | **[`DisableProfileRefresh`](#disableprofilerefresh)** | Disable the Refresh Firefox button on about:support and support.mozilla.org
  59 | **[`DisableSafeMode`](#disablesafemode)** | Disable safe mode within the browser.
  60 | **[`DisableSecurityBypass`](#disablesecuritybypass)** | Prevent the user from bypassing security in certain cases.
  61 | **[`DisableSetDesktopBackground`](#disablesetdesktopbackground)** | Remove the "Set As Desktop Background..." menuitem when right clicking on an image.
  62 | **[`DisableSystemAddonUpdate`](#disablesystemaddonupdate)** | Prevent system add-ons from being installed or updated.
  63 | **[`DisableTelemetry`](#disabletelemetry)** | DisableTelemetry
  64 | **[`DisableThirdPartyModuleBlocking`](#disablethirdpartymoduleblocking)** | Do not allow blocking third-party modules.
  65 | **[`DisplayBookmarksToolbar`](#displaybookmarkstoolbar)** | Set the initial state of the bookmarks toolbar.
  66 | **[`DisplayMenuBar`](#displaymenubar)** | Set the state of the menubar.
  67 | **[`DNSOverHTTPS`](#dnsoverhttps)** | Configure DNS over HTTPS.
  68 | **[`DontCheckDefaultBrowser`](#dontcheckdefaultbrowser)** | Don't check if Firefox is the default browser at startup.
  69 | **[`DownloadDirectory`](#downloaddirectory)** | Set and lock the download directory.
  70 | **[`EnableTrackingProtection`](#enabletrackingprotection)** | Configure tracking protection.
  71 | **[`EncryptedMediaExtensions`](#encryptedmediaextensions)** | Enable or disable Encrypted Media Extensions and optionally lock it.
  72 | **[`EnterprisePoliciesEnabled`](#enterprisepoliciesenabled)** | Enable policy support on macOS.
  73 | **[`ExemptDomainFileTypePairsFromFileTypeDownloadWarnings`](#exemptdomainfiletypepairsfromfiletypedownloadwarnings)** | Disable warnings based on file extension for specific file types on domains.
  74 | **[`Extensions`](#extensions)** | Control the installation, uninstallation and locking of extensions.
  75 | **[`ExtensionSettings`](#extensionsettings)** | Manage all aspects of extensions.
  76 | **[`ExtensionUpdate`](#extensionupdate)** | Control extension updates.
  77 | **[`FirefoxHome`](#firefoxhome)** | Customize the Firefox Home page.
  78 | **[`FirefoxSuggest`](#firefoxsuggest)** | Customize Firefox Suggest.
  79 | **[`GoToIntranetSiteForSingleWordEntryInAddressBar`](#gotointranetsiteforsinglewordentryinaddressbar)** | Force direct intranet site navigation instead of searching when typing single word entries in the address bar.
  80 | **[`Handlers`](#handlers)** | Configure default application handlers.
  81 | **[`HardwareAcceleration`](#hardwareacceleration)** | Control hardware acceleration.
  82 | **[`Homepage`](#homepage)** | Configure the default homepage and how Firefox starts.
  83 | **[`HttpAllowlist`](#httpallowlist)** | Configure origins that will not be upgraded to HTTPS.
  84 | **[`HttpsOnlyMode`](#httpsonlymode)** | Configure HTTPS-Only Mode.
  85 | **[`InstallAddonsPermission`](#installaddonspermission)** | Configure the default extension install policy as well as origins for extension installs are allowed.
  86 | **[`LegacyProfiles`](#legacyprofiles)** | Disable the feature enforcing a separate profile for each installation.
  87 | **[`LegacySameSiteCookieBehaviorEnabled`](#legacysamesitecookiebehaviorenabled)** | Enable default legacy SameSite cookie behavior setting.
  88 | **[`LegacySameSiteCookieBehaviorEnabledForDomainList`](#legacysamesitecookiebehaviorenabledfordomainlist)** | Revert to legacy SameSite behavior for cookies on specified sites.
  89 | **[`LocalFileLinks`](#localfilelinks)** | Enable linking to local files by origin.
  90 | **[`ManagedBookmarks`](#managedbookmarks)** | Configures a list of bookmarks managed by an administrator that cannot be changed by the user.
  91 | **[`ManualAppUpdateOnly`](#manualappupdateonly)** | Allow manual updates only and do not notify the user about updates.
  92 | **[`NetworkPrediction`](#networkprediction)** | Enable or disable network prediction (DNS prefetching).
  93 | **[`NewTabPage`](#newtabpage)** | Enable or disable the New Tab page.
  94 | **[`NoDefaultBookmarks`](#nodefaultbookmarks)** | Disable the creation of default bookmarks.
  95 | **[`OfferToSaveLogins`](#offertosavelogins)** | Control whether or not Firefox offers to save passwords.
  96 | **[`OfferToSaveLoginsDefault`](#offertosaveloginsdefault)** | Set the default value for whether or not Firefox offers to save passwords.
  97 | **[`OverrideFirstRunPage`](#overridefirstrunpage)** | Override the first run page.
  98 | **[`OverridePostUpdatePage`](#overridepostupdatepage)** | Override the upgrade page.
  99 | **[`PasswordManagerEnabled`](#passwordmanagerenabled)** | Remove (some) access to the password manager.
 100 | **[`PasswordManagerExceptions`](#passwordmanagerexceptions)** | Prevent Firefox from saving passwords for specific sites.
 101 | **[`PDFjs`](#pdfjs)** | Disable or configure PDF.js, the built-in PDF viewer.
 102 | **[`Permissions`](#permissions)** | Set permissions associated with camera, microphone, location, and notifications.
 103 | **[`PictureInPicture`](#pictureinpicture)** | Enable or disable Picture-in-Picture.
 104 | **[`PopupBlocking`](#popupblocking)** | Configure the default pop-up window policy as well as origins for which pop-up windows are allowed.
 105 | **[`PostQuantumKeyAgreementEnabled`](#postquantumkeyagreementenabled)** | Enable post-quantum key agreement for TLS.
 106 | **[`Preferences`](#preferences)** | Set and lock preferences.
 107 | **[`PrimaryPassword`](#primarypassword)** | Require or prevent using a primary (formerly master) password.
 108 | **[`PrintingEnabled`](#printingenabled)** | Enable or disable printing.
 109 | **[`PromptForDownloadLocation`](#promptfordownloadlocation)** | Ask where to save each file before downloading.
 110 | **[`Proxy`](#proxy)** | Configure proxy settings.
 111 | **[`RequestedLocales`](#requestedlocales)** | Set the the list of requested locales for the application in order of preference.
 112 | **[`SanitizeOnShutdown` (All)](#sanitizeonshutdown-all)** | Clear all data on shutdown.
 113 | **[`SanitizeOnShutdown` (Selective)](#sanitizeonshutdown-selective)** | Clear data on shutdown.
 114 | **[`SearchBar`](#searchbar)** | Set whether or not search bar is displayed.
 115 | **[`SearchEngines`](#searchengines-this-policy-is-only-available-on-the-esr)** |
 116 | **[`SearchEngines -> Add`](#searchengines--add)** | Add new search engines.
 117 | **[`SearchEngines -> Default`](#searchengines--default)** | Set the default search engine.
 118 | **[`SearchEngines -> PreventInstalls`](#searchengines--preventinstalls)** | Prevent installing search engines from webpages.
 119 | **[`SearchEngines -> Remove`](#searchengines--remove)** | Hide built-in search engines.
 120 | **[`SearchSuggestEnabled`](#searchsuggestenabled)** | Enable search suggestions.
 121 | **[`SecurityDevices`](#securitydevices)** | Install PKCS #11 modules.
 122 | **[`ShowHomeButton`](#showhomebutton)** | Show the home button on the toolbar.
 123 | **[`SSLVersionMax`](#sslversionmax)** | Set and lock the maximum version of TLS.
 124 | **[`SSLVersionMin`](#sslversionmin)** | Set and lock the minimum version of TLS.
 125 | **[`StartDownloadsInTempDirectory`](#startdownloadsintempdirectory)** | Force downloads to start off in a local, temporary location rather than the default download directory.
 126 | **[`SupportMenu`](#supportmenu)** | Add a menuitem to the help menu for specifying support information.
 127 | **[`TranslateEnabled`](#translateenabled)** | Enable or disable webpage translation.
 128 | **[`UserMessaging`](#usermessaging)** | Don't show certain messages to the user.
 129 | **[`UseSystemPrintDialog`](#usesystemprintdialog)** | Print using the system print dialog instead of print preview.
 130 | **[`WebsiteFilter`](#websitefilter)** | Block websites from being visited.
 131 | **[`WindowsSSO`](#windowssso)** | Allow Windows single sign-on for Microsoft, work, and school accounts.
 132
 133 ### 3rdparty
 134
 135 Allow WebExtensions to configure policy. For more information, see [Adding policy support to your extension](https://extensionworkshop.com/documentation/enterprise/enterprise-development/#how-to-add-policy).
 136
 137 For GPO and Intune, the extension developer should provide an ADMX file.
 138
 139 **Compatibility:** Firefox 68\
 140 **CCK2 Equivalent:** N/A\
 141 **Preferences Affected:** N/A
 142
 143 #### macOS
 144 ```
 145 <dict>
 146   <key>3rdparty</key>
 147   <dict>
 148     <key>Extensions</key>
 149     <dict>
 150       <key>uBlock0@raymondhill.net</key>
 151       <dict>
 152         <key>adminSettings</key>
 153         <dict>
 154           <key>selectedFilterLists</key>
 155           <array>
 156             <string>ublock-privacy</string>
 157             <string>ublock-badware</string>
 158             <string>ublock-filters</string>
 159             <string>user-filters</string>
 160           </array>
 161         </dict>
 162       </dict>
 163     </dict>
 164   </dict>
 165 </dict>
 166 ```
 167 #### policies.json
 168 ```
 169 {
 170   "policies": {
 171     "3rdparty": {
 172       "Extensions": {
 173         "uBlock0@raymondhill.net": {
 174           "adminSettings": {
 175             "selectedFilterLists": [
 176               "ublock-privacy",
 177               "ublock-badware",
 178               "ublock-filters",
 179               "user-filters"
 180             ]
 181           }
 182         }
 183       }
 184     }
 185   }
 186 }
 187 ```
 188
 189 ### AllowedDomainsForApps
 190
 191 Define domains allowed to access Google Workspace.
 192
 193 This policy is based on the [Chrome policy](https://chromeenterprise.google/policies/#AllowedDomainsForApps) of the same name.
 194
 195 If this policy is enabled, users can only access Google Workspace using accounts from the specified domains. If you want to allow Gmail, you can add ```consumer_accounts``` to the list.
 196
 197 **Compatibility:** Firefox 89, Firefox ESR 78.11\
 198 **CCK2 Equivalent:** N/A\
 199 **Preferences Affected:** N/A
 200
 201 #### Windows (GPO)
 202 ```
 203 Software\Policies\Mozilla\Firefox\AllowedDomainsForApps = "managedfirefox.com,example.com"
 204 ```
 205 #### Windows (Intune)
 206 OMA-URI:
 207 ```
 208 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox/AllowedDomainsForApps
 209 ```
 210 Value (string):
 211 ```
 212 <enabled/>
 213 <data id="AllowedDomainsForApps" value="managedfirefox.com,example.com"/>
 214 ```
 215 #### macOS
 216 ```
 217 <dict>
 218   <key>AllowedDomainsForApps</key>
 219   <string>managedfirefox.com,example.com</string>
 220 </dict>
 221 ```
 222 #### policies.json
 223 ```
 224 {
 225   "policies": {
 226     "AllowedDomainsForApps": "managedfirefox.com,example.com"
 227   }
 228 }
 229 ```
 230 ### AllowFileSelectionDialogs
 231
 232 Enable or disable file selection dialogs.
 233
 234 **Compatibility:** Firefox 124\
 235 **CCK2 Equivalent:** N/A\
 236 **Preferences Affected:** `widget.disable_file_pickers`
 237
 238 #### Windows (GPO)
 239 ```
 240 Software\Policies\Mozilla\Firefox\AllowFileSelectionDialogs = 0x1 | 0x0
 241 ```
 242 #### Windows (Intune)
 243 OMA-URI:
 244 ```
 245 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox/AppAutoAllowFileSelectionDialogsUpdate
 246 ```
 247 Value (string):
 248 ```
 249 <enabled/> or <disabled/>
 250 ```
 251 #### macOS
 252 ```
 253 <dict>
 254   <key>AllowFileSelectionDialogs</key>
 255   <true/> | <false/>
 256 </dict>
 257 ```
 258 #### policies.json
 259 ```
 260 {
 261   "policies": {
 262     "AllowFileSelectionDialogs": true | false
 263   }
 264 }
 265 ```
 266 ### AppAutoUpdate
 267
 268 Enable or disable **automatic** application update.
 269
 270 If set to true, application updates are installed without user approval within Firefox. The operating system might still require approval.
 271
 272 If set to false, application updates are downloaded but the user can choose when to install the update.
 273
 274 If you have disabled updates via `DisableAppUpdate`, this policy has no effect.
 275
 276 **Compatibility:** Firefox 75, Firefox ESR 68.7\
 277 **CCK2 Equivalent:** N/A\
 278 **Preferences Affected:** `app.update.auto`
 279
 280 #### Windows (GPO)
 281 ```
 282 Software\Policies\Mozilla\Firefox\AppAutoUpdate = 0x1 | 0x0
 283 ```
 284 #### Windows (Intune)
 285 OMA-URI:
 286 ```
 287 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox/AppAutoUpdate
 288 ```
 289 Value (string):
 290 ```
 291 <enabled/> or <disabled/>
 292 ```
 293 #### macOS
 294 ```
 295 <dict>
 296   <key>AppAutoUpdate</key>
 297   <true/> | <false/>
 298 </dict>
 299 ```
 300 #### policies.json
 301 ```
 302 {
 303   "policies": {
 304     "AppAutoUpdate": true | false
 305   }
 306 }
 307 ```
 308 ### AppUpdatePin
 309
 310 Prevent Firefox from being updated beyond the specified version.
 311
 312 You can specify the any version as ```xx.``` and Firefox will be updated with all minor versions, but will not be updated beyond the major version.
 313
 314 You can also specify the version as ```xx.xx``` and Firefox will be updated with all patch versions, but will not be updated beyond the minor version.
 315
 316 You should specify a version that exists or is guaranteed to exist. If you specify a version that doesn't end up existing, Firefox will update beyond that version.
 317
 318 **Compatibility:** Firefox 102,\
 319 **CCK2 Equivalent:** N/A\
 320 **Preferences Affected:** N/A
 321
 322 #### Windows (GPO)
 323 ```
 324 Software\Policies\Mozilla\Firefox\AppUpdatePin = "106."
 325 ```
 326 #### Windows (Intune)
 327 OMA-URI:
 328 ```
 329 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox/AppUpdatePin
 330 ```
 331 Value (string):
 332 ```
 333 <enabled/>
 334 <data id="AppUpdatePin" value="106."/>
 335 ```
 336 #### macOS
 337 ```
 338 <dict>
 339   <key>AppUpdatePin</key>
 340   <string>106.</string>
 341 </dict>
 342 ```
 343 #### policies.json
 344 ```
 345 {
 346   "policies": {
 347     "AppUpdatePin": "106."
 348   }
 349 }
 350 ```
 351 ### AppUpdateURL
 352
 353 Change the URL for application update if you are providing Firefox updates from a custom update server.
 354
 355 **Compatibility:** Firefox 62, Firefox ESR 60.2\
 356 **CCK2 Equivalent:** N/A\
 357 **Preferences Affected:** `app.update.url`
 358
 359 #### Windows (GPO)
 360 ```
 361 Software\Policies\Mozilla\Firefox\AppUpdateURL = "https://yoursite.com"
 362 ```
 363 #### Windows (Intune)
 364 OMA-URI:
 365 ```
 366 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox/AppUpdateURL
 367 ```
 368 Value (string):
 369 ```
 370 <enabled/>
 371 <data id="AppUpdateURL" value="https://yoursite.com"/>
 372 ```
 373 #### macOS
 374 ```
 375 <dict>
 376   <key>AppUpdateURL</key>
 377   <string>https://yoursite.com</string>
 378 </dict>
 379 ```
 380 #### policies.json
 381 ```
 382 {
 383   "policies": {
 384     "AppUpdateURL": "https://yoursite.com"
 385   }
 386 }
 387 ```
 388 ### Authentication
 389
 390 Configure sites that support integrated authentication.
 391
 392 See [Integrated authentication](https://htmlpreview.github.io/?https://github.com/mdn/archived-content/blob/main/files/en-us/mozilla/integrated_authentication/raw.html) for more information.
 393
 394 `PrivateBrowsing` enables integrated authentication in private browsing.
 395
 396 **Compatibility:** Firefox 60, Firefox ESR 60 (AllowNonFQDN added in 62/60.2, AllowProxies added in 70/68.2, Locked added in 71/68.3, PrivateBrowsing added in 77/68.9)\
 397 **CCK2 Equivalent:** N/A\
 398 **Preferences Affected:** `network.negotiate-auth.trusted-uris`,`network.negotiate-auth.delegation-uris`,`network.automatic-ntlm-auth.trusted-uris`,`network.automatic-ntlm-auth.allow-non-fqdn`,`network.negotiate-auth.allow-non-fqdn`,`network.automatic-ntlm-auth.allow-proxies`,`network.negotiate-auth.allow-proxies`,`network.auth.private-browsing-sso`
 399
 400 #### Windows (GPO)
 401 ```
 402 Software\Policies\Mozilla\Firefox\Authentication\SPNEGO\1 = "mydomain.com"
 403 Software\Policies\Mozilla\Firefox\Authentication\SPNEGO\2 = "https://myotherdomain.com"
 404 Software\Policies\Mozilla\Firefox\Authentication\Delegated\1 = "mydomain.com"
 405 Software\Policies\Mozilla\Firefox\Authentication\Delegated\2 = "https://myotherdomain.com"
 406 Software\Policies\Mozilla\Firefox\Authentication\NTLM\1 = "mydomain.com"
 407 Software\Policies\Mozilla\Firefox\Authentication\NTLM\2 = "https://myotherdomain.com"
 408 Software\Policies\Mozilla\Firefox\Authentication\AllowNonFQDN\SPNEGO = 0x1 | 0x0
 409 Software\Policies\Mozilla\Firefox\Authentication\AllowNonFQDN\NTLM = 0x1 | 0x0
 410 Software\Policies\Mozilla\Firefox\Authentication\AllowProxies\SPNEGO = 0x1 | 0x0
 411 Software\Policies\Mozilla\Firefox\Authentication\AllowProxies\NTLM = 0x1 | 0x0
 412 Software\Policies\Mozilla\Firefox\Authentication\Locked = 0x1 | 0x0
 413 Software\Policies\Mozilla\Firefox\Authentication\PrivateBrowsing = 0x1 | 0x0
 414 ```
 415 #### Windows (Intune)
 416 OMA-URI:
 417 ```
 418 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~Authentication/Authentication_SPNEGO
 419 ```
 420 Value (string):
 421 ```
 422 <enabled/>
 423 <data id="Authentication" value="1&#xF000;mydomain&#xF000;2&#xF000;https://myotherdomain.com"/>
 424 ```
 425 OMA-URI:
 426 ```
 427 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~Authentication/Authentication_Delegated
 428 ```
 429 Value (string):
 430 ```
 431 <enabled/>
 432 <data id="Authentication" value="1&#xF000;mydomain&#xF000;2&#xF000;https://myotherdomain.com"/>
 433 ```
 434 OMA-URI:
 435 ```
 436 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~Authentication/Authentication_NTLM
 437 ```
 438 Value (string):
 439 ```
 440 <enabled/>
 441 <data id="Authentication" value="1&#xF000;mydomain&#xF000;2&#xF000;https://myotherdomain.com"/>
 442 ```
 443 OMA-URI:
 444 ```
 445 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~Authentication/Authentication_AllowNonFQDN
 446 ```
 447 Value (string):
 448 ```
 449 <enabled/>
 450 <data id="Authentication_AllowNonFQDN_NTLM" value="true | false"/>
 451 <data id="Authentication_AllowNonFQDN_SPNEGO" value="true | false"/>
 452 ```
 453 OMA-URI:
 454 ```
 455 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~Authentication/Authentication_Locked
 456 ```
 457 Value (string):
 458 ```
 459 <enabled/> or <disabled/>
 460 ```
 461 OMA-URI:
 462 ```
 463 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~Authentication/Authentication_PrivateBrowsing
 464 ```
 465 Value (string):
 466 ```
 467 <enabled/> or <disabled/>
 468 ```
 469 #### macOS
 470 ```
 471 <dict>
 472   <key>Authentication</key>
 473   <dict>
 474     <key>SPNEGO</key>
 475     <array>
 476       <string>mydomain.com</string>
 477       <string>https://myotherdomain.com</string>
 478     </array>
 479     <key>Delegated</key>
 480     <array>
 481       <string>mydomain.com</string>
 482       <string>https://myotherdomain.com</string>
 483     </array>
 484     <key>NTLM</key>
 485     <array>
 486       <string>mydomain.com</string>
 487       <string>https://myotherdomain.com</string>
 488     </array>
 489     <key>AllowNonFQDN</key>
 490       <dict>
 491       <key>SPNEGO</key>
 492       <true/> | <false/>
 493       <key>NTLM</key>
 494       <true/> | <false/>
 495     </dict>
 496     <key>AllowProxies</key>
 497       <dict>
 498       <key>SPNEGO</key>
 499       <true/> | <false/>
 500       <key>NTLM</key>
 501       <true/> | <false/>
 502     </dict>
 503     <key>Locked</key>
 504     <true/> | <false/>
 505     <key>PrivateBrowsing</key>
 506     <true/> | <false/>
 507   </dict>
 508 </dict>
 509 ```
 510 #### policies.json
 511 ```
 512 {
 513   "policies": {
 514     "Authentication": {
 515       "SPNEGO": ["mydomain.com", "https://myotherdomain.com"],
 516       "Delegated": ["mydomain.com", "https://myotherdomain.com"],
 517       "NTLM": ["mydomain.com", "https://myotherdomain.com"],
 518       "AllowNonFQDN": {
 519         "SPNEGO": true | false,
 520         "NTLM": true | false
 521       },
 522       "AllowProxies": {
 523         "SPNEGO": true | false,
 524         "NTLM": true | false
 525       },
 526       "Locked": true | false,
 527       "PrivateBrowsing": true | false
 528     }
 529   }
 530 }
 531 ```
 532 ### AutofillAddressEnabled
 533
 534 Enables or disables autofill for addresses.
 535
 536 This only applies when address autofill is enabled for a particular Firefox version or region. See [this page](https://support.mozilla.org/kb/automatically-fill-your-address-web-forms) for more information.
 537
 538 **Compatibility:** Firefox 125, Firefox ESR 115.10\
 539 **CCK2 Equivalent:** N/A\
 540 **Preferences Affected:** `extensions.formautofill.addresses.enabled`
 541
 542 #### Windows (GPO)
 543 ```
 544 Software\Policies\Mozilla\Firefox\AutofillAddressEnabled = 0x1 | 0x0
 545 ```
 546 #### Windows (Intune)
 547 OMA-URI:
 548 ```
 549 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox/AutofillAddressEnabled
 550 ```
 551 Value (string):
 552 ```
 553 <enabled/> or <disabled/>
 554 ```
 555 #### macOS
 556 ```
 557 <dict>
 558   <key>AutofillAddressEnabled</key>
 559   <true/> | <false/>
 560 </dict>
 561 ```
 562 #### policies.json
 563 ```
 564 {
 565   "policies": {
 566     "AutofillAddressEnabled": true | false
 567   }
 568 }
 569 ```
 570 ### AutofillCreditCardEnabled
 571
 572 Enables or disables autofill for payment methods.
 573
 574 This only applies when payment method autofill is enabled for a particular Firefox version or region. See [this page](https://support.mozilla.org/kb/credit-card-autofill) for more information.
 575
 576 **Compatibility:** Firefox 125, Firefox ESR 115.10\
 577 **CCK2 Equivalent:** N/A\
 578 **Preferences Affected:** `extensions.formautofill.creditCards.enabled`
 579
 580 #### Windows (GPO)
 581 ```
 582 Software\Policies\Mozilla\Firefox\AutofillCreditCardEnabled = 0x1 | 0x0
 583 ```
 584 #### Windows (Intune)
 585 OMA-URI:
 586 ```
 587 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox/AutofillCreditCardEnabled
 588 ```
 589 Value (string):
 590 ```
 591 <enabled/> or <disabled/>
 592 ```
 593 #### macOS
 594 ```
 595 <dict>
 596   <key>AutofillCreditCardEnabled</key>
 597   <true/> | <false/>
 598 </dict>
 599 ```
 600 #### policies.json
 601 ```
 602 {
 603   "policies": {
 604     "AutofillCreditCardEnabled": true | false
 605   }
 606 }
 607 ```
 608 ### AutoLaunchProtocolsFromOrigins
 609 Define a list of external protocols that can be used from listed origins without prompting the user. The origin is the scheme plus the hostname.
 610
 611 The syntax of this policy is exactly the same as the [Chrome AutoLaunchProtocolsFromOrigins policy](https://cloud.google.com/docs/chrome-enterprise/policies/?policy=AutoLaunchProtocolsFromOrigins) except that you can only use valid origins (not just hostnames). This also means that you cannot specify an asterisk for all origins.
 612
 613 The schema is:
 614 ```
 615 {
 616  "items": {
 617   "properties": {
 618    "allowed_origins": {
 619     "items": {
 620      "type": "string"
 621     },
 622     "type": "array"
 623    },
 624    "protocol": {
 625     "type": "string"
 626    }
 627   },
 628   "required": [
 629    "protocol",
 630    "allowed_origins"
 631   ],
 632   "type": "object"
 633  },
 634  "type": "array"
 635 }
 636 ```
 637 **Compatibility:** Firefox 90, Firefox ESR 78.12\
 638 **CCK2 Equivalent:** N/A\
 639 **Preferences Affected:** N/A
 640
 641 #### Windows (GPO)
 642 Software\Policies\Mozilla\Firefox\AutoLaunchProtocolsFromOrigins (REG_MULTI_SZ) =
 643 ```
 644 [
 645   {
 646     "protocol": "zoommtg",
 647     "allowed_origins": [
 648       "https://somesite.zoom.us"
 649     ]
 650   }
 651 ]
 652 ```
 653 #### Windows (Intune)
 654 OMA-URI:
 655 ```
 656 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox/AutoLaunchProtocolsFromOrigins
 657 ```
 658 Value (string):
 659 ```
 660 <enabled/>
 661 <data id="JSON" value='
 662 [
 663   {
 664     "protocol": "zoommtg",
 665     "allowed_origins": [
 666       "https://somesite.zoom.us"
 667     ]
 668   }
 669 ]'/>
 670 ```
 671 If you are using custom ADMX and ADML administrative templates in Intune, you can use this OMA-URI instead
 672 to workaround the limit on the length of strings. Put all of your JSON on one line.
 673
 674 OMA-URI:
 675 ```
 676 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~Extensions/AutoLaunchProtocolsFromOriginsOneLine
 677 ```
 678 Value (string):
 679 ```
 680 <enabled/>
 681 <data id="JSONOneLine" value='[]'/>
 682 ```
 683 #### macOS
 684 ```
 685 <dict>
 686   <key>AutoLaunchProtocolsFromOrigins</key>
 687   <array>
 688     <dict>
 689       <key>protocol</key>
 690       <string>zoommtg</string>
 691       <key>allowed_origins</key>
 692       <array>
 693         <string>https://somesite.zoom.us</string>
 694       </array>
 695     </dict>
 696   </array>
 697 </dict>
 698 ```
 699 #### policies.json
 700 ```
 701 {
 702   "policies": {
 703     "AutoLaunchProtocolsFromOrigins": [{
 704       "protocol": "zoommtg",
 705       "allowed_origins": [
 706         "https://somesite.zoom.us"
 707       ]
 708     }]
 709   }
 710 }
 711 ```
 712 ### BackgroundAppUpdate
 713
 714 Enable or disable **automatic** application update **in the background**, when the application is not running.
 715
 716 If set to true, application updates may be installed (without user approval) in the background, even when the application is not running. The operating system might still require approval.
 717
 718 If set to false, the application will not try to install updates when the application is not running.
 719
 720 If you have disabled updates via `DisableAppUpdate` or disabled automatic updates via `AppAutoUpdate`, this policy has no effect.
 721
 722 If you are having trouble getting the background task to run, verify your configuration with the ["Requirements to run" section in this support document](https://support.mozilla.org/en-US/kb/enable-background-updates-firefox-windows).
 723
 724 **Compatibility:** Firefox 90 (Windows only)\
 725 **CCK2 Equivalent:** N/A\
 726 **Preferences Affected:** `app.update.background.enabled`
 727
 728 #### Windows (GPO)
 729 ```
 730 Software\Policies\Mozilla\Firefox\BackgroundAppUpdate = 0x1 | 0x0
 731 ```
 732 #### Windows (Intune)
 733 OMA-URI:
 734 ```
 735 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox/BackgroundAppUpdate
 736 ```
 737 Value (string):
 738 ```
 739 <enabled/> or <disabled/>
 740 ```
 741 #### macOS
 742 ```
 743 <dict>
 744   <key>BackgroundAppUpdate</key>
 745   <true/> | <false/>
 746 </dict>
 747 ```
 748 #### policies.json
 749 ```
 750 {
 751   "policies": {
 752     "BackgroundAppUpdate": true | false
 753   }
 754 }
 755 ```
 756 ### BlockAboutAddons
 757
 758 Block access to the Add-ons Manager (about:addons).
 759
 760 **Compatibility:** Firefox 60, Firefox ESR 60\
 761 **CCK2 Equivalent:** `disableAddonsManager`\
 762 **Preferences Affected:** N/A
 763
 764 #### Windows (GPO)
 765 ```
 766 Software\Policies\Mozilla\Firefox\BlockAboutAddons = 0x1 | 0x0
 767 ```
 768 #### Windows (Intune)
 769 OMA-URI:
 770 ```
 771 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox/BlockAboutAddons
 772 ```
 773 Value (string):
 774 ```
 775 <enabled/> or <disabled/>
 776 ```
 777 #### macOS
 778 ```
 779 <dict>
 780   <key>BlockAboutAddons</key>
 781   <true/> | <false/>
 782 </dict>
 783 ```
 784 #### policies.json
 785 ```
 786 {
 787   "policies": {
 788     "BlockAboutAddons": true | false
 789   }
 790 }
 791 ```
 792 ### BlockAboutConfig
 793
 794 Block access to about:config.
 795
 796 **Compatibility:** Firefox 60, Firefox ESR 60\
 797 **CCK2 Equivalent:** `disableAboutConfig`\
 798 **Preferences Affected:** N/A
 799
 800 #### Windows (GPO)
 801 ```
 802 Software\Policies\Mozilla\Firefox\BlockAboutConfig = 0x1 | 0x0
 803 ```
 804 #### Windows (Intune)
 805 OMA-URI:
 806 ```
 807 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox/BlockAboutConfig
 808 ```
 809 Value (string):
 810 ```
 811 <enabled/> or <disabled/>
 812 ```
 813 #### macOS
 814 ```
 815 <dict>
 816   <key>BlockAboutConfig</key>
 817   <true/> | <false/>
 818 </dict>
 819 ```
 820 #### policies.json
 821 ```
 822 {
 823   "policies": {
 824     "BlockAboutConfig": true | false
 825   }
 826 }
 827 ```
 828 ### BlockAboutProfiles
 829
 830 Block access to About Profiles (about:profiles).
 831
 832 **Compatibility:** Firefox 60, Firefox ESR 60\
 833 **CCK2 Equivalent:** `disableAboutProfiles`\
 834 **Preferences Affected:** N/A
 835
 836 #### Windows (GPO)
 837 ```
 838 Software\Policies\Mozilla\Firefox\BlockAboutProfiles = 0x1 | 0x0
 839 ```
 840 #### Windows (Intune)
 841 OMA-URI:
 842 ```
 843 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox/BlockAboutProfiles
 844 ```
 845 Value (string):
 846 ```
 847 <enabled/> or <disabled/>
 848 ```
 849 #### macOS
 850 ```
 851 <dict>
 852   <key>BlockAboutProfiles</key>
 853   <true/> | <false/>
 854 </dict>
 855 ```
 856 #### policies.json
 857 ```
 858 {
 859   "policies": {
 860     "BlockAboutProfiles": true | false
 861   }
 862 }
 863 ```
 864 ### BlockAboutSupport
 865
 866 Block access to Troubleshooting Information (about:support).
 867
 868 **Compatibility:** Firefox 60, Firefox ESR 60\
 869 **CCK2 Equivalent:** `disableAboutSupport`\
 870 **Preferences Affected:** N/A
 871
 872 #### Windows (GPO)
 873 ```
 874 Software\Policies\Mozilla\Firefox\BlockAboutSupport = 0x1 | 0x0
 875 ```
 876 #### Windows (Intune)
 877 OMA-URI:
 878 ```
 879 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox/BlockAboutSupport
 880 ```
 881 Value (string):
 882 ```
 883 <enabled/> or <disabled/>
 884 ```
 885 #### macOS
 886 ```
 887 <dict>
 888   <key>BlockAboutSupport</key>
 889   <true/> | <false/>
 890 </dict>
 891 ```
 892 #### policies.json
 893 ```
 894 {
 895   "policies": {
 896     "BlockAboutSupport": true | false
 897   }
 898 }
 899 ```
 900 ### Bookmarks
 901
 902 Note: [`ManagedBookmarks`](#managedbookmarks) is the new recommended way to add bookmarks. This policy will continue to be supported.
 903
 904 Add bookmarks in either the bookmarks toolbar or menu. Only `Title` and `URL` are required. If `Placement` is not specified, the bookmark will be placed on the toolbar. If `Folder` is specified, it is automatically created and bookmarks with the same folder name are grouped together.
 905
 906 If you want to clear all bookmarks set with this policy, you can set the value to an empty array (```[]```). This can be on Windows via the new Bookmarks (JSON) policy available with GPO and Intune.
 907
 908 **Compatibility:** Firefox 60, Firefox ESR 60\
 909 **CCK2 Equivalent:** `bookmarks.toolbar`,`bookmarks.menu`\
 910 **Preferences Affected:** N/A
 911
 912 #### Windows (GPO)
 913 ```
 914 Software\Policies\Mozilla\Firefox\Bookmarks\1\Title = "Example"
 915 Software\Policies\Mozilla\Firefox\Bookmarks\1\URL = "https://example.com"
 916 Software\Policies\Mozilla\Firefox\Bookmarks\1\Favicon = "https://example.com/favicon.ico"
 917 Software\Policies\Mozilla\Firefox\Bookmarks\1\Placement = "toolbar" | "menu"
 918 Software\Policies\Mozilla\Firefox\Bookmarks\1\Folder = "FolderName"
 919
 920 Software\Policies\Mozilla\Firefox\Bookmarks (REG_MULTI_SZ) =
 921 ```
 922 []
 923 ```
 924
 925 ```
 926 #### Windows (Intune)
 927 OMA-URI:
 928 ```
 929 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~Bookmarks/Bookmark01
 930 ```
 931 Value (string):
 932 ```
 933 <enabled/>
 934 <data id="BookmarkTitle" value="Example"/>
 935 <data id="BookmarkURL" value="https://example.com"/>
 936 <data id="BookmarkFavicon" value="https://example.com/favicon.ico"/>
 937 <data id="BookmarkPlacement" value="toolbar | menu"/>
 938 <data id="BookmarkFolder" value="FolderName"/>
 939 ```
 940 OMA-URI:
 941 ```
 942 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox/Bookmarks
 943 ```
 944 Value (string):
 945 ```
 946 <enabled/>
 947 <data id="JSON" value='[]'/>
 948 ```
 949 If you are using custom ADMX and ADML administrative templates in Intune, you can use this OMA-URI instead
 950 to workaround the limit on the length of strings. Put all of your JSON on one line.
 951
 952 OMA-URI:
 953 ```
 954 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~Extensions/BookmarksOneLine
 955 ```
 956 Value (string):
 957 ```
 958 <enabled/>
 959 <data id="JSONOneLine" value='[]'/>
 960 ```
 961 #### macOS
 962 ```
 963 <dict>
 964   <key>Bookmarks</key>
 965   <array>
 966     <dict>
 967       <key>Title</key>
 968       <string>Example</string>
 969       <key>URL</key>
 970       <string>https://example.com</string>
 971       <key>Favicon</key>
 972       <string>https://example.com/favicon.ico</string>
 973       <key>Placement</key>
 974       <string>toolbar | menu</string>
 975       <key>Folder</key>
 976       <string>FolderName</string>
 977     </dict>
 978   </array>
 979 </dict>
 980 ```
 981 #### policies.json
 982 ```
 983 {
 984   "policies": {
 985     "Bookmarks": [
 986       {
 987         "Title": "Example",
 988         "URL": "https://example.com",
 989         "Favicon": "https://example.com/favicon.ico",
 990         "Placement": "toolbar" | "menu",
 991         "Folder": "FolderName"
 992       }
 993     ]
 994   }
 995 }
 996 ```
 997 ### CaptivePortal
 998 Enable or disable the detection of captive portals.
 999
1000 **Compatibility:** Firefox 67, Firefox ESR 60.7\
1001 **CCK2 Equivalent:** N/A\
1002 **Preferences Affected:** `network.captive-portal-service.enabled`
1003
1004 #### Windows (GPO)
1005 ```
1006 Software\Policies\Mozilla\Firefox\CaptivePortal = 0x1 | 0x0
1007 ```
1008 #### Windows (Intune)
1009 OMA-URI:
1010 ```
1011 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox/CaptivePortal
1012 ```
1013 Value (string):
1014 ```
1015 <enabled/> or <disabled/>
1016 ```
1017 #### macOS
1018 ```
1019 <dict>
1020   <key>CaptivePortal</key>
1021   <true/> | <false/>
1022 </dict>
1023 ```
1024 #### policies.json
1025 ```
1026 {
1027   "policies": {
1028     "CaptivePortal": true | false
1029   }
1030 }
1031 ```
1032 ### Certificates
1033
1034 ### Certificates | ImportEnterpriseRoots
1035
1036 Trust certificates that have been added to the operating system certificate store by a user or administrator.
1037
1038 Note: This policy only works on Windows and macOS. For Linux discussion, see [bug 1600509](https://bugzilla.mozilla.org/show_bug.cgi?id=1600509).
1039
1040 See https://support.mozilla.org/kb/setting-certificate-authorities-firefox for more detail.
1041
1042 **Compatibility:** Firefox 60, Firefox ESR 60 (macOS support in Firefox 63, Firefox ESR 68)\
1043 **CCK2 Equivalent:** N/A\
1044 **Preferences Affected:** `security.enterprise_roots.enabled`
1045
1046 #### Windows (GPO)
1047 ```
1048 Software\Policies\Mozilla\Firefox\Certificates\ImportEnterpriseRoots = 0x1 | 0x0
1049 ```
1050 #### Windows (Intune)
1051 OMA-URI:
1052 ```
1053 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~Certificates/Certificates_ImportEnterpriseRoots
1054 ```
1055 Value (string):
1056 ```
1057 <enabled/> or <disabled/>
1058 ```
1059 #### macOS
1060 ```
1061 <dict>
1062   <key>Certificates</key>
1063   <dict>
1064     <key>ImportEnterpriseRoots</key>
1065     <true/> | <false/>
1066   </dict>
1067 </dict>
1068 ```
1069 #### policies.json
1070 ```
1071 {
1072   "policies": {
1073     "Certificates": {
1074       "ImportEnterpriseRoots": true | false
1075     }
1076   }
1077 }
1078 ```
1079 ### Certificates | Install
1080
1081 Install certificates into the Firefox certificate store. If only a filename is specified, Firefox searches for the file in the following locations:
1082
1083 - Windows
1084   - %USERPROFILE%\AppData\Local\Mozilla\Certificates
1085   - %USERPROFILE%\AppData\Roaming\Mozilla\Certificates
1086 - macOS
1087   - /Library/Application Support/Mozilla/Certificates
1088   - ~/Library/Application Support/Mozilla/Certificates
1089 - Linux
1090   - /usr/lib/mozilla/certificates
1091   - /usr/lib64/mozilla/certificates
1092   - ~/.mozilla/certificates
1093
1094 Starting with Firefox 65, Firefox 60.5 ESR, a fully qualified path can be used, including UNC paths. You should use the native path style for your operating system. We do not support using %USERPROFILE% or other environment variables on Windows.
1095
1096 If you are specifying the path in the policies.json file on Windows, you need to escape your backslashes (`\\`) which means that for UNC paths, you need to escape both (`\\\\`). If you use group policy, you only need one backslash.
1097
1098 Certificates are installed using the trust string `CT,CT,`.
1099
1100 Binary (DER) and ASCII (PEM) certificates are both supported.
1101
1102 **Compatibility:** Firefox 64, Firefox ESR 64\
1103 **CCK2 Equivalent:** `certs.ca`\
1104 **Preferences Affected:** N/A
1105
1106 #### Windows (GPO)
1107 ```
1108 Software\Policies\Mozilla\Firefox\Certificates\Install\1 = "cert1.der"
1109 Software\Policies\Mozilla\Firefox\Certificates\Install\2 = "C:\Users\username\cert2.pem"
1110 ```
1111 #### Windows (Intune)
1112 OMA-URI:
1113 ```
1114 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~Certificates/Certificates_Install
1115 ```
1116 Value (string):
1117 ```
1118 <enabled/>
1119 <data id="Certificates_Install" value="1&#xF000;cert1.der&#xF000;2&#xF000;C:\Users\username\cert2.pem"/>
1120 ```
1121 #### macOS
1122 ```
1123 <dict>
1124   <key>Certificates</key>
1125   <dict>
1126     <key>Install</key>
1127     <array>
1128       <string>cert1.der</string>
1129       <string>/Users/username/cert2.pem</string>
1130     </array>
1131   </dict>
1132 </dict>
1133 ```
1134 #### policies.json
1135 ```
1136 {
1137   "policies": {
1138     "Certificates": {
1139       "Install": ["cert1.der", "/home/username/cert2.pem"]
1140     }
1141   }
1142 }
1143 ```
1144 ### Containers
1145 Set policies related to [containers](https://addons.mozilla.org/firefox/addon/multi-account-containers/).
1146
1147 Currently you can set the initial set of containers.
1148
1149 For each container, you can specify the name, icon, and color.
1150
1151 | Name | Description |
1152 | --- | --- |
1153 | `name`| Name of container
1154 | `icon` | Can be `fingerprint`, `briefcase`, `dollar`, `cart`, `vacation`, `gift`, `food`, `fruit`, `pet`, `tree`, `chill`, `circle`, `fence`
1155 | `color` | Can be `blue`, `turquoise`, `green`, `yellow`, `orange`, `red`, `pink`, `purple`, `toolbar`
1156
1157 **Compatibility:** Firefox 113\
1158 **CCK2 Equivalent:** N/A\
1159 **Preferences Affected:** N/A
1160
1161 #### Windows (GPO)
1162 Software\Policies\Mozilla\Firefox\Containers (REG_MULTI_SZ) =
1163 ```
1164 {
1165   "Default": [
1166     {
1167       "name": "My container",
1168       "icon": "pet",
1169       "color": "turquoise"
1170     }
1171   ]
1172 }
1173 ```
1174 #### Windows (Intune)
1175 OMA-URI:
1176 ```
1177 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox/Containers
1178 ```
1179 Value (string):
1180 ```
1181 <enabled/>
1182 <data id="JSON" value='
1183 {
1184   "Default": [
1185     {
1186       "name": "My container",
1187       "icon": "pet",
1188       "color": "turquoise"
1189     }
1190   ]
1191 }
1192 '/>
1193 ```
1194 If you are using custom ADMX and ADML administrative templates in Intune, you can use this OMA-URI instead
1195 to workaround the limit on the length of strings. Put all of your JSON on one line.
1196
1197 OMA-URI:
1198 ```
1199 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~Extensions/ContainersOneLine
1200 ```
1201 Value (string):
1202 ```
1203 <enabled/>
1204 <data id="JSONOneLine" value='{}'/>
1205 ```
1206 #### macOS
1207 ```
1208 <dict>
1209   <key>Default</key>
1210   <dict>
1211     <key>Containers</key>
1212     <array>
1213       <dict>
1214         <key>name</key>
1215         <string>My container</string>
1216         <key>icon</key>
1217         <string>pet</string>
1218         <key>color</key>
1219         <string>turquoise</string>
1220       </dict>
1221     </array>
1222   </dict>
1223 </dict>
1224 ```
1225 #### policies.json
1226 ```
1227 {
1228   "policies": {
1229     "Containers": {
1230       "Default": [
1231         {
1232           "name": "My container",
1233           "icon": "pet",
1234           "color": "turquoise"
1235         }
1236       ]
1237     }
1238   }
1239 }
1240 ```
1241 ### Cookies
1242 Configure cookie preferences.
1243
1244 `Allow` is a list of origins (not domains) where cookies are always allowed. You must include http or https.
1245
1246 `AllowSession` is a list of origins (not domains) where cookies are only allowed for the current session. You must include http or https.
1247
1248 `Block` is a list of origins (not domains) where cookies are always blocked. You must include http or https.
1249
1250 `Behavior` sets the default behavior for cookies based on the values below.
1251
1252 `BehaviorPrivateBrowsing` sets the default behavior for cookies in private browsing based on the values below.
1253
1254 | Value | Description
1255 | --- | --- |
1256 | accept | Accept all cookies
1257 | reject-foreign | Reject third party cookies
1258 | reject | Reject all cookies
1259 | limit-foreign | Reject third party cookies for sites you haven't visited
1260 | reject-tracker | Reject cookies for known trackers (default)
1261 | reject-tracker-and-partition-foreign | Reject cookies for known trackers and partition third-party cookies (Total Cookie Protection) (default for private browsing)
1262
1263 `Locked` prevents the user from changing cookie preferences.
1264
1265 `Default` determines whether cookies are accepted at all. (*Deprecated*. Use `Behavior` instead)
1266
1267 `AcceptThirdParty` determines how third-party cookies are handled. (*Deprecated*. Use `Behavior` instead)
1268
1269 `RejectTracker` only rejects cookies for trackers. (*Deprecated*. Use `Behavior` instead)
1270
1271 `ExpireAtSessionEnd` determines when cookies expire. (*Deprecated*. Use [`SanitizeOnShutdown`](#sanitizeonshutdown-selective) instead)
1272
1273 **Compatibility:** Firefox 60, Firefox ESR 60 (RejectTracker added in Firefox 63, AllowSession added in Firefox 79/78.1, Behavior added in Firefox 95/91.4)\
1274 **CCK2 Equivalent:** N/A\
1275 **Preferences Affected:** `network.cookie.cookieBehavior`, `network.cookie.cookieBehavior.pbmode`, `network.cookie.lifetimePolicy`
1276
1277 #### Windows (GPO)
1278 ```
1279 Software\Policies\Mozilla\Firefox\Cookies\Allow\1 = "https://example.com"
1280 Software\Policies\Mozilla\Firefox\Cookies\AllowSession\1 = "https://example.edu"
1281 Software\Policies\Mozilla\Firefox\Cookies\Block\1 = "https://example.org"
1282 Software\Policies\Mozilla\Firefox\Cookies\Behavior = "accept" | "reject-foreign" | "reject" | "limit-foreign" | "reject-tracker" | "reject-tracker-and-partition-foreign"
1283 Software\Policies\Mozilla\Firefox\Cookies\BehaviorPrivateBrowsing = "accept" | "reject-foreign" | "reject" | "limit-foreign" | "reject-tracker" | "reject-tracker-and-partition-foreign"
1284 Software\Policies\Mozilla\Firefox\Cookies\Locked = 0x1 | 0x0
1285 ```
1286 #### Windows (Intune)
1287 OMA-URI:
1288 ```
1289 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~Cookies/Cookies_Allow
1290 ```
1291 Value (string):
1292 ```
1293 <enabled/>
1294 <data id="Permissions" value="1&#xF000;https://example.com"/>
1295 ```
1296 OMA-URI:
1297 ```
1298 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~Cookies/Cookies_AllowSession
1299 ```
1300 Value (string):
1301 ```
1302 <enabled/>
1303 <data id="Permissions" value="1&#xF000;https://example.edu"/>
1304 ```
1305 OMA-URI:
1306 ```
1307 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~Cookies/Cookies_Block
1308 ```
1309 Value (string):
1310 ```
1311 <enabled/>
1312 <data id="Permissions" value="1&#xF000;https://example.org"/>
1313 ```
1314 OMA-URI:
1315 ```
1316 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~Cookies/Cookies_Locked
1317 ```
1318 Value (string):
1319 ```
1320 <enabled/> or <disabled/>
1321 ```
1322 OMA-URI:
1323 ```
1324 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~Cookies/Cookies_Behavior
1325 ```
1326 Value (string):
1327 ```
1328 <enabled/>
1329 <data id="Cookies_Behavior" value="accept | reject-foreign | reject | limit-foreign | reject-tracker | reject-tracker-and-partition-foreign"/>
1330 ```
1331 OMA-URI:
1332 ```
1333 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~Cookies/Cookies_BehaviorPrivateBrowsing
1334 ```
1335 Value (string):
1336 ```
1337 <enabled/>
1338 <data id="Cookies_BehaviorPrivateBrowsing" value="accept | reject-foreign | reject | limit-foreign | reject-tracker | reject-tracker-and-partition-foreign"/>
1339 ```
1340 #### macOS
1341 ```
1342 <dict>
1343   <key>Cookies</key>
1344   <dict>
1345     <key>Allow</key>
1346     <array>
1347       <string>http://example.com</string>
1348     </array>
1349     <key>AllowSession</key>
1350     <array>
1351       <string>http://example.edu</string>
1352     </array>
1353     <key>Block</key>
1354     <array>
1355       <string>http://example.org</string>
1356     </array>
1357     <key>Locked</key>
1358     <true/> | <false/>
1359     <key>Behavior</key>
1360     <string>accept | reject-foreign | reject | limit-foreign | reject-tracker | reject-tracker-and-partition-foreign</string>
1361     <key>BehaviorPrivateBrowsing</key>
1362     <string>accept | reject-foreign | reject | limit-foreign | reject-tracker | reject-tracker-and-partition-foreign</string>
1363   </dict>
1364 </dict>
1365 ```
1366 #### policies.json
1367 ```
1368 {
1369   "policies": {
1370     "Cookies": {
1371       "Allow": ["http://example.org/"],
1372       "AllowSession": ["http://example.edu/"],
1373       "Block": ["http://example.edu/"],
1374       "Locked": true | false,
1375       "Behavior": "accept" | "reject-foreign" | "reject" | "limit-foreign" | "reject-tracker" | "reject-tracker-and-partition-foreign",
1376       "BehaviorPrivateBrowsing": "accept" | "reject-foreign" | "reject" | "limit-foreign" | "reject-tracker" | "reject-tracker-and-partition-foreign",
1377     }
1378   }
1379 }
1380 ```
1381 ### DefaultDownloadDirectory
1382 Set the default download directory.
1383
1384 You can use ${home} for the native home directory.
1385
1386 **Compatibility:** Firefox 68, Firefox ESR 68\
1387 **CCK2 Equivalent:** N/A\
1388 **Preferences Affected:** `browser.download.dir`, `browser.download.folderList`
1389
1390 #### Windows (GPO)
1391 ```
1392 Software\Policies\Mozilla\Firefox\DefaultDownloadDirectory = "${home}\Downloads"
1393 ```
1394 #### Windows (Intune)
1395 OMA-URI:
1396 ```
1397 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox/DefaultDownloadDirectory
1398 ```
1399 Value (string):
1400 ```
1401 <enabled/>
1402 <data id="Preferences_String" value="${home}\Downloads"/>
1403 ```
1404 #### macOS
1405 ```
1406 <dict>
1407   <key>DefaultDownloadDirectory</key>
1408   <string>${home}/Downloads</string>
1409 </dict>
1410 ```
1411 #### policies.json (macOS and Linux)
1412 ```
1413 {
1414   "policies": {
1415     "DefaultDownloadDirectory": "${home}/Downloads"
1416   }
1417 }
1418 ```
1419 #### policies.json (Windows)
1420 ```
1421 {
1422   "policies": {
1423     "DefaultDownloadDirectory": "${home}\\Downloads"
1424   }
1425 }
1426 ```
1427 ### DisableAppUpdate
1428 Turn off application updates within Firefox.
1429
1430 **Compatibility:** Firefox 60, Firefox ESR 60\
1431 **CCK2 Equivalent:** `disableFirefoxUpdates`\
1432 **Preferences Affected:** N/A
1433
1434 #### Windows (GPO)
1435 ```
1436 Software\Policies\Mozilla\Firefox\DisableAppUpdate = 0x1 | 0x0
1437 ```
1438 #### Windows (Intune)
1439 OMA-URI:
1440 ```
1441 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox/DisableAppUpdate
1442 ```
1443 Value (string):
1444 ```
1445 <enabled/> or <disabled/>
1446 ```
1447 #### macOS
1448 ```
1449 <dict>
1450   <key>DisableAppUpdate</key>
1451   <true/> | <false/>
1452 </dict>
1453 ```
1454 #### policies.json
1455 ```
1456 {
1457   "policies": {
1458     "DisableAppUpdate": true | false
1459   }
1460 }
1461 ```
1462 ### DisableBuiltinPDFViewer
1463 Disable the built in PDF viewer. PDF files are downloaded and sent externally.
1464
1465 **Compatibility:** Firefox 60, Firefox ESR 60\
1466 **CCK2 Equivalent:** `disablePDFjs`\
1467 **Preferences Affected:** `pdfjs.disabled`
1468
1469 #### Windows (GPO)
1470 ```
1471 Software\Policies\Mozilla\Firefox\DisableBuiltinPDFViewer = 0x1 | 0x0
1472 ```
1473 #### Windows (Intune)
1474 OMA-URI:
1475 ```
1476 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox/DisableBuiltinPDFViewer
1477 ```
1478 Value (string):
1479 ```
1480 <enabled/> or <disabled/>
1481 ```
1482 #### macOS
1483 ```
1484 <dict>
1485   <key>DisableBuiltinPDFViewer</key>
1486   <true/> | <false/>
1487 </dict>
1488 ```
1489 #### policies.json
1490 ```
1491 {
1492   "policies": {
1493     "DisableBuiltinPDFViewer": true | false
1494   }
1495 }
1496 ```
1497 ### DisabledCiphers
1498 Disable specific cryptographic ciphers, listed below.
1499
1500 ```
1501 TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256
1502 TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256
1503 TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256
1504 TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256
1505 TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384
1506 TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384
1507 TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA
1508 TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA
1509 TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA
1510 TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA
1511 TLS_DHE_RSA_WITH_AES_128_CBC_SHA
1512 TLS_DHE_RSA_WITH_AES_256_CBC_SHA
1513 TLS_RSA_WITH_AES_128_GCM_SHA256
1514 TLS_RSA_WITH_AES_256_GCM_SHA384
1515 TLS_RSA_WITH_AES_128_CBC_SHA
1516 TLS_RSA_WITH_AES_256_CBC_SHA
1517 TLS_RSA_WITH_3DES_EDE_CBC_SHA
1518 ```
1519
1520 **Preferences Affected:** `security.ssl3.ecdhe_rsa_aes_128_gcm_sha256`, `security.ssl3.ecdhe_ecdsa_aes_128_gcm_sha256`, `security.ssl3.ecdhe_ecdsa_chacha20_poly1305_sha256`, `security.ssl3.ecdhe_rsa_chacha20_poly1305_sha256`, `security.ssl3.ecdhe_ecdsa_aes_256_gcm_sha384`, `security.ssl3.ecdhe_rsa_aes_256_gcm_sha384`, `security.ssl3.ecdhe_rsa_aes_128_sha`, `security.ssl3.ecdhe_ecdsa_aes_128_sha`, `security.ssl3.ecdhe_rsa_aes_256_sha`, `security.ssl3.ecdhe_ecdsa_aes_256_sha`, `security.ssl3.dhe_rsa_aes_128_sha`, `security.ssl3.dhe_rsa_aes_256_sha`, `security.ssl3.rsa_aes_128_gcm_sha256`, `security.ssl3.rsa_aes_256_gcm_sha384`, `security.ssl3.rsa_aes_128_sha`, `security.ssl3.rsa_aes_256_sha`, `security.ssl3.deprecated.rsa_des_ede3_sha`
1521
1522 ---
1523 **Note:**
1524
1525 This policy was updated in Firefox 78 to allow enabling ciphers as well. Setting the value to true disables the cipher, setting the value to false enables the cipher. Previously setting the value to true or false disabled the cipher.
1526
1527 ---
1528 **Compatibility:** Firefox 76, Firefox ESR 68.8 (TLS_RSA_WITH_AES_128_GCM_SHA256 and TLS_RSA_WITH_AES_256_GCM_SHA384 were added in Firefox 78, TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA, TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA, TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA38, TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256, TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384, and TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256 were added in Firefox 97 and Firefox 91.6)\
1529 **CCK2 Equivalent:** N/A\
1530 **Preferences Affected:** N/A
1531
1532 #### Windows (GPO)
1533 ```
1534 Software\Policies\Mozilla\Firefox\DisabledCiphers\CIPHER_NAME = 0x1 | 0x0
1535 ```
1536 #### Windows (Intune)
1537 OMA-URI:
1538 ```
1539 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~DisabledCiphers/DisabledCiphers_CIPHER_NAME
1540
1541 ```
1542 Value (string):
1543 ```
1544 <enabled/> or <disabled/>
1545 ```
1546 #### macOS
1547 ```
1548 <dict>
1549   <key>DisabledCiphers</key>
1550     <dict>
1551       <key>CIPHER_NAME</key>
1552       <true/> | <false/>
1553     </dict>
1554 </dict>
1555 ```
1556 #### policies.json
1557 ```
1558 {
1559   "policies": {
1560     "DisabledCiphers": {
1561       "CIPHER_NAME": true | false,
1562     }
1563   }
1564 }
1565 ```
1566 ### DisableDefaultBrowserAgent
1567 Prevent the default browser agent from taking any actions. Only applicable to Windows; other platforms don’t have the agent.
1568
1569 The browser agent is a Windows-only scheduled task which runs in the background to collect and submit data about the browser that the user has set as their OS default. More information is available [here](https://firefox-source-docs.mozilla.org/toolkit/mozapps/defaultagent/default-browser-agent/index.html).
1570
1571 **Compatibility:** Firefox 75, Firefox ESR 68.7 (Windows only)\
1572 **CCK2 Equivalent:** N/A\
1573 **Preferences Affected:** N/A
1574
1575 #### Windows (GPO)
1576 ```
1577 Software\Policies\Mozilla\Firefox\DisableDefaultBrowserAgent = 0x1 | 0x0
1578 ```
1579 #### Windows (Intune)
1580 OMA-URI:
1581 ```
1582 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox/DisableDefaultBrowserAgent
1583 ```
1584 Value (string):
1585 ```
1586 <enabled/> or <disabled/>
1587 ```
1588 #### policies.json
1589 ```
1590 {
1591   "policies": {
1592     "DisableDefaultBrowserAgent": true | false
1593   }
1594 }
1595 ```
1596 ### DisableDeveloperTools
1597 Remove access to all developer tools.
1598
1599 **Compatibility:** Firefox 60, Firefox ESR 60\
1600 **CCK2 Equivalent:** `removeDeveloperTools`\
1601 **Preferences Affected:** `devtools.policy.disabled`
1602
1603 #### Windows (GPO)
1604 ```
1605 Software\Policies\Mozilla\Firefox\DisableDeveloperTools = 0x1 | 0x0`
1606 ```
1607 #### Windows (Intune)
1608 OMA-URI:
1609 ```
1610 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox/DisableDeveloperTools
1611 ```
1612 Value (string):
1613 ```
1614 <enabled/> or <disabled/>
1615 ```
1616 #### macOS
1617 ```
1618 <dict>
1619   <key>DisableDeveloperTools</key>
1620   <true/> | <false/>
1621 </dict>
1622 ```
1623 #### policies.json
1624 ```
1625 {
1626   "policies": {
1627     "DisableDeveloperTools": true | false
1628   }
1629 }
1630 ```
1631 ### DisableFeedbackCommands
1632 Disable the menus for reporting sites (Submit Feedback, Report Deceptive Site).
1633
1634 **Compatibility:** Firefox 60, Firefox ESR 60\
1635 **CCK2 Equivalent:** N/A\
1636 **Preferences Affected:** N/A
1637
1638 #### Windows (GPO)
1639 ```
1640 Software\Policies\Mozilla\Firefox\DisableFeedbackCommands = 0x1 | 0x0
1641 ```
1642 #### Windows (Intune)
1643 OMA-URI:
1644 ```
1645 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox/DisableFeedbackCommands
1646 ```
1647 Value (string):
1648 ```
1649 <enabled/> or <disabled/>
1650 ```
1651 #### macOS
1652 ```
1653 <dict>
1654   <key>DisableFeedbackCommands</key>
1655   <true/> | <false/>
1656 </dict>
1657 ```
1658 #### policies.json
1659 ```
1660 {
1661   "policies": {
1662     "DisableFeedbackCommands": true | false
1663   }
1664 }
1665 ```
1666 ### DisableEncryptedClientHello
1667 Disable the TLS Feature for Encrypted Client Hello. Note that TLS Client Hellos will still contain an ECH extension, but this extension will not be used by Firefox during the TLS handshake.
1668
1669 **Compatibility:** Firefox 127, Firefox ESR 128\
1670 **CCK2 Equivalent:** N/A\
1671 **Preferences Affected:** `network.dns.echconfig.enabled`, `network.dns.http3_echconfig.enabled`
1672
1673 #### Windows (GPO)
1674 ```
1675 Software\Policies\Mozilla\Firefox\DisableEncryptedClientHello = 0x1 | 0x0
1676 ```
1677 #### Windows (Intune)
1678 OMA-URI:
1679 ```
1680 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox/DisableEncryptedClientHello
1681 ```
1682 Value (string):
1683 ```
1684 <enabled/> or <disabled/>
1685 ```
1686 #### macOS
1687 ```
1688 <dict>
1689   <key>DisableEncryptedClientHello</key>
1690   <true/> | <false/>
1691 </dict>
1692 ```
1693 #### policies.json
1694 ```
1695 {
1696   "policies": {
1697     "DisableEncryptedClientHello": true | false
1698   }
1699 }
1700 ```
1701 ### DisableFirefoxAccounts
1702 Disable Firefox Accounts integration (Sync).
1703
1704 **Compatibility:** Firefox 60, Firefox ESR 60\
1705 **CCK2 Equivalent:** `disableSync`\
1706 **Preferences Affected:** `identity.fxaccounts.enabled`
1707
1708 #### Windows (GPO)
1709 ```
1710 Software\Policies\Mozilla\Firefox\DisableFirefoxAccounts = 0x1 | 0x0
1711 ```
1712 #### Windows (Intune)
1713 OMA-URI:
1714 ```
1715 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox/DisableFirefoxAccounts
1716 ```
1717 Value (string):
1718 ```
1719 <enabled/> or <disabled/>
1720 ```
1721 #### macOS
1722 ```
1723 <dict>
1724   <key>DisableFirefoxAccounts</key>
1725   <true/> | <false/>
1726 </dict>
1727 ```
1728 #### policies.json
1729 ```
1730 {
1731   "policies": {
1732     "DisableFirefoxAccounts": true | false
1733   }
1734 }
1735 ```
1736 ### DisableFirefoxScreenshots
1737 Remove access to Firefox Screenshots.
1738
1739 **Compatibility:** Firefox 60, Firefox ESR 60\
1740 **CCK2 Equivalent:** N/A\
1741 **Preferences Affected:** `extensions.screenshots.disabled`
1742
1743 #### Windows (GPO)
1744 ```
1745 Software\Policies\Mozilla\Firefox\DisableFirefoxScreenshots = 0x1 | 0x0
1746 ```
1747 #### Windows (Intune)
1748 OMA-URI:
1749 ```
1750 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox/DisableFirefoxScreenshots
1751 ```
1752 Value (string):
1753 ```
1754 <enabled/> or <disabled/>
1755 ```
1756 #### macOS
1757 ```
1758 <dict>
1759   <key>DisableFirefoxScreenshots</key>
1760   <true/> | <false/>
1761 </dict>
1762 ```
1763 #### policies.json
1764 ```
1765 {
1766   "policies": {
1767     "DisableFirefoxScreenshots": true | false
1768   }
1769 }
1770 ```
1771 ### DisableFirefoxStudies
1772 Disable Firefox studies (Shield).
1773
1774 **Compatibility:** Firefox 60, Firefox ESR 60\
1775 **CCK2 Equivalent:** N/A\
1776 **Preferences Affected:** `browser.newtabpage.activity-stream.asrouter.userprefs.cfr.addons`, `browser.newtabpage.activity-stream.asrouter.userprefs.cfr.features`
1777
1778 #### Windows (GPO)
1779 ```
1780 Software\Policies\Mozilla\Firefox\DisableFirefoxStudies = 0x1 | 0x0
1781 ```
1782 #### Windows (Intune)
1783 OMA-URI:
1784 ```
1785 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox/DisableFirefoxStudies
1786 ```
1787 Value (string):
1788 ```
1789 <enabled/> or <disabled/>
1790 ```
1791 #### macOS
1792 ```
1793 <dict>
1794   <key>DisableFirefoxStudies</key>
1795   <true/> | <false/>
1796 </dict>
1797 ```
1798 #### policies.json
1799 ```
1800 {
1801   "policies": {
1802     "DisableFirefoxStudies": true | false
1803   }
1804 }
1805 ```
1806 ### DisableForgetButton
1807 Disable the "Forget" button.
1808
1809 **Compatibility:** Firefox 60, Firefox ESR 60\
1810 **CCK2 Equivalent:** `disableForget`\
1811 **Preferences Affected:** N/A
1812
1813 #### Windows (GPO)
1814 ```
1815 Software\Policies\Mozilla\Firefox\DisableForgetButton = 0x1 | 0x0
1816 ```
1817 #### Windows (Intune)
1818 OMA-URI:
1819 ```
1820 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox/DisableForgetButton
1821 ```
1822 Value (string):
1823 ```
1824 <enabled/> or <disabled/>
1825 ```
1826 #### macOS
1827 ```
1828 <dict>
1829   <key>DisableForgetButton</key>
1830   <true/> | <false/>
1831 </dict>
1832 ```
1833 #### policies.json
1834 ```
1835 {
1836   "policies": {
1837     "DisableForgetButton": true | false
1838   }
1839 }
1840 ```
1841 ### DisableFormHistory
1842 Turn off saving information on web forms and the search bar.
1843
1844 **Compatibility:** Firefox 60, Firefox ESR 60\
1845 **CCK2 Equivalent:** `disableFormFill`\
1846 **Preferences Affected:** `browser.formfill.enable`
1847
1848 #### Windows (GPO)
1849 ```
1850 Software\Policies\Mozilla\Firefox\DisableFormHistory = 0x1 | 0x0
1851 ```
1852 #### Windows (Intune)
1853 OMA-URI:
1854 ```
1855 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox/DisableFormHistory
1856 ```
1857 Value (string):
1858 ```
1859 <enabled/> or <disabled/>
1860 ```
1861 #### macOS
1862 ```
1863 <dict>
1864   <key>DisableFormHistory</key>
1865   <true/> | <false/>
1866 </dict>
1867 ```
1868 #### policies.json
1869 ```
1870 {
1871   "policies": {
1872     "DisableFormHistory": true | false
1873   }
1874 }
1875 ```
1876 ### DisableMasterPasswordCreation
1877 Remove the master password functionality.
1878
1879 If this value is true, it works the same as setting [`PrimaryPassword`](#primarypassword) to false and removes the primary password functionality.
1880
1881 If both `DisableMasterPasswordCreation` and `PrimaryPassword` are used, `DisableMasterPasswordCreation` takes precedent.
1882
1883 **Compatibility:** Firefox 60, Firefox ESR 60\
1884 **CCK2 Equivalent:** `noMasterPassword`\
1885 **Preferences Affected:** N/A
1886
1887 #### Windows (GPO)
1888 ```
1889 Software\Policies\Mozilla\Firefox\DisableMasterPasswordCreation = 0x1 | 0x0
1890 ```
1891 #### Windows (Intune)
1892 OMA-URI:
1893 ```
1894 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox/DisableMasterPasswordCreation
1895 ```
1896 Value (string):
1897 ```
1898 <enabled/> or <disabled/>
1899 ```
1900 #### macOS
1901 ```
1902 <dict>
1903   <key>DisableMasterPasswordCreation</key>
1904   <true/> | <false/>
1905 </dict>
1906 ```
1907 #### policies.json
1908 ```
1909 {
1910   "policies": {
1911     "DisableMasterPasswordCreation": true | false
1912   }
1913 }
1914 ```
1915 ### DisablePasswordReveal
1916 Do not allow passwords to be shown in saved logins
1917
1918 **Compatibility:** Firefox 71, Firefox ESR 68.3\
1919 **CCK2 Equivalent:** N/A
1920 **Preferences Affected:** N/A
1921
1922 #### Windows (GPO)
1923 ```
1924 Software\Policies\Mozilla\Firefox\DisablePasswordReveal = 0x1 | 0x0
1925 ```
1926 #### Windows (Intune)
1927 OMA-URI:
1928 ```
1929 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox/DisablePasswordReveal
1930 ```
1931 Value (string):
1932 ```
1933 <enabled/> or <disabled/>
1934 ```
1935 #### macOS
1936 ```
1937 <dict>
1938   <key>DisablePasswordReveal</key>
1939   <true/> | <false/>
1940 </dict>
1941 ```
1942 #### policies.json
1943 ```
1944 {
1945   "policies": {
1946     "DisablePasswordReveal": true | false
1947   }
1948 }
1949 ```
1950 ### DisablePocket
1951 Remove Pocket in the Firefox UI. It does not remove it from the new tab page.
1952
1953 **Compatibility:** Firefox 60, Firefox ESR 60\
1954 **CCK2 Equivalent:** `disablePocket`\
1955 **Preferences Affected:** `extensions.pocket.enabled`
1956
1957 #### Windows (GPO)
1958 ```
1959 Software\Policies\Mozilla\Firefox\DisablePocket = 0x1 | 0x0
1960 ```
1961 #### Windows (Intune)
1962 OMA-URI:
1963 ```
1964 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox/DisablePocket
1965 ```
1966 Value (string):
1967 ```
1968 <enabled/> or <disabled/>
1969 ```
1970 #### macOS
1971 ```
1972 <dict>
1973   <key>DisablePocket</key>
1974   <true/> | <false/>
1975 </dict>
1976 ```
1977 #### policies.json
1978 ```
1979 {
1980   "policies": {
1981     "DisablePocket": true | false
1982   }
1983 }
1984 ```
1985 ### DisablePrivateBrowsing
1986 Remove access to private browsing.
1987
1988 **Compatibility:** Firefox 60, Firefox ESR 60\
1989 **CCK2 Equivalent:** `disablePrivateBrowsing`\
1990 **Preferences Affected:** N/A
1991
1992 #### Windows (GPO)
1993 ```
1994 Software\Policies\Mozilla\Firefox\DisablePrivateBrowsing = 0x1 | 0x0
1995 ```
1996 #### Windows (Intune)
1997 OMA-URI:
1998 ```
1999 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox/DisablePrivateBrowsing
2000 ```
2001 Value (string):
2002 ```
2003 <enabled/> or <disabled/>
2004 ```
2005 #### macOS
2006 ```
2007 <dict>
2008   <key>DisablePrivateBrowsing</key>
2009   <true/> | <false/>
2010 </dict>
2011 ```
2012 #### policies.json
2013 ```
2014 {
2015   "policies": {
2016     "DisablePrivateBrowsing": true | false
2017   }
2018 }
2019 ```
2020 ### DisableProfileImport
2021 Disables the "Import data from another browser" option in the bookmarks window.
2022
2023 **Compatibility:** Firefox 60, Firefox ESR 60\
2024 **CCK2 Equivalent:** N/A\
2025 **Preferences Affected:** N/A
2026
2027 #### Windows (GPO)
2028 ```
2029 Software\Policies\Mozilla\Firefox\DisableProfileImport = 0x1 | 0x0
2030 ```
2031 #### Windows (Intune)
2032 OMA-URI:
2033 ```
2034 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox/DisableProfileImport
2035 ```
2036 Value (string):
2037 ```
2038 <enabled/> or <disabled/>
2039 ```
2040 #### macOS
2041 ```
2042 <dict>
2043   <key>DisableProfileImport</key>
2044   <true/> | <false/>
2045 </dict>
2046 ```
2047 #### policies.json
2048 ```
2049 {
2050   "policies": {
2051     "DisableProfileImport": true | false
2052   }
2053 }
2054 ```
2055 ### DisableProfileRefresh
2056 Disable the Refresh Firefox button on about:support and support.mozilla.org, as well as the prompt that displays offering to refresh Firefox when you haven't used it in a while.
2057
2058 **Compatibility:** Firefox 60, Firefox ESR 60\
2059 **CCK2 Equivalent:** `disableResetFirefox`\
2060 **Preferences Affected:** `browser.disableResetPrompt`
2061
2062 #### Windows (GPO)
2063 ```
2064 Software\Policies\Mozilla\Firefox\DisableProfileRefresh = 0x1 | 0x0
2065 ```
2066 #### Windows (Intune)
2067 OMA-URI:
2068 ```
2069 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox/DisableProfileRefresh
2070 ```
2071 Value (string):
2072 ```
2073 <enabled/> or <disabled/>
2074 ```
2075 #### macOS
2076 ```
2077 <dict>
2078   <key>DisableProfileRefresh</key>
2079   <true/> | <false/>
2080 </dict>
2081 ```
2082 #### policies.json
2083 ```
2084 {
2085   "policies": {
2086     "DisableProfileRefresh": true | false
2087   }
2088 }
2089 ```
2090 ### DisableSafeMode
2091 Disable safe mode within the browser.
2092
2093 On Windows, this disables safe mode via the command line as well.
2094
2095 **Compatibility:** Firefox 60, Firefox ESR 60 (Windows, macOS)\
2096 **CCK2 Equivalent:** `disableSafeMode`\
2097 **Preferences Affected:** N/A
2098
2099 #### Windows (GPO)
2100 ```
2101 Software\Policies\Mozilla\Firefox\DisableSafeMode = 0x1 | 0x0
2102 ```
2103 #### Windows (Intune)
2104 OMA-URI:
2105 ```
2106 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox/DisableSafeMode
2107 ```
2108 Value (string):
2109 ```
2110 <enabled/> or <disabled/>
2111 ```
2112 #### macOS
2113 ```
2114 <dict>
2115   <key>DisableSafeMode</key>
2116   <true/> | <false/>
2117 </dict>
2118 ```
2119 #### policies.json
2120 ```
2121 {
2122   "policies": {
2123     "DisableSafeMode": true | false
2124   }
2125 }
2126 ```
2127 ### DisableSecurityBypass
2128 Prevent the user from bypassing security in certain cases.
2129
2130 `InvalidCertificate` prevents adding an exception when an invalid certificate is shown.
2131
2132 `SafeBrowsing` prevents selecting "ignore the risk" and visiting a harmful site anyway.
2133
2134 These policies only affect what happens when an error is shown, they do not affect any settings in preferences.
2135
2136 **Compatibility:** Firefox 60, Firefox ESR 60\
2137 **CCK2 Equivalent:** N/A\
2138 **Preferences Affected:** `security.certerror.hideAddException`, `browser.safebrowsing.allowOverride`
2139
2140 #### Windows (GPO)
2141 ```
2142 Software\Policies\Mozilla\Firefox\DisableSecurityBypass\InvalidCertificate = 0x1 | 0x0
2143 Software\Policies\Mozilla\Firefox\DisableSecurityBypass\SafeBrowsing = 0x1 | 0x0
2144 ```
2145 #### Windows (Intune)
2146 OMA-URI:
2147 ```
2148 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox/P_DisableSecurityBypass_InvalidCertificate
2149 ```
2150 Value (string):
2151 ```
2152 <enabled/> or <disabled/>
2153 ```
2154 OMA-URI:
2155 ```
2156 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox/P_DisableSecurityBypass_SafeBrowsing
2157 ```
2158 Value (string):
2159 ```
2160 <enabled/> or <disabled/>
2161 ```
2162
2163 #### macOS
2164 ```
2165 <dict>
2166   <key>DisableSecurityBypass</key>
2167   <dict>
2168     <key>InvalidCertificate</key>
2169     <true/> | <false/>
2170     <key>SafeBrowsing</key>
2171     <true/> | <false/>
2172   </dict>
2173 </dict>
2174 ```
2175 #### policies.json
2176 ```
2177 {
2178   "policies": {
2179     "DisableSecurityBypass": {
2180       "InvalidCertificate": true | false,
2181       "SafeBrowsing": true | false
2182     }
2183   }
2184 }
2185 ```
2186 ### DisableSetDesktopBackground
2187 Remove the "Set As Desktop Background..." menuitem when right clicking on an image.
2188
2189 **Compatibility:** Firefox 60, Firefox ESR 60\
2190 **CCK2 Equivalent:** `removeSetDesktopBackground`\
2191 **Preferences Affected:** N/A
2192
2193 #### Windows (GPO)
2194 ```
2195 Software\Policies\Mozilla\Firefox\DisableSetDesktopBackground = 0x1 | 0x0
2196 ```
2197 #### Windows (Intune)
2198 OMA-URI:
2199 ```
2200 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox/DisableSetDesktopBackground
2201 ```
2202 Value (string):
2203 ```
2204 <enabled/> or <disabled/>
2205 ```
2206 #### macOS
2207 ```
2208 <dict>
2209   <key>DisableSetDesktopBackground</key>
2210   <true/> | <false/>
2211 </dict>
2212 ```
2213 #### policies.json
2214 ```
2215 {
2216   "policies": {
2217     "DisableSetDesktopBackground": true | false
2218   }
2219 }
2220 ```
2221 ### DisableSystemAddonUpdate
2222 Prevent system add-ons from being installed or updated.
2223
2224 **Compatibility:** Firefox 60, Firefox ESR 60\
2225 **CCK2 Equivalent:** N/A\
2226 **Preferences Affected:** N/A
2227
2228 #### Windows (GPO)
2229 ```
2230 Software\Policies\Mozilla\Firefox\DisableSystemAddonUpdate = 0x1 | 0x0
2231 ```
2232 #### Windows (Intune)
2233 OMA-URI:
2234 ```
2235 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox/DisableSystemAddonUpdate
2236 ```
2237 Value (string):
2238 ```
2239 <enabled/> or <disabled/>
2240 ```
2241 #### macOS
2242 ```
2243 <dict>
2244   <key>DisableSystemAddonUpdate</key>
2245   <true/> | <false/>
2246 </dict>
2247 ```
2248 #### policies.json
2249 ```
2250 {
2251   "policies": {
2252     "DisableSystemAddonUpdate": true | false
2253   }
2254 }
2255 ```
2256 ### DisableTelemetry
2257 Prevent the upload of telemetry data.
2258
2259 As of Firefox 83 and Firefox ESR 78.5, local storage of telemetry data is disabled as well.
2260
2261 Mozilla recommends that you do not disable telemetry. Information collected through telemetry helps us build a better product for businesses like yours.
2262
2263 **Compatibility:** Firefox 60, Firefox ESR 60\
2264 **CCK2 Equivalent:** `disableTelemetry`\
2265 **Preferences Affected:** `datareporting.healthreport.uploadEnabled`, `datareporting.policy.dataSubmissionEnabled`, `toolkit.telemetry.archive.enabled`
2266
2267 #### Windows (GPO)
2268 ```
2269 Software\Policies\Mozilla\Firefox\DisableTelemetry = 0x1 | 0x0
2270 ```
2271 #### Windows (Intune)
2272 OMA-URI:
2273 ```
2274 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox/DisableTelemetry
2275 ```
2276 Value (string):
2277 ```
2278 <enabled/> or <disabled/>
2279 ```
2280 #### macOS
2281 ```
2282 <dict>
2283   <key>DisableTelemetry</key>
2284   <true/> | <false/>
2285 </dict>
2286 ```
2287 #### policies.json
2288 ```
2289 {
2290   "policies": {
2291     "DisableTelemetry": true | false
2292   }
2293 }
2294 ```
2295 ### DisableThirdPartyModuleBlocking
2296 Do not allow blocking third-party modules from the `about:third-party` page.
2297
2298 This policy only works on Windows through GPO (not policies.json).
2299
2300 **Compatibility:** Firefox 110 (Windows only, GPO only)\
2301 **CCK2 Equivalent:** N/A\
2302 **Preferences Affected:** N/A
2303
2304 #### Windows (GPO)
2305 ```
2306 Software\Policies\Mozilla\Firefox\DisableThirdPartyModuleBlocking = = 0x1 | 0x0
2307 ```
2308 #### Windows (Intune)
2309 OMA-URI:
2310 ```
2311 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox/DisableThirdPartyModuleBlocking
2312 ```
2313 Value (string):
2314 ```
2315 <enabled/> or <disabled/>
2316 ```
2317 ### DisplayBookmarksToolbar
2318 Set the initial state of the bookmarks toolbar. A user can still change how it is displayed.
2319
2320 `always` means the bookmarks toolbar is always shown.
2321
2322 `never` means the bookmarks toolbar is not shown.
2323
2324 `newtab` means the bookmarks toolbar is only shown on the new tab page.
2325
2326 **Compatibility:** Firefox 109, Firefox ESR 102.7\
2327 **CCK2 Equivalent:** N/A\
2328 **Preferences Affected:** N/A
2329
2330 #### Windows (GPO)
2331 ```
2332 Software\Policies\Mozilla\Firefox\DisplayBookmarksToolbar = "always", "never", "newtab"
2333 ```
2334 #### Windows (Intune)
2335 OMA-URI:
2336 ```
2337 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox/DisplayBookmarksToolbar_Enum
2338 ```
2339 Value (string):
2340 ```
2341 <enabled/>
2342 <data id="DisplayBookmarksToolbar" value="always | never | newtab"/>
2343 ```
2344 #### macOS
2345 ```
2346 <dict>
2347   <key>DisplayBookmarksToolbar</key>
2348   <string>always | never | newtab</string>
2349 </dict>
2350 ```
2351 #### policies.json
2352 ```
2353 {
2354   "policies": {
2355     "DisplayBookmarksToolbar": "always" | "never" | "newtab"
2356   }
2357 }
2358 ```
2359 ### DisplayMenuBar
2360 Set the state of the menubar.
2361
2362 `always` means the menubar is shown and cannot be hidden.
2363
2364 `never` means the menubar is hidden and cannot be shown.
2365
2366 `default-on` means the menubar is on by default but can be hidden.
2367
2368 `default-off` means the menubar is off by default but can be shown.
2369
2370 **Compatibility:** Firefox 73, Firefox ESR 68.5 (Windows, some Linux)\
2371 **CCK2 Equivalent:** `displayMenuBar`\
2372 **Preferences Affected:** N/A
2373
2374 #### Windows (GPO)
2375 ```
2376 Software\Policies\Mozilla\Firefox\DisplayMenuBar = "always", "never", "default-on", "default-off"
2377 ```
2378 #### Windows (Intune)
2379 OMA-URI:
2380 ```
2381 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox/DisplayMenuBar_Enum
2382 ```
2383 Value (string):
2384 ```
2385 <enabled/>
2386 <data id="DisplayMenuBar" value="always | never | default-on | default-off"/>
2387 ```
2388 #### macOS
2389 ```
2390 <dict>
2391   <key>DisplayMenuBar</key>
2392   <string>always | never | default-on | default-off</string>
2393 </dict>
2394 ```
2395 #### policies.json
2396 ```
2397 {
2398   "policies": {
2399     "DisplayMenuBar": "always", "never", "default-on", "default-off"
2400   }
2401 }
2402 ```
2403 ### DNSOverHTTPS
2404 Configure DNS over HTTPS.
2405
2406 `Enabled` determines whether DNS over HTTPS is enabled
2407
2408 `ProviderURL` is a URL to another provider.
2409
2410 `Locked` prevents the user from changing DNS over HTTPS preferences.
2411
2412 `ExcludedDomains` excludes domains from DNS over HTTPS.
2413
2414 `Fallback` determines whether or not Firefox will use your default DNS resolver if there is a problem with the secure DNS provider.
2415
2416 **Compatibility:** Firefox 63, Firefox ESR 68 (ExcludedDomains added in 75/68.7) (Fallback added in 124)\
2417 **CCK2 Equivalent:** N/A\
2418 **Preferences Affected:** `network.trr.mode`, `network.trr.uri`
2419
2420 #### Windows (GPO)
2421 ```
2422 Software\Policies\Mozilla\Firefox\DNSOverHTTPS\Enabled = 0x1 | 0x0
2423 Software\Policies\Mozilla\Firefox\DNSOverHTTPS\ProviderURL = "URL_TO_ALTERNATE_PROVIDER"
2424 Software\Policies\Mozilla\Firefox\DNSOverHTTPS\Locked = 0x1 | 0x0
2425 Software\Policies\Mozilla\Firefox\DNSOverHTTPS\ExcludedDomains\1 = "example.com"
2426 Software\Policies\Mozilla\Firefox\DNSOverHTTPS\Fallback = 0x1 | 0x0
2427 ```
2428 #### Windows (Intune)
2429 OMA-URI:
2430 ```
2431 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~DNSOverHTTPS/DNSOverHTTPS_Enabled
2432 ```
2433 Value (string):
2434 ```
2435 <enabled/> or <disabled/>
2436 ```
2437 OMA-URI:
2438 ```
2439 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~DNSOverHTTPS/DNSOverHTTPS_ProviderURL
2440 ```
2441 Value (string):
2442 ```
2443 <enabled/>
2444 <data id="String" value="URL_TO_ALTERNATE_PROVIDER"/>
2445 ```
2446 OMA-URI:
2447 ```
2448 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~DNSOverHTTPS/DNSOverHTTPS_Locked
2449 ```
2450 Value (string):
2451 ```
2452 <enabled/> or <disabled/>
2453 ```
2454 OMA-URI:
2455 ```
2456 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~DNSOverHTTPS/DNSOverHTTPS_ExcludedDomains
2457 ```
2458 Value (string):
2459 ```
2460 <enabled/>
2461 <data id="List" value="1&#xF000;example.com"/>
2462 ```
2463 OMA-URI:
2464 ```
2465 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~DNSOverHTTPS/DNSOverHTTPS_Fallback
2466 ```
2467 Value (string):
2468 ```
2469 <enabled/> or <disabled/>
2470 ```
2471 #### macOS
2472 ```
2473 <dict>
2474   <key>DNSOverHTTPS</key>
2475   <dict>
2476     <key>Enabled</key>
2477     <true/> | <false/>
2478     <key>ProviderURL</key>
2479     <string>URL_TO_ALTERNATE_PROVIDER</string>
2480     <key>Locked</key>
2481     <true/> | <false/>
2482     <key>ExcludedDomains</key>
2483     <array>
2484       <string>example.com</string>
2485     </array>
2486     <key>Fallback</key>
2487     <true/> | <false/>
2488   </dict>
2489 </dict>
2490 ```
2491 #### policies.json
2492 ```
2493 {
2494   "policies": {
2495     "DNSOverHTTPS": {
2496       "Enabled":  true | false,
2497       "ProviderURL": "URL_TO_ALTERNATE_PROVIDER",
2498       "Locked": true | false,
2499       "ExcludedDomains": ["example.com"],
2500       "Fallback": true | false,
2501     }
2502   }
2503 }
2504 ```
2505 ### DontCheckDefaultBrowser
2506 Don't check if Firefox is the default browser at startup.
2507
2508 **Compatibility:** Firefox 60, Firefox ESR 60\
2509 **CCK2 Equivalent:** `dontCheckDefaultBrowser`\
2510 **Preferences Affected:** `browser.shell.checkDefaultBrowser`
2511
2512 #### Windows (GPO)
2513 ```
2514 Software\Policies\Mozilla\Firefox\DontCheckDefaultBrowser = 0x1 | 0x0
2515 ```
2516 #### Windows (Intune)
2517 OMA-URI:
2518 ```
2519 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox/DontCheckDefaultBrowser
2520 ```
2521 Value (string):
2522 ```
2523 <enabled/> or <disabled/>
2524 ```
2525 #### macOS
2526 ```
2527 <dict>
2528   <key>DontCheckDefaultBrowser</key>
2529   <true/> | <false/>
2530 </dict>
2531 ```
2532 #### policies.json
2533 ```
2534 {
2535   "policies": {
2536     "DontCheckDefaultBrowser": true | false
2537   }
2538 }
2539 ```
2540 ### DownloadDirectory
2541 Set and lock the download directory.
2542
2543 You can use ${home} for the native home directory.
2544
2545 **Compatibility:** Firefox 68, Firefox ESR 68\
2546 **CCK2 Equivalent:** N/A\
2547 **Preferences Affected:** `browser.download.dir`, `browser.download.folderList`, `browser.download.useDownloadDir`
2548
2549 #### Windows (GPO)
2550 ```
2551 Software\Policies\Mozilla\Firefox\DownloadDirectory = "${home}\Downloads"
2552 ```
2553 #### Windows (Intune)
2554 OMA-URI:
2555 ```
2556 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox/DownloadDirectory
2557 ```
2558 Value (string):
2559 ```
2560 <enabled/>
2561 <data id="Preferences_String" value="${home}\Downloads"/>
2562 ```
2563 #### macOS
2564 ```
2565 <dict>
2566   <key>DownloadDirectory</key>
2567   <string>${home}/Downloads</string>
2568 </dict>
2569 ```
2570 #### policies.json (macOS and Linux)
2571 ```
2572 {
2573   "policies": {
2574     "DownloadDirectory": "${home}/Downloads"
2575 }
2576 ```
2577 #### policies.json (Windows)
2578 ```
2579 {
2580   "policies": {
2581     "DownloadDirectory": "${home}\\Downloads"
2582 }
2583 ```
2584 ### EnableTrackingProtection
2585 Configure tracking protection.
2586
2587 If this policy is not configured, tracking protection is not enabled by default in the browser, but it is enabled by default in private browsing and the user can change it.
2588
2589 If `Value` is set to false, tracking protection is disabled and locked in both the regular browser and private browsing.
2590
2591 If `Value` is set to true, tracking protection is enabled by default in both the regular browser and private browsing and the `Locked` value determines whether or not a user can change it.
2592
2593 If `Cryptomining` is set to true, cryptomining scripts on websites are blocked.
2594
2595 If `Fingerprinting` is set to true, fingerprinting scripts on websites are blocked.
2596
2597 If `EmailTracking` is set to true, hidden email tracking pixels and scripts on websites are blocked. (Firefox 112)
2598
2599 `Exceptions` are origins for which tracking protection is not enabled.
2600
2601 **Compatibility:** Firefox 60, Firefox ESR 60 (Cryptomining and Fingerprinting added in 70/68.2, Exceptions added in 73/68.5)\
2602 **CCK2 Equivalent:** N/A\
2603 **Preferences Affected:** `privacy.trackingprotection.enabled`, `privacy.trackingprotection.pbmode.enabled`, `privacy.trackingprotection.cryptomining.enabled`, `privacy.trackingprotection.fingerprinting.enabled`
2604
2605 #### Windows (GPO)
2606 ```
2607 Software\Policies\Mozilla\Firefox\EnableTrackingProtection\Value = 0x1 | 0x0
2608 Software\Policies\Mozilla\Firefox\EnableTrackingProtection\Locked = 0x1 | 0x0
2609 Software\Policies\Mozilla\Firefox\EnableTrackingProtection\Cryptomining = 0x1 | 0x0
2610 Software\Policies\Mozilla\Firefox\EnableTrackingProtection\Fingerprinting = 0x1 | 0x0
2611 Software\Policies\Mozilla\Firefox\EnableTrackingProtection\Exceptions\1 = "https://example.com"
2612 ```
2613 #### Windows (Intune)
2614 OMA-URI:
2615 ```
2616 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~TrackingProtection/A_TrackingProtection_Value
2617 ```
2618 Value (string):
2619 ```
2620 <enabled/> or <disabled/>
2621 ```
2622 OMA-URI:
2623 ```
2624 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~TrackingProtection/B_TrackingProtection_Cryptomining
2625 ```
2626 Value (string):
2627 ```
2628 <enabled/> or <disabled/>
2629 ```
2630 OMA-URI:
2631 ```
2632 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~TrackingProtection/C_TrackingProtection_Fingerprinting
2633 ```
2634 Value (string):
2635 ```
2636 <enabled/> or <disabled/>
2637 ```
2638 OMA-URI:
2639 ```
2640 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~TrackingProtection/D_TrackingProtection_Exceptions
2641 ```
2642 Value (string):
2643 ```
2644 <enabled/>
2645 <data id="TrackingProtection_Exceptions" value="1&#xF000;https://example.com"/>
2646 ```
2647 OMA-URI:
2648 ```
2649 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~TrackingProtection/E_TrackingProtection_Locked
2650 ```
2651 Value (string):
2652 ```
2653 <enabled/> or <disabled/>
2654 ```
2655 #### macOS
2656 ```
2657 <dict>
2658   <key>EnableTrackingProtection</key>
2659   <dict>
2660     <key>Value</key>
2661     <true/> | <false/>
2662     <key>Locked</key>
2663     <true/> | <false/>
2664     <key>Cryptomining</key>
2665     <true/> | <false/>
2666     <key>Fingerprinting</key>
2667     <true/> | <false/>
2668     <key>Exceptions</key>
2669     <array>
2670       <string>https://example.com</string>
2671     </array>
2672   </dict>
2673 </dict>
2674 ```
2675 #### policies.json
2676 ```
2677 {
2678   "policies": {
2679     "EnableTrackingProtection": {
2680       "Value": true | false,
2681       "Locked": true | false,
2682       "Cryptomining": true | false,
2683       "Fingerprinting": true | false,
2684       "Exceptions": ["https://example.com"]
2685     }
2686   }
2687 }
2688 ```
2689 ### EncryptedMediaExtensions
2690 Enable or disable Encrypted Media Extensions and optionally lock it.
2691
2692 If `Enabled` is set to false, encrypted media extensions (like Widevine) are not downloaded by Firefox unless the user consents to installing them.
2693
2694 If `Locked` is set to true and `Enabled` is set to false, Firefox will not download encrypted media extensions (like Widevine) or ask the user to install them.
2695
2696 **Compatibility:** Firefox 77, Firefox ESR 68.9\
2697 **CCK2 Equivalent:** N/A\
2698 **Preferences Affected:** `media.eme.enabled`
2699
2700 #### Windows (GPO)
2701 ```
2702 Software\Policies\Mozilla\Firefox\EncryptedMediaExtensions\Enabled = 0x1 | 0x0
2703 Software\Policies\Mozilla\Firefox\EncryptedMediaExtensions\Locked = 0x1 | 0x0
2704 ```
2705 #### Windows (Intune)
2706 OMA-URI:
2707 ```
2708 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~EncryptedMediaExtensions/EncryptedMediaExtensions_Enabled
2709 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~EncryptedMediaExtensions/EncryptedMediaExtensions_Locked
2710 ```
2711 Value (string):
2712 ```
2713 <enabled/>or <disabled/>
2714 ```
2715 #### macOS
2716 ```
2717 <dict>
2718   <key>EncryptedMediaExtensions</key>
2719   <dict>
2720     <key>Enabled</key>
2721     <true/> | <false/>
2722     <key>Locked</key>
2723     <true/> | <false/>
2724   </dict>
2725 </dict>
2726 ```
2727 #### policies.json
2728 ```
2729 {
2730   "policies": {
2731     "EncryptedMediaExtensions": {
2732       "Enabled": true | false,
2733       "Locked": true | false
2734     }
2735   }
2736 }
2737 ```
2738 ### EnterprisePoliciesEnabled
2739 Enable policy support on macOS.
2740
2741 **Compatibility:** Firefox 63, Firefox ESR 60.3 (macOS only)\
2742 **CCK2 Equivalent:** N/A\
2743 **Preferences Affected:** N/A
2744
2745 #### macOS
2746 ```
2747 <dict>
2748   <key>EnterprisePoliciesEnabled</key>
2749   <true/>
2750 </dict>
2751 ```
2752 ### ExemptDomainFileTypePairsFromFileTypeDownloadWarnings
2753
2754 Disable warnings based on file extension for specific file types on domains.
2755
2756 This policy is based on the [Chrome policy](https://chromeenterprise.google/policies/#ExemptDomainFileTypePairsFromFileTypeDownloadWarnings) of the same name.
2757
2758 Important: The documentation for the policy for both Edge and Chrome is incorrect. The ```domains``` value must be a domain, not a URL pattern. Also, we do not support using ```*``` to mean all domains.
2759
2760 **Compatibility:** Firefox 102\
2761 **CCK2 Equivalent:** N/A\
2762 **Preferences Affected:** N/A
2763
2764 #### Windows (GPO)
2765 Software\Policies\Mozilla\Firefox\ExemptDomainFileTypePairsFromFileTypeDownloadWarnings (REG_MULTI_SZ) =
2766 ```
2767 [
2768   {
2769      "file_extension": "jnlp",
2770      "domains": ["example.com"]
2771   }
2772 ]
2773 ```
2774 #### Windows (Intune)
2775 OMA-URI:
2776 ```
2777 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox/ExemptDomainFileTypePairsFromFileTypeDownloadWarnings
2778 ```
2779 Value (string):
2780 ```
2781 <enabled/>
2782 <data id="JSON" value='
2783 [
2784   {
2785      "file_extension": "jnlp",
2786      "domains": ["example.com"]
2787   }
2788 ]
2789 '/>
2790 ```
2791 If you are using custom ADMX and ADML administrative templates in Intune, you can use this OMA-URI instead
2792 to workaround the limit on the length of strings. Put all of your JSON on one line.
2793
2794 OMA-URI:
2795 ```
2796 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~Extensions/ExemptDomainFileTypePairsFromFileTypeDownloadWarningsOneLine
2797 ```
2798 Value (string):
2799 ```
2800 <enabled/>
2801 <data id="JSONOneLine" value='[]'/>
2802 ```
2803 #### macOS
2804 ```
2805 <dict>
2806   <key>ExemptDomainFileTypePairsFromFileTypeDownloadWarnings</key>
2807   <array>
2808     <dict>
2809       <key>file_extension</key>
2810       <string>jnlp</string>
2811       <key>domains</key>
2812       <array>
2813         <string>example.com</string>
2814       </array>
2815     </dict>
2816   </array>
2817 </dict>
2818 ```
2819 #### policies.json
2820 ```
2821 {
2822   "policies": {
2823     "ExemptDomainFileTypePairsFromFileTypeDownloadWarnings": [{
2824       "file_extension": "jnlp",
2825       "domains": ["example.com"]
2826     }]
2827   }
2828 }
2829 ```
2830 ### Extensions
2831 Control the installation, uninstallation and locking of extensions.
2832
2833 We strongly recommend that you use the **[`ExtensionSettings`](#extensionsettings)** policy. It has the same functionality and adds more. It does not support native paths, though, so you'll have to use file:/// URLs.
2834
2835 This method will be deprecated in the near future.
2836
2837 `Install` is a list of URLs or native paths for extensions to be installed.
2838
2839 `Uninstall` is a list of extension IDs that should be uninstalled if found.
2840
2841 `Locked` is a list of extension IDs that the user cannot disable or uninstall.
2842
2843 **Compatibility:** Firefox 60, Firefox ESR 60\
2844 **CCK2 Equivalent:** `addons`\
2845 **Preferences Affected:** N/A
2846
2847 #### Windows (GPO)
2848 ```
2849 Software\Policies\Mozilla\Firefox\Extensions\Install\1 = "https://addons.mozilla.org/firefox/downloads/somefile.xpi"
2850 Software\Policies\Mozilla\Firefox\Extensions\Install\2 = "//path/to/xpi"
2851 Software\Policies\Mozilla\Firefox\Extensions\Uninstall\1 = "bad_addon_id@mozilla.org"
2852 Software\Policies\Mozilla\Firefox\Extensions\Locked\1 = "addon_id@mozilla.org"
2853 ```
2854 #### Windows (Intune)
2855 OMA-URI:
2856 ```
2857 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~Extensions/Extensions_Install
2858 ```
2859 Value (string):
2860 ```
2861 <enabled/>
2862 <data id="Extensions" value="1&#xF000;https://addons.mozilla.org/firefox/downloads/somefile.xpi&#xF000;2&#xF000;//path/to/xpi"/>
2863 ```
2864 OMA-URI:
2865 ```
2866 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~Extensions/Extensions_Uninstall
2867 ```
2868 Value (string):
2869 ```
2870 <enabled/>
2871 <data id="Extensions" value="1&#xF000;bad_addon_id@mozilla.org"/>
2872 ```
2873 OMA-URI:
2874 ```
2875 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~Extensions/Extensions_Locked
2876 ```
2877 Value (string):
2878 ```
2879 <enabled/>
2880 <data id="Extensions" value="1&#xF000;addon_id@mozilla.org"/>
2881 ```
2882 #### macOS
2883 ```
2884 <dict>
2885   <key>Extensions</key>
2886   <dict>
2887     <key>Install</key>
2888     <array>
2889       <string>https://addons.mozilla.org/firefox/downloads/somefile.xpi</string>
2890       <string>//path/to/xpi</string>
2891     </array>
2892     <key>Uninstall</key>
2893     <array>
2894       <string>bad_addon_id@mozilla.org</string>
2895     </array>
2896     <key>Locked</key>
2897     <array>
2898       <string>addon_id@mozilla.org</string>
2899     </array>
2900   </dict>
2901 </dict>
2902 ```
2903 #### policies.json
2904 ```
2905 {
2906   "policies": {
2907     "Extensions": {
2908       "Install": ["https://addons.mozilla.org/firefox/downloads/somefile.xpi", "//path/to/xpi"],
2909       "Uninstall": ["bad_addon_id@mozilla.org"],
2910       "Locked":  ["addon_id@mozilla.org"]
2911     }
2912   }
2913 }
2914 ```
2915 ### ExtensionSettings
2916 Manage all aspects of extensions. This policy is based heavily on the [Chrome policy](https://dev.chromium.org/administrators/policy-list-3/extension-settings-full) of the same name.
2917
2918 This policy maps an extension ID to its configuration. With an extension ID, the configuration will be applied to the specified extension only. A default configuration can be set for the special ID "*", which will apply to all extensions that don't have a custom configuration set in this policy.
2919
2920 To obtain an extension ID, install the extension and go to about:support. You will see the ID in the Extensions section. I've also created an extension that makes it easy to find the ID of extensions on AMO. You can download it [here](https://github.com/mkaply/queryamoid/releases/tag/v0.1).
2921
2922 The configuration for each extension is another dictionary that can contain the fields documented below.
2923
2924 | Name | Description |
2925 | --- | --- |
2926 | `installation_mode` | Maps to a string indicating the installation mode for the extension. The valid strings are `allowed`,`blocked`,`force_installed`, and `normal_installed`.
2927 | &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;`allowed` | Allows the extension to be installed by the user. This is the default behavior. There is no need for an install_url; it will automatically be allowed based on the ID.
2928 | &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;`blocked`| Blocks installation of the extension and removes it from the device if already installed.
2929 | &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;`force_installed`| The extension is automatically installed and can't be removed by the user. This option is not valid for the default configuration and requires an install_url.
2930 | &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;`normal_installed`| The extension is automatically installed but can be disabled by the user. This option is not valid for the default configuration and requires an install_url.
2931 | `install_url`| Maps to a URL indicating where Firefox can download a force_installed or normal_installed extension.  If installing from the local file system, use a [```file:///``` URL](https://en.wikipedia.org/wiki/File_URI_scheme). If installing from the addons.mozilla.org, use the following URL (substituting SHORT_NAME from the URL on AMO), https://addons.mozilla.org/firefox/downloads/latest/SHORT_NAME/latest.xpi. Languages packs are available from https://releases.mozilla.org/pub/firefox/releases/VERSION/PLATFORM/xpi/LANGUAGE.xpi. If you need to update the extension, you can change the name of the extension and it will be automatically updated. Extensions installed from file URLs will additional be updated when their internal version changes.
2932 | `install_sources` | A list of sources from which installing extensions is allowed using URL match patterns. **This is unnecessary if you are only allowing the installation of certain extensions by ID.** Each item in this list is an extension-style match pattern. Users will be able to easily install items from any URL that matches an item in this list. Both the location of the *.xpi file and the page where the download is started from (i.e.  the referrer) must be allowed by these patterns. This setting can be used only for the default configuration.
2933 | `allowed_types` | This setting whitelists the allowed types of extension/apps that can be installed in Firefox. The value is a list of strings, each of which should be one of the following: "extension", "theme", "dictionary", "locale" This setting can be used only for the default configuration.
2934 | `blocked_install_message` | This maps to a string specifying the error message to display to users if they're blocked from installing an extension. This setting allows you to append text to the generic error message displayed when the extension is blocked. This could be be used to direct users to your help desk, explain why a particular extension is blocked, or something else. This setting can be used only for the default configuration.
2935 | `restricted_domains` | An array of domains on which content scripts can't be run. This setting can be used only for the default configuration.
2936 | `updates_disabled` | (Firefox 89, Firefox ESR 78.11) Boolean that indicates whether or not to disable automatic updates for an individual extension.
2937 | `default_area` | (Firefox 113) String that indicates where to place the extension icon by default. Possible values are `navbar` and `menupanel`.
2938 | `temporarily_allow_weak_signatures`| (Firefox 127) A boolean that indicates whether to allow installing extensions signed using deprecated signature algorithms.
2939
2940 **Compatibility:** Firefox 69, Firefox ESR 68.1 (As of Firefox 85, Firefox ESR 78.7, installing a theme makes it the default.)\
2941 **CCK2 Equivalent:** N/A\
2942 **Preferences Affected:** N/A
2943
2944 #### Windows (GPO)
2945 Software\Policies\Mozilla\Firefox\ExtensionSettings (REG_MULTI_SZ) =
2946 ```
2947 {
2948   "*": {
2949     "blocked_install_message": "Custom error message.",
2950     "install_sources": ["https://yourwebsite.com/*"],
2951     "installation_mode": "blocked",
2952     "allowed_types": ["extension"]
2953   },
2954   "uBlock0@raymondhill.net": {
2955     "installation_mode": "force_installed",
2956     "install_url": "https://addons.mozilla.org/firefox/downloads/latest/ublock-origin/latest.xpi"
2957   },
2958   "https-everywhere@eff.org": {
2959     "installation_mode": "allowed",
2960     "updates_disabled": false
2961   }
2962 }
2963 ```
2964 #### Windows (Intune)
2965 OMA-URI:
2966 ```
2967 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~Extensions/ExtensionSettings
2968 ```
2969 Value (string):
2970 ```
2971 <enabled/>
2972 <data id="ExtensionSettings" value='
2973 {
2974   "*": {
2975     "blocked_install_message": "Custom error message.",
2976     "install_sources": ["https://yourwebsite.com/*"],
2977     "installation_mode": "blocked",
2978     "allowed_types": ["extension"]
2979   },
2980   "uBlock0@raymondhill.net": {
2981     "installation_mode": "force_installed",
2982     "install_url": "https://addons.mozilla.org/firefox/downloads/latest/ublock-origin/latest.xpi"
2983   },
2984     "https-everywhere@eff.org": {
2985     "installation_mode": "allowed",
2986     "updates_disabled": false
2987   }
2988 }'/>
2989 ```
2990 If you are using custom ADMX and ADML administrative templates in Intune, you can use this OMA-URI instead
2991 to workaround the limit on the length of strings. Put all of your JSON on one line.
2992
2993 OMA-URI:
2994 ```
2995 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~Extensions/ExtensionSettingsOneLine
2996 ```
2997 Value (string):
2998 ```
2999 <enabled/>
3000 <data id="JSONOneLine" value='{}'/>
3001 ```
3002 #### macOS
3003 ```
3004 <dict>
3005   <key>ExtensionSettings</key>
3006   <dict>
3007     <key>*</key>
3008     <dict>
3009       <key>blocked_install_message</key>
3010       <string>Custom error message.</string>
3011       <key>install_sources</key>
3012       <array>
3013         <string>"https://yourwebsite.com/*"</string>
3014       </array>
3015       <key>installation_mode</key>
3016       <string>blocked</string>
3017       <key>allowed_types</key>
3018       <array>
3019         <string>extension</string>
3020       </array>
3021     </dict>
3022     <key>uBlock0@raymondhill.net</key>
3023     <dict>
3024       <key>installation_mode</key>
3025       <string>force_installed</string>
3026       <key>install_url</key>
3027       <string>https://addons.mozilla.org/firefox/downloads/latest/ublock-origin/latest.xpi</string>
3028     </dict>
3029     <key>https-everywhere@eff.org</key>
3030     <dict>
3031       <key>installation_mode</key>
3032       <string>allowed</string>
3033       <key>updates_disabled</key>
3034       <true/> | <false/>
3035     </dict>
3036   </dict>
3037 </dict>
3038 ```
3039 #### policies.json
3040 ```
3041 {
3042   "policies": {
3043     "ExtensionSettings": {
3044       "*": {
3045         "blocked_install_message": "Custom error message.",
3046         "install_sources": ["https://yourwebsite.com/*"],
3047         "installation_mode": "blocked",
3048         "allowed_types": ["extension"]
3049       },
3050       "uBlock0@raymondhill.net": {
3051         "installation_mode": "force_installed",
3052         "install_url": "https://addons.mozilla.org/firefox/downloads/latest/ublock-origin/latest.xpi"
3053       },
3054       "https-everywhere@eff.org": {
3055         "installation_mode": "allowed",
3056         "updates_disabled": false
3057       }
3058     }
3059   }
3060 }
3061 ```
3062 ### ExtensionUpdate
3063 Control extension updates.
3064
3065 **Compatibility:** Firefox 67, Firefox ESR 60.7\
3066 **CCK2 Equivalent:** N/A\
3067 **Preferences Affected:** `extensions.update.enabled`
3068
3069 #### Windows (GPO)
3070 ```
3071 Software\Policies\Mozilla\Firefox\ExtensionUpdate = 0x1 | 0x0
3072 ```
3073 #### Windows (Intune)
3074 OMA-URI:
3075 ```
3076 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~Extensions/ExtensionUpdate
3077 ```
3078 Value (string):
3079 ```
3080 <enabled/> or <disabled/>
3081 ```
3082 #### macOS
3083 ```
3084 <dict>
3085   <key>ExtensionUpdate</key>
3086   <true/> | <false/>
3087 </dict>
3088 ```
3089 #### policies.json
3090 ```
3091 {
3092   "policies": {
3093     "ExtensionUpdate": true | false
3094   }
3095 }
3096 ```
3097 ### FirefoxHome
3098 Customize the Firefox Home page.
3099
3100 **Compatibility:** Firefox 68, Firefox ESR 68 (SponsoredTopSites and SponsoredPocket were added in Firefox 95, Firefox ESR 91.4, Snippets was deprecated in Firefox 122)
3101 **CCK2 Equivalent:** N/A\
3102 **Preferences Affected:** `browser.newtabpage.activity-stream.showSearch`, `browser.newtabpage.activity-stream.feeds.topsites`, `browser.newtabpage.activity-stream.feeds.section.highlights`, `browser.newtabpage.activity-stream.feeds.section.topstories`, `browser.newtabpage.activity-stream.feeds.snippets`, `browser.newtabpage.activity-stream.showSponsoredTopSites`, `browser.newtabpage.activity-stream.showSponsored`
3103
3104 #### Windows (GPO)
3105 ```
3106 Software\Policies\Mozilla\Firefox\FirefoxHome\Search = 0x1 | 0x0
3107 Software\Policies\Mozilla\Firefox\FirefoxHome\TopSites = 0x1 | 0x0
3108 Software\Policies\Mozilla\Firefox\FirefoxHome\SponsoredTopSites = 0x1 | 0x0
3109 Software\Policies\Mozilla\Firefox\FirefoxHome\Highlights = 0x1 | 0x0
3110 Software\Policies\Mozilla\Firefox\FirefoxHome\Pocket = 0x1 | 0x0
3111 Software\Policies\Mozilla\Firefox\FirefoxHome\SponsoredPocket = 0x1 | 0x0
3112 Software\Policies\Mozilla\Firefox\FirefoxHome\Snippets = 0x1 | 0x0
3113 Software\Policies\Mozilla\Firefox\FirefoxHome\Locked = 0x1 | 0x0
3114 ```
3115 #### Windows (Intune)
3116 OMA-URI:
3117 ```
3118 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox/CustomizeFirefoxHome
3119 ```
3120 Value (string):
3121 ```
3122 <enabled/>
3123 <data id="FirefoxHome_Search"  value="true | false"/>
3124 <data id="FirefoxHome_TopSites"  value="true | false"/>
3125 <data id="FirefoxHome_SponsoredTopSites"  value="true | false"/>
3126 <data id="FirefoxHome_Highlights"  value="true | false"/>
3127 <data id="FirefoxHome_Pocket"  value="true | false"/>
3128 <data id="FirefoxHome_SponsoredPocket"  value="true | false"/>
3129 <data id="FirefoxHome_Snippets"  value="true | false"/>
3130 <data id="FirefoxHome_Locked"  value="true | false"/>
3131 ```
3132 #### macOS
3133 ```
3134 <dict>
3135   <key>FirefoxHome</key>
3136   <dict>
3137     <key>Search</key>
3138     <true/> | <false/>
3139     <key>TopSites</key>
3140     <true/> | <false/>
3141     <key>SponsoredTopSites</key>
3142     <true/> | <false/>
3143     <key>Highlights</key>
3144     <true/> | <false/>
3145     <key>Pocket</key>
3146     <true/> | <false/>
3147     <key>SponsoredPocket</key>
3148     <true/> | <false/>
3149     <key>Snippets</key>
3150     <true/> | <false/>
3151     <key>Locked</key>
3152     <true/> | <false/>
3153   </dict>
3154 </dict>
3155 ```
3156 #### policies.json
3157 ```
3158 {
3159   "policies": {
3160     "FirefoxHome": {
3161       "Search": true | false,
3162       "TopSites": true | false,
3163       "SponsoredTopSites": true | false,
3164       "Highlights": true | false,
3165       "Pocket": true | false,
3166       "SponsoredPocket": true | false,
3167       "Snippets": true | false,
3168       "Locked": true | false
3169     }
3170   }
3171 }
3172 ```
3173 ### FirefoxSuggest
3174 Customize Firefox Suggest (US only).
3175
3176 **Compatibility:** Firefox 118, Firefox ESR 115.3.
3177 **CCK2 Equivalent:** N/A\
3178 **Preferences Affected:** `browser.urlbar.suggest.quicksuggest.nonsponsored`, `browser.urlbar.suggest.quicksuggest.sponsored`, `browser.urlbar.quicksuggest.dataCollection.enabled`
3179
3180 #### Windows (GPO)
3181 ```
3182 Software\Policies\Mozilla\Firefox\FirefoxSuggest\WebSuggestions = 0x1 | 0x0
3183 Software\Policies\Mozilla\Firefox\FirefoxSuggest\SponsoredSuggestions = 0x1 | 0x0
3184 Software\Policies\Mozilla\Firefox\FirefoxSuggest\ImproveSuggest = 0x1 | 0x0
3185 Software\Policies\Mozilla\Firefox\FirefoxSuggest\Locked = 0x1 | 0x0
3186 ```
3187 #### Windows (Intune)
3188 OMA-URI:
3189 ```
3190 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~FirefoxSuggest/WebSuggestions
3191 ```
3192 Value (string):
3193 ```
3194 <enabled/> or <disabled/>
3195 ```
3196 OMA-URI:
3197 ```
3198 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~FirefoxSuggest/SponsoredSuggestions
3199 ```
3200 Value (string):
3201 ```
3202 <enabled/> or <disabled/>
3203 ```
3204 OMA-URI:
3205 ```
3206 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~FirefoxSuggest/ImproveSuggest
3207 ```
3208 Value (string):
3209 ```
3210 <enabled/> or <disabled/>
3211 ```
3212 OMA-URI:
3213 ```
3214 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~FirefoxSuggest/Locked
3215 ```
3216 Value (string):
3217 ```
3218 <enabled/> or <disabled/>
3219 ```
3220 #### macOS
3221 ```
3222 <dict>
3223   <key>FirefoxSuggest</key>
3224   <dict>
3225     <key>WebSuggestions</key>
3226     <true/> | <false/>
3227     <key>SponsoredSuggestions</key>
3228     <true/> | <false/>
3229     <key>ImproveSuggest</key>
3230     <true/> | <false/>
3231     <key>Locked</key>
3232     <true/> | <false/>
3233   </dict>
3234 </dict>
3235 ```
3236 #### policies.json
3237 ```
3238 {
3239   "policies": {
3240     "FirefoxSuggest": {
3241       "WebSuggestions": true | false,
3242       "SponsoredSuggestions": true | false,
3243       "ImproveSuggest": true | false,
3244       "Locked": true | false
3245     }
3246   }
3247 }
3248 ```
3249 ### GoToIntranetSiteForSingleWordEntryInAddressBar
3250 Whether to always go through the DNS server before sending a single word search string to a search engine.
3251
3252 If the site exists, it will navigate to the website. If the intranet responds with a 404, the page will show a 404. If the intranet does not respond, the browser will attempt a search.
3253
3254 The second result in the URL bar will be a search result to allow users to conduct a web search exactly as it was entered.
3255
3256 If instead you would like to enable the ability to have your domain appear as a valid URL and to disallow the browser from ever searching that term using the first result that matches it, add the pref `browser.fixup.domainwhitelist.YOUR_DOMAIN` (where `YOUR_DOMAIN` is the name of the domain you'd like to add), and set the pref to `true`. The URL bar will then suggest `YOUR_DOMAIN` when the user fully types `YOUR_DOMAIN`. If the user attempts to load that domain and it fails to load, it will show an "Unable to connect" error page.
3257
3258 You can also whitelist a domain suffix that is not part of the [Public Suffix List](https://publicsuffix.org/) by adding the pref `browser.fixup.domainsuffixwhitelist.YOUR_DOMAIN_SUFFIX` with a value of `true`.
3259
3260 Additionally, if you want users to see a "Did you mean to go to 'YOUR_DOMAIN'" prompt below the URL bar if they land on a search results page instead of an intranet domain that provides a response, set the pref `browser.urlbar.dnsResolveSingleWordsAfterSearch` to `1`. Enabling this will cause the browser to commit a DNS check after every single word search. If the browser receives a response from the intranet, a prompt will ask the user if they'd like to instead navigate to `YOUR_DOMAIN`. If the user presses the **yes** button, `browser.fixup.domainwhitelist.YOUR_DOMAIN` will be set to `true`.
3261
3262 **Compatibility:** Firefox 104, Firefox ESR 102.2\
3263 **CCK2 Equivalent:** `N/A`\
3264 **Preferences Affected:** `browser.fixup.dns_first_for_single_words`
3265
3266 #### Windows (GPO)
3267 ```
3268 Software\Policies\Mozilla\Firefox\GoToIntranetSiteForSingleWordEntryInAddressBar = 0x1 | 0x0
3269 ```
3270 #### Windows (Intune)
3271 OMA-URI:
3272 ```
3273 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox/GoToIntranetSiteForSingleWordEntryInAddressBar
3274 ```
3275 Value (string):
3276 ```
3277 <enabled/> or <disabled/>
3278 ```
3279 #### macOS
3280 ```
3281 <dict>
3282   <key>GoToIntranetSiteForSingleWordEntryInAddressBar</key>
3283   <true/> | <false/>
3284 </dict>
3285 ```
3286 #### policies.json
3287 ```
3288 {
3289   "policies": {
3290     "GoToIntranetSiteForSingleWordEntryInAddressBar": true | false
3291   }
3292 }
3293 ```
3294 ### Handlers
3295 Configure default application handlers. This policy is based on the internal format of `handlers.json`.
3296
3297 You can configure handlers based on a mime type (`mimeTypes`), a file's extension (`extensions`), or a protocol (`schemes`).
3298
3299 Within each handler type, you specify the given mimeType/extension/scheme as a key and use the following subkeys to describe how it is handled.
3300
3301 | Name | Description |
3302 | --- | --- |
3303 | `action`| Can be either `saveToDisk`, `useHelperApp`, `useSystemDefault`.
3304 | `ask` | If `true`, the user is asked if what they want to do with the file. If `false`, the action is taken without user intervention.
3305 | `handlers` | An array of handlers with the first one being the default. If you don't want to have a default handler, use an empty object for the first handler. Choose between path or uriTemplate.
3306 | &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;`name` | The display name of the handler (might not be used).
3307 | &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;`path`| The native path to the executable to be used.
3308 | &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;`uriTemplate`| A url to a web based application handler. The URL must be https and contain a %s to be used for substitution.
3309
3310 **Compatibility:** Firefox 78, Firefox ESR 78\
3311 **CCK2 Equivalent:** N/A\
3312 **Preferences Affected:** N/A
3313
3314 #### Windows (GPO)
3315 Software\Policies\Mozilla\Firefox\Handlers (REG_MULTI_SZ) =
3316 ```
3317 {
3318   "mimeTypes": {
3319     "application/msword": {
3320       "action": "useSystemDefault",
3321       "ask": true | false
3322     }
3323   },
3324   "schemes": {
3325     "mailto": {
3326       "action": "useHelperApp",
3327       "ask": true | false,
3328       "handlers": [{
3329         "name": "Gmail",
3330         "uriTemplate": "https://mail.google.com/mail/?extsrc=mailto&url=%s"
3331       }]
3332     }
3333   },
3334   "extensions": {
3335     "pdf": {
3336       "action": "useHelperApp",
3337       "ask": true | false,
3338       "handlers": [{
3339         "name": "Adobe Acrobat",
3340         "path": "C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\AcroRd32.exe"
3341       }]
3342     }
3343   }
3344 }
3345 ```
3346 #### Windows (Intune)
3347 OMA-URI:
3348 ```
3349 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox/Handlers
3350 ```
3351 Value (string):
3352 ```
3353 <enabled/>
3354 <data id="Handlers" value='
3355 {
3356   "mimeTypes": {
3357     "application/msword": {
3358       "action": "useSystemDefault",
3359       "ask": true | false
3360     }
3361   },
3362   "schemes": {
3363     "mailto": {
3364       "action": "useHelperApp",
3365       "ask": true | false,
3366       "handlers": [{
3367         "name": "Gmail",
3368         "uriTemplate": "https://mail.google.com/mail/?extsrc=mailto&amp;url=%s"
3369       }]
3370     }
3371   },
3372   "extensions": {
3373     "pdf": {
3374       "action": "useHelperApp",
3375       "ask": true | false,
3376       "handlers": [{
3377         "name": "Adobe Acrobat",
3378         "path": "C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\AcroRd32.exe"
3379       }]
3380     }
3381   }
3382 }
3383 '/>
3384 ```
3385 If you are using custom ADMX and ADML administrative templates in Intune, you can use this OMA-URI instead
3386 to workaround the limit on the length of strings. Put all of your JSON on one line.
3387
3388 OMA-URI:
3389 ```
3390 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~Extensions/HandlersOneLine
3391 ```
3392 Value (string):
3393 ```
3394 <enabled/>
3395 <data id="JSONOneLine" value='{}'/>
3396 ```
3397 #### macOS
3398 ```
3399 <dict>
3400   <key>Handlers</key>
3401   <dict>
3402     <key>mimeTypes</key>
3403     <dict>
3404       <key>application/msword</key>
3405       <dict>
3406         <key>action</key>
3407         <string>useSystemDefault</string>
3408         <key>ask</key>
3409         <true/> | <false/>
3410       </dict>
3411     </dict>
3412     <key>schemes</key>
3413     <dict>
3414       <key>mailto</key>
3415       <dict>
3416         <key>action</key>
3417         <string>useHelperApp</string>
3418         <key>ask</key>
3419         <true/> | <false/>
3420         <key>handlers</key>
3421         <array>
3422           <dict>
3423             <key>name</key>
3424             <string>Gmail</string>
3425             <key>uriTemplate</key>
3426             <string>https://mail.google.com/mail/?extsrc=mailto&url=%s</string>
3427           </dict>
3428         </array>
3429       </dict>
3430     </dict>
3431     <key>extensions</key>
3432     <dict>
3433       <key>pdf</key>
3434       <dict>
3435         <key>action</key>
3436         <string>useHelperApp</string>
3437         <key>ask</key>
3438         <true/> | <false/>
3439         <key>handlers</key>
3440         <array>
3441           <dict>
3442             <key>name</key>
3443             <string>Adobe Acrobat</string>
3444             <key>path</key>
3445             <string>/System/Applications/Preview.app</string>
3446           </dict>
3447         </array>
3448       </dict>
3449     </dict>
3450   </dict>
3451 </dict>
3452 ```
3453 #### policies.json
3454 ```
3455 {
3456   "policies": {
3457     "Handlers": {
3458       "mimeTypes": {
3459         "application/msword": {
3460           "action": "useSystemDefault",
3461           "ask": false
3462         }
3463       },
3464       "schemes": {
3465         "mailto": {
3466           "action": "useHelperApp",
3467           "ask": true | false,
3468           "handlers": [{
3469             "name": "Gmail",
3470             "uriTemplate": "https://mail.google.com/mail/?extsrc=mailto&url=%s"
3471           }]
3472         }
3473       },
3474       "extensions": {
3475         "pdf": {
3476           "action": "useHelperApp",
3477           "ask": true | false,
3478           "handlers": [{
3479             "name": "Adobe Acrobat",
3480             "path": "/usr/bin/acroread"
3481           }]
3482         }
3483       }
3484     }
3485   }
3486 }
3487 ```
3488 ### HardwareAcceleration
3489 Control hardware acceleration.
3490
3491 **Compatibility:** Firefox 60, Firefox ESR 60\
3492 **CCK2 Equivalent:** N/A\
3493 **Preferences Affected:** `layers.acceleration.disabled`
3494
3495 #### Windows (GPO)
3496 ```
3497 Software\Policies\Mozilla\Firefox\HardwareAcceleration = 0x1 | 0x0
3498 ```
3499 #### Windows (Intune)
3500 OMA-URI:
3501 ```
3502 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox/HardwareAcceleration
3503 ```
3504 Value (string):
3505 ```
3506 <enabled/> or <disabled/>
3507 ```
3508 #### macOS
3509 ```
3510 <dict>
3511   <key>HardwareAcceleration</key>
3512   <true/> | <false/>
3513 </dict>
3514 ```
3515 #### policies.json
3516 ```
3517 {
3518   "policies": {
3519     "HardwareAcceleration": true | false
3520   }
3521 }
3522 ```
3523 ### Homepage
3524 Configure the default homepage and how Firefox starts.
3525
3526 `URL` is the default homepage.
3527
3528 `Locked` prevents the user from changing homepage preferences.
3529
3530 `Additional` allows for more than one homepage.
3531
3532 `StartPage` is how Firefox starts. The choices are no homepage, the default homepage or the previous session.
3533
3534 With Firefox 78, an additional option as added for `Startpage`, `homepage-locked`. If this is value is set for the Startpage, the user will always get the homepage at startup and cannot choose to restore their session.
3535
3536 **Compatibility:** Firefox 60, Firefox ESR 60 (StartPage was added in Firefox 60, Firefox ESR 60.4, homepage-locked added in Firefox 78)\
3537 **CCK2 Equivalent:** `homePage`,`lockHomePage`\
3538 **Preferences Affected:** `browser.startup.homepage`, `browser.startup.page`
3539
3540 #### Windows (GPO)
3541 ```
3542 Software\Policies\Mozilla\Firefox\Homepage\URL = "https://example.com"
3543 Software\Policies\Mozilla\Firefox\Homepage\Locked = 0x1 | 0x0
3544 Software\Policies\Mozilla\Firefox\Homepage\Additional\1 = "https://example.org"
3545 Software\Policies\Mozilla\Firefox\Homepage\Additional\2 = "https://example.edu"
3546 Software\Policies\Mozilla\Firefox\Homepage\StartPage = "none" | "homepage" | "previous-session" | "homepage-locked"
3547 ```
3548 #### Windows (Intune)
3549 OMA-URI:
3550 ```
3551 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~Homepage/HomepageURL
3552 ```
3553 Value (string):
3554 ```
3555 <enabled/>
3556
3557 <data id="HomepageURL" value="https://example.com"/>
3558 <data id="HomepageLocked" value="true | false"/>
3559 ```
3560 OMA-URI:
3561 ```
3562 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~Homepage/HomepageAdditional
3563 ```
3564 Value (string):
3565 ```
3566 <enabled/>
3567
3568 <data id="HomepageAdditional" value="1&#xF000;http://example.org&#xF000;2&#xF000;http://example.edu"/>
3569 ```
3570 OMA-URI:
3571 ```
3572 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~Homepage/HomepageStartPage
3573 ```
3574 Value (string):
3575 ```
3576 <enabled/>
3577
3578 <data id="StartPage" value="none | homepage | previous-session"/>
3579 ```
3580 #### macOS
3581 ```
3582 <dict>
3583   <key>Homepage</key>
3584   <dict>
3585     <key>URL</key>
3586     <string>http://example.com</string>
3587     <key>Locked</key>
3588     <true/> | <false/>
3589     <key>Additional</key>
3590     <array>
3591       <string>http://example.org</string>
3592       <string>http://example.edu</string>
3593     </array>
3594     <key>StartPage</key>
3595     <string>none | homepage | previous-session | homepage-locked</string>
3596   </dict>
3597 </dict>
3598 ```
3599 #### policies.json
3600 ```
3601 {
3602   "policies": {
3603     "Homepage": {
3604       "URL": "http://example.com/",
3605       "Locked": true | false,
3606       "Additional": ["http://example.org/",
3607                      "http://example.edu/"],
3608       "StartPage": "none" | "homepage" | "previous-session" | "homepage-locked"
3609     }
3610   }
3611 }
3612 ```
3613 ### HttpAllowlist
3614 Configure sites that will not be upgraded to HTTPS.
3615
3616 The sites are specified as a list of origins.
3617
3618 **Compatibility:** Firefox 127\
3619 **CCK2 Equivalent:** N/A\
3620 **Preferences Affected:** N/A
3621
3622 #### Windows (GPO)
3623 ```
3624 Software\Policies\Mozilla\Firefox\HttpAllowlist\1 = "http://example.org"
3625 Software\Policies\Mozilla\Firefox\HttpAllowlist\2 = "http://example.edu"
3626 ```
3627 #### Windows (Intune)
3628 OMA-URI:
3629 ```
3630 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox/HttpAllowlist
3631 ```
3632 Value (string):
3633 ```
3634 <enabled/>
3635 <data id="List" value="1&#xF000;http://example.org&#xF000;2&#xF000;http://example.edu"/>
3636 ```
3637 #### macOS
3638 ```
3639 <dict>
3640   <key>HttpAllowlist </key>
3641   <array>
3642     <string>http://example.org</string>
3643     <string>http://example.edu</string>
3644   </array>
3645 </dict>
3646 ```
3647 #### policies.json
3648 ```
3649 {
3650   "policies": {
3651     "HttpAllowlist ": ["http://example.org",
3652                        "http://example.edu"]
3653   }
3654 }
3655 ```
3656 ### HttpsOnlyMode
3657 Configure HTTPS-Only Mode.
3658
3659 | Value | Description
3660 | --- | --- |
3661 | allowed | HTTPS-Only Mode is off by default, but the user can turn it on.
3662 | disallowed | HTTPS-Only Mode is off and the user can't turn it on.
3663 | enabled | HTTPS-Only Mode is on by default, but the user can turn it off.
3664 | force_enabled | HTTPS-Only Mode is on and the user can't turn it off.
3665
3666 **Compatibility:** Firefox 127\
3667 **CCK2 Equivalent:** N/A\
3668 **Preferences Affected:** `dom.security.https_only_mode`
3669
3670 #### Windows (GPO)
3671 ```
3672 Software\Policies\Mozilla\Firefox\HttpsOnlyMode = "allowed", "disallowed", "enabled", "force_enabled"
3673 ```
3674 #### Windows (Intune)
3675 OMA-URI:
3676 ```
3677 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox/HttpsOnlyMode
3678 ```
3679 Value (string):
3680 ```
3681 <enabled/>
3682 <data id="HttpsOnlyMode" value="allowed | disallowed | enabled | force_enabled"/>
3683 ```
3684 #### macOS
3685 ```
3686 <dict>
3687   <key>HttpsOnlyMode</key>
3688   <string>allowed | disallowed | enabled | force_enabled</string>
3689 </dict>
3690 ```
3691 #### policies.json
3692 ```
3693 {
3694   "policies": {
3695     "HttpsOnlyMode": "allowed" | "disallowed" | "enabled" | "force_enabled"
3696   }
3697 }
3698 ```
3699 ### InstallAddonsPermission
3700 Configure the default extension install policy as well as origins for extension installs are allowed. This policy does not override turning off all extension installs.
3701
3702 `Allow` is a list of origins where extension installs are allowed.
3703
3704 `Default` determines whether or not extension installs are allowed by default.
3705
3706 **Compatibility:** Firefox 60, Firefox ESR 60\
3707 **CCK2 Equivalent:** `permissions.install`\
3708 **Preferences Affected:** `xpinstall.enabled`, `browser.newtabpage.activity-stream.asrouter.userprefs.cfr.addons`, `browser.newtabpage.activity-stream.asrouter.userprefs.cfr.features`
3709
3710 #### Windows (GPO)
3711 ```
3712 Software\Policies\Mozilla\Firefox\InstallAddonsPermission\Allow\1 = "https://example.org"
3713 Software\Policies\Mozilla\Firefox\InstallAddonsPermission\Allow\2 = "https://example.edu"
3714 Software\Policies\Mozilla\Firefox\InstallAddonsPermission\Default = 0x1 | 0x0
3715 ```
3716 #### Windows (Intune)
3717 OMA-URI:
3718 ```
3719 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~Addons/InstallAddonsPermission_Allow
3720 ```
3721 Value (string):
3722 ```
3723 <enabled/>
3724 <data id="Permissions" value="1&#xF000;https://example.org&#xF000;2&#xF000;https://example.edu"/>
3725 ```
3726 OMA-URI:
3727 ```
3728 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~Addons/InstallAddonsPermission_Default
3729 ```
3730 Value (string):
3731 ```
3732 <enabled/>
3733 ```
3734 #### macOS
3735 ```
3736 <dict>
3737   <key>InstallAddonsPermission</key>
3738   <dict>
3739     <key>Allow</key>
3740     <array>
3741       <string>http://example.org</string>
3742       <string>http://example.edu</string>
3743     </array>
3744     <key>Default</key>
3745     <true/> | <false/>
3746   </dict>
3747 </dict>
3748 ```
3749 #### policies.json
3750 ```
3751 {
3752   "policies": {
3753     "InstallAddonsPermission": {
3754       "Allow": ["http://example.org/",
3755                 "http://example.edu/"],
3756       "Default": true | false
3757     }
3758   }
3759 }
3760 ```
3761 ### LegacyProfiles
3762 Disable the feature enforcing a separate profile for each installation.
3763
3764 If this policy set to true, Firefox will not try to create different profiles for installations of Firefox in different directories. This is the equivalent of the MOZ_LEGACY_PROFILES environment variable.
3765
3766 If this policy set to false, Firefox will create a new profile for each unique installation of Firefox.
3767
3768 This policy only work on Windows via GPO (not policies.json).
3769
3770 **Compatibility:** Firefox 70, Firefox ESR 68.2 (Windows only, GPO only)\
3771 **CCK2 Equivalent:** N/A\
3772 **Preferences Affected:** N/A
3773
3774 #### Windows (GPO)
3775 ```
3776 Software\Policies\Mozilla\Firefox\LegacyProfiles = = 0x1 | 0x0
3777 ```
3778 #### Windows (Intune)
3779 OMA-URI:
3780 ```
3781 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox/LegacyProfiles
3782 ```
3783 Value (string):
3784 ```
3785 <enabled/> or <disabled/>
3786 ```
3787 ### LegacySameSiteCookieBehaviorEnabled
3788 Enable default legacy SameSite cookie behavior setting.
3789
3790 If this policy is set to true, it reverts all cookies to legacy SameSite behavior which means that cookies that don't explicitly specify a ```SameSite``` attribute are treated as if they were ```SameSite=None```.
3791
3792 **Compatibility:** Firefox 96\
3793 **CCK2 Equivalent:** N/A\
3794 **Preferences Affected:** `network.cookie.sameSite.laxByDefault`
3795
3796 #### Windows (GPO)
3797 ```
3798 Software\Policies\Mozilla\Firefox\LegacySameSiteCookieBehaviorEnabled = = 0x1 | 0x0
3799 ```
3800 #### Windows (Intune)
3801 OMA-URI:
3802 ```
3803 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox/LegacySameSiteCookieBehaviorEnabled
3804 ```
3805 Value (string):
3806 ```
3807 <enabled/> or <disabled/>
3808 ```
3809 #### macOS
3810 ```
3811 <dict>
3812   <key>LegacySameSiteCookieBehaviorEnabled</key>
3813   <true/> | <false/>
3814 </dict>
3815 ```
3816 #### policies.json
3817 ```
3818 {
3819   "policies": {
3820     "LegacySameSiteCookieBehaviorEnabled": true | false
3821 }
3822 ```
3823 ### LegacySameSiteCookieBehaviorEnabledForDomainList
3824 Revert to legacy SameSite behavior for cookies on specified sites.
3825
3826 If this policy is set to true, cookies set for domains in this list will revert to legacy SameSite behavior which means that cookies that don't explicitly specify a ```SameSite``` attribute are treated as if they were ```SameSite=None```.
3827
3828 **Compatibility:** Firefox 96\
3829 **CCK2 Equivalent:** N/A\
3830 **Preferences Affected:** `network.cookie.sameSite.laxByDefault.disabledHosts`
3831
3832 #### Windows (GPO)
3833 ```
3834 Software\Policies\Mozilla\Firefox\LegacySameSiteCookieBehaviorEnabledForDomainList\1 = "example.org"
3835 Software\Policies\Mozilla\Firefox\LegacySameSiteCookieBehaviorEnabledForDomainList\2 = "example.edu"
3836 ```
3837 #### Windows (Intune)
3838 OMA-URI:
3839 ```
3840 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox/LegacySameSiteCookieBehaviorEnabledForDomainList
3841 ```
3842 Value (string):
3843 ```
3844 <enabled/>
3845 <data id="LegacySameSiteCookieBehaviorEnabledForDomainList" value="1&#xF000;example.org&#xF000;2&#xF000;example.edu"/>
3846 ```
3847 #### macOS
3848 ```
3849 <dict>
3850   <key>LegacySameSiteCookieBehaviorEnabledForDomainList</key>
3851   <array>
3852     <string>example.org</string>
3853     <string>example.edu</string>
3854   </array>
3855 </dict>
3856 ```
3857 #### policies.json
3858 ```
3859 {
3860   "policies": {
3861     "LegacySameSiteCookieBehaviorEnabledForDomainList": ["example.org",
3862                                                          "example.edu"]
3863   }
3864 }
3865 ```
3866 ### LocalFileLinks
3867 Enable linking to local files by origin.
3868
3869 **Compatibility:** Firefox 68, Firefox ESR 68\
3870 **CCK2 Equivalent:** N/A\
3871 **Preferences Affected:** `capability.policy.localfilelinks.*`
3872
3873 #### Windows (GPO)
3874 ```
3875 Software\Policies\Mozilla\Firefox\LocalFileLinks\1 = "https://example.org"
3876 Software\Policies\Mozilla\Firefox\LocalFileLinks\2 = "https://example.edu"
3877 ```
3878 #### Windows (Intune)
3879 OMA-URI:
3880 ```
3881 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox/LocalFileLinks
3882 ```
3883 Value (string):
3884 ```
3885 <enabled/>
3886 <data id="LocalFileLinks" value="1&#xF000;https://example.org&#xF000;2&#xF000;https://example.edu"/>
3887 ```
3888 #### macOS
3889 ```
3890 <dict>
3891   <key>LocalFileLinks</key>
3892   <array>
3893     <string>http://example.org</string>
3894     <string>http://example.edu</string>
3895   </array>
3896 </dict>
3897 ```
3898 #### policies.json
3899 ```
3900 {
3901   "policies": {
3902     "LocalFileLinks": ["http://example.org/",
3903                        "http://example.edu/"]
3904   }
3905 }
3906 ```
3907 ### ManagedBookmarks
3908 Configures a list of bookmarks managed by an administrator that cannot be changed by the user.
3909
3910 The bookmarks are only added as a button on the personal toolbar. They are not in the bookmarks folder.
3911
3912 The syntax of this policy is exactly the same as the [Chrome ManagedBookmarks policy](https://cloud.google.com/docs/chrome-enterprise/policies/?policy=ManagedBookmarks). The schema is:
3913 ```
3914 {
3915  "items": {
3916   "id": "BookmarkType",
3917   "properties": {
3918    "children": {
3919     "items": {
3920      "$ref": "BookmarkType"
3921     },
3922     "type": "array"
3923    },
3924    "name": {
3925     "type": "string"
3926    },
3927    "toplevel_name": {
3928     "type": "string"
3929    },
3930    "url": {
3931     "type": "string"
3932    }
3933   },
3934   "type": "object"
3935  },
3936  "type": "array"
3937 }
3938 ```
3939 **Compatibility:** Firefox 83, Firefox ESR 78.5\
3940 **CCK2 Equivalent:** N/A\
3941 **Preferences Affected:** N/A
3942
3943 #### Windows (GPO)
3944 Software\Policies\Mozilla\Firefox\ManagedBookmarks (REG_MULTI_SZ) =
3945 ```
3946 [
3947   {
3948     "toplevel_name": "My managed bookmarks folder"
3949   },
3950   {
3951     "url": "example.com",
3952     "name": "Example"
3953   },
3954   {
3955     "name": "Mozilla links",
3956     "children": [
3957       {
3958         "url": "https://mozilla.org",
3959         "name": "Mozilla.org"
3960       },
3961       {
3962         "url": "https://support.mozilla.org/",
3963         "name": "SUMO"
3964       }
3965     ]
3966   }
3967 ]
3968 ```
3969 #### Windows (Intune)
3970 OMA-URI:
3971 ```
3972 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox/ManagedBookmarks
3973 ```
3974 Value (string):
3975 ```
3976 <enabled/>
3977 <data id="JSON" value='
3978 [
3979   {
3980     "toplevel_name": "My managed bookmarks folder"
3981   },
3982   {
3983     "url": "example.com",
3984     "name": "Example"
3985   },
3986   {
3987     "name": "Mozilla links",
3988     "children": [
3989       {
3990         "url": "https://mozilla.org",
3991         "name": "Mozilla.org"
3992       },
3993       {
3994         "url": "https://support.mozilla.org/",
3995         "name": "SUMO"
3996       }
3997     ]
3998   }
3999 ]'/>
4000 ```
4001 If you are using custom ADMX and ADML administrative templates in Intune, you can use this OMA-URI instead
4002 to workaround the limit on the length of strings. Put all of your JSON on one line.
4003
4004 OMA-URI:
4005 ```
4006 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~Extensions/ManagedBoomarksOneLine
4007 ```
4008 Value (string):
4009 ```
4010 <enabled/>
4011 <data id="JSONOneLine" value='[]'/>
4012 ```
4013 #### macOS
4014 ```
4015 <dict>
4016   <key>ManagedBookmarks</key>
4017   <array>
4018     <dict>
4019       <key>toplevel_name</key>
4020       <string>My managed bookmarks folder</string>
4021       <dict>
4022         <key>url</key>
4023         <string>example.com</string>
4024         <key>name</key>
4025         <string>Example</string>
4026       </dict>
4027       <dict>
4028       <key>name</key>
4029       <string>Mozilla links</string>
4030       <key>children</key>
4031       <array>
4032         <dict>
4033           <key>url</key>
4034           <string>https://mozilla.org</string>
4035           <key>name</key>
4036           <string>Mozilla</string>
4037         </dict>
4038         <dict>
4039           <key>url</key>
4040           <string>https://support.mozilla.org/</string>
4041           <key>name</key>
4042           <string>SUMO</string>
4043         </dict>
4044       </array>
4045     </dict>
4046   </array>
4047 </dict>
4048 ```
4049 #### policies.json
4050 ```
4051 {
4052   "policies": {
4053     "ManagedBookmarks": [
4054       {
4055         "toplevel_name": "My managed bookmarks folder"
4056       },
4057       {
4058         "url": "example.com",
4059         "name": "Example"
4060       },
4061       {
4062         "name": "Mozilla links",
4063         "children": [
4064           {
4065             "url": "https://mozilla.org",
4066             "name": "Mozilla.org"
4067           },
4068           {
4069             "url": "https://support.mozilla.org/",
4070             "name": "SUMO"
4071           }
4072         ]
4073       }
4074     ]
4075   }
4076 }
4077 ```
4078 ### ManualAppUpdateOnly
4079
4080 Switch to manual updates only.
4081
4082 If this policy is enabled:
4083  1. The user will never be prompted to install updates
4084  2. Firefox will not check for updates in the background, though it will check automatically when an update UI is displayed (such as the one in the About dialog). This check will be used to show "Update to version X" in the UI, but will not automatically download the update or prompt the user to update in any other way.
4085  3. The update UI will work as expected, unlike when using DisableAppUpdate.
4086
4087 This policy is primarily intended for advanced end users, not for enterprises, but it is available via GPO.
4088
4089 **Compatibility:** Firefox 87\
4090 **CCK2 Equivalent:** N/A\
4091 **Preferences Affected:** N/A
4092
4093 #### Windows (GPO)
4094 ```
4095 Software\Policies\Mozilla\Firefox\ManualAppUpdateOnly = 0x1 | 0x0
4096 ```
4097 #### Windows (Intune)
4098 OMA-URI:
4099 ```
4100 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox/ManualAppUpdateOnly
4101 ```
4102 Value (string):
4103 ```
4104 <enabled/> or <disabled/>
4105 ```
4106 #### macOS
4107 ```
4108 <dict>
4109   <key>ManualAppUpdateOnly</key>
4110   <true/> | <false/>
4111 </dict>
4112 ```
4113 #### policies.json
4114 ```
4115 {
4116   "policies": {
4117     "ManualAppUpdateOnly": true | false
4118   }
4119 }
4120 ```
4121 ### NetworkPrediction
4122 Enable or disable network prediction (DNS prefetching).
4123
4124 **Compatibility:** Firefox 67, Firefox ESR 60.7\
4125 **CCK2 Equivalent:** N/A\
4126 **Preferences Affected:** `network.dns.disablePrefetch`, `network.dns.disablePrefetchFromHTTPS`
4127
4128 #### Windows (GPO)
4129 ```
4130 Software\Policies\Mozilla\Firefox\NetworkPrediction = 0x1 | 0x0
4131 ```
4132 #### Windows (Intune)
4133 OMA-URI:
4134 ```
4135 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox/NetworkPrediction
4136 ```
4137 Value (string):
4138 ```
4139 <enabled/> or <disabled/>
4140 ```
4141 #### macOS
4142 ```
4143 <dict>
4144   <key>NetworkPrediction</key>
4145   <true/> | <false/>
4146 </dict>
4147 ```
4148 #### policies.json
4149 ```
4150 {
4151   "policies": {
4152     "NetworkPrediction": true | false
4153 }
4154 ```
4155 ### NewTabPage
4156 Enable or disable the New Tab page.
4157
4158 **Compatibility:** Firefox 68, Firefox ESR 68\
4159 **CCK2 Equivalent:** N/A\
4160 **Preferences Affected:** `browser.newtabpage.enabled`
4161
4162 #### Windows (GPO)
4163 ```
4164 Software\Policies\Mozilla\Firefox\NewTabPage = 0x1 | 0x0
4165 ```
4166 #### Windows (Intune)
4167 OMA-URI:
4168 ```
4169 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox/NewTabPage
4170 ```
4171 Value (string):
4172 ```
4173 <enabled/> or <disabled/>
4174 ```
4175 #### macOS
4176 ```
4177 <dict>
4178   <key>NewTabPage</key>
4179   <true/> | <false/>
4180 </dict>
4181 ```
4182 #### policies.json
4183 ```
4184 {
4185   "policies": {
4186     "NewTabPage": true | false
4187 }
4188 ```
4189 ### NoDefaultBookmarks
4190 Disable the creation of default bookmarks.
4191
4192 This policy is only effective if the user profile has not been created yet.
4193
4194 **Compatibility:** Firefox 60, Firefox ESR 60\
4195 **CCK2 Equivalent:** `removeDefaultBookmarks`\
4196 **Preferences Affected:** N/A
4197
4198 #### Windows (GPO)
4199 ```
4200 Software\Policies\Mozilla\Firefox\NoDefaultBookmarks = 0x1 | 0x0
4201 ```
4202 #### Windows (Intune)
4203 OMA-URI:
4204 ```
4205 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox/NoDefaultBookmarks
4206 ```
4207 Value (string):
4208 ```
4209 <enabled/> or <disabled/>
4210 ```
4211 #### macOS
4212 ```
4213 <dict>
4214   <key>NoDefaultBookmarks</key>
4215   <true/> | <false/>
4216 </dict>
4217 ```
4218 #### policies.json
4219 ```
4220 {
4221   "policies": {
4222     "NoDefaultBookmarks": true | false
4223   }
4224 }
4225 ```
4226 ### OfferToSaveLogins
4227 Control whether or not Firefox offers to save passwords.
4228
4229 **Compatibility:** Firefox 60, Firefox ESR 60\
4230 **CCK2 Equivalent:** `dontRememberPasswords`\
4231 **Preferences Affected:** `signon.rememberSignons`
4232
4233 #### Windows (GPO)
4234 ```
4235 Software\Policies\Mozilla\Firefox\OfferToSaveLogins = 0x1 | 0x0
4236 ```
4237 #### Windows (Intune)
4238 OMA-URI:
4239 ```
4240 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox/OfferToSaveLogins
4241 ```
4242 Value (string):
4243 ```
4244 <enabled/> or <disabled/>
4245 ```
4246 #### macOS
4247 ```
4248 <dict>
4249   <key>OfferToSaveLogins</key>
4250   <true/> | <false/>
4251 </dict>
4252 ```
4253 #### policies.json
4254 ```
4255 {
4256   "policies": {
4257     "OfferToSaveLogins": true | false
4258   }
4259 }
4260 ```
4261 ### OfferToSaveLoginsDefault
4262 Sets the default value of signon.rememberSignons without locking it.
4263
4264 **Compatibility:** Firefox 70, Firefox ESR 60.2\
4265 **CCK2 Equivalent:** `dontRememberPasswords`\
4266 **Preferences Affected:** `signon.rememberSignons`
4267
4268 #### Windows (GPO)
4269 ```
4270 Software\Policies\Mozilla\Firefox\OfferToSaveLoginsDefault = 0x1 | 0x0
4271 ```
4272 #### Windows (Intune)
4273 OMA-URI:
4274 ```
4275 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox/OfferToSaveLoginsDefault
4276 ```
4277 Value (string):
4278 ```
4279 <enabled/> or <disabled/>
4280 ```
4281 #### macOS
4282 ```
4283 <dict>
4284   <key>OfferToSaveLoginsDefault</key>
4285   <true/> | <false/>
4286 </dict>
4287 ```
4288 #### policies.json
4289 ```
4290 {
4291   "policies": {
4292     "OfferToSaveLoginsDefault": true | false
4293   }
4294 }
4295 ```
4296 ### OverrideFirstRunPage
4297 Override the first run page. If the value is an empty string (""), the first run page is not displayed.
4298
4299 Starting with Firefox 83, Firefox ESR 78.5, you can also specify multiple URLS separated by a vertical bar (|).
4300
4301 **Compatibility:** Firefox 60, Firefox ESR 60\
4302 **CCK2 Equivalent:** `welcomePage`,`noWelcomePage`\
4303 **Preferences Affected:** `startup.homepage_welcome_url`
4304
4305 #### Windows (GPO)
4306 ```
4307 Software\Policies\Mozilla\Firefox\OverrideFirstRunPage = "http://example.org"
4308 ```
4309 #### Windows (Intune)
4310 OMA-URI:
4311 ```
4312 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox/OverrideFirstRunPage
4313 ```
4314 Value (string):
4315 ```
4316 <enabled/>
4317 <data id="OverridePage" value="https://example.com"/>
4318 ```
4319 #### macOS
4320 ```
4321 <dict>
4322   <key>OverrideFirstRunPage</key>
4323   <string>http://example.org</string>
4324 </dict>
4325 ```
4326 #### policies.json
4327 ```
4328 {
4329   "policies": {
4330     "OverrideFirstRunPage": "http://example.org"
4331   }
4332 }
4333 ```
4334 ### OverridePostUpdatePage
4335 Override the upgrade page. If the value is an empty string (""), no extra pages are displayed when Firefox is upgraded.
4336
4337 **Compatibility:** Firefox 60, Firefox ESR 60\
4338 **CCK2 Equivalent:** `upgradePage`,`noUpgradePage`\
4339 **Preferences Affected:** `startup.homepage_override_url`
4340
4341 #### Windows (GPO)
4342 ```
4343 Software\Policies\Mozilla\Firefox\OverridePostUpdatePage = "http://example.org"
4344 ```
4345 #### Windows (Intune)
4346 OMA-URI:
4347 ```
4348 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox/OverridePostUpdatePage
4349 ```
4350 Value (string):
4351 ```
4352 <enabled/>
4353 <data id="OverridePage" value="https://example.com"/>
4354 ```
4355 #### macOS
4356 ```
4357 <dict>
4358   <key>OverridePostUpdatePage</key>
4359   <string>http://example.org</string>
4360 </dict>
4361 ```
4362 #### policies.json
4363 ```
4364 {
4365   "policies": {
4366     "OverridePostUpdatePage": "http://example.org"
4367   }
4368 }
4369 ```
4370 ### PasswordManagerEnabled
4371 Remove access to the password manager via preferences and blocks about:logins on Firefox 70.
4372
4373 **Compatibility:** Firefox 70, Firefox ESR 60.2\
4374 **CCK2 Equivalent:** N/A\
4375 **Preferences Affected:** `pref.privacy.disable_button.view_passwords`
4376
4377 #### Windows (GPO)
4378 ```
4379 Software\Policies\Mozilla\Firefox\PasswordManagerEnabled = 0x1 | 0x0
4380 ```
4381 #### Windows (Intune)
4382 OMA-URI:
4383 ```
4384 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox/PasswordManagerEnabled
4385 ```
4386 Value (string):
4387 ```
4388 <enabled/> or <disabled/>
4389 ```
4390 #### macOS
4391 ```
4392 <dict>
4393   <key>PasswordManagerEnabled</key>
4394   <true/> | <false/>
4395 </dict>
4396 ```
4397 #### policies.json
4398 ```
4399 {
4400   "policies": {
4401     "PasswordManagerEnabled": true | false
4402   }
4403 }
4404 ```
4405 ### PasswordManagerExceptions
4406 Prevent Firefox from saving passwords for specific sites.
4407
4408 The sites are specified as a list of origins.
4409
4410 **Compatibility:** Firefox 101\
4411 **CCK2 Equivalent:** N/A\
4412 **Preferences Affected:** N/A
4413
4414 #### Windows (GPO)
4415 ```
4416 Software\Policies\Mozilla\Firefox\PasswordManagerExceptions\1 = "https://example.org"
4417 Software\Policies\Mozilla\Firefox\PasswordManagerExceptions\2 = "https://example.edu"
4418 ```
4419 #### Windows (Intune)
4420 OMA-URI:
4421 ```
4422 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox/PasswordManagerExceptions
4423 ```
4424 Value (string):
4425 ```
4426 <enabled/>
4427 <data id="List" value="1&#xF000;https://example.org&#xF000;2&#xF000;https://example.edu"/>
4428 ```
4429 #### macOS
4430 ```
4431 <dict>
4432   <key>PasswordManagerExceptions</key>
4433   <array>
4434     <string>https://example.org</string>
4435     <string>https://example.edu</string>
4436   </array>
4437 </dict>
4438 ```
4439 #### policies.json
4440 ```
4441 {
4442   "policies": {
4443     "PasswordManagerExceptions": ["https://example.org",
4444                                   "https://example.edu"]
4445   }
4446 }
4447 ```
4448 ### PDFjs
4449 Disable or configure PDF.js, the built-in PDF viewer.
4450
4451 If `Enabled` is set to false, the built-in PDF viewer is disabled.
4452
4453 If `EnablePermissions` is set to true, the built-in PDF viewer will honor document permissions like preventing the copying of text.
4454
4455 Note: DisableBuiltinPDFViewer has not been deprecated. You can either continue to use it, or switch to using PDFjs->Enabled to disable the built-in PDF viewer. This new permission was added because we needed a place for PDFjs->EnabledPermissions.
4456
4457 **Compatibility:** Firefox 77, Firefox ESR 68.9\
4458 **CCK2 Equivalent:** N/A\
4459 **Preferences Affected:** `pdfjs.disabled`, `pdfjs.enablePermissions`
4460
4461 #### Windows (GPO)
4462 ```
4463 Software\Policies\Mozilla\Firefox\PDFjs\Enabled = 0x1 | 0x0
4464 Software\Policies\Mozilla\Firefox\PDFjs\EnablePermissions = 0x1 | 0x0
4465 ```
4466 #### Windows (Intune)
4467 OMA-URI:
4468 ```
4469 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~PDFjs/PDFjs_Enabled
4470 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~PDFjs/PDFjs_EnablePermissions
4471 ```
4472 Value (string):
4473 ```
4474 <enabled/>or <disabled/>
4475 ```
4476 #### macOS
4477 ```
4478 <dict>
4479   <key>PDFjs</key>
4480   <dict>
4481     <key>Enabled</key>
4482     <true/> | <false/>
4483     <key>EnablePermissions</key>
4484     <true/> | <false/>
4485   </dict>
4486 </dict>
4487 ```
4488 #### policies.json
4489 ```
4490 {
4491   "policies": {
4492     "PDFjs": {
4493       "Enabled": true | false,
4494       "EnablePermissions": true | false
4495     }
4496   }
4497 }
4498 ```
4499 ### Permissions
4500 Set permissions associated with camera, microphone, location, notifications, autoplay, and virtual reality. Because these are origins, not domains, entries with unique ports must be specified separately. This explicitly means that it is not possible to add wildcards. See examples below.
4501
4502 `Allow` is a list of origins where the feature is allowed.
4503
4504 `Block` is a list of origins where the feature is not allowed.
4505
4506 `BlockNewRequests` determines whether or not new requests can be made for the feature.
4507
4508 `Locked` prevents the user from changing preferences for the feature.
4509
4510 `Default` specifies the default value for Autoplay. block-audio-video is not supported on Firefox ESR 68.
4511
4512 **Compatibility:** Firefox 62, Firefox ESR 60.2 (Autoplay added in Firefox 74, Firefox ESR 68.6, Autoplay Default/Locked added in Firefox 76, Firefox ESR 68.8, VirtualReality added in Firefox 80, Firefox ESR 78.2)\
4513 **CCK2 Equivalent:** N/A\
4514 **Preferences Affected:** `permissions.default.camera`, `permissions.default.microphone`, `permissions.default.geo`, `permissions.default.desktop-notification`, `media.autoplay.default`, `permissions.default.xr`
4515
4516 #### Windows (GPO)
4517 ```
4518 Software\Policies\Mozilla\Firefox\Permissions\Camera\Allow\1 = "https://example.org"
4519 Software\Policies\Mozilla\Firefox\Permissions\Camera\Allow\2 = "https://example.org:1234"
4520 Software\Policies\Mozilla\Firefox\Permissions\Camera\Block\1 = "https://example.edu"
4521 Software\Policies\Mozilla\Firefox\Permissions\Camera\BlockNewRequests = 0x1 | 0x0
4522 Software\Policies\Mozilla\Firefox\Permissions\Camera\Locked = 0x1 | 0x0
4523 Software\Policies\Mozilla\Firefox\Permissions\Microphone\Allow\1 = "https://example.org"
4524 Software\Policies\Mozilla\Firefox\Permissions\Microphone\Block\1 = "https://example.edu"
4525 Software\Policies\Mozilla\Firefox\Permissions\Microphone\BlockNewRequests = 0x1 | 0x0
4526 Software\Policies\Mozilla\Firefox\Permissions\Microphone\Locked = 0x1 | 0x0
4527 Software\Policies\Mozilla\Firefox\Permissions\Location\Allow\1 = "https://example.org"
4528 Software\Policies\Mozilla\Firefox\Permissions\Location\Block\1 = "https://example.edu"
4529 Software\Policies\Mozilla\Firefox\Permissions\Location\BlockNewRequests = 0x1 | 0x0
4530 Software\Policies\Mozilla\Firefox\Permissions\Location\Locked = 0x1 | 0x0
4531 Software\Policies\Mozilla\Firefox\Permissions\Notifications\Allow\1 = "https://example.org"
4532 Software\Policies\Mozilla\Firefox\Permissions\Notifications\Block\1 = "https://example.edu"
4533 Software\Policies\Mozilla\Firefox\Permissions\Notifications\BlockNewRequests = 0x1 | 0x0
4534 Software\Policies\Mozilla\Firefox\Permissions\Notifications\Locked = 0x1 | 0x0
4535 Software\Policies\Mozilla\Firefox\Permissions\Autoplay\Allow\1 = "https://example.org"
4536 Software\Policies\Mozilla\Firefox\Permissions\Autoplay\Block\1 = "https://example.edu"
4537 Software\Policies\Mozilla\Firefox\Permissions\Autoplay\Default = "allow-audio-video" | "block-audio" | "block-audio-video"
4538 Software\Policies\Mozilla\Firefox\Permissions\Autoplay\Locked = 0x1 | 0x0
4539 Software\Policies\Mozilla\Firefox\Permissions\VirtualReality\Allow\1 = "https://example.org"
4540 Software\Policies\Mozilla\Firefox\Permissions\VirtualReality\Block\1 = "https://example.edu"
4541 Software\Policies\Mozilla\Firefox\Permissions\VirtualReality\BlockNewRequests = 0x1 | 0x0
4542 Software\Policies\Mozilla\Firefox\Permissions\VirtualReality\Locked = 0x1 | 0x0
4543 ```
4544 #### Windows (Intune)
4545 OMA-URI:
4546 ```
4547 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~Permissions~Location/Location_BlockNewRequests
4548 ```
4549 Value (string):
4550 ```
4551 <enabled/> or <disabled/>
4552 ```
4553 OMA-URI:
4554 ```
4555 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~Permissions~Location/Location_Locked
4556 ```
4557 Value (string):
4558 ```
4559 <enabled/> or <disabled/>
4560 ```
4561 OMA-URI:
4562 ```
4563 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~Permissions~Notifications/Notifications_Allow
4564 ```
4565 Value (string):
4566 ```
4567 <enabled/>
4568 <data id="Permissions" value="1&#xF000;https://example.org"/>
4569 ```
4570 OMA-URI:
4571 ```
4572 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~Permissions~Notifications/Notifications_BlockNewRequests
4573 ```
4574 Value (string):
4575 ```
4576 <enabled/> or <disabled/>
4577 ```
4578 OMA-URI:
4579 ```
4580 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~Permissions~Notifications/Notifications_Locked
4581 ```
4582 Value (string):
4583 ```
4584 <enabled/> or <disabled/>
4585 ```
4586 OMA-URI:
4587 ```
4588 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~Permissions~Autoplay/Autoplay_Allow
4589 ```
4590 Value (string):
4591 ```
4592 <enabled/>
4593 <data id="Permissions" value="1&#xF000;https://example.org"/>
4594 ```
4595 OMA-URI:
4596 ```
4597 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~Permissions~Autoplay/Autoplay_Block
4598 ```
4599 Value (string):
4600 ```
4601 <enabled/>
4602 <data id="Permissions" value="1&#xF000;https://example.edu"/>
4603 ```
4604 OMA-URI:
4605 ```
4606 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~Permissions~Autoplay/Autoplay_Default
4607 ```
4608 Value (string):
4609 ```
4610 <enabled/>
4611 <data id="Autoplay_Default" value="allow-audio-video | block-audio | block-audio-video"/>
4612 ```
4613 OMA-URI:
4614 ```
4615 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~Permissions~Autoplay/Autoplay_Locked
4616 ```
4617 Value (string):
4618 ```
4619 <enabled/> or <disabled/>
4620 ```
4621 OMA-URI:
4622 ```
4623 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~Permissions~Notifications/VirtualReality_Allow
4624 ```
4625 Value (string):
4626 ```
4627 <enabled/>
4628 <data id="Permissions" value="1&#xF000;https://example.org"/>
4629 ```
4630 OMA-URI:
4631 ```
4632 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~Permissions~Notifications/VirtualReality_Block
4633 ```
4634 Value (string):
4635 ```
4636 <enabled/>
4637 <data id="Permissions" value="1&#xF000;https://example.edu"/>
4638 ```
4639 OMA-URI:
4640 ```
4641 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~Permissions~Notifications/VirtualReality_BlockNewRequests
4642 ```
4643 Value (string):
4644 ```
4645 <enabled/> or <disabled/>
4646 ```
4647 OMA-URI:
4648 ```
4649 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~Permissions~Notifications/VirtualReality_Locked
4650 ```
4651 Value (string):
4652 ```
4653 <enabled/> or <disabled/>
4654 ```
4655 #### macOS
4656 ```
4657 <dict>
4658   <key>Permissions</key>
4659   <dict>
4660     <key>Camera</key>
4661     <dict>
4662       <key>Allow</key>
4663       <array>
4664         <string>https://example.org</string>
4665         <string>https://example.org:1234</string>
4666       </array>
4667       <key>Block</key>
4668       <array>
4669         <string>https://example.edu</string>
4670       </array>
4671       <key>BlockNewRequests</key>
4672       <true/> | <false/>
4673       <key>Locked</key>
4674       <true/> | <false/>
4675     </dict>
4676     <key>Microphone</key>
4677     <dict>
4678       <key>Allow</key>
4679       <array>
4680         <string>https://example.org</string>
4681       </array>
4682       <key>Block</key>
4683       <array>
4684         <string>https://example.edu</string>
4685       </array>
4686       <key>BlockNewRequests</key>
4687       <true/> | <false/>
4688       <key>Locked</key>
4689       <true/> | <false/>
4690     </dict>
4691     <key>Location</key>
4692     <dict>
4693       <key>Allow</key>
4694       <array>
4695         <string>https://example.org</string>
4696       </array>
4697       <key>Block</key>
4698       <array>
4699         <string>https://example.edu</string>
4700       </array>
4701       <key>BlockNewRequests</key>
4702       <true/> | <false/>
4703       <key>Locked</key>
4704       <true/> | <false/>
4705     </dict>
4706     <key>Notifications</key>
4707     <dict>
4708       <key>Allow</key>
4709       <array>
4710         <string>https://example.org</string>
4711       </array>
4712       <key>Block</key>
4713       <array>
4714         <string>https://example.edu</string>
4715       </array>
4716       <key>BlockNewRequests</key>
4717       <true/>
4718       <key>Locked</key>
4719       <true/>
4720     </dict>
4721     <key>Autoplay</key>
4722     <dict>
4723       <key>Allow</key>
4724       <array>
4725         <string>https://example.org</string>
4726       </array>
4727       <key>Block</key>
4728       <array>
4729         <string>https://example.edu</string>
4730       </array>
4731       <key>Default</key>
4732       <string>allow-audio-video | block-audio | block-audio-video</string>
4733       <key>Locked</key>
4734       <true/> | <false/>
4735     </dict>
4736   </dict>
4737 </dict>
4738 ```
4739 #### policies.json
4740 ```
4741 {
4742   "policies": {
4743     "Permissions": {
4744       "Camera": {
4745         "Allow": ["https://example.org","https://example.org:1234"],
4746         "Block": ["https://example.edu"],
4747         "BlockNewRequests": true | false,
4748         "Locked": true | false
4749       },
4750       "Microphone": {
4751         "Allow": ["https://example.org"],
4752         "Block": ["https://example.edu"],
4753         "BlockNewRequests": true | false,
4754         "Locked": true | false
4755       },
4756       "Location": {
4757         "Allow": ["https://example.org"],
4758         "Block": ["https://example.edu"],
4759         "BlockNewRequests": true | false,
4760         "Locked": true | false
4761       },
4762       "Notifications": {
4763         "Allow": ["https://example.org"],
4764         "Block": ["https://example.edu"],
4765         "BlockNewRequests": true | false,
4766         "Locked": true | false
4767       },
4768       "Autoplay": {
4769         "Allow": ["https://example.org"],
4770         "Block": ["https://example.edu"],
4771         "Default": "allow-audio-video" | "block-audio" | "block-audio-video",
4772         "Locked": true | false
4773       }
4774     }
4775   }
4776 }
4777 ```
4778 ### PictureInPicture
4779
4780 Enable or disable Picture-in-Picture as well as prevent the user from enabling or disabling it (Locked).
4781
4782 **Compatibility:** Firefox 78, Firefox ESR 78\
4783 **CCK2 Equivalent:** N/A\
4784 **Preferences Affected:** `media.videocontrols.picture-in-picture.video-toggle.enabled`
4785
4786 #### Windows (GPO)
4787 ```
4788 Software\Policies\Mozilla\Firefox\PictureInPicture\Enabled = 0x1 | 0x0
4789 Software\Policies\Mozilla\Firefox\PictureInPicture\Locked = 0x1 | 0x0
4790
4791 ```
4792 #### Windows (Intune)
4793 OMA-URI:
4794 ```
4795 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~PictureInPicture/PictureInPicture_Enabled
4796 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~PictureInPicture/PictureInPicture_Locked
4797 ```
4798 Value (string):
4799 ```
4800 <enabled/> or <disabled/>
4801 ```
4802 #### macOS
4803 ```
4804 <dict>
4805   <key>PictureInPicture</key>
4806   <dict>
4807     <key>Enabled</key>
4808     <true/> | <false/>
4809     <key>Locked</key>
4810     <true/> | <false/>
4811   </dict>
4812 </dict>
4813 ```
4814 #### policies.json
4815 ```
4816 {
4817   "policies": {
4818     "PictureInPicture": {
4819       "Enabled": true | false,
4820       "Locked": true | false
4821     }
4822   }
4823 }
4824 ```
4825 ### PopupBlocking
4826 Configure the default pop-up window policy as well as origins for which pop-up windows are allowed.
4827
4828 `Allow` is a list of origins where popup-windows are allowed.
4829
4830 `Default` determines whether or not pop-up windows are allowed by default.
4831
4832 `Locked` prevents the user from changing pop-up preferences.
4833
4834 **Compatibility:** Firefox 60, Firefox ESR 60\
4835 **CCK2 Equivalent:** `permissions.popup`\
4836 **Preferences Affected:** `dom.disable_open_during_load`
4837
4838 #### Windows (GPO)
4839 ```
4840 Software\Policies\Mozilla\Firefox\PopupBlocking\Allow\1 = "https://example.org"
4841 Software\Policies\Mozilla\Firefox\PopupBlocking\Allow\2 = "https://example.edu"
4842 Software\Policies\Mozilla\Firefox\PopupBlocking\Default = 0x1 | 0x0
4843 Software\Policies\Mozilla\Firefox\PopupBlocking\Locked = 0x1 | 0x0
4844 ```
4845 #### Windows (Intune)
4846 OMA-URI:
4847 ```
4848 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~Popups/PopupBlocking_Allow
4849 ```
4850 Value (string):
4851 ```
4852 <enabled/>
4853 <data id="Permissions" value="1&#xF000;https://example.org&#xF000;2&#xF000;https://example.edu"/>
4854 ```
4855 OMA-URI:
4856 ```
4857 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~Popups/PopupBlocking_Default
4858 ```
4859 Value (string):
4860 ```
4861 <enabled/> or <disabled/>
4862 ```
4863 OMA-URI:
4864 ```
4865 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~Popups/PopupBlocking_Locked
4866 ```
4867 Value (string):
4868 ```
4869 <enabled/> or <disabled/>
4870 ```
4871 #### macOS
4872 ```
4873 <dict>
4874   <key>PopupBlocking</key>
4875   <dict>
4876     <key>Allow</key>
4877     <array>
4878       <string>http://example.org</string>
4879       <string>http://example.edu</string>
4880     </array>
4881     <key>Default</key>
4882     <true/> | <false/>
4883     <key>Locked</key>
4884     <true/> | <false/>
4885   </dict>
4886 </dict>
4887 ```
4888 #### policies.json
4889 ```
4890 {
4891   "policies": {
4892     "PopupBlocking": {
4893       "Allow": ["http://example.org/",
4894                 "http://example.edu/"],
4895       "Default": true | false,
4896       "Locked": true | false
4897     }
4898   }
4899 }
4900 ```
4901 ### PostQuantumKeyAgreementEnabled
4902 Enable post-quantum key agreement for TLS.
4903
4904 **Compatibility:** Firefox 127\
4905 **CCK2 Equivalent:** N/A\
4906 **Preferences Affected:** `security.tls.enable_kyber`, `network.http.http3.enable_kyber` (Firefox 128)
4907
4908 #### Windows (GPO)
4909 ```
4910 Software\Policies\Mozilla\Firefox\PostQuantumKeyAgreementEnabled = 0x1 | 0x0
4911 ```
4912 #### Windows (Intune)
4913 OMA-URI:
4914 ```
4915 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox/PostQuantumKeyAgreementEnabled
4916 ```
4917 Value (string):
4918 ```
4919 <enabled/> or <disabled/>
4920 ```
4921 #### macOS
4922 ```
4923 <dict>
4924   <key>PostQuantumKeyAgreementEnabled</key>
4925   <true/> | <false/>
4926 </dict>
4927 ```
4928 #### policies.json
4929 ```
4930 {
4931   "policies": {
4932     "PostQuantumKeyAgreementEnabled": true | false
4933   }
4934 }
4935 ```
4936 ### Preferences
4937 Set and lock preferences.
4938
4939 **NOTE** On Windows, in order to use this policy, you must clear all settings in the old **Preferences (Deprecated)** section in group policy.
4940
4941 Previously you could only set and lock a subset of preferences. Starting with Firefox 81 and Firefox ESR 78.3 you can set many more preferences. You can also set default preferences, user preferences and you can clear preferences.
4942
4943 Preferences that start with the following prefixes are supported:
4944 ```
4945 accessibility.
4946 alerts.* (Firefox 122, Firefox ESR 115.7)
4947 app.update.* (Firefox 86, Firefox ESR 78.8)
4948 browser.
4949 datareporting.policy.
4950 dom.
4951 extensions.
4952 general.autoScroll (Firefox 83, Firefox ESR 78.5)
4953 general.smoothScroll (Firefox 83, Firefox ESR 78.5)
4954 geo.
4955 gfx.
4956 intl.
4957 keyword.enabled (Firefox 95, Firefox ESR 91.4)
4958 layers.
4959 layout.
4960 media.
4961 network.
4962 pdfjs. (Firefox 84, Firefox ESR 78.6)
4963 places.
4964 pref.
4965 print.
4966 privacy.globalprivacycontrol.enabled (Firefox 127, Firefox ESR 128.0)
4967 privacy.userContext.enabled (Firefox 126, Firefox ESR 115.11)
4968 privacy.userContext.ui.enabled (Firefox 126, Firefox ESR 115.11)
4969 signon. (Firefox 83, Firefox ESR 78.5)
4970 spellchecker. (Firefox 84, Firefox ESR 78.6)
4971 toolkit.legacyUserProfileCustomizations.stylesheets (Firefox 95, Firefox ESR 91.4)
4972 ui.
4973 widget.
4974 xpinstall.signatures.required (Firefox ESR 102.10, Firefox ESR only)
4975 xpinstall.whitelist.required (Firefox 118, Firefox ESR 115.3)
4976 ```
4977 as well as the following security preferences:
4978
4979 | Preference | Type | Default
4980 | --- | --- | --- |
4981 | security.default_personal_cert | string | Ask Every Time
4982 | &nbsp;&nbsp;&nbsp;&nbsp;If set to Select Automatically, Firefox automatically chooses the default personal certificate.
4983 | security.disable_button.openCertManager | string | N/A
4984 | &nbsp;&nbsp;&nbsp;&nbsp;If set to true and locked, the View Certificates button in preferences is disabled (Firefox 121, Firefox ESR 115.6)
4985 | security.disable_button.openDeviceManager | string | N/A
4986 | &nbsp;&nbsp;&nbsp;&nbsp;If set to true and locked, the Security Devices button in preferences is disabled (Firefox 121, Firefox ESR 115.6)
4987 | security.insecure_connection_text.enabled | bool | false
4988 | &nbsp;&nbsp;&nbsp;&nbsp;If set to true, adds the words "Not Secure" for insecure sites.
4989 | security.insecure_connection_text.pbmode.enabled | bool | false
4990 | &nbsp;&nbsp;&nbsp;&nbsp;If set to true, adds the words "Not Secure" for insecure sites in private browsing.
4991 | security.mixed_content.block_active_content | boolean | true
4992 | &nbsp;&nbsp;&nbsp;&nbsp;If set to true, mixed active content (HTTP subresources such as scripts, fetch requests, etc. on a HTTPS page) will be blocked.
4993 | security.mixed_content.block_display_content | boolean | false
4994 | &nbsp;&nbsp;&nbsp;&nbsp;If set to true, mixed passive/display content (HTTP subresources such as images, videos, etc. on a HTTPS page) will be blocked. (Firefox 127, Firefox ESR 128.0)
4995 | security.mixed_content.upgrade_display_content | boolean | true
4996 | &nbsp;&nbsp;&nbsp;&nbsp;If set to true, mixed passive/display content (HTTP subresources such as images, videos, etc. on a HTTPS page) will be upgraded to HTTPS. (Firefox 127, Firefox ESR 128.0)
4997 | security.osclientcerts.autoload | boolean | false
4998 | &nbsp;&nbsp;&nbsp;&nbsp;If true, client certificates are loaded from the operating system certificate store.
4999 | security.OCSP.enabled | integer | 1
5000 | &nbsp;&nbsp;&nbsp;&nbsp;If 0, do not fetch OCSP. If 1, fetch OCSP for DV and EV certificates. If 2, fetch OCSP only for EV certificates.
5001 | security.OCSP.require | boolean | false
5002 | &nbsp;&nbsp;&nbsp;&nbsp; If true, if an OCSP request times out, the connection fails.
5003 | security.osclientcerts.assume_rsa_pss_support | boolean | true
5004 | &nbsp;&nbsp;&nbsp;&nbsp; If false, we don't assume an RSA key can do RSA-PSS. (Firefox 114, Firefox ESR 102.12)
5005 | security.ssl.enable_ocsp_stapling | boolean | true
5006 | &nbsp;&nbsp;&nbsp;&nbsp; If false, OCSP stapling is not enabled.
5007 | security.ssl.errorReporting.enabled | boolean | true
5008 | &nbsp;&nbsp;&nbsp;&nbsp;If false, SSL errors cannot be sent to Mozilla.
5009 | security.ssl.require_safe_negotiation | boolean | false
5010 | &nbsp;&nbsp;&nbsp;&nbsp;If true, Firefox will only negotiate TLS connections with servers that indicate they support secure renegotiation. (Firefox 118, Firefox ESR 115.3)
5011 | security.tls.enable_0rtt_data | boolean | true
5012 | &nbsp;&nbsp;&nbsp;&nbsp;If false, TLS early data is turned off. (Firefox 93, Firefox 91.2, Firefox 78.15)
5013 | security.tls.hello_downgrade_check | boolean | true
5014 | &nbsp;&nbsp;&nbsp;&nbsp;If false, the TLS 1.3 downgrade check is disabled.
5015 | security.tls.version.enable-deprecated | boolean | false
5016 | &nbsp;&nbsp;&nbsp;&nbsp;If true, browser will accept TLS 1.0. and TLS 1.1. (Firefox 86, Firefox 78.8)
5017 | security.warn_submit_secure_to_insecure | boolean | true
5018 | &nbsp;&nbsp;&nbsp;&nbsp;If false, no warning is shown when submitting a form from https to http.
5019
5020 Using the preference as the key, set the `Value` to the corresponding preference value.
5021
5022 `Status` can be "default", "locked", "user" or "clear"
5023
5024 * `"default"`: Read/Write: Settings appear as default even if factory default differs.
5025 * `"locked"`: Read-Only: Settings appear as default even if factory default differs.
5026 * `"user"`: Read/Write: Settings appear as changed if it differs from factory default.
5027 * `"clear"`: Read/Write: `Value` has no effect. Resets to factory defaults on each startup.
5028
5029 `"user"` preferences persist across invocations of Firefox. It is the equivalent of a user setting the preference. They are most useful when a preference is needed very early in startup so it can't be set as default by policy. An example of this is ```toolkit.legacyUserProfileCustomizations.stylesheets```.
5030
5031 `"user"` preferences persist even if the policy is removed, so if you need to remove them, you should use the clear policy.
5032
5033 You can also set the `Type` starting in Firefox 123 and Firefox ESR 115.8. It can be `number`, `boolean` or `string`. This is especially useful if you are seeing 0 or 1 values being converted to booleans when set as user preferences.
5034
5035 See the examples below for more detail.
5036
5037 IMPORTANT: Make sure you're only setting a particular preference using this mechanism and not some other way.
5038
5039 Status
5040 **Compatibility:** Firefox 81, Firefox ESR 78.3\
5041 **CCK2 Equivalent:** `preferences`\
5042 **Preferences Affected:** Many
5043
5044 #### Windows (GPO)
5045 Software\Policies\Mozilla\Firefox\Preferences (REG_MULTI_SZ) =
5046 ```
5047 {
5048   "accessibility.force_disabled": {
5049     "Value": 1,
5050     "Status": "default",
5051     "Type": "number"
5052
5053   },
5054   "browser.cache.disk.parent_directory": {
5055     "Value": "SOME_NATIVE_PATH",
5056     "Status": "user"
5057   },
5058   "browser.tabs.warnOnClose": {
5059     "Value": false,
5060     "Status": "locked"
5061   }
5062 }
5063 ```
5064 #### Windows (Intune)
5065 OMA-URI:
5066 ```
5067 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox/Preferences
5068 ```
5069 Value (string):
5070 ```
5071 <enabled/>
5072 <data id="JSON" value='
5073 {
5074   "accessibility.force_disabled": {
5075     "Value": 1,
5076     "Status": "default",
5077     "Type": "number"
5078   },
5079   "browser.cache.disk.parent_directory": {
5080     "Value": "SOME_NATIVE_PATH",
5081     "Status": "user"
5082   },
5083   "browser.tabs.warnOnClose": {
5084     "Value": false,
5085     "Status": "locked"
5086   }
5087 }'/>
5088 ```
5089 If you are using custom ADMX and ADML administrative templates in Intune, you can use this OMA-URI instead
5090 to workaround the limit on the length of strings. Put all of your JSON on one line.
5091
5092 OMA-URI:
5093 ```
5094 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~Extensions/PreferencesOneLine
5095 ```
5096 Value (string):
5097 ```
5098 <enabled/>
5099 <data id="JSONOneLine" value='{}'/>
5100 ```
5101 #### macOS
5102 ```
5103 <dict>
5104   <key>Preferences</key>
5105   <dict>
5106     <key>accessibility.force_disabled</key>
5107     <dict>
5108       <key>Value</key>
5109       <integer>1</integer>
5110       <key>Status</key>
5111       <string>default</string>
5112       <key>Type</key>
5113       <string>number</string>
5114     </dict>
5115     <key>browser.cache.disk.parent_directory</key>
5116     <dict>
5117       <key>Value</key>
5118       <string>SOME_NATIVE_PATH</string>
5119       <key>Status</key>
5120       <string>user</string>
5121     </dict>
5122     <key>browser.tabs.warnOnClose</key>
5123     <dict>
5124       <key>Value</key>
5125       <false/>
5126       <key>Status</key>
5127       <string>locked</string>
5128     </dict>
5129   </dict>
5130 </dict>
5131 ```
5132 #### policies.json
5133 ```
5134 {
5135   "policies": {
5136     "Preferences": {
5137       "accessibility.force_disabled": {
5138         "Value": 1,
5139         "Status": "default"
5140         "Type": "number"
5141       },
5142       "browser.cache.disk.parent_directory": {
5143         "Value": "SOME_NATIVE_PATH",
5144         "Status": "user"
5145       },
5146       "browser.tabs.warnOnClose": {
5147         "Value": false,
5148         "Status": "locked"
5149       }
5150     }
5151   }
5152 }
5153 ```
5154 ### PrimaryPassword
5155 Require or prevent using a primary (formerly master) password.
5156
5157 If this value is true, a primary password is required. If this value is false, it works the same as if [`DisableMasterPasswordCreation`](#disablemasterpasswordcreation) was true and removes the primary password functionality.
5158
5159 If both DisableMasterPasswordCreation and PrimaryPassword are used, DisableMasterPasswordCreation takes precedent.
5160
5161 **Compatibility:** Firefox 79, Firefox ESR 78.1\
5162 **CCK2 Equivalent:** `noMasterPassword`\
5163 **Preferences Affected:** N/A
5164
5165 #### Windows (GPO)
5166 ```
5167 Software\Policies\Mozilla\Firefox\PrimaryPassword = 0x1 | 0x0
5168 ```
5169 #### Windows (Intune)
5170 OMA-URI:
5171 ```
5172 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox/PrimaryPassword
5173 ```
5174 Value (string):
5175 ```
5176 <enabled/> or <disabled/>
5177 ```
5178 #### macOS
5179 ```
5180 <dict>
5181   <key>PrimaryPassword</key>
5182   <true/> | <false/>
5183 </dict>
5184 ```
5185 #### policies.json
5186 ```
5187 {
5188   "policies": {
5189     "PrimaryPassword": true | false
5190   }
5191 }
5192 ```
5193 ### PrintingEnabled
5194 Enable or disable printing.
5195
5196 **Compatibility:** Firefox 120, Firefox ESR 115.5\
5197 **CCK2 Equivalent:** N/A\
5198 **Preferences Affected:** `print.enabled`
5199
5200 #### Windows (GPO)
5201 ```
5202 Software\Policies\Mozilla\Firefox\PrintingEnabled = 0x1 | 0x0
5203 ```
5204 #### Windows (Intune)
5205 OMA-URI:
5206 ```
5207 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox/PrintingEnabled
5208 ```
5209 Value (string):
5210 ```
5211 <enabled/> or <disabled/>
5212 ```
5213 #### macOS
5214 ```
5215 <dict>
5216   <key>PrintingEnabled</key>
5217   <true/> | <false/>
5218 </dict>
5219 ```
5220 #### policies.json
5221 ```
5222 {
5223   "policies": {
5224     "PrintingEnabled": true | false
5225   }
5226 }
5227 ```
5228 ### PromptForDownloadLocation
5229 Ask where to save each file before downloading.
5230
5231 **Compatibility:** Firefox 68, Firefox ESR 68\
5232 **CCK2 Equivalent:** N/A\
5233 **Preferences Affected:** `browser.download.useDownloadDir`
5234
5235 #### Windows (GPO)
5236 ```
5237 Software\Policies\Mozilla\Firefox\PromptForDownloadLocation = 0x1 | 0x0
5238 ```
5239 #### Windows (Intune)
5240 OMA-URI:
5241 ```
5242 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox/PromptForDownloadLocation
5243 ```
5244 Value (string):
5245 ```
5246 <enabled/> or <disabled/>
5247 ```
5248 #### macOS
5249 ```
5250 <dict>
5251   <key>PromptForDownloadLocation</key>
5252   <true/> | <false/>
5253 </dict>
5254 ```
5255 #### policies.json
5256 ```
5257 {
5258   "policies": {
5259     "PromptForDownloadLocation": true | false
5260   }
5261 }
5262 ```
5263 ### Proxy
5264 Configure proxy settings. These settings correspond to the connection settings in Firefox preferences.
5265 To specify ports, append them to the hostnames with a colon (:).
5266
5267 Unless you lock this policy, changes the user already has in place will take effect.
5268
5269 `Mode` is the proxy method being used.
5270
5271 `Locked` is whether or not proxy settings can be changed.
5272
5273 `HTTPProxy` is the HTTP proxy server.
5274
5275 `UseHTTPProxyForAllProtocols` is whether or not the HTTP proxy should be used for all other proxies.
5276
5277 `SSLProxy` is the SSL proxy server.
5278
5279 `FTPProxy` is the FTP proxy server.
5280
5281 `SOCKSProxy` is the SOCKS proxy server
5282
5283 `SOCKSVersion` is the SOCKS version (4 or 5)
5284
5285 `Passthrough` is list of hostnames or IP addresses that will not be proxied. Use `<local>` to bypass proxying for all hostnames which do not contain periods.
5286
5287 `AutoConfigURL` is a  URL for proxy configuration (only used if Mode is autoConfig).
5288
5289 `AutoLogin` means do not prompt for authentication if password is saved.
5290
5291 `UseProxyForDNS` to use proxy DNS when using SOCKS v5.
5292
5293 **Compatibility:** Firefox 60, Firefox ESR 60\
5294 **CCK2 Equivalent:** `networkProxy*`\
5295 **Preferences Affected:** `network.proxy.type`, `network.proxy.autoconfig_url`, `network.proxy.socks_remote_dns`, `signon.autologin.proxy`, `network.proxy.socks_version`, `network.proxy.no_proxies_on`, `network.proxy.share_proxy_settings`, `network.proxy.http`, `network.proxy.http_port`, `network.proxy.ftp`, `network.proxy.ftp_port`, `network.proxy.ssl`, `network.proxy.ssl_port`, `network.proxy.socks`, `network.proxy.socks_port`
5296
5297 #### Windows (GPO)
5298 ```
5299 Software\Policies\Mozilla\Firefox\Proxy\Mode = "none" | "system" | "manual" | "autoDetect" | "autoConfig"
5300 Software\Policies\Mozilla\Firefox\Proxy\Locked = 0x1 | 0x0
5301 Software\Policies\Mozilla\Firefox\Proxy\HTTPProxy = https://httpproxy.example.com
5302 Software\Policies\Mozilla\Firefox\Proxy\UseHTTPProxyForAllProtocols = 0x1 | 0x0
5303 Software\Policies\Mozilla\Firefox\Proxy\SSLProxy = https://sslproxy.example.com
5304 Software\Policies\Mozilla\Firefox\Proxy\FTPProxy = https://ftpproxy.example.com
5305 Software\Policies\Mozilla\Firefox\Proxy\SOCKSProxy = https://socksproxy.example.com
5306 Software\Policies\Mozilla\Firefox\Proxy\SOCKSVersion = 0x4 | 0x5
5307 Software\Policies\Mozilla\Firefox\Proxy\Passthrough = <local>
5308 Software\Policies\Mozilla\Firefox\Proxy\AutoConfigURL = URL_TO_AUTOCONFIG
5309 Software\Policies\Mozilla\Firefox\Proxy\AutoLogin = 0x1 | 0x0
5310 Software\Policies\Mozilla\Firefox\Proxy\UseProxyForDNS = 0x1 | 0x0
5311 ```
5312 #### Windows (Intune)
5313 **Note**
5314 These setttings were moved to a category to make them easier to configure via Intune.
5315
5316 OMA-URI:
5317 ```
5318 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~ProxySettings/Proxy_Locked
5319 ```
5320 Value (string):
5321 ```
5322 <enabled/> or <disabled/>
5323 ```
5324 OMA-URI:
5325 ```
5326 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~ProxySettings/Proxy_ConnectionType
5327 ```
5328 Value (string):
5329 ```
5330 <enabled/>
5331 <data id="Proxy_ConnectionType" value="none | system | manual | autoDetect | autoConfig"/>
5332 ```
5333 OMA-URI:
5334 ```
5335 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~ProxySettings/Proxy_HTTPProxy
5336 ```
5337 Value (string):
5338 ```
5339 <enabled/>
5340 <data id="Proxy_HTTPProxy" value="httpproxy.example.com"/>
5341 ```
5342 OMA-URI:
5343 ```
5344 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~ProxySettings/Proxy_UseHTTPProxyForAllProtocols
5345 ```
5346 Value (string):
5347 ```
5348 <enabled/> or <disabled/>
5349 ```
5350 OMA-URI:
5351 ```
5352 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~ProxySettings/Proxy_SSLProxy
5353 ```
5354 Value (string):
5355 ```
5356 <enabled/>
5357 <data id="Proxy_SSLProxy" value="sslproxy.example.com"/>
5358 ```
5359 OMA-URI:
5360 ```
5361 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~ProxySettings/Proxy_SOCKSProxy
5362 ```
5363 Value (string):
5364 ```
5365 <enabled/>
5366 <data id="Proxy_SOCKSProxy" value="socksproxy.example.com"/>
5367 <data id="Proxy_SOCKSVersion" value="4 | 5"/>
5368 ```
5369 OMA-URI:
5370 ```
5371 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~ProxySettings/Proxy_AutoConfigURL
5372 ```
5373 Value (string):
5374 ```
5375 <enabled/>
5376 <data id="Proxy_AutoConfigURL" value="URL_TO_AUTOCONFIG"/>
5377 ```
5378 OMA-URI:
5379 ```
5380 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~ProxySettings/Proxy_Passthrough
5381 ```
5382 Value (string):
5383 ```
5384 <enabled/>
5385 <data id="Proxy_Passthrough" value="&lt;local&gt;"/>
5386 ```
5387 OMA-URI:
5388 ```
5389 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~ProxySettings/Proxy_AutoLogin
5390 ```
5391 Value (string):
5392 ```
5393 <enabled/> or <disabled/>
5394 ```
5395 OMA-URI:
5396 ```
5397 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~ProxySettings/Proxy_UseProxyForDNS
5398 ```
5399 Value (string):
5400 ```
5401 <enabled/> or <disabled/>
5402 ```
5403 OMA-URI (Old way):
5404 ```
5405 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox/Proxy
5406 ```
5407 Value (string):
5408 ```
5409 <enabled/>
5410 <data id="ProxyLocked" value="true | false"/>
5411 <data id="ConnectionType" value="none | system | manual | autoDetect | autoConfig"/>
5412 <data id="HTTPProxy" value="httpproxy.example.com"/>
5413 <data id="UseHTTPProxyForAllProtocols" value="true | false"/>
5414 <data id="SSLProxy" value="sslproxy.example.com"/>
5415 <data id="FTPProxy" value="ftpproxy.example.com"/>
5416 <data id="SOCKSProxy" value="socksproxy.example.com"/>
5417 <data id="SOCKSVersion" value="4 | 5"/>
5418 <data id="AutoConfigURL" value="URL_TO_AUTOCONFIG"/>
5419 <data id="Passthrough" value="<local>"/>
5420 <data id="AutoLogin" value="true | false"/>
5421 <data id="UseProxyForDNS" value="true | false"/>
5422 ```
5423 #### macOS
5424 ```
5425 <dict>
5426   <key>Proxy</key>
5427   <dict>
5428     <key>Mode</key>
5429     <string>none | system | manual | autoDetect | autoConfig</string>
5430     <key>Locked</key>
5431     <true> | </false>
5432     <key>HTTPProxy</key>
5433     <string>https://httpproxy.example.com</string>
5434     <key>UseHTTPProxyForAllProtocols</key>
5435     <true> | </false>
5436     <key>SSLProxy</key>
5437     <string>https://sslproxy.example.com</string>
5438     <key>FTPProxy</key>
5439     <string>https://ftpproxy.example.com</string>
5440     <key>SOCKSProxy</key>
5441     <string>https://socksproxy.example.com</string>
5442     <key>SOCKSVersion</key>
5443     <string>4 | 5</string>
5444     <key>Passthrough</key>
5445     <string>&lt;local>&gt;</string>
5446     <key>AutoConfigURL</key>
5447     <string>URL_TO_AUTOCONFIG</string>
5448     <key>AutoLogin</key>
5449     <true> | </false>
5450     <key>UseProxyForDNS</key>
5451     <true> | </false>
5452   </dict>
5453 </dict>
5454 ```
5455 #### policies.json
5456 ```
5457 {
5458   "policies": {
5459     "Proxy": {
5460       "Mode": "none" | "system" | "manual" | "autoDetect" | "autoConfig",
5461       "Locked": true | false,
5462       "HTTPProxy": "hostname",
5463       "UseHTTPProxyForAllProtocols": true | false,
5464       "SSLProxy": "hostname",
5465       "FTPProxy": "hostname",
5466       "SOCKSProxy": "hostname",
5467       "SOCKSVersion": 4 | 5,
5468       "Passthrough": "<local>",
5469       "AutoConfigURL": "URL_TO_AUTOCONFIG",
5470       "AutoLogin": true | false,
5471       "UseProxyForDNS": true | false
5472     }
5473   }
5474 }
5475 ```
5476 ### RequestedLocales
5477 Set the the list of requested locales for the application in order of preference. It will cause the corresponding language pack to become active.
5478
5479 Note: For Firefox 68, this can now be a string so that you can specify an empty value.
5480
5481 **Compatibility:** Firefox 64, Firefox ESR 60.4, Updated in Firefox 68, Firefox ESR 68\
5482 **CCK2 Equivalent:** N/A\
5483 **Preferences Affected:** N/A
5484 #### Windows (GPO)
5485 ```
5486 Software\Policies\Mozilla\Firefox\RequestedLocales\1 = "de"
5487 Software\Policies\Mozilla\Firefox\RequestedLocales\2 = "en-US"
5488
5489 or
5490
5491 Software\Policies\Mozilla\Firefox\RequestedLocales = "de,en-US"
5492 ```
5493 #### Windows (Intune)
5494 OMA-URI:
5495 ```
5496 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox/RequestedLocalesString
5497 ```
5498 Value (string):
5499 ```
5500 <enabled/>
5501 <data id="Preferences_String" value="de,en-US"/>
5502 ```
5503 #### macOS
5504 ```
5505 <dict>
5506   <key>RequestedLocales</key>
5507   <array>
5508     <string>de</string>
5509     <string>en-US</string>
5510   </array>
5511 </dict>
5512
5513 or
5514
5515 <dict>
5516   <key>RequestedLocales</key>
5517   <string>de,en-US</string>
5518 </dict>
5519
5520 ```
5521 #### policies.json
5522 ```
5523 {
5524   "policies": {
5525     "RequestedLocales": ["de", "en-US"]
5526   }
5527 }
5528
5529 or
5530
5531 {
5532   "policies": {
5533     "RequestedLocales": "de,en-US"
5534   }
5535 }
5536 ```
5537 <a name="SanitizeOnShutdown"></a>
5538
5539 ### SanitizeOnShutdown (Selective)
5540 Clear data on shutdown. Choose from Cache, Cookies, Download History, Form & Search History, Browsing History, Active Logins, Site Preferences and Offline Website Data.
5541
5542 Previously, these values were always locked. Starting with Firefox 74 and Firefox ESR 68.6, you can use the `Locked` option to either keep the values unlocked (set it to false), or lock only the values you set (set it to true). If you want the old behavior of locking everything, do not set `Locked` at all.
5543
5544 **Compatibility:** Firefox 68, Firefox ESR 68 (Locked added in 74/68.6)\
5545 **CCK2 Equivalent:** N/A\
5546 **Preferences Affected:** `privacy.sanitize.sanitizeOnShutdown`, `privacy.clearOnShutdown.cache`, `privacy.clearOnShutdown.cookies`, `privacy.clearOnShutdown.downloads`, `privacy.clearOnShutdown.formdata`, `privacy.clearOnShutdown.history`, `privacy.clearOnShutdown.sessions`, `privacy.clearOnShutdown.siteSettings`, `privacy.clearOnShutdown.offlineApps`
5547 #### Windows (GPO)
5548 ```
5549 Software\Policies\Mozilla\Firefox\SanitizeOnShutdown\Cache = 0x1 | 0x0
5550 Software\Policies\Mozilla\Firefox\SanitizeOnShutdown\Cookies = 0x1 | 0x0
5551 Software\Policies\Mozilla\Firefox\SanitizeOnShutdown\Downloads = 0x1 | 0x0
5552 Software\Policies\Mozilla\Firefox\SanitizeOnShutdown\FormData = 0x1 | 0x0
5553 Software\Policies\Mozilla\Firefox\SanitizeOnShutdown\History = 0x1 | 0x0
5554 Software\Policies\Mozilla\Firefox\SanitizeOnShutdown\Sessions = 0x1 | 0x0
5555 Software\Policies\Mozilla\Firefox\SanitizeOnShutdown\SiteSettings = 0x1 | 0x0
5556 Software\Policies\Mozilla\Firefox\SanitizeOnShutdown\OfflineApps = 0x1 | 0x0
5557 Software\Policies\Mozilla\Firefox\SanitizeOnShutdown\Locked = 0x1 | 0x0
5558 ```
5559 #### Windows (Intune)
5560 OMA-URI:
5561 ```
5562 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~SanitizeOnShutdown/A_SanitizeOnShutdown_Cache
5563 ```
5564 Value (string):
5565 ```
5566 <enabled/> or <disabled/>
5567 ```
5568 OMA-URI:
5569 ```
5570 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~SanitizeOnShutdown/B_SanitizeOnShutdown_Cookies
5571 ```
5572 Value (string):
5573 ```
5574 <enabled/> or <disabled/>
5575 ```
5576 OMA-URI:
5577 ```
5578 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~SanitizeOnShutdown/C_SanitizeOnShutdown_Downloads
5579 ```
5580 Value (string):
5581 ```
5582 <enabled/> or <disabled/>
5583 ```
5584 OMA-URI:
5585 ```
5586 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~SanitizeOnShutdown/D_SanitizeOnShutdown_FormData
5587 ```
5588 Value (string):
5589 ```
5590 <enabled/> or <disabled/>
5591 ```
5592 OMA-URI:
5593 ```
5594 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~SanitizeOnShutdown/E_SanitizeOnShutdown_History
5595 ```
5596 Value (string):
5597 ```
5598 <enabled/> or <disabled/>
5599 ```
5600 OMA-URI:
5601 ```
5602 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~SanitizeOnShutdown/F_SanitizeOnShutdown_Sessions
5603 ```
5604 Value (string):
5605 ```
5606 <enabled/> or <disabled/>
5607 ```
5608 OMA-URI:
5609 ```
5610 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~SanitizeOnShutdown/G_SanitizeOnShutdown_SiteSettings
5611 ```
5612 Value (string):
5613 ```
5614 <enabled/> or <disabled/>
5615 ```
5616 OMA-URI:
5617 ```
5618 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~SanitizeOnShutdown/H_SanitizeOnShutdown_OfflineApps
5619 ```
5620 Value (string):
5621 ```
5622 <enabled/> or <disabled/>
5623 ```
5624 OMA-URI:
5625 ```
5626 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~SanitizeOnShutdown/I_SanitizeOnShutdown_Locked
5627 ```
5628 Value (string):
5629 ```
5630 <enabled/> or <disabled/>
5631 ```
5632 #### macOS
5633 ```
5634 <dict>
5635   <key>SanitizeOnShutdown</key>
5636   <dict>
5637     <key>Cache</key>
5638     <true/> | <false/>
5639     <key>Cookies</key>
5640     <true/> | <false/>
5641     <key>Downloads</key>
5642     <true/> | <false/>
5643     <key>FormData</key>
5644     <true/> | <false/>
5645     <key>History</key>
5646     <true/> | <false/>
5647     <key>Sessions</key>
5648     <true/> | <false/>
5649     <key>SiteSettings</key>
5650     <true/> | <false/>
5651     <key>OfflineApps</key>
5652     <true/> | <false/>
5653     <key>Locked</key>
5654     <true/> | <false/>
5655   </dict>
5656 </dict>
5657 ```
5658 #### policies.json
5659 ```
5660 {
5661   "policies": {
5662     "SanitizeOnShutdown": {
5663       "Cache": true | false,
5664       "Cookies": true | false,
5665       "Downloads": true | false,
5666       "FormData": true | false,
5667       "History": true | false,
5668       "Sessions": true | false,
5669       "SiteSettings": true | false,
5670       "OfflineApps": true | false,
5671       "Locked": true | false
5672     }
5673   }
5674 }
5675 ```
5676 ### SanitizeOnShutdown (All)
5677 Clear all data on shutdown, including Browsing & Download History, Cookies, Active Logins, Cache, Form & Search History, Site Preferences and Offline Website Data.
5678
5679 **Compatibility:** Firefox 60, Firefox ESR 60\
5680 **CCK2 Equivalent:** N/A\
5681 **Preferences Affected:** `privacy.sanitize.sanitizeOnShutdown`, `privacy.clearOnShutdown.cache`, `privacy.clearOnShutdown.cookies`, `privacy.clearOnShutdown.downloads`, `privacy.clearOnShutdown.formdata`, `privacy.clearOnShutdown.history`, `privacy.clearOnShutdown.sessions`, `privacy.clearOnShutdown.siteSettings`, `privacy.clearOnShutdown.offlineApps`
5682 #### Windows (GPO)
5683 ```
5684 Software\Policies\Mozilla\Firefox\SanitizeOnShutdown = 0x1 | 0x0
5685 ```
5686 #### Windows (Intune)
5687 OMA-URI:
5688 ```
5689 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox/C_SanitizeOnShutdown
5690 ```
5691 Value (string):
5692 ```
5693 <enabled/> or <disabled/>
5694 ```
5695 #### macOS
5696 ```
5697 <dict>
5698   <key>SanitizeOnShutdown</key>
5699   <true/> | <false/>
5700 </dict>
5701 ```
5702 #### policies.json
5703 ```
5704 {
5705   "policies": {
5706     "SanitizeOnShutdown": true | false
5707   }
5708 }
5709 ```
5710 ### SearchBar
5711 Set whether or not search bar is displayed.
5712
5713 **Compatibility:** Firefox 60, Firefox ESR 60\
5714 **CCK2 Equivalent:** `showSearchBar`\
5715 **Preferences Affected:** N/A
5716
5717 #### Windows (GPO)
5718 ```
5719 Software\Policies\Mozilla\Firefox\SearchBar = "unified" | "separate"
5720 ```
5721
5722 #### Windows (Intune)
5723 OMA-URI:
5724 ```
5725 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox/SearchBar
5726 ```
5727 Value (string):
5728 ```
5729 <enabled/>
5730 <data id="SearchBar" value="unified | separate"/>
5731 ```
5732 #### macOS
5733 ```
5734 <dict>
5735   <key>SearchBar</key>
5736   <string>unified | separate</string>
5737 </dict>
5738 ```
5739 #### policies.json
5740 ```
5741 {
5742   "policies": {
5743     "SearchBar": "unified" | "separate"
5744   }
5745 }
5746 ```
5747 <a name="SearchEngines"></a>
5748
5749 ### SearchEngines (This policy is only available on the ESR.)
5750
5751 ### SearchEngines | Add
5752
5753 Add new search engines. Although there are only five engines available in the ADMX template, there is no limit. To add more in the ADMX template, you can duplicate the XML.
5754
5755 This policy is only available on the ESR. `Name` and `URLTemplate` are required.
5756
5757 `Name` is the name of the search engine.
5758
5759 `URLTemplate` is the search URL with {searchTerms} to substitute for the search term.
5760
5761 `Method` is either GET or POST
5762
5763 `IconURL` is a URL for the icon to use.
5764
5765 `Alias` is a keyword to use for the engine.
5766
5767 `Description` is a description of the search engine.
5768
5769 `PostData` is the POST data as name value pairs separated by &.
5770
5771 `SuggestURLTemplate` is a search suggestions URL with {searchTerms} to substitute for the search term.
5772
5773 `Encoding` is the query charset for the engine. It defaults to UTF-8.
5774
5775 **Compatibility:** Firefox ESR 60 (POST support in Firefox ESR 68, Encoding support in Firefox 91)\
5776 **CCK2 Equivalent:** `searchplugins`\
5777 **Preferences Affected:** N/A
5778
5779 #### Windows (GPO)
5780 ```
5781 Software\Policies\Mozilla\Firefox\SearchEngines\Add\1\Name = "Example1"
5782 Software\Policies\Mozilla\Firefox\SearchEngines\Add\1\URLTemplate = "https://www.example.org/q={searchTerms}"
5783 Software\Policies\Mozilla\Firefox\SearchEngines\Add\1\Method = "GET" | "POST"
5784 Software\Policies\Mozilla\Firefox\SearchEngines\Add\1\IconURL = "https://www.example.org/favicon.ico"
5785 Software\Policies\Mozilla\Firefox\SearchEngines\Add\1\Alias = "example"
5786 Software\Policies\Mozilla\Firefox\SearchEngines\Add\1\Description = "Example Description"
5787 Software\Policies\Mozilla\Firefox\SearchEngines\Add\1\SuggestURLTemplate = "https://www.example.org/suggestions/q={searchTerms}"
5788 Software\Policies\Mozilla\Firefox\SearchEngines\Add\1\PostData = "name=value&q={searchTerms}"
5789 ```
5790 #### Windows (Intune)
5791 OMA-URI:
5792 ```
5793 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~Search/SearchEngines_1
5794 ```
5795 Value (string):
5796 ```
5797 <enabled/>
5798 <data id="SearchEngine_Name" value="Example1"/>
5799 <data id="SearchEngine_URLTemplate" value="https://www.example.org/q={searchTerms"/>
5800 <data id="SearchEngine_Method" value="GET | POST"/>
5801 <data id="SearchEngine_IconURL" value="https://www.example.org/favicon.ico"/>
5802 <data id="SearchEngine_Alias" value="example"/>
5803 <data id="SearchEngine_Description" value="Example Description"/>
5804 <data id="SearchEngine_SuggestURLTemplate" value="https://www.example.org/suggestions/q={searchTerms}"/>
5805 <data id="SearchEngine_PostData" value="name=value&amp;q={searchTerms}"/>
5806 ```
5807 #### macOS
5808 ```
5809 <dict>
5810   <key>SearchEngines</key>
5811   <dict>
5812     <key>Add</key>
5813     <array>
5814       <dict>
5815         <key>Name</key>
5816         <string>Example1</string>
5817         <key>URLTemplate</key>
5818         <string>https://www.example.org/q={searchTerms}</string>
5819         <key>Method</key>
5820         <string>GET | POST </string>
5821         <key>IconURL</key>
5822         <string>https://www.example.org/favicon.ico</string>
5823         <key>Alias</key>
5824         <string>example</string>
5825         <key>Description</key>
5826         <string>Example Description</string>
5827         <key>SuggestURLTemplate</key>
5828         <string>https://www.example.org/suggestions/q={searchTerms}</string>
5829         <key>PostData</key>
5830         <string>name=value&q={searchTerms}</string>
5831       </dict>
5832     <array>
5833   </dict>
5834 </dict>
5835 ```
5836 #### policies.json
5837 ```
5838 {
5839   "policies": {
5840     "SearchEngines": {
5841       "Add": [
5842         {
5843           "Name": "Example1",
5844           "URLTemplate": "https://www.example.org/q={searchTerms}",
5845           "Method": "GET" | "POST",
5846           "IconURL": "https://www.example.org/favicon.ico",
5847           "Alias": "example",
5848           "Description": "Description",
5849           "PostData": "name=value&q={searchTerms}",
5850           "SuggestURLTemplate": "https://www.example.org/suggestions/q={searchTerms}"
5851         }
5852       ]
5853     }
5854   }
5855 }
5856 ```
5857 ### SearchEngines | Default
5858
5859 Set the default search engine. This policy is only available on the ESR.
5860
5861 **Compatibility:** Firefox ESR 60\
5862 **CCK2 Equivalent:** `defaultSearchEngine`\
5863 **Preferences Affected:** N/A
5864
5865 #### Windows (GPO)
5866 ```
5867 Software\Policies\Mozilla\Firefox\SearchEngines\Default = NAME_OF_SEARCH_ENGINE
5868 ```
5869 #### Windows (Intune)
5870 OMA-URI:
5871 ```
5872 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~Search/SearchEngines_Default
5873 ```
5874 Value (string):
5875 ```
5876 <enabled/>
5877 <data id="SearchEngines_Default" value="NAME_OF_SEARCH_ENGINE"/>
5878 ```
5879 #### macOS
5880 ```
5881 <dict>
5882   <key>SearchEngines</key>
5883   <dict>
5884     <key>Default</key>
5885     <string>NAME_OF_SEARCH_ENGINE</string>
5886   </dict>
5887 </dict>
5888 ```
5889 #### policies.json
5890 ```
5891 {
5892   "policies": {
5893     "SearchEngines": {
5894       "Default": "NAME_OF_SEARCH_ENGINE"
5895     }
5896   }
5897 }
5898 ```
5899 ### SearchEngines | PreventInstalls
5900
5901 Prevent installing search engines from webpages.
5902
5903 **Compatibility:** Firefox ESR 60\
5904 **CCK2 Equivalent:** `disableSearchEngineInstall`\
5905 **Preferences Affected:** N/A
5906
5907 #### Windows (GPO)
5908 ```
5909 Software\Policies\Mozilla\Firefox\SearchEngines\PreventInstalls = 0x1 | 0x0
5910 ```
5911 #### Windows (Intune)
5912 OMA-URI:
5913 ```
5914 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~Search/SearchEngines_PreventInstalls
5915 ```
5916 Value (string):
5917 ```
5918 <enabled/> or <disabled/>
5919 ```
5920 #### macOS
5921 ```
5922 <dict>
5923   <key>SearchEngines</key>
5924   <dict>
5925     <key>PreventInstalls</key>
5926     <true/> | <false/>
5927   </dict>
5928 </dict>
5929 ```
5930 #### policies.json
5931 ```
5932 {
5933   "policies": {
5934     "SearchEngines": {
5935       "PreventInstalls": true | false
5936     }
5937   }
5938 }
5939 ```
5940 ### SearchEngines | Remove
5941
5942 Hide built-in search engines. This policy is only available on the ESR.
5943
5944 **Compatibility:** Firefox ESR 60.2\
5945 **CCK2 Equivalent:** `removeDefaultSearchEngines` (removed all built-in engines)\
5946 **Preferences Affected:** N/A
5947
5948 #### Windows (GPO)
5949 ```
5950 Software\Policies\Mozilla\Firefox\SearchEngines\Remove\1 = NAME_OF_SEARCH_ENGINE
5951 ```
5952 #### Windows (Intune)
5953 OMA-URI:
5954 ```
5955 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~Search/SearchEngines_Remove
5956 ```
5957 Value (string):
5958 ```
5959 <enabled/>
5960 <data id="SearchEngines_Remove" value="1&#xF000;NAME_OF_SEARCH_ENGINE"/>
5961 ```
5962 #### macOS
5963 ```
5964 <dict>
5965   <key>SearchEngines</key>
5966   <dict>
5967     <key>Remove</key>
5968     <array>
5969       <string>NAME_OF_SEARCH_ENGINE</string>
5970     </array>
5971   </dict>
5972 </dict>
5973 ```
5974 #### policies.json
5975 ```
5976 {
5977   "policies": {
5978     "SearchEngines": {
5979       "Remove": ["NAME_OF_SEARCH_ENGINE"]
5980     }
5981   }
5982 }
5983 ```
5984 ### SearchSuggestEnabled
5985
5986 Enable search suggestions.
5987
5988 **Compatibility:** Firefox 68, Firefox ESR 68\
5989 **CCK2 Equivalent:** N/A\
5990 **Preferences Affected:** `browser.urlbar.suggest.searches`, `browser.search.suggest.enabled`
5991
5992 #### Windows (GPO)
5993 ```
5994 Software\Policies\Mozilla\Firefox\SearchSuggestEnabled = 0x1 | 0x0
5995 ```
5996 #### Windows (Intune)
5997 OMA-URI:
5998 ```
5999 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~Search/SearchSuggestEnabled
6000 ```
6001 Value (string):
6002 ```
6003 <enabled/> or <disabled/>
6004 ```
6005 #### macOS
6006 ```
6007 <dict>
6008   <key>SearchSuggestEnabled</key>
6009   <true/> | <false/>
6010 </dict>
6011 ```
6012 #### policies.json
6013 ```
6014 {
6015   "policies": {
6016     "SearchSuggestEnabled": true | false
6017   }
6018 }
6019 ```
6020 ### SecurityDevices
6021
6022 Add or delete PKCS #11 modules.
6023
6024 **Compatibility:** Firefox 114, Firefox ESR 112.12\
6025 **CCK2 Equivalent:** N/A\
6026 **Preferences Affected:** N/A
6027
6028 #### Windows (GPO)
6029 ```
6030 Software\Policies\Mozilla\Firefox\SecurityDevices\Add\NAME_OF_DEVICE_TO_ADD = PATH_TO_LIBRARY_FOR_DEVICE
6031 Software\Policies\Mozilla\Firefox\SecurityDevices\Remove\1 = NAME_OF_DEVICE_TO_REMOVE
6032 ```
6033 #### Windows (Intune)
6034 OMA-URI:
6035 ```
6036 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox/SecurityDevices/SecurityDevices_Add
6037 ```
6038 Value (string):
6039 ```
6040 <enabled/>
6041 <data id="SecurityDevices" value="NAME_OF_DEVICE_TO_ADD&#xF000;PATH_TO_LIBRARY_FOR_DEVICE"/>
6042 ```
6043 OMA-URI:
6044 ```
6045 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox/SecurityDevices/SecurityDevices_Delete
6046 ```
6047 Value (string):
6048 ```
6049 <enabled/>
6050 <data id="SecurityDevices" value="1&#xF000;NAME_OF_DEVICE_TO_REMOVE"/>
6051 ```
6052 #### macOS
6053 ```
6054 <dict>
6055   <key>SecurityDevices</key>
6056   <dict>
6057     <key>Add<key>
6058     <dict>
6059       <key>NAME_OF_DEVICE_TO_ADD</key>
6060       <string>PATH_TO_LIBRARY_FOR_DEVICE</string>
6061     </dict>
6062     <key>Delete</add>
6063     <array>
6064       <string>NAME_OF_DEVICE_TO_DELETE</string>
6065     </array>
6066   </dict>
6067 </dict>
6068 ```
6069 #### policies.json
6070 ```
6071 {
6072   "policies": {
6073     "SecurityDevices": {
6074       "Add": {
6075         "NAME_OF_DEVICE_TO_ADD": "PATH_TO_LIBRARY_FOR_DEVICE"
6076       },
6077       "Delete": ["NAME_OF_DEVICE_TO_DELETE"]
6078     }
6079   }
6080 }
6081 ```
6082 ### SecurityDevices (Deprecated)
6083
6084 Install PKCS #11 modules.
6085
6086 **Compatibility:** Firefox 64, Firefox ESR 60.4\
6087 **CCK2 Equivalent:** `certs.devices`\
6088 **Preferences Affected:** N/A
6089
6090 #### Windows (GPO)
6091 ```
6092 Software\Policies\Mozilla\Firefox\SecurityDevices\NAME_OF_DEVICE = PATH_TO_LIBRARY_FOR_DEVICE
6093 ```
6094 #### Windows (Intune)
6095 OMA-URI:
6096 ```
6097 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox/SecurityDevices
6098 ```
6099 Value (string):
6100 ```
6101 <enabled/>
6102 <data id="SecurityDevices" value="NAME_OF_DEVICE&#xF000;PATH_TO_LIBRARY_FOR_DEVICE"/>
6103 ```
6104 #### macOS
6105 ```
6106 <dict>
6107   <key>SecurityDevices</key>
6108   <dict>
6109     <key>NAME_OF_DEVICE</key>
6110     <string>PATH_TO_LIBRARY_FOR_DEVICE</string>
6111   </dict>
6112 </dict>
6113 ```
6114 #### policies.json
6115 ```
6116 {
6117   "policies": {
6118     "SecurityDevices": {
6119       "NAME_OF_DEVICE": "PATH_TO_LIBRARY_FOR_DEVICE"
6120     }
6121   }
6122 }
6123 ```
6124 ### ShowHomeButton
6125 Show the home button on the toolbar.
6126
6127 Future versions of Firefox will not show the home button by default.
6128
6129 **Compatibility:** Firefox 88, Firefox ESR 78.10\
6130 **CCK2 Equivalent:** N/A\
6131 **Preferences Affected:** N/A
6132
6133 #### Windows (GPO)
6134 ```
6135 Software\Policies\Mozilla\Firefox\ShowHomeButton = 0x1 | 0x0
6136 ```
6137 #### Windows (Intune)
6138 OMA-URI:
6139 ```
6140 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~Homepage/Homepage_ShowHomeButton
6141 ```
6142 Value (string):
6143 ```
6144 <enabled/> or <disabled/>
6145 ```
6146 #### macOS
6147 ```
6148 <dict>
6149   <key>ShowHomeButton</key>
6150   <true/> | <false/>
6151 </dict>
6152 ```
6153 #### policies.json
6154 ```
6155 {
6156   "policies": {
6157     "ShowHomeButton": true | false
6158   }
6159 }
6160 ```
6161 ### SSLVersionMax
6162
6163 Set and lock the maximum version of TLS. (Firefox defaults to a maximum of TLS 1.3.)
6164
6165 **Compatibility:** Firefox 66, Firefox ESR 60.6\
6166 **CCK2 Equivalent:** N/A\
6167 **Preferences Affected:** `security.tls.version.max`
6168
6169 #### Windows (GPO)
6170 ```
6171 Software\Policies\Mozilla\Firefox\SSLVersionMax = "tls1" | "tls1.1" | "tls1.2" | "tls1.3"
6172 ```
6173 #### Windows (Intune)
6174 OMA-URI:
6175 ```
6176 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox/SSLVersionMax
6177 ```
6178 Value (string):
6179 ```
6180 <enabled/>
6181 <data id="SSLVersion" value="tls1 | tls1.2 | tls1.3"/>
6182 ```
6183 #### macOS
6184 ```
6185 <dict>
6186   <key>SSLVersionMax</key>
6187   <string>tls1 | tls1.1 | tls1.2 | tls1.3</string>
6188 </dict>
6189 ```
6190
6191 #### policies.json
6192 ```
6193 {
6194   "policies": {
6195     "SSLVersionMax": "tls1" | "tls1.1" | "tls1.2" | "tls1.3"
6196   }
6197 }
6198 ```
6199 ### SSLVersionMin
6200
6201 Set and lock the minimum version of TLS. (Firefox defaults to a minimum of TLS 1.2.)
6202
6203 **Compatibility:** Firefox 66, Firefox ESR 60.6\
6204 **CCK2 Equivalent:** N/A\
6205 **Preferences Affected:** `security.tls.version.min`
6206
6207 #### Windows (GPO)
6208 ```
6209 Software\Policies\Mozilla\Firefox\SSLVersionMin = "tls1" | "tls1.1" | "tls1.2" | "tls1.3"
6210 ```
6211 #### Windows (Intune)
6212 OMA-URI:
6213 ```
6214 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox/SSLVersionMin
6215 ```
6216 Value (string):
6217 ```
6218 <enabled/>
6219 <data id="SSLVersion" value="tls1 | tls1.2 | tls1.3"/>
6220 ```
6221 #### macOS
6222 ```
6223 <dict>
6224   <key>SSLVersionMin</key>
6225   <string>tls1 | tls1.1 | tls1.2 | tls1.3</string>
6226 </dict>
6227 ```
6228
6229 #### policies.json
6230 ```
6231 {
6232   "policies": {
6233     "SSLVersionMin": "tls1" | "tls1.1" | "tls1.2" | "tls1.3"
6234   }
6235 }
6236 ```
6237 ### StartDownloadsInTempDirectory
6238 Force downloads to start off in a local, temporary location rather than the default download directory.
6239
6240 **Compatibility:** Firefox 102\
6241 **CCK2 Equivalent:** N/A\
6242 **Preferences Affected:** `browser.download.start_downloads_in_tmp_dir`
6243
6244 #### Windows (GPO)
6245 ```
6246 Software\Policies\Mozilla\Firefox\StartDownloadsInTempDirectory = 0x1 | 0x0
6247 ```
6248 #### Windows (Intune)
6249 OMA-URI:
6250 ```
6251 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox/StartDownloadsInTempDirectory
6252 ```
6253 Value (string):
6254 ```
6255 <enabled/> or <disabled/>
6256 ```
6257 #### macOS
6258 ```
6259 <dict>
6260   <key>StartDownloadsInTempDirectory</key>
6261   <true/> | <false/>
6262 </dict>
6263 ```
6264 #### policies.json
6265 ```
6266 {
6267   "policies": {
6268     "StartDownloadsInTempDirectory": true | false
6269 }
6270 ```
6271 ### SupportMenu
6272 Add a menuitem to the help menu for specifying support information.
6273
6274 **Compatibility:** Firefox 68.0.1, Firefox ESR 68.0.1\
6275 **CCK2 Equivalent:** helpMenu\
6276 **Preferences Affected:** N/A
6277
6278 #### Windows (GPO)
6279 ```
6280 Software\Policies\Mozilla\Firefox\SupportMenu\Title = "Support Menu"
6281 Software\Policies\Mozilla\Firefox\SupportMenu\URL = "http://example.com/support"
6282 Software\Policies\Mozilla\Firefox\SupportMenu\AccessKey = "S"
6283 ```
6284 #### Windows (Intune)
6285 OMA-URI:
6286 ```
6287 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox/SupportMenu
6288 ```
6289 Value (string):
6290 ```
6291 <enabled/>
6292 <data id="SupportMenuTitle" value="Support Menu"/>
6293 <data id="SupportMenuURL" value="http://example.com/support"/>
6294 <data id="SupportMenuAccessKey" value="S"/>
6295 ```
6296 #### macOS
6297 ```
6298 <dict>
6299   <key>SupportMenu</key>
6300   <dict>
6301     <key>Title</key>
6302     <string>SupportMenu</string>
6303     <key>URL</key>
6304     <string>http://example.com/support</string>
6305     <key>AccessKey</key>
6306     <string>S</string>
6307   </dict>
6308 </dict>
6309 ```
6310 #### policies.json
6311 ```
6312 {
6313   "policies": {
6314     "SupportMenu": {
6315       "Title": "Support Menu",
6316       "URL": "http://example.com/support",
6317       "AccessKey": "S"
6318     }
6319   }
6320 }
6321 ```
6322 ### TranslateEnabled
6323 Enable or disable webpage translation.
6324
6325 Note: Web page translation is done completely on the client, so there is no data or privacy risk.
6326
6327 If you only want to disable the popup, you can set the pref `browser.translations.automaticallyPopup` to false using the [Preferences](#preferences) policy.
6328
6329 **Compatibility:** Firefox 126\
6330 **CCK2 Equivalent:** N/A\
6331 **Preferences Affected:** `browser.translations.enable`
6332
6333 #### Windows (GPO)
6334 ```
6335 Software\Policies\Mozilla\Firefox\TranslateEnabled = 0x1 | 0x0
6336 ```
6337 #### Windows (Intune)
6338 OMA-URI:
6339 ```
6340 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox/TranslateEnabled
6341 ```
6342 Value (string):
6343 ```
6344 <enabled/> or <disabled/>
6345 ```
6346 #### macOS
6347 ```
6348 <dict>
6349   <key>TranslateEnabled</key>
6350   <true/> | <false/>
6351 </dict>
6352 ```
6353 #### policies.json
6354 ```
6355 {
6356   "policies": {
6357     "TranslateEnabled": true | false
6358   }
6359 }
6360 ```
6361 ### UserMessaging
6362
6363 Prevent Firefox from messaging the user in certain situations.
6364
6365 `WhatsNew` Remove the "What's New" icon and menuitem. (*Deprecated*)
6366
6367 `ExtensionRecommendations` If false, don't recommend extensions while the user is visiting web pages.
6368
6369 `FeatureRecommendations` If false, don't recommend browser features.
6370
6371 `UrlbarInterventions` If false, Don't offer Firefox specific suggestions in the URL bar.
6372
6373 `SkipOnboarding` If true, don't show onboarding messages on the new tab page.
6374
6375 `MoreFromMozilla` If false, don't show the "More from Mozilla" section in Preferences. (Firefox 98)
6376
6377 `Locked` prevents the user from changing user messaging preferences.
6378
6379 **Compatibility:** Firefox 75, Firefox ESR 68.7\
6380 **CCK2 Equivalent:** N/A\
6381 **Preferences Affected:** `browser.newtabpage.activity-stream.asrouter.userprefs.cfr.addons`, `browser.newtabpage.activity-stream.asrouter.userprefs.cfr.features`, `browser.aboutwelcome.enabled`, `browser.preferences.moreFromMozilla`
6382
6383 #### Windows (GPO)
6384 ```
6385 Software\Policies\Mozilla\Firefox\UserMessaging\ExtensionRecommendations = 0x1 | 0x0
6386 Software\Policies\Mozilla\Firefox\UserMessaging\FeatureRecommendations = 0x1 | 0x0
6387 Software\Policies\Mozilla\Firefox\UserMessaging\UrlbarInterventions = 0x1 | 0x0
6388 Software\Policies\Mozilla\Firefox\UserMessaging\SkipOnboarding = 0x1 | 0x0
6389 Software\Policies\Mozilla\Firefox\UserMessaging\MoreFromMozilla = 0x1 | 0x0
6390 Software\Policies\Mozilla\Firefox\UserMessaging\Locked = 0x1 | 0x0
6391 ```
6392 #### Windows (Intune)
6393 OMA-URI:
6394 ```
6395 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~UserMessaging/UserMessaging_ExtensionRecommendations
6396 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~UserMessaging/UserMessaging_FeatureRecommendations
6397 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~UserMessaging/UserMessaging_UrlbarInterventions
6398 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~UserMessaging/UserMessaging_SkipOnboarding
6399 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~UserMessaging/UserMessaging_MoreFromMozilla
6400 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~UserMessaging/UserMessaging_Locked
6401 ```
6402 Value (string):
6403 ```
6404 <enabled/> or <disabled/>
6405 ```
6406 #### macOS
6407 ```
6408 <dict>
6409   <key>UserMessaging</key>
6410   <dict>
6411     <key>ExtensionRecommendations</key>
6412     <true/> | <false/>
6413     <key>FeatureRecommendations</key>
6414     <true/> | <false/>
6415     <key>UrlbarInterventions</key>
6416     <true/> | <false/>
6417     <key>SkipOnboarding</key>
6418     <true/> | <false/>
6419     <key>MoreFromMozilla</key>
6420     <true/> | <false/>
6421     <key>Locked</key>
6422     <true/> | <false/>
6423   </dict>
6424 </dict>
6425 ```
6426 #### policies.json
6427 ```
6428 {
6429   "policies": {
6430     "UserMessaging": {
6431       "ExtensionRecommendations": true | false,
6432       "FeatureRecommendations": true | false,
6433       "UrlbarInterventions": true | false,
6434       "SkipOnboarding": true | false,
6435       "MoreFromMozilla": true | false,
6436       "Locked": true | false
6437     }
6438   }
6439 }
6440 ```
6441 ### UseSystemPrintDialog
6442 Use the system print dialog instead of the print preview window.
6443
6444 **Compatibility:** Firefox 102\
6445 **CCK2 Equivalent:** N/A\
6446 **Preferences Affected:** `print.prefer_system_dialog`
6447
6448 #### Windows (GPO)
6449 ```
6450 Software\Policies\Mozilla\Firefox\UseSystemPrintDialog = 0x1 | 0x0
6451 ```
6452 #### Windows (Intune)
6453 OMA-URI:
6454 ```
6455 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox/UseSystemPrintDialog
6456 ```
6457 Value (string):
6458 ```
6459 <enabled/> or <disabled/>
6460 ```
6461 #### macOS
6462 ```
6463 <dict>
6464   <key>UseSystemPrintDialog</key>
6465   <true/> | <false/>
6466 </dict>
6467 ```
6468 #### policies.json
6469 ```
6470 {
6471   "policies": {
6472     "UseSystemPrintDialog": true | false
6473   }
6474 }
6475 ```
6476 ### WebsiteFilter
6477 Block websites from being visited. The parameters take an array of Match Patterns, as documented in https://developer.mozilla.org/en-US/Add-ons/WebExtensions/Match_patterns.
6478 The arrays are limited to 1000 entries each.
6479
6480 If you want to block all URLs, you can use `<all_urls>` or `*://*/*`. You can't have just a `*` on the right side.
6481
6482 For specific protocols, use `https://*/*` or `http://*/*`.
6483
6484 As of Firefox 83 and Firefox ESR 78.5, file URLs are supported.
6485
6486 **Compatibility:** Firefox 60, Firefox ESR 60\
6487 **CCK2 Equivalent:** N/A\
6488 **Preferences Affected:** N/A
6489
6490 #### Windows (GPO)
6491 ```
6492 Software\Policies\Mozilla\Firefox\WebsiteFilter\Block\1 = "<all_urls>"
6493 Software\Policies\Mozilla\Firefox\WebsiteFilter\Exceptions\1 = "http://example.org/*"
6494 ```
6495 #### Windows (Intune)
6496 OMA-URI:
6497 ```
6498 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox/B_WebsiteFilter_Block
6499 ```
6500 Value (string):
6501 ```
6502 <enabled/> <data id="WebsiteFilter" value="1&#xF000;&#60;all_urls&#62;"/>
6503 ```
6504 OMA-URI:
6505 ```
6506 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox/B_WebsiteFilter_Exceptions
6507 ```
6508 Value (string):
6509 ```
6510 <enabled/>
6511 <data id="WebsiteFilter" value="1&#xF000;http://example.org/*"/>
6512 ```
6513 If you are using custom ADMX and ADML administrative templates in Intune, you can use this OMA-URI instead
6514 to workaround the limit on the length of strings. Put all of your JSON on one line.
6515
6516 OMA-URI:
6517 ```
6518 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~Extensions/WebsiteFilterOneLine
6519 ```
6520 Value (string):
6521 ```
6522 <enabled/>
6523 <data id="JSONOneLine" value='{"Block": ["<all_urls>"],"Exceptions": ["http://example.org/*"]}'/>
6524 ```
6525 #### macOS
6526 ```
6527 <dict>
6528   <key>WebsiteFilter</key>
6529   <dict>
6530     <key>Block</key>
6531     <array>
6532       <string><all_urls></string>
6533     </array>
6534     <key>Exceptions</key>
6535     <array>
6536       <string>http://example.org/*</string>
6537     </array>
6538   </dict>
6539
6540 </dict>
6541 ```
6542 #### policies.json
6543 ```
6544 {
6545   "policies": {
6546     "WebsiteFilter": {
6547       "Block": ["<all_urls>"],
6548       "Exceptions": ["http://example.org/*"]
6549     }
6550   }
6551 }
6552 ```
6553 ### WindowsSSO
6554 Allow Windows single sign-on for Microsoft, work, and school accounts.
6555
6556 If this policy is set to true, Firefox will use credentials stored in Windows to sign in to Microsoft, work, and school accounts.
6557
6558 **Compatibility:** Firefox 91\
6559 **CCK2 Equivalent:** N/A\
6560 **Preferences Affected:** `network.http.windows-sso.enabled`
6561
6562 #### Windows (GPO)
6563 ```
6564 Software\Policies\Mozilla\Firefox\WindowsSSO = 0x1 | 0x0
6565 ```
6566 #### Windows (Intune)
6567 OMA-URI:
6568 ```
6569 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox/WindowsSSO
6570 ```
6571 Value (string):
6572 ```
6573 <enabled/> or <disabled/>
6574 ```
6575 #### policies.json
6576 ```
6577 {
6578   "policies": {
6579     "WindowsSSO": true | false
6580   }
6581 }
6582 ```