docs/index.md

   1 Firefox policies can be specified using the [Group Policy templates on Windows](https://github.com/mozilla/policy-templates/tree/master/windows), [Intune on Windows](https://support.mozilla.org/kb/managing-firefox-intune), [configuration profiles on macOS](https://github.com/mozilla/policy-templates/tree/master/mac), or by creating a file called `policies.json`. On Windows, create a directory called `distribution` where the EXE is located and place the file there. On Mac, the file goes into `Firefox.app/Contents/Resources/distribution`.  On Linux, the file goes into `firefox/distribution`, where `firefox` is the installation directory for firefox, which varies by distribution or you can specify system-wide policy by placing the file in `/etc/firefox/policies`.
   2
   3 Unfortunately, JSON files do not support comments, but you can add extra entries to the JSON to use as comments. You will see an error in about:policies, but the policies will still work properly. For example:
   4 ```
   5 {
   6   "policies": {
   7     "Authentication": {
   8       "SPNEGO": ["mydomain.com", "https://myotherdomain.com"]
   9     }
  10     "Authentication_Comment": "These domains are required for us"
  11   }
  12 }
  13 ```
  14 Note: The `policies.json` must use the UTF-8 encoding.
  15
  16 | Policy Name | Description
  17 | --- | --- |
  18 | **[`3rdparty`](#3rdparty)** | Set policies that WebExtensions can access via chrome.storage.managed.
  19 | **[`AllowedDomainsForApps`](#alloweddomainsforapps)** | Define domains allowed to access Google Workspace.
  20 | **[`AllowFileSelectionDialogs`](#allowfileselectiondialogs)** | Allow file selection dialogs.
  21 | **[`AppAutoUpdate`](#appautoupdate)** | Enable or disable automatic application update.
  22 | **[`AppUpdatePin`](#appupdatepin)** | Prevent Firefox from being updated beyond the specified version.
  23 | **[`AppUpdateURL`](#appupdateurl)** | Change the URL for application update.
  24 | **[`Authentication`](#authentication)** | Configure sites that support integrated authentication.
  25 | **[`AutofillAddressEnabled`](#autofilladdressenabled)** | Enable autofill for addresses.
  26 | **[`AutofillCreditCardEnabled`](#autofillcreditcardenabled)** | Enable autofill for payment methods.
  27 | **[`AutoLaunchProtocolsFromOrigins`](#autolaunchprotocolsfromorigins)** | Define a list of external protocols that can be used from listed origins without prompting the user.
  28 | **[`BackgroundAppUpdate`](#backgroundappupdate)** | Enable or disable the background updater (Windows only).
  29 | **[`BlockAboutAddons`](#blockaboutaddons)** | Block access to the Add-ons Manager (about:addons).
  30 | **[`BlockAboutConfig`](#blockaboutconfig)** | Block access to about:config.
  31 | **[`BlockAboutProfiles`](#blockaboutprofiles)** | Block access to About Profiles (about:profiles).
  32 | **[`BlockAboutSupport`](#blockaboutsupport)** | Block access to Troubleshooting Information (about:support).
  33 | **[`Bookmarks`](#bookmarks)** | Add bookmarks in either the bookmarks toolbar or menu.
  34 | **[`CaptivePortal`](#captiveportal)** | Enable or disable the detection of captive portals.
  35 | **[`Certificates`](#certificates)** |
  36 | **[`Certificates -> ImportEnterpriseRoots`](#certificates--importenterpriseroots)** | Trust certificates that have been added to the operating system certificate store by a user or administrator.
  37 | **[`Certificates -> Install`](#certificates--install)** | Install certificates into the Firefox certificate store.
  38 | **[`Containers`](#containers)** | Set policies related to [containers](https://addons.mozilla.org/firefox/addon/multi-account-containers/).
  39 | **[`ContentAnalysis`](#contentanalysis)** | Configure Firefox to use an agent for Data Loss Prevention (DLP) that is compatible with the [Google Chrome Content Analysis Connector Agent SDK](https://github.com/chromium/content_analysis_sdk).
  40 | **[`Cookies`](#cookies)** | Configure cookie preferences.
  41 | **[`DefaultDownloadDirectory`](#defaultdownloaddirectory)** | Set the default download directory.
  42 | **[`DisableAppUpdate`](#disableappupdate)** | Turn off application updates.
  43 | **[`DisableBuiltinPDFViewer`](#disablebuiltinpdfviewer)** | Disable the built in PDF viewer.
  44 | **[`DisabledCiphers`](#disabledciphers)** | Disable ciphers.
  45 | **[`DisableDefaultBrowserAgent`](#disabledefaultbrowseragent)** | Prevent the default browser agent from taking any actions (Windows only).
  46 | **[`DisableDeveloperTools`](#disabledevelopertools)** | Remove access to all developer tools.
  47 | **[`DisableEncryptedClientHello`](#disableencryptedclienthello)** | Disable the TLS Feature Encrypted Client Hello (ECH).
  48 | **[`DisableFeedbackCommands`](#disablefeedbackcommands)** | Disable the menus for reporting sites.
  49 | **[`DisableFirefoxAccounts`](#disablefirefoxaccounts)** | Disable Firefox Accounts integration (Sync).
  50 | **[`DisableFirefoxScreenshots`](#disablefirefoxscreenshots)** | Remove access to Firefox Screenshots.
  51 | **[`DisableFirefoxStudies`](#disablefirefoxstudies)** | Disable Firefox studies (Shield).
  52 | **[`DisableForgetButton`](#disableforgetbutton)** | Disable the "Forget" button.
  53 | **[`DisableFormHistory`](#disableformhistory)** | Turn off saving information on web forms and the search bar.
  54 | **[`DisableMasterPasswordCreation`](#disablemasterpasswordcreation)** | Remove the master password functionality.
  55 | **[`DisablePasswordReveal`](#disablepasswordreveal)** | Do not allow passwords to be revealed in saved logins.
  56 | **[`DisablePocket`](#disablepocket)** | Remove Pocket in the Firefox UI.
  57 | **[`DisablePrivateBrowsing`](#disableprivatebrowsing)** | Remove access to private browsing.
  58 | **[`DisableProfileImport`](#disableprofileimport)** | Disables the "Import data from another browser" option in the bookmarks window.
  59 | **[`DisableProfileRefresh`](#disableprofilerefresh)** | Disable the Refresh Firefox button on about:support and support.mozilla.org
  60 | **[`DisableSafeMode`](#disablesafemode)** | Disable safe mode within the browser.
  61 | **[`DisableSecurityBypass`](#disablesecuritybypass)** | Prevent the user from bypassing security in certain cases.
  62 | **[`DisableSetDesktopBackground`](#disablesetdesktopbackground)** | Remove the "Set As Desktop Background..." menuitem when right clicking on an image.
  63 | **[`DisableSystemAddonUpdate`](#disablesystemaddonupdate)** | Prevent system add-ons from being installed or updated.
  64 | **[`DisableTelemetry`](#disabletelemetry)** | DisableTelemetry
  65 | **[`DisableThirdPartyModuleBlocking`](#disablethirdpartymoduleblocking)** | Do not allow blocking third-party modules.
  66 | **[`DisplayBookmarksToolbar`](#displaybookmarkstoolbar)** | Set the initial state of the bookmarks toolbar.
  67 | **[`DisplayMenuBar`](#displaymenubar)** | Set the state of the menubar.
  68 | **[`DNSOverHTTPS`](#dnsoverhttps)** | Configure DNS over HTTPS.
  69 | **[`DontCheckDefaultBrowser`](#dontcheckdefaultbrowser)** | Don't check if Firefox is the default browser at startup.
  70 | **[`DownloadDirectory`](#downloaddirectory)** | Set and lock the download directory.
  71 | **[`EnableTrackingProtection`](#enabletrackingprotection)** | Configure tracking protection.
  72 | **[`EncryptedMediaExtensions`](#encryptedmediaextensions)** | Enable or disable Encrypted Media Extensions and optionally lock it.
  73 | **[`EnterprisePoliciesEnabled`](#enterprisepoliciesenabled)** | Enable policy support on macOS.
  74 | **[`ExemptDomainFileTypePairsFromFileTypeDownloadWarnings`](#exemptdomainfiletypepairsfromfiletypedownloadwarnings)** | Disable warnings based on file extension for specific file types on domains.
  75 | **[`Extensions`](#extensions)** | Control the installation, uninstallation and locking of extensions.
  76 | **[`ExtensionSettings`](#extensionsettings)** | Manage all aspects of extensions.
  77 | **[`ExtensionUpdate`](#extensionupdate)** | Control extension updates.
  78 | **[`FirefoxHome`](#firefoxhome)** | Customize the Firefox Home page.
  79 | **[`FirefoxSuggest`](#firefoxsuggest)** | Customize Firefox Suggest.
  80 | **[`GoToIntranetSiteForSingleWordEntryInAddressBar`](#gotointranetsiteforsinglewordentryinaddressbar)** | Force direct intranet site navigation instead of searching when typing single word entries in the address bar.
  81 | **[`Handlers`](#handlers)** | Configure default application handlers.
  82 | **[`HardwareAcceleration`](#hardwareacceleration)** | Control hardware acceleration.
  83 | **[`Homepage`](#homepage)** | Configure the default homepage and how Firefox starts.
  84 | **[`HttpAllowlist`](#httpallowlist)** | Configure origins that will not be upgraded to HTTPS.
  85 | **[`HttpsOnlyMode`](#httpsonlymode)** | Configure HTTPS-Only Mode.
  86 | **[`InstallAddonsPermission`](#installaddonspermission)** | Configure the default extension install policy as well as origins for extension installs are allowed.
  87 | **[`LegacyProfiles`](#legacyprofiles)** | Disable the feature enforcing a separate profile for each installation.
  88 | **[`LegacySameSiteCookieBehaviorEnabled`](#legacysamesitecookiebehaviorenabled)** | Enable default legacy SameSite cookie behavior setting.
  89 | **[`LegacySameSiteCookieBehaviorEnabledForDomainList`](#legacysamesitecookiebehaviorenabledfordomainlist)** | Revert to legacy SameSite behavior for cookies on specified sites.
  90 | **[`LocalFileLinks`](#localfilelinks)** | Enable linking to local files by origin.
  91 | **[`ManagedBookmarks`](#managedbookmarks)** | Configures a list of bookmarks managed by an administrator that cannot be changed by the user.
  92 | **[`ManualAppUpdateOnly`](#manualappupdateonly)** | Allow manual updates only and do not notify the user about updates.
  93 | **[`MicrosoftEntraSSO`](#microsoftentrasso)** | Allow single sign-on for Microsoft Entra accounts on macOS.
  94 | **[`NetworkPrediction`](#networkprediction)** | Enable or disable network prediction (DNS prefetching).
  95 | **[`NewTabPage`](#newtabpage)** | Enable or disable the New Tab page.
  96 | **[`NoDefaultBookmarks`](#nodefaultbookmarks)** | Disable the creation of default bookmarks.
  97 | **[`OfferToSaveLogins`](#offertosavelogins)** | Control whether or not Firefox offers to save passwords.
  98 | **[`OfferToSaveLoginsDefault`](#offertosaveloginsdefault)** | Set the default value for whether or not Firefox offers to save passwords.
  99 | **[`OverrideFirstRunPage`](#overridefirstrunpage)** | Override the first run page.
 100 | **[`OverridePostUpdatePage`](#overridepostupdatepage)** | Override the upgrade page.
 101 | **[`PasswordManagerEnabled`](#passwordmanagerenabled)** | Remove (some) access to the password manager.
 102 | **[`PasswordManagerExceptions`](#passwordmanagerexceptions)** | Prevent Firefox from saving passwords for specific sites.
 103 | **[`PDFjs`](#pdfjs)** | Disable or configure PDF.js, the built-in PDF viewer.
 104 | **[`Permissions`](#permissions)** | Set permissions associated with camera, microphone, location, and notifications.
 105 | **[`PictureInPicture`](#pictureinpicture)** | Enable or disable Picture-in-Picture.
 106 | **[`PopupBlocking`](#popupblocking)** | Configure the default pop-up window policy as well as origins for which pop-up windows are allowed.
 107 | **[`PostQuantumKeyAgreementEnabled`](#postquantumkeyagreementenabled)** | Enable post-quantum key agreement for TLS.
 108 | **[`Preferences`](#preferences)** | Set and lock preferences.
 109 | **[`PrimaryPassword`](#primarypassword)** | Require or prevent using a primary (formerly master) password.
 110 | **[`PrintingEnabled`](#printingenabled)** | Enable or disable printing.
 111 | **[`PrivateBrowsingModeAvailability`](#privatebrowsingmodeavailability)** | Set availability of private browsing mode.
 112 | **[`PromptForDownloadLocation`](#promptfordownloadlocation)** | Ask where to save each file before downloading.
 113 | **[`Proxy`](#proxy)** | Configure proxy settings.
 114 | **[`RequestedLocales`](#requestedlocales)** | Set the the list of requested locales for the application in order of preference.
 115 | **[`SanitizeOnShutdown` (All)](#sanitizeonshutdown-all)** | Clear all data on shutdown.
 116 | **[`SanitizeOnShutdown` (Selective)](#sanitizeonshutdown-selective)** | Clear data on shutdown.
 117 | **[`SearchBar`](#searchbar)** | Set whether or not search bar is displayed.
 118 | **[`SearchEngines`](#searchengines-this-policy-is-only-available-on-the-esr)** |
 119 | **[`SearchEngines -> Add`](#searchengines--add)** | Add new search engines.
 120 | **[`SearchEngines -> Default`](#searchengines--default)** | Set the default search engine.
 121 | **[`SearchEngines -> PreventInstalls`](#searchengines--preventinstalls)** | Prevent installing search engines from webpages.
 122 | **[`SearchEngines -> Remove`](#searchengines--remove)** | Hide built-in search engines.
 123 | **[`SearchSuggestEnabled`](#searchsuggestenabled)** | Enable search suggestions.
 124 | **[`SecurityDevices`](#securitydevices)** | Install PKCS #11 modules.
 125 | **[`ShowHomeButton`](#showhomebutton)** | Show the home button on the toolbar.
 126 | **[`SSLVersionMax`](#sslversionmax)** | Set and lock the maximum version of TLS.
 127 | **[`SSLVersionMin`](#sslversionmin)** | Set and lock the minimum version of TLS.
 128 | **[`StartDownloadsInTempDirectory`](#startdownloadsintempdirectory)** | Force downloads to start off in a local, temporary location rather than the default download directory.
 129 | **[`SupportMenu`](#supportmenu)** | Add a menuitem to the help menu for specifying support information.
 130 | **[`TranslateEnabled`](#translateenabled)** | Enable or disable webpage translation.
 131 | **[`UserMessaging`](#usermessaging)** | Don't show certain messages to the user.
 132 | **[`UseSystemPrintDialog`](#usesystemprintdialog)** | Print using the system print dialog instead of print preview.
 133 | **[`WebsiteFilter`](#websitefilter)** | Block websites from being visited.
 134 | **[`WindowsSSO`](#windowssso)** | Allow Windows single sign-on for Microsoft, work, and school accounts.
 135
 136 ### 3rdparty
 137
 138 Allow WebExtensions to configure policy. For more information, see [Adding policy support to your extension](https://extensionworkshop.com/documentation/enterprise/enterprise-development/#how-to-add-policy).
 139
 140 For GPO and Intune, the extension developer should provide an ADMX file.
 141
 142 **Compatibility:** Firefox 68\
 143 **CCK2 Equivalent:** N/A\
 144 **Preferences Affected:** N/A
 145
 146 #### macOS
 147 ```
 148 <dict>
 149   <key>3rdparty</key>
 150   <dict>
 151     <key>Extensions</key>
 152     <dict>
 153       <key>uBlock0@raymondhill.net</key>
 154       <dict>
 155         <key>adminSettings</key>
 156         <dict>
 157           <key>selectedFilterLists</key>
 158           <array>
 159             <string>ublock-privacy</string>
 160             <string>ublock-badware</string>
 161             <string>ublock-filters</string>
 162             <string>user-filters</string>
 163           </array>
 164         </dict>
 165       </dict>
 166     </dict>
 167   </dict>
 168 </dict>
 169 ```
 170 #### policies.json
 171 ```
 172 {
 173   "policies": {
 174     "3rdparty": {
 175       "Extensions": {
 176         "uBlock0@raymondhill.net": {
 177           "adminSettings": {
 178             "selectedFilterLists": [
 179               "ublock-privacy",
 180               "ublock-badware",
 181               "ublock-filters",
 182               "user-filters"
 183             ]
 184           }
 185         }
 186       }
 187     }
 188   }
 189 }
 190 ```
 191
 192 ### AllowedDomainsForApps
 193
 194 Define domains allowed to access Google Workspace.
 195
 196 This policy is based on the [Chrome policy](https://chromeenterprise.google/policies/#AllowedDomainsForApps) of the same name.
 197
 198 If this policy is enabled, users can only access Google Workspace using accounts from the specified domains. If you want to allow Gmail, you can add ```consumer_accounts``` to the list.
 199
 200 **Compatibility:** Firefox 89, Firefox ESR 78.11\
 201 **CCK2 Equivalent:** N/A\
 202 **Preferences Affected:** N/A
 203
 204 #### Windows (GPO)
 205 ```
 206 Software\Policies\Mozilla\Firefox\AllowedDomainsForApps = "managedfirefox.com,example.com"
 207 ```
 208 #### Windows (Intune)
 209 OMA-URI:
 210 ```
 211 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox/AllowedDomainsForApps
 212 ```
 213 Value (string):
 214 ```
 215 <enabled/>
 216 <data id="AllowedDomainsForApps" value="managedfirefox.com,example.com"/>
 217 ```
 218 #### macOS
 219 ```
 220 <dict>
 221   <key>AllowedDomainsForApps</key>
 222   <string>managedfirefox.com,example.com</string>
 223 </dict>
 224 ```
 225 #### policies.json
 226 ```
 227 {
 228   "policies": {
 229     "AllowedDomainsForApps": "managedfirefox.com,example.com"
 230   }
 231 }
 232 ```
 233 ### AllowFileSelectionDialogs
 234
 235 Enable or disable file selection dialogs.
 236
 237 **Compatibility:** Firefox 124\
 238 **CCK2 Equivalent:** N/A\
 239 **Preferences Affected:** `widget.disable_file_pickers`
 240
 241 #### Windows (GPO)
 242 ```
 243 Software\Policies\Mozilla\Firefox\AllowFileSelectionDialogs = 0x1 | 0x0
 244 ```
 245 #### Windows (Intune)
 246 OMA-URI:
 247 ```
 248 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox/AppAutoAllowFileSelectionDialogsUpdate
 249 ```
 250 Value (string):
 251 ```
 252 <enabled/> or <disabled/>
 253 ```
 254 #### macOS
 255 ```
 256 <dict>
 257   <key>AllowFileSelectionDialogs</key>
 258   <true/> | <false/>
 259 </dict>
 260 ```
 261 #### policies.json
 262 ```
 263 {
 264   "policies": {
 265     "AllowFileSelectionDialogs": true | false
 266   }
 267 }
 268 ```
 269 ### AppAutoUpdate
 270
 271 Enable or disable **automatic** application update.
 272
 273 If set to true, application updates are installed without user approval within Firefox. The operating system might still require approval.
 274
 275 If set to false, application updates are downloaded but the user can choose when to install the update.
 276
 277 If you have disabled updates via `DisableAppUpdate`, this policy has no effect.
 278
 279 **Compatibility:** Firefox 75, Firefox ESR 68.7\
 280 **CCK2 Equivalent:** N/A\
 281 **Preferences Affected:** `app.update.auto`
 282
 283 #### Windows (GPO)
 284 ```
 285 Software\Policies\Mozilla\Firefox\AppAutoUpdate = 0x1 | 0x0
 286 ```
 287 #### Windows (Intune)
 288 OMA-URI:
 289 ```
 290 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox/AppAutoUpdate
 291 ```
 292 Value (string):
 293 ```
 294 <enabled/> or <disabled/>
 295 ```
 296 #### macOS
 297 ```
 298 <dict>
 299   <key>AppAutoUpdate</key>
 300   <true/> | <false/>
 301 </dict>
 302 ```
 303 #### policies.json
 304 ```
 305 {
 306   "policies": {
 307     "AppAutoUpdate": true | false
 308   }
 309 }
 310 ```
 311 ### AppUpdatePin
 312
 313 Prevent Firefox from being updated beyond the specified version.
 314
 315 You can specify the any version as ```xx.``` and Firefox will be updated with all minor versions, but will not be updated beyond the major version.
 316
 317 You can also specify the version as ```xx.xx``` and Firefox will be updated with all patch versions, but will not be updated beyond the minor version.
 318
 319 You should specify a version that exists or is guaranteed to exist. If you specify a version that doesn't end up existing, Firefox will update beyond that version.
 320
 321 **Compatibility:** Firefox 102,\
 322 **CCK2 Equivalent:** N/A\
 323 **Preferences Affected:** N/A
 324
 325 #### Windows (GPO)
 326 ```
 327 Software\Policies\Mozilla\Firefox\AppUpdatePin = "106."
 328 ```
 329 #### Windows (Intune)
 330 OMA-URI:
 331 ```
 332 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox/AppUpdatePin
 333 ```
 334 Value (string):
 335 ```
 336 <enabled/>
 337 <data id="String" value="106."/>
 338 ```
 339 #### macOS
 340 ```
 341 <dict>
 342   <key>AppUpdatePin</key>
 343   <string>106.</string>
 344 </dict>
 345 ```
 346 #### policies.json
 347 ```
 348 {
 349   "policies": {
 350     "AppUpdatePin": "106."
 351   }
 352 }
 353 ```
 354 ### AppUpdateURL
 355
 356 Change the URL for application update if you are providing Firefox updates from a custom update server.
 357
 358 **Compatibility:** Firefox 62, Firefox ESR 60.2\
 359 **CCK2 Equivalent:** N/A\
 360 **Preferences Affected:** `app.update.url`
 361
 362 #### Windows (GPO)
 363 ```
 364 Software\Policies\Mozilla\Firefox\AppUpdateURL = "https://yoursite.com"
 365 ```
 366 #### Windows (Intune)
 367 OMA-URI:
 368 ```
 369 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox/AppUpdateURL
 370 ```
 371 Value (string):
 372 ```
 373 <enabled/>
 374 <data id="AppUpdateURL" value="https://yoursite.com"/>
 375 ```
 376 #### macOS
 377 ```
 378 <dict>
 379   <key>AppUpdateURL</key>
 380   <string>https://yoursite.com</string>
 381 </dict>
 382 ```
 383 #### policies.json
 384 ```
 385 {
 386   "policies": {
 387     "AppUpdateURL": "https://yoursite.com"
 388   }
 389 }
 390 ```
 391 ### Authentication
 392
 393 Configure sites that support integrated authentication.
 394
 395 See [Integrated authentication](https://htmlpreview.github.io/?https://github.com/mdn/archived-content/blob/main/files/en-us/mozilla/integrated_authentication/raw.html) for more information.
 396
 397 `PrivateBrowsing` enables integrated authentication in private browsing.
 398
 399 **Compatibility:** Firefox 60, Firefox ESR 60 (AllowNonFQDN added in 62/60.2, AllowProxies added in 70/68.2, Locked added in 71/68.3, PrivateBrowsing added in 77/68.9)\
 400 **CCK2 Equivalent:** N/A\
 401 **Preferences Affected:** `network.negotiate-auth.trusted-uris`,`network.negotiate-auth.delegation-uris`,`network.automatic-ntlm-auth.trusted-uris`,`network.automatic-ntlm-auth.allow-non-fqdn`,`network.negotiate-auth.allow-non-fqdn`,`network.automatic-ntlm-auth.allow-proxies`,`network.negotiate-auth.allow-proxies`,`network.auth.private-browsing-sso`
 402
 403 #### Windows (GPO)
 404 ```
 405 Software\Policies\Mozilla\Firefox\Authentication\SPNEGO\1 = "mydomain.com"
 406 Software\Policies\Mozilla\Firefox\Authentication\SPNEGO\2 = "https://myotherdomain.com"
 407 Software\Policies\Mozilla\Firefox\Authentication\Delegated\1 = "mydomain.com"
 408 Software\Policies\Mozilla\Firefox\Authentication\Delegated\2 = "https://myotherdomain.com"
 409 Software\Policies\Mozilla\Firefox\Authentication\NTLM\1 = "mydomain.com"
 410 Software\Policies\Mozilla\Firefox\Authentication\NTLM\2 = "https://myotherdomain.com"
 411 Software\Policies\Mozilla\Firefox\Authentication\AllowNonFQDN\SPNEGO = 0x1 | 0x0
 412 Software\Policies\Mozilla\Firefox\Authentication\AllowNonFQDN\NTLM = 0x1 | 0x0
 413 Software\Policies\Mozilla\Firefox\Authentication\AllowProxies\SPNEGO = 0x1 | 0x0
 414 Software\Policies\Mozilla\Firefox\Authentication\AllowProxies\NTLM = 0x1 | 0x0
 415 Software\Policies\Mozilla\Firefox\Authentication\Locked = 0x1 | 0x0
 416 Software\Policies\Mozilla\Firefox\Authentication\PrivateBrowsing = 0x1 | 0x0
 417 ```
 418 #### Windows (Intune)
 419 OMA-URI:
 420 ```
 421 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~Authentication/Authentication_SPNEGO
 422 ```
 423 Value (string):
 424 ```
 425 <enabled/>
 426 <data id="Authentication" value="1&#xF000;mydomain&#xF000;2&#xF000;https://myotherdomain.com"/>
 427 ```
 428 OMA-URI:
 429 ```
 430 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~Authentication/Authentication_Delegated
 431 ```
 432 Value (string):
 433 ```
 434 <enabled/>
 435 <data id="Authentication" value="1&#xF000;mydomain&#xF000;2&#xF000;https://myotherdomain.com"/>
 436 ```
 437 OMA-URI:
 438 ```
 439 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~Authentication/Authentication_NTLM
 440 ```
 441 Value (string):
 442 ```
 443 <enabled/>
 444 <data id="Authentication" value="1&#xF000;mydomain&#xF000;2&#xF000;https://myotherdomain.com"/>
 445 ```
 446 OMA-URI:
 447 ```
 448 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~Authentication/Authentication_AllowNonFQDN
 449 ```
 450 Value (string):
 451 ```
 452 <enabled/>
 453 <data id="Authentication_AllowNonFQDN_NTLM" value="true | false"/>
 454 <data id="Authentication_AllowNonFQDN_SPNEGO" value="true | false"/>
 455 ```
 456 OMA-URI:
 457 ```
 458 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~Authentication/Authentication_Locked
 459 ```
 460 Value (string):
 461 ```
 462 <enabled/> or <disabled/>
 463 ```
 464 OMA-URI:
 465 ```
 466 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~Authentication/Authentication_PrivateBrowsing
 467 ```
 468 Value (string):
 469 ```
 470 <enabled/> or <disabled/>
 471 ```
 472 #### macOS
 473 ```
 474 <dict>
 475   <key>Authentication</key>
 476   <dict>
 477     <key>SPNEGO</key>
 478     <array>
 479       <string>mydomain.com</string>
 480       <string>https://myotherdomain.com</string>
 481     </array>
 482     <key>Delegated</key>
 483     <array>
 484       <string>mydomain.com</string>
 485       <string>https://myotherdomain.com</string>
 486     </array>
 487     <key>NTLM</key>
 488     <array>
 489       <string>mydomain.com</string>
 490       <string>https://myotherdomain.com</string>
 491     </array>
 492     <key>AllowNonFQDN</key>
 493       <dict>
 494       <key>SPNEGO</key>
 495       <true/> | <false/>
 496       <key>NTLM</key>
 497       <true/> | <false/>
 498     </dict>
 499     <key>AllowProxies</key>
 500       <dict>
 501       <key>SPNEGO</key>
 502       <true/> | <false/>
 503       <key>NTLM</key>
 504       <true/> | <false/>
 505     </dict>
 506     <key>Locked</key>
 507     <true/> | <false/>
 508     <key>PrivateBrowsing</key>
 509     <true/> | <false/>
 510   </dict>
 511 </dict>
 512 ```
 513 #### policies.json
 514 ```
 515 {
 516   "policies": {
 517     "Authentication": {
 518       "SPNEGO": ["mydomain.com", "https://myotherdomain.com"],
 519       "Delegated": ["mydomain.com", "https://myotherdomain.com"],
 520       "NTLM": ["mydomain.com", "https://myotherdomain.com"],
 521       "AllowNonFQDN": {
 522         "SPNEGO": true | false,
 523         "NTLM": true | false
 524       },
 525       "AllowProxies": {
 526         "SPNEGO": true | false,
 527         "NTLM": true | false
 528       },
 529       "Locked": true | false,
 530       "PrivateBrowsing": true | false
 531     }
 532   }
 533 }
 534 ```
 535 ### AutofillAddressEnabled
 536
 537 Enables or disables autofill for addresses.
 538
 539 This only applies when address autofill is enabled for a particular Firefox version or region. See [this page](https://support.mozilla.org/kb/automatically-fill-your-address-web-forms) for more information.
 540
 541 **Compatibility:** Firefox 125, Firefox ESR 115.10\
 542 **CCK2 Equivalent:** N/A\
 543 **Preferences Affected:** `extensions.formautofill.addresses.enabled`
 544
 545 #### Windows (GPO)
 546 ```
 547 Software\Policies\Mozilla\Firefox\AutofillAddressEnabled = 0x1 | 0x0
 548 ```
 549 #### Windows (Intune)
 550 OMA-URI:
 551 ```
 552 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox/AutofillAddressEnabled
 553 ```
 554 Value (string):
 555 ```
 556 <enabled/> or <disabled/>
 557 ```
 558 #### macOS
 559 ```
 560 <dict>
 561   <key>AutofillAddressEnabled</key>
 562   <true/> | <false/>
 563 </dict>
 564 ```
 565 #### policies.json
 566 ```
 567 {
 568   "policies": {
 569     "AutofillAddressEnabled": true | false
 570   }
 571 }
 572 ```
 573 ### AutofillCreditCardEnabled
 574
 575 Enables or disables autofill for payment methods.
 576
 577 This only applies when payment method autofill is enabled for a particular Firefox version or region. See [this page](https://support.mozilla.org/kb/credit-card-autofill) for more information.
 578
 579 **Compatibility:** Firefox 125, Firefox ESR 115.10\
 580 **CCK2 Equivalent:** N/A\
 581 **Preferences Affected:** `extensions.formautofill.creditCards.enabled`
 582
 583 #### Windows (GPO)
 584 ```
 585 Software\Policies\Mozilla\Firefox\AutofillCreditCardEnabled = 0x1 | 0x0
 586 ```
 587 #### Windows (Intune)
 588 OMA-URI:
 589 ```
 590 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox/AutofillCreditCardEnabled
 591 ```
 592 Value (string):
 593 ```
 594 <enabled/> or <disabled/>
 595 ```
 596 #### macOS
 597 ```
 598 <dict>
 599   <key>AutofillCreditCardEnabled</key>
 600   <true/> | <false/>
 601 </dict>
 602 ```
 603 #### policies.json
 604 ```
 605 {
 606   "policies": {
 607     "AutofillCreditCardEnabled": true | false
 608   }
 609 }
 610 ```
 611 ### AutoLaunchProtocolsFromOrigins
 612 Define a list of external protocols that can be used from listed origins without prompting the user. The origin is the scheme plus the hostname.
 613
 614 The syntax of this policy is exactly the same as the [Chrome AutoLaunchProtocolsFromOrigins policy](https://cloud.google.com/docs/chrome-enterprise/policies/?policy=AutoLaunchProtocolsFromOrigins) except that you can only use valid origins (not just hostnames). This also means that you cannot specify an asterisk for all origins.
 615
 616 The schema is:
 617 ```
 618 {
 619  "items": {
 620   "properties": {
 621    "allowed_origins": {
 622     "items": {
 623      "type": "string"
 624     },
 625     "type": "array"
 626    },
 627    "protocol": {
 628     "type": "string"
 629    }
 630   },
 631   "required": [
 632    "protocol",
 633    "allowed_origins"
 634   ],
 635   "type": "object"
 636  },
 637  "type": "array"
 638 }
 639 ```
 640 **Compatibility:** Firefox 90, Firefox ESR 78.12\
 641 **CCK2 Equivalent:** N/A\
 642 **Preferences Affected:** N/A
 643
 644 #### Windows (GPO)
 645 Software\Policies\Mozilla\Firefox\AutoLaunchProtocolsFromOrigins (REG_MULTI_SZ) =
 646 ```
 647 [
 648   {
 649     "protocol": "zoommtg",
 650     "allowed_origins": [
 651       "https://somesite.zoom.us"
 652     ]
 653   }
 654 ]
 655 ```
 656 #### Windows (Intune)
 657 OMA-URI:
 658 ```
 659 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox/AutoLaunchProtocolsFromOrigins
 660 ```
 661 Value (string):
 662 ```
 663 <enabled/>
 664 <data id="JSON" value='
 665 [
 666   {
 667     "protocol": "zoommtg",
 668     "allowed_origins": [
 669       "https://somesite.zoom.us"
 670     ]
 671   }
 672 ]'/>
 673 ```
 674 If you are using custom ADMX and ADML administrative templates in Intune, you can use this OMA-URI instead
 675 to workaround the limit on the length of strings. Put all of your JSON on one line.
 676
 677 OMA-URI:
 678 ```
 679 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~Extensions/AutoLaunchProtocolsFromOriginsOneLine
 680 ```
 681 Value (string):
 682 ```
 683 <enabled/>
 684 <data id="JSONOneLine" value='[]'/>
 685 ```
 686 #### macOS
 687 ```
 688 <dict>
 689   <key>AutoLaunchProtocolsFromOrigins</key>
 690   <array>
 691     <dict>
 692       <key>protocol</key>
 693       <string>zoommtg</string>
 694       <key>allowed_origins</key>
 695       <array>
 696         <string>https://somesite.zoom.us</string>
 697       </array>
 698     </dict>
 699   </array>
 700 </dict>
 701 ```
 702 #### policies.json
 703 ```
 704 {
 705   "policies": {
 706     "AutoLaunchProtocolsFromOrigins": [{
 707       "protocol": "zoommtg",
 708       "allowed_origins": [
 709         "https://somesite.zoom.us"
 710       ]
 711     }]
 712   }
 713 }
 714 ```
 715 ### BackgroundAppUpdate
 716
 717 Enable or disable **automatic** application update **in the background**, when the application is not running.
 718
 719 If set to true, application updates may be installed (without user approval) in the background, even when the application is not running. The operating system might still require approval.
 720
 721 If set to false, the application will not try to install updates when the application is not running.
 722
 723 If you have disabled updates via `DisableAppUpdate` or disabled automatic updates via `AppAutoUpdate`, this policy has no effect.
 724
 725 If you are having trouble getting the background task to run, verify your configuration with the ["Requirements to run" section in this support document](https://support.mozilla.org/en-US/kb/enable-background-updates-firefox-windows).
 726
 727 **Compatibility:** Firefox 90 (Windows only)\
 728 **CCK2 Equivalent:** N/A\
 729 **Preferences Affected:** `app.update.background.enabled`
 730
 731 #### Windows (GPO)
 732 ```
 733 Software\Policies\Mozilla\Firefox\BackgroundAppUpdate = 0x1 | 0x0
 734 ```
 735 #### Windows (Intune)
 736 OMA-URI:
 737 ```
 738 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox/BackgroundAppUpdate
 739 ```
 740 Value (string):
 741 ```
 742 <enabled/> or <disabled/>
 743 ```
 744 #### macOS
 745 ```
 746 <dict>
 747   <key>BackgroundAppUpdate</key>
 748   <true/> | <false/>
 749 </dict>
 750 ```
 751 #### policies.json
 752 ```
 753 {
 754   "policies": {
 755     "BackgroundAppUpdate": true | false
 756   }
 757 }
 758 ```
 759 ### BlockAboutAddons
 760
 761 Block access to the Add-ons Manager (about:addons).
 762
 763 **Compatibility:** Firefox 60, Firefox ESR 60\
 764 **CCK2 Equivalent:** `disableAddonsManager`\
 765 **Preferences Affected:** N/A
 766
 767 #### Windows (GPO)
 768 ```
 769 Software\Policies\Mozilla\Firefox\BlockAboutAddons = 0x1 | 0x0
 770 ```
 771 #### Windows (Intune)
 772 OMA-URI:
 773 ```
 774 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox/BlockAboutAddons
 775 ```
 776 Value (string):
 777 ```
 778 <enabled/> or <disabled/>
 779 ```
 780 #### macOS
 781 ```
 782 <dict>
 783   <key>BlockAboutAddons</key>
 784   <true/> | <false/>
 785 </dict>
 786 ```
 787 #### policies.json
 788 ```
 789 {
 790   "policies": {
 791     "BlockAboutAddons": true | false
 792   }
 793 }
 794 ```
 795 ### BlockAboutConfig
 796
 797 Block access to about:config.
 798
 799 **Compatibility:** Firefox 60, Firefox ESR 60\
 800 **CCK2 Equivalent:** `disableAboutConfig`\
 801 **Preferences Affected:** N/A
 802
 803 #### Windows (GPO)
 804 ```
 805 Software\Policies\Mozilla\Firefox\BlockAboutConfig = 0x1 | 0x0
 806 ```
 807 #### Windows (Intune)
 808 OMA-URI:
 809 ```
 810 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox/BlockAboutConfig
 811 ```
 812 Value (string):
 813 ```
 814 <enabled/> or <disabled/>
 815 ```
 816 #### macOS
 817 ```
 818 <dict>
 819   <key>BlockAboutConfig</key>
 820   <true/> | <false/>
 821 </dict>
 822 ```
 823 #### policies.json
 824 ```
 825 {
 826   "policies": {
 827     "BlockAboutConfig": true | false
 828   }
 829 }
 830 ```
 831 ### BlockAboutProfiles
 832
 833 Block access to About Profiles (about:profiles).
 834
 835 **Compatibility:** Firefox 60, Firefox ESR 60\
 836 **CCK2 Equivalent:** `disableAboutProfiles`\
 837 **Preferences Affected:** N/A
 838
 839 #### Windows (GPO)
 840 ```
 841 Software\Policies\Mozilla\Firefox\BlockAboutProfiles = 0x1 | 0x0
 842 ```
 843 #### Windows (Intune)
 844 OMA-URI:
 845 ```
 846 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox/BlockAboutProfiles
 847 ```
 848 Value (string):
 849 ```
 850 <enabled/> or <disabled/>
 851 ```
 852 #### macOS
 853 ```
 854 <dict>
 855   <key>BlockAboutProfiles</key>
 856   <true/> | <false/>
 857 </dict>
 858 ```
 859 #### policies.json
 860 ```
 861 {
 862   "policies": {
 863     "BlockAboutProfiles": true | false
 864   }
 865 }
 866 ```
 867 ### BlockAboutSupport
 868
 869 Block access to Troubleshooting Information (about:support).
 870
 871 **Compatibility:** Firefox 60, Firefox ESR 60\
 872 **CCK2 Equivalent:** `disableAboutSupport`\
 873 **Preferences Affected:** N/A
 874
 875 #### Windows (GPO)
 876 ```
 877 Software\Policies\Mozilla\Firefox\BlockAboutSupport = 0x1 | 0x0
 878 ```
 879 #### Windows (Intune)
 880 OMA-URI:
 881 ```
 882 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox/BlockAboutSupport
 883 ```
 884 Value (string):
 885 ```
 886 <enabled/> or <disabled/>
 887 ```
 888 #### macOS
 889 ```
 890 <dict>
 891   <key>BlockAboutSupport</key>
 892   <true/> | <false/>
 893 </dict>
 894 ```
 895 #### policies.json
 896 ```
 897 {
 898   "policies": {
 899     "BlockAboutSupport": true | false
 900   }
 901 }
 902 ```
 903 ### Bookmarks
 904
 905 Note: [`ManagedBookmarks`](#managedbookmarks) is the new recommended way to add bookmarks. This policy will continue to be supported.
 906
 907 Add bookmarks in either the bookmarks toolbar or menu. Only `Title` and `URL` are required. If `Placement` is not specified, the bookmark will be placed on the toolbar. If `Folder` is specified, it is automatically created and bookmarks with the same folder name are grouped together.
 908
 909 If you want to clear all bookmarks set with this policy, you can set the value to an empty array (```[]```). This can be on Windows via the new Bookmarks (JSON) policy available with GPO and Intune.
 910
 911 **Compatibility:** Firefox 60, Firefox ESR 60\
 912 **CCK2 Equivalent:** `bookmarks.toolbar`,`bookmarks.menu`\
 913 **Preferences Affected:** N/A
 914
 915 #### Windows (GPO)
 916 ```
 917 Software\Policies\Mozilla\Firefox\Bookmarks\1\Title = "Example"
 918 Software\Policies\Mozilla\Firefox\Bookmarks\1\URL = "https://example.com"
 919 Software\Policies\Mozilla\Firefox\Bookmarks\1\Favicon = "https://example.com/favicon.ico"
 920 Software\Policies\Mozilla\Firefox\Bookmarks\1\Placement = "toolbar" | "menu"
 921 Software\Policies\Mozilla\Firefox\Bookmarks\1\Folder = "FolderName"
 922
 923 Software\Policies\Mozilla\Firefox\Bookmarks (REG_MULTI_SZ) =
 924 ```
 925 []
 926 ```
 927
 928 ```
 929 #### Windows (Intune)
 930 OMA-URI:
 931 ```
 932 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~Bookmarks/Bookmark01
 933 ```
 934 Value (string):
 935 ```
 936 <enabled/>
 937 <data id="BookmarkTitle" value="Example"/>
 938 <data id="BookmarkURL" value="https://example.com"/>
 939 <data id="BookmarkFavicon" value="https://example.com/favicon.ico"/>
 940 <data id="BookmarkPlacement" value="toolbar | menu"/>
 941 <data id="BookmarkFolder" value="FolderName"/>
 942 ```
 943 OMA-URI:
 944 ```
 945 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox/Bookmarks
 946 ```
 947 Value (string):
 948 ```
 949 <enabled/>
 950 <data id="JSON" value='[]'/>
 951 ```
 952 If you are using custom ADMX and ADML administrative templates in Intune, you can use this OMA-URI instead
 953 to workaround the limit on the length of strings. Put all of your JSON on one line.
 954
 955 OMA-URI:
 956 ```
 957 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~Extensions/BookmarksOneLine
 958 ```
 959 Value (string):
 960 ```
 961 <enabled/>
 962 <data id="JSONOneLine" value='[]'/>
 963 ```
 964 #### macOS
 965 ```
 966 <dict>
 967   <key>Bookmarks</key>
 968   <array>
 969     <dict>
 970       <key>Title</key>
 971       <string>Example</string>
 972       <key>URL</key>
 973       <string>https://example.com</string>
 974       <key>Favicon</key>
 975       <string>https://example.com/favicon.ico</string>
 976       <key>Placement</key>
 977       <string>toolbar | menu</string>
 978       <key>Folder</key>
 979       <string>FolderName</string>
 980     </dict>
 981   </array>
 982 </dict>
 983 ```
 984 #### policies.json
 985 ```
 986 {
 987   "policies": {
 988     "Bookmarks": [
 989       {
 990         "Title": "Example",
 991         "URL": "https://example.com",
 992         "Favicon": "https://example.com/favicon.ico",
 993         "Placement": "toolbar" | "menu",
 994         "Folder": "FolderName"
 995       }
 996     ]
 997   }
 998 }
 999 ```
1000 ### CaptivePortal
1001 Enable or disable the detection of captive portals.
1002
1003 **Compatibility:** Firefox 67, Firefox ESR 60.7\
1004 **CCK2 Equivalent:** N/A\
1005 **Preferences Affected:** `network.captive-portal-service.enabled`
1006
1007 #### Windows (GPO)
1008 ```
1009 Software\Policies\Mozilla\Firefox\CaptivePortal = 0x1 | 0x0
1010 ```
1011 #### Windows (Intune)
1012 OMA-URI:
1013 ```
1014 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox/CaptivePortal
1015 ```
1016 Value (string):
1017 ```
1018 <enabled/> or <disabled/>
1019 ```
1020 #### macOS
1021 ```
1022 <dict>
1023   <key>CaptivePortal</key>
1024   <true/> | <false/>
1025 </dict>
1026 ```
1027 #### policies.json
1028 ```
1029 {
1030   "policies": {
1031     "CaptivePortal": true | false
1032   }
1033 }
1034 ```
1035 ### Certificates
1036
1037 ### Certificates | ImportEnterpriseRoots
1038
1039 Trust certificates that have been added to the operating system certificate store by a user or administrator.
1040
1041 Note: This policy only works on Windows and macOS. For Linux discussion, see [bug 1600509](https://bugzilla.mozilla.org/show_bug.cgi?id=1600509).
1042
1043 See https://support.mozilla.org/kb/setting-certificate-authorities-firefox for more detail.
1044
1045 **Compatibility:** Firefox 60, Firefox ESR 60 (macOS support in Firefox 63, Firefox ESR 68)\
1046 **CCK2 Equivalent:** N/A\
1047 **Preferences Affected:** `security.enterprise_roots.enabled`
1048
1049 #### Windows (GPO)
1050 ```
1051 Software\Policies\Mozilla\Firefox\Certificates\ImportEnterpriseRoots = 0x1 | 0x0
1052 ```
1053 #### Windows (Intune)
1054 OMA-URI:
1055 ```
1056 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~Certificates/Certificates_ImportEnterpriseRoots
1057 ```
1058 Value (string):
1059 ```
1060 <enabled/> or <disabled/>
1061 ```
1062 #### macOS
1063 ```
1064 <dict>
1065   <key>Certificates</key>
1066   <dict>
1067     <key>ImportEnterpriseRoots</key>
1068     <true/> | <false/>
1069   </dict>
1070 </dict>
1071 ```
1072 #### policies.json
1073 ```
1074 {
1075   "policies": {
1076     "Certificates": {
1077       "ImportEnterpriseRoots": true | false
1078     }
1079   }
1080 }
1081 ```
1082 ### Certificates | Install
1083
1084 Install certificates into the Firefox certificate store. If only a filename is specified, Firefox searches for the file in the following locations:
1085
1086 - Windows
1087   - %USERPROFILE%\AppData\Local\Mozilla\Certificates
1088   - %USERPROFILE%\AppData\Roaming\Mozilla\Certificates
1089 - macOS
1090   - /Library/Application Support/Mozilla/Certificates
1091   - ~/Library/Application Support/Mozilla/Certificates
1092 - Linux
1093   - /usr/lib/mozilla/certificates
1094   - /usr/lib64/mozilla/certificates
1095   - ~/.mozilla/certificates
1096
1097 Starting with Firefox 65, Firefox 60.5 ESR, a fully qualified path can be used, including UNC paths. You should use the native path style for your operating system. We do not support using %USERPROFILE% or other environment variables on Windows.
1098
1099 If you are specifying the path in the policies.json file on Windows, you need to escape your backslashes (`\\`) which means that for UNC paths, you need to escape both (`\\\\`). If you use group policy, you only need one backslash.
1100
1101 Certificates are installed using the trust string `CT,CT,`.
1102
1103 Binary (DER) and ASCII (PEM) certificates are both supported.
1104
1105 **Compatibility:** Firefox 64, Firefox ESR 64\
1106 **CCK2 Equivalent:** `certs.ca`\
1107 **Preferences Affected:** N/A
1108
1109 #### Windows (GPO)
1110 ```
1111 Software\Policies\Mozilla\Firefox\Certificates\Install\1 = "cert1.der"
1112 Software\Policies\Mozilla\Firefox\Certificates\Install\2 = "C:\Users\username\cert2.pem"
1113 ```
1114 #### Windows (Intune)
1115 OMA-URI:
1116 ```
1117 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~Certificates/Certificates_Install
1118 ```
1119 Value (string):
1120 ```
1121 <enabled/>
1122 <data id="Certificates_Install" value="1&#xF000;cert1.der&#xF000;2&#xF000;C:\Users\username\cert2.pem"/>
1123 ```
1124 #### macOS
1125 ```
1126 <dict>
1127   <key>Certificates</key>
1128   <dict>
1129     <key>Install</key>
1130     <array>
1131       <string>cert1.der</string>
1132       <string>/Users/username/cert2.pem</string>
1133     </array>
1134   </dict>
1135 </dict>
1136 ```
1137 #### policies.json
1138 ```
1139 {
1140   "policies": {
1141     "Certificates": {
1142       "Install": ["cert1.der", "/home/username/cert2.pem"]
1143     }
1144   }
1145 }
1146 ```
1147 ### Containers
1148 Set policies related to [containers](https://addons.mozilla.org/firefox/addon/multi-account-containers/).
1149
1150 Currently you can set the initial set of containers.
1151
1152 For each container, you can specify the name, icon, and color.
1153
1154 | Name | Description |
1155 | --- | --- |
1156 | `name`| Name of container
1157 | `icon` | Can be `fingerprint`, `briefcase`, `dollar`, `cart`, `vacation`, `gift`, `food`, `fruit`, `pet`, `tree`, `chill`, `circle`, `fence`
1158 | `color` | Can be `blue`, `turquoise`, `green`, `yellow`, `orange`, `red`, `pink`, `purple`, `toolbar`
1159
1160 **Compatibility:** Firefox 113\
1161 **CCK2 Equivalent:** N/A\
1162 **Preferences Affected:** N/A
1163
1164 #### Windows (GPO)
1165 Software\Policies\Mozilla\Firefox\Containers (REG_MULTI_SZ) =
1166 ```
1167 {
1168   "Default": [
1169     {
1170       "name": "My container",
1171       "icon": "pet",
1172       "color": "turquoise"
1173     }
1174   ]
1175 }
1176 ```
1177 #### Windows (Intune)
1178 OMA-URI:
1179 ```
1180 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox/Containers
1181 ```
1182 Value (string):
1183 ```
1184 <enabled/>
1185 <data id="JSON" value='
1186 {
1187   "Default": [
1188     {
1189       "name": "My container",
1190       "icon": "pet",
1191       "color": "turquoise"
1192     }
1193   ]
1194 }
1195 '/>
1196 ```
1197 If you are using custom ADMX and ADML administrative templates in Intune, you can use this OMA-URI instead
1198 to workaround the limit on the length of strings. Put all of your JSON on one line.
1199
1200 OMA-URI:
1201 ```
1202 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~Extensions/ContainersOneLine
1203 ```
1204 Value (string):
1205 ```
1206 <enabled/>
1207 <data id="JSONOneLine" value='{}'/>
1208 ```
1209 #### macOS
1210 ```
1211 <dict>
1212   <key>Default</key>
1213   <dict>
1214     <key>Containers</key>
1215     <array>
1216       <dict>
1217         <key>name</key>
1218         <string>My container</string>
1219         <key>icon</key>
1220         <string>pet</string>
1221         <key>color</key>
1222         <string>turquoise</string>
1223       </dict>
1224     </array>
1225   </dict>
1226 </dict>
1227 ```
1228 #### policies.json
1229 ```
1230 {
1231   "policies": {
1232     "Containers": {
1233       "Default": [
1234         {
1235           "name": "My container",
1236           "icon": "pet",
1237           "color": "turquoise"
1238         }
1239       ]
1240     }
1241   }
1242 }
1243 ```
1244 ### ContentAnalysis
1245 Configure Firefox to use an agent for Data Loss Prevention (DLP) that is compatible with the [Google Chrome Content Analysis Connector Agent SDK](https://github.com/chromium/content_analysis_sdk).
1246
1247 `AgentName` is the name of the DLP agent. This is used in dialogs and notifications about DLP operations. The default is "A DLP Agent".
1248
1249 `AgentTimeout` is the timeout in number of seconds after a DLP request is sent to the agent. After this timeout, the request will be denied unless `DefaultResult` is set to 1 or 2. The default is 30.
1250
1251 `AllowUrlRegexList` is a space-separated list of regular expressions that indicates URLs for which DLP operations will always be allowed without consulting the agent. The default is "^about:(?!blank&#124;srcdoc).*", meaning that any pages that start with "about:" will be exempt from DLP except for "about:blank" and "about:srcdoc", as these can be controlled by web content.
1252
1253 `BypassForSameTabOperations` indicates whether Firefox will automatically allow DLP requests whose data comes from the same tab and frame - for example, if data is copied to the clipboard and then pasted on the same page. The default is false.
1254
1255 `ClientSignature` indicates the required signature of the DLP agent connected to the pipe. If this is a non-empty string and the DLP agent does not have a signature with a Subject Name that exactly matches this value, Firefox will not connect to the pipe. The default is the empty string.
1256
1257 `DefaultResult` indicates the desired behavior for DLP requests if there is a problem connecting to the DLP agent. The default is 0.
1258
1259 | Value | Description
1260 | --- | --- |
1261 | 0 | Deny the request (default)
1262 | 1 | Warn the user and allow them to choose whether to allow or deny
1263 | 2 | Allow the request
1264
1265 `DenyUrlRegexList` is a space-separated list of regular expressions that indicates URLs for which DLP operations will always be denied without consulting the agent. The default is the empty string.
1266
1267 `Enabled` indicates whether Firefox should use DLP. Note that if this value is true and no DLP agent is running, all DLP requests will be denied unless `DefaultResult` is set to 1 or 2.
1268
1269 `IsPerUser` indicates whether the pipe the DLP agent has created is per-user or per-system. The default is true, meaning per-user.
1270
1271 `PipePathName` is the name of the pipe the DLP agent has created and Firefox will connect to. The default is "path_user".
1272
1273 `ShowBlockedResult` indicates whether Firefox should show a notification when a DLP request is denied. The default is true.
1274
1275 **Compatibility:** Firefox 132\
1276 **CCK2 Equivalent:** N/A\
1277 **Preferences Affected:** `browser.contentanalysis.agent_name`, `browser.contentanalysis.agent_timeout`, `browser.contentanalysis.allow_url_regex_list`, `browser.contentanalysis.bypass_for_same_tab_operations`, `browser.contentanalysis.client_signature`, `browser.contentanalysis.default_result`, `browser.contentanalysis.deny_url_regex_list`, `browser.contentanalysis.enabled`, `browser.contentanalysis.is_per_user`, `browser.contentanalysis.pipe_path_name`, `browser.contentanalysis.show_blocked_result`
1278
1279 #### Windows (GPO)
1280 ```
1281 Software\Policies\Mozilla\Firefox\ContentAnalysis\AgentName = "My DLP Product"
1282 Software\Policies\Mozilla\Firefox\ContentAnalysis\AgentTimeout = 60
1283 Software\Policies\Mozilla\Firefox\ContentAnalysis\AllowUrlRegexList = "https://example\.com/.* https://subdomain\.example\.com/.*"
1284 Software\Policies\Mozilla\Firefox\ContentAnalysis\BypassForSameTabOperations = 0x1 | 0x0
1285 Software\Policies\Mozilla\Firefox\ContentAnalysis\ClientSignature = "My DLP Company"
1286 Software\Policies\Mozilla\Firefox\ContentAnalysis\DefaultResult = 0x0 | 0x1 | 0x2
1287 Software\Policies\Mozilla\Firefox\ContentAnalysis\DenyUrlRegexList = "https://example\.com/.* https://subdomain\.example\.com/.*"
1288 Software\Policies\Mozilla\Firefox\ContentAnalysis\Enabled = 0x1 | 0x0
1289 Software\Policies\Mozilla\Firefox\ContentAnalysis\IsPerUser = 0x1 | 0x0
1290 Software\Policies\Mozilla\Firefox\ContentAnalysis\PipePathName = "pipe_custom_name"
1291 Software\Policies\Mozilla\Firefox\ContentAnalysis\ShowBlockedResult = 0x1 | 0x0
1292 ```
1293
1294 #### Windows (Intune)
1295 OMA-URI:
1296 ```
1297 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~ContentAnalysis/ContentAnalysis_AgentName
1298 ```
1299 Value (string):
1300 ```
1301 <enabled/>
1302 <data id="ContentAnalysis_AgentName" value="My DLP Product"/>
1303 ```
1304 OMA-URI:
1305 ```
1306 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~ContentAnalysis/ContentAnalysis_AgentTimeout
1307 ```
1308 Value (string):
1309 ```
1310 <enabled/>
1311 <data id="ContentAnalysis_AgentTimeout" value="60"/>
1312 ```
1313 OMA-URI:
1314 ```
1315 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~ContentAnalysis/ContentAnalysis_AllowUrlRegexList
1316 ```
1317 Value (string):
1318 ```
1319 <enabled/>
1320 <data id="ContentAnalysis_AllowUrlRegexList" value="https://example\.com/.* https://subdomain\.example\.com/.*"/>
1321 ```
1322 OMA-URI:
1323 ```
1324 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~ContentAnalysis/ContentAnalysis_BypassForSameTabOperations
1325 ```
1326 Value (string):
1327 ```
1328 <enabled/> or <disabled/>
1329 ```
1330 OMA-URI:
1331 ```
1332 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~ContentAnalysis/ContentAnalysis_ClientSignature
1333 ```
1334 Value (string):
1335 ```
1336 <enabled/>
1337 <data id="ContentAnalysis_ClientSignature" value="My DLP Company"/>
1338 ```
1339 OMA-URI:
1340 ```
1341 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~ContentAnalysis/ContentAnalysis_DefaultResult
1342 ```
1343 Value (string):
1344 ```
1345 <enabled/>
1346 <data id="ContentAnalysis_DefaultResult" value="1"/>
1347 ```
1348 OMA-URI:
1349 ```
1350 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~ContentAnalysis/ContentAnalysis_DenyUrlRegexList
1351 ```
1352 Value (string):
1353 ```
1354 <enabled/>
1355 <data id="ContentAnalysis_DenyUrlRegexList" value="https://example\.com/.* https://subdomain\.example\.com/.*"/>
1356 ```
1357 OMA-URI:
1358 ```
1359 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~ContentAnalysis/ContentAnalysis_Enabled
1360 ```
1361 Value (string):
1362 ```
1363 <enabled/> or <disabled/>
1364 ```
1365 OMA-URI:
1366 ```
1367 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~ContentAnalysis/ContentAnalysis_IsPerUser
1368 ```
1369 Value (string):
1370 ```
1371 <enabled/> or <disabled/>
1372 ```
1373 OMA-URI:
1374 ```
1375 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~ContentAnalysis/ContentAnalysis_PipePathName
1376 ```
1377 Value (string):
1378 ```
1379 <enabled/>
1380 <data id="ContentAnalysis_PipePathName" value="pipe_custom_name"/>
1381 ```
1382 OMA-URI:
1383 ```
1384 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~ContentAnalysis/ContentAnalysis_ShowBlockedResult
1385 ```
1386 Value (string):
1387 ```
1388 <enabled/> or <disabled/>
1389 ```
1390
1391 #### policies.json
1392 ```
1393 {
1394   "policies": {
1395     "ContentAnalysis": {
1396       "AgentName": "My DLP Product",
1397       "AgentTimeout": 60,
1398       "AllowUrlRegexList": "https://example\.com/.* https://subdomain\.example\.com/.*",
1399       "BypassForSameTabOperations": true | false,
1400       "ClientSignature": "My DLP Company",
1401       "DefaultResult": 0 | 1 | 2,
1402       "DenyUrlRegexList": "https://example\.com/.* https://subdomain\.example\.com/.*",
1403       "Enabled": true | false,
1404       "IsPerUser": true | false,
1405       "PipePathName": "pipe_custom_name",
1406       "ShowBlockedResult": true | false,
1407     }
1408   }
1409 }
1410 ```
1411
1412 ### Cookies
1413 Configure cookie preferences.
1414
1415 `Allow` is a list of origins (not domains) where cookies are always allowed. You must include http or https.
1416
1417 `AllowSession` is a list of origins (not domains) where cookies are only allowed for the current session. You must include http or https.
1418
1419 `Block` is a list of origins (not domains) where cookies are always blocked. You must include http or https.
1420
1421 `Behavior` sets the default behavior for cookies based on the values below.
1422
1423 `BehaviorPrivateBrowsing` sets the default behavior for cookies in private browsing based on the values below.
1424
1425 | Value | Description
1426 | --- | --- |
1427 | accept | Accept all cookies
1428 | reject-foreign | Reject third party cookies
1429 | reject | Reject all cookies
1430 | limit-foreign | Reject third party cookies for sites you haven't visited
1431 | reject-tracker | Reject cookies for known trackers (default)
1432 | reject-tracker-and-partition-foreign | Reject cookies for known trackers and partition third-party cookies (Total Cookie Protection) (default for private browsing)
1433
1434 `Locked` prevents the user from changing cookie preferences.
1435
1436 `Default` determines whether cookies are accepted at all. (*Deprecated*. Use `Behavior` instead)
1437
1438 `AcceptThirdParty` determines how third-party cookies are handled. (*Deprecated*. Use `Behavior` instead)
1439
1440 `RejectTracker` only rejects cookies for trackers. (*Deprecated*. Use `Behavior` instead)
1441
1442 `ExpireAtSessionEnd` determines when cookies expire. (*Deprecated*. Use [`SanitizeOnShutdown`](#sanitizeonshutdown-selective) instead)
1443
1444 **Compatibility:** Firefox 60, Firefox ESR 60 (RejectTracker added in Firefox 63, AllowSession added in Firefox 79/78.1, Behavior added in Firefox 95/91.4)\
1445 **CCK2 Equivalent:** N/A\
1446 **Preferences Affected:** `network.cookie.cookieBehavior`, `network.cookie.cookieBehavior.pbmode`, `network.cookie.lifetimePolicy`
1447
1448 #### Windows (GPO)
1449 ```
1450 Software\Policies\Mozilla\Firefox\Cookies\Allow\1 = "https://example.com"
1451 Software\Policies\Mozilla\Firefox\Cookies\AllowSession\1 = "https://example.edu"
1452 Software\Policies\Mozilla\Firefox\Cookies\Block\1 = "https://example.org"
1453 Software\Policies\Mozilla\Firefox\Cookies\Behavior = "accept" | "reject-foreign" | "reject" | "limit-foreign" | "reject-tracker" | "reject-tracker-and-partition-foreign"
1454 Software\Policies\Mozilla\Firefox\Cookies\BehaviorPrivateBrowsing = "accept" | "reject-foreign" | "reject" | "limit-foreign" | "reject-tracker" | "reject-tracker-and-partition-foreign"
1455 Software\Policies\Mozilla\Firefox\Cookies\Locked = 0x1 | 0x0
1456 ```
1457 #### Windows (Intune)
1458 OMA-URI:
1459 ```
1460 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~Cookies/Cookies_Allow
1461 ```
1462 Value (string):
1463 ```
1464 <enabled/>
1465 <data id="Permissions" value="1&#xF000;https://example.com"/>
1466 ```
1467 OMA-URI:
1468 ```
1469 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~Cookies/Cookies_AllowSession
1470 ```
1471 Value (string):
1472 ```
1473 <enabled/>
1474 <data id="Permissions" value="1&#xF000;https://example.edu"/>
1475 ```
1476 OMA-URI:
1477 ```
1478 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~Cookies/Cookies_Block
1479 ```
1480 Value (string):
1481 ```
1482 <enabled/>
1483 <data id="Permissions" value="1&#xF000;https://example.org"/>
1484 ```
1485 OMA-URI:
1486 ```
1487 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~Cookies/Cookies_Locked
1488 ```
1489 Value (string):
1490 ```
1491 <enabled/> or <disabled/>
1492 ```
1493 OMA-URI:
1494 ```
1495 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~Cookies/Cookies_Behavior
1496 ```
1497 Value (string):
1498 ```
1499 <enabled/>
1500 <data id="Cookies_Behavior" value="accept | reject-foreign | reject | limit-foreign | reject-tracker | reject-tracker-and-partition-foreign"/>
1501 ```
1502 OMA-URI:
1503 ```
1504 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~Cookies/Cookies_BehaviorPrivateBrowsing
1505 ```
1506 Value (string):
1507 ```
1508 <enabled/>
1509 <data id="Cookies_BehaviorPrivateBrowsing" value="accept | reject-foreign | reject | limit-foreign | reject-tracker | reject-tracker-and-partition-foreign"/>
1510 ```
1511 #### macOS
1512 ```
1513 <dict>
1514   <key>Cookies</key>
1515   <dict>
1516     <key>Allow</key>
1517     <array>
1518       <string>http://example.com</string>
1519     </array>
1520     <key>AllowSession</key>
1521     <array>
1522       <string>http://example.edu</string>
1523     </array>
1524     <key>Block</key>
1525     <array>
1526       <string>http://example.org</string>
1527     </array>
1528     <key>Locked</key>
1529     <true/> | <false/>
1530     <key>Behavior</key>
1531     <string>accept | reject-foreign | reject | limit-foreign | reject-tracker | reject-tracker-and-partition-foreign</string>
1532     <key>BehaviorPrivateBrowsing</key>
1533     <string>accept | reject-foreign | reject | limit-foreign | reject-tracker | reject-tracker-and-partition-foreign</string>
1534   </dict>
1535 </dict>
1536 ```
1537 #### policies.json
1538 ```
1539 {
1540   "policies": {
1541     "Cookies": {
1542       "Allow": ["http://example.org/"],
1543       "AllowSession": ["http://example.edu/"],
1544       "Block": ["http://example.edu/"],
1545       "Locked": true | false,
1546       "Behavior": "accept" | "reject-foreign" | "reject" | "limit-foreign" | "reject-tracker" | "reject-tracker-and-partition-foreign",
1547       "BehaviorPrivateBrowsing": "accept" | "reject-foreign" | "reject" | "limit-foreign" | "reject-tracker" | "reject-tracker-and-partition-foreign",
1548     }
1549   }
1550 }
1551 ```
1552 ### DefaultDownloadDirectory
1553 Set the default download directory.
1554
1555 You can use ${home} for the native home directory.
1556
1557 **Compatibility:** Firefox 68, Firefox ESR 68\
1558 **CCK2 Equivalent:** N/A\
1559 **Preferences Affected:** `browser.download.dir`, `browser.download.folderList`
1560
1561 #### Windows (GPO)
1562 ```
1563 Software\Policies\Mozilla\Firefox\DefaultDownloadDirectory = "${home}\Downloads"
1564 ```
1565 #### Windows (Intune)
1566 OMA-URI:
1567 ```
1568 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox/DefaultDownloadDirectory
1569 ```
1570 Value (string):
1571 ```
1572 <enabled/>
1573 <data id="Preferences_String" value="${home}\Downloads"/>
1574 ```
1575 #### macOS
1576 ```
1577 <dict>
1578   <key>DefaultDownloadDirectory</key>
1579   <string>${home}/Downloads</string>
1580 </dict>
1581 ```
1582 #### policies.json (macOS and Linux)
1583 ```
1584 {
1585   "policies": {
1586     "DefaultDownloadDirectory": "${home}/Downloads"
1587   }
1588 }
1589 ```
1590 #### policies.json (Windows)
1591 ```
1592 {
1593   "policies": {
1594     "DefaultDownloadDirectory": "${home}\\Downloads"
1595   }
1596 }
1597 ```
1598 ### DisableAppUpdate
1599 Turn off application updates within Firefox.
1600
1601 **Compatibility:** Firefox 60, Firefox ESR 60\
1602 **CCK2 Equivalent:** `disableFirefoxUpdates`\
1603 **Preferences Affected:** N/A
1604
1605 #### Windows (GPO)
1606 ```
1607 Software\Policies\Mozilla\Firefox\DisableAppUpdate = 0x1 | 0x0
1608 ```
1609 #### Windows (Intune)
1610 OMA-URI:
1611 ```
1612 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox/DisableAppUpdate
1613 ```
1614 Value (string):
1615 ```
1616 <enabled/> or <disabled/>
1617 ```
1618 #### macOS
1619 ```
1620 <dict>
1621   <key>DisableAppUpdate</key>
1622   <true/> | <false/>
1623 </dict>
1624 ```
1625 #### policies.json
1626 ```
1627 {
1628   "policies": {
1629     "DisableAppUpdate": true | false
1630   }
1631 }
1632 ```
1633 ### DisableBuiltinPDFViewer
1634 Disable the built in PDF viewer. PDF files are downloaded and sent externally.
1635
1636 **Compatibility:** Firefox 60, Firefox ESR 60\
1637 **CCK2 Equivalent:** `disablePDFjs`\
1638 **Preferences Affected:** `pdfjs.disabled`
1639
1640 #### Windows (GPO)
1641 ```
1642 Software\Policies\Mozilla\Firefox\DisableBuiltinPDFViewer = 0x1 | 0x0
1643 ```
1644 #### Windows (Intune)
1645 OMA-URI:
1646 ```
1647 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox/DisableBuiltinPDFViewer
1648 ```
1649 Value (string):
1650 ```
1651 <enabled/> or <disabled/>
1652 ```
1653 #### macOS
1654 ```
1655 <dict>
1656   <key>DisableBuiltinPDFViewer</key>
1657   <true/> | <false/>
1658 </dict>
1659 ```
1660 #### policies.json
1661 ```
1662 {
1663   "policies": {
1664     "DisableBuiltinPDFViewer": true | false
1665   }
1666 }
1667 ```
1668 ### DisabledCiphers
1669 Disable specific cryptographic ciphers, listed below.
1670
1671 ```
1672 TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256
1673 TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256
1674 TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256
1675 TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256
1676 TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384
1677 TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384
1678 TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA
1679 TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA
1680 TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA
1681 TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA
1682 TLS_DHE_RSA_WITH_AES_128_CBC_SHA
1683 TLS_DHE_RSA_WITH_AES_256_CBC_SHA
1684 TLS_RSA_WITH_AES_128_GCM_SHA256
1685 TLS_RSA_WITH_AES_256_GCM_SHA384
1686 TLS_RSA_WITH_AES_128_CBC_SHA
1687 TLS_RSA_WITH_AES_256_CBC_SHA
1688 TLS_RSA_WITH_3DES_EDE_CBC_SHA
1689 ```
1690
1691 **Preferences Affected:** `security.ssl3.ecdhe_rsa_aes_128_gcm_sha256`, `security.ssl3.ecdhe_ecdsa_aes_128_gcm_sha256`, `security.ssl3.ecdhe_ecdsa_chacha20_poly1305_sha256`, `security.ssl3.ecdhe_rsa_chacha20_poly1305_sha256`, `security.ssl3.ecdhe_ecdsa_aes_256_gcm_sha384`, `security.ssl3.ecdhe_rsa_aes_256_gcm_sha384`, `security.ssl3.ecdhe_rsa_aes_128_sha`, `security.ssl3.ecdhe_ecdsa_aes_128_sha`, `security.ssl3.ecdhe_rsa_aes_256_sha`, `security.ssl3.ecdhe_ecdsa_aes_256_sha`, `security.ssl3.dhe_rsa_aes_128_sha`, `security.ssl3.dhe_rsa_aes_256_sha`, `security.ssl3.rsa_aes_128_gcm_sha256`, `security.ssl3.rsa_aes_256_gcm_sha384`, `security.ssl3.rsa_aes_128_sha`, `security.ssl3.rsa_aes_256_sha`, `security.ssl3.deprecated.rsa_des_ede3_sha`
1692
1693 ---
1694 **Note:**
1695
1696 This policy was updated in Firefox 78 to allow enabling ciphers as well. Setting the value to true disables the cipher, setting the value to false enables the cipher. Previously setting the value to true or false disabled the cipher.
1697
1698 ---
1699 **Compatibility:** Firefox 76, Firefox ESR 68.8 (TLS_RSA_WITH_AES_128_GCM_SHA256 and TLS_RSA_WITH_AES_256_GCM_SHA384 were added in Firefox 78, TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA, TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA, TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA38, TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256, TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384, and TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256 were added in Firefox 97 and Firefox 91.6)\
1700 **CCK2 Equivalent:** N/A\
1701 **Preferences Affected:** N/A
1702
1703 #### Windows (GPO)
1704 ```
1705 Software\Policies\Mozilla\Firefox\DisabledCiphers\CIPHER_NAME = 0x1 | 0x0
1706 ```
1707 #### Windows (Intune)
1708 OMA-URI:
1709 ```
1710 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~DisabledCiphers/DisabledCiphers_CIPHER_NAME
1711
1712 ```
1713 Value (string):
1714 ```
1715 <enabled/> or <disabled/>
1716 ```
1717 #### macOS
1718 ```
1719 <dict>
1720   <key>DisabledCiphers</key>
1721     <dict>
1722       <key>CIPHER_NAME</key>
1723       <true/> | <false/>
1724     </dict>
1725 </dict>
1726 ```
1727 #### policies.json
1728 ```
1729 {
1730   "policies": {
1731     "DisabledCiphers": {
1732       "CIPHER_NAME": true | false,
1733     }
1734   }
1735 }
1736 ```
1737 ### DisableDefaultBrowserAgent
1738 Prevent the default browser agent from taking any actions. Only applicable to Windows; other platforms don’t have the agent.
1739
1740 The browser agent is a Windows-only scheduled task which runs in the background to collect and submit data about the browser that the user has set as their OS default. More information is available [here](https://firefox-source-docs.mozilla.org/toolkit/mozapps/defaultagent/default-browser-agent/index.html).
1741
1742 **Compatibility:** Firefox 75, Firefox ESR 68.7 (Windows only)\
1743 **CCK2 Equivalent:** N/A\
1744 **Preferences Affected:** N/A
1745
1746 #### Windows (GPO)
1747 ```
1748 Software\Policies\Mozilla\Firefox\DisableDefaultBrowserAgent = 0x1 | 0x0
1749 ```
1750 #### Windows (Intune)
1751 OMA-URI:
1752 ```
1753 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox/DisableDefaultBrowserAgent
1754 ```
1755 Value (string):
1756 ```
1757 <enabled/> or <disabled/>
1758 ```
1759 #### policies.json
1760 ```
1761 {
1762   "policies": {
1763     "DisableDefaultBrowserAgent": true | false
1764   }
1765 }
1766 ```
1767 ### DisableDeveloperTools
1768 Remove access to all developer tools.
1769
1770 **Compatibility:** Firefox 60, Firefox ESR 60\
1771 **CCK2 Equivalent:** `removeDeveloperTools`\
1772 **Preferences Affected:** `devtools.policy.disabled`
1773
1774 #### Windows (GPO)
1775 ```
1776 Software\Policies\Mozilla\Firefox\DisableDeveloperTools = 0x1 | 0x0`
1777 ```
1778 #### Windows (Intune)
1779 OMA-URI:
1780 ```
1781 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox/DisableDeveloperTools
1782 ```
1783 Value (string):
1784 ```
1785 <enabled/> or <disabled/>
1786 ```
1787 #### macOS
1788 ```
1789 <dict>
1790   <key>DisableDeveloperTools</key>
1791   <true/> | <false/>
1792 </dict>
1793 ```
1794 #### policies.json
1795 ```
1796 {
1797   "policies": {
1798     "DisableDeveloperTools": true | false
1799   }
1800 }
1801 ```
1802 ### DisableFeedbackCommands
1803 Disable the menus for reporting sites (Submit Feedback, Report Deceptive Site).
1804
1805 **Compatibility:** Firefox 60, Firefox ESR 60\
1806 **CCK2 Equivalent:** N/A\
1807 **Preferences Affected:** N/A
1808
1809 #### Windows (GPO)
1810 ```
1811 Software\Policies\Mozilla\Firefox\DisableFeedbackCommands = 0x1 | 0x0
1812 ```
1813 #### Windows (Intune)
1814 OMA-URI:
1815 ```
1816 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox/DisableFeedbackCommands
1817 ```
1818 Value (string):
1819 ```
1820 <enabled/> or <disabled/>
1821 ```
1822 #### macOS
1823 ```
1824 <dict>
1825   <key>DisableFeedbackCommands</key>
1826   <true/> | <false/>
1827 </dict>
1828 ```
1829 #### policies.json
1830 ```
1831 {
1832   "policies": {
1833     "DisableFeedbackCommands": true | false
1834   }
1835 }
1836 ```
1837 ### DisableEncryptedClientHello
1838 Disable the TLS Feature for Encrypted Client Hello. Note that TLS Client Hellos will still contain an ECH extension, but this extension will not be used by Firefox during the TLS handshake.
1839
1840 **Compatibility:** Firefox 127, Firefox ESR 128\
1841 **CCK2 Equivalent:** N/A\
1842 **Preferences Affected:** `network.dns.echconfig.enabled`, `network.dns.http3_echconfig.enabled`
1843
1844 #### Windows (GPO)
1845 ```
1846 Software\Policies\Mozilla\Firefox\DisableEncryptedClientHello = 0x1 | 0x0
1847 ```
1848 #### Windows (Intune)
1849 OMA-URI:
1850 ```
1851 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox/DisableEncryptedClientHello
1852 ```
1853 Value (string):
1854 ```
1855 <enabled/> or <disabled/>
1856 ```
1857 #### macOS
1858 ```
1859 <dict>
1860   <key>DisableEncryptedClientHello</key>
1861   <true/> | <false/>
1862 </dict>
1863 ```
1864 #### policies.json
1865 ```
1866 {
1867   "policies": {
1868     "DisableEncryptedClientHello": true | false
1869   }
1870 }
1871 ```
1872 ### DisableFirefoxAccounts
1873 Disable Firefox Accounts integration (Sync).
1874
1875 **Compatibility:** Firefox 60, Firefox ESR 60\
1876 **CCK2 Equivalent:** `disableSync`\
1877 **Preferences Affected:** `identity.fxaccounts.enabled`
1878
1879 #### Windows (GPO)
1880 ```
1881 Software\Policies\Mozilla\Firefox\DisableFirefoxAccounts = 0x1 | 0x0
1882 ```
1883 #### Windows (Intune)
1884 OMA-URI:
1885 ```
1886 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox/DisableFirefoxAccounts
1887 ```
1888 Value (string):
1889 ```
1890 <enabled/> or <disabled/>
1891 ```
1892 #### macOS
1893 ```
1894 <dict>
1895   <key>DisableFirefoxAccounts</key>
1896   <true/> | <false/>
1897 </dict>
1898 ```
1899 #### policies.json
1900 ```
1901 {
1902   "policies": {
1903     "DisableFirefoxAccounts": true | false
1904   }
1905 }
1906 ```
1907 ### DisableFirefoxScreenshots
1908 Remove access to Firefox Screenshots.
1909
1910 **Compatibility:** Firefox 60, Firefox ESR 60\
1911 **CCK2 Equivalent:** N/A\
1912 **Preferences Affected:** `extensions.screenshots.disabled`
1913
1914 #### Windows (GPO)
1915 ```
1916 Software\Policies\Mozilla\Firefox\DisableFirefoxScreenshots = 0x1 | 0x0
1917 ```
1918 #### Windows (Intune)
1919 OMA-URI:
1920 ```
1921 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox/DisableFirefoxScreenshots
1922 ```
1923 Value (string):
1924 ```
1925 <enabled/> or <disabled/>
1926 ```
1927 #### macOS
1928 ```
1929 <dict>
1930   <key>DisableFirefoxScreenshots</key>
1931   <true/> | <false/>
1932 </dict>
1933 ```
1934 #### policies.json
1935 ```
1936 {
1937   "policies": {
1938     "DisableFirefoxScreenshots": true | false
1939   }
1940 }
1941 ```
1942 ### DisableFirefoxStudies
1943 Disable Firefox studies (Shield).
1944
1945 **Compatibility:** Firefox 60, Firefox ESR 60\
1946 **CCK2 Equivalent:** N/A\
1947 **Preferences Affected:** `browser.newtabpage.activity-stream.asrouter.userprefs.cfr.addons`, `browser.newtabpage.activity-stream.asrouter.userprefs.cfr.features`
1948
1949 #### Windows (GPO)
1950 ```
1951 Software\Policies\Mozilla\Firefox\DisableFirefoxStudies = 0x1 | 0x0
1952 ```
1953 #### Windows (Intune)
1954 OMA-URI:
1955 ```
1956 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox/DisableFirefoxStudies
1957 ```
1958 Value (string):
1959 ```
1960 <enabled/> or <disabled/>
1961 ```
1962 #### macOS
1963 ```
1964 <dict>
1965   <key>DisableFirefoxStudies</key>
1966   <true/> | <false/>
1967 </dict>
1968 ```
1969 #### policies.json
1970 ```
1971 {
1972   "policies": {
1973     "DisableFirefoxStudies": true | false
1974   }
1975 }
1976 ```
1977 ### DisableForgetButton
1978 Disable the "Forget" button.
1979
1980 **Compatibility:** Firefox 60, Firefox ESR 60\
1981 **CCK2 Equivalent:** `disableForget`\
1982 **Preferences Affected:** N/A
1983
1984 #### Windows (GPO)
1985 ```
1986 Software\Policies\Mozilla\Firefox\DisableForgetButton = 0x1 | 0x0
1987 ```
1988 #### Windows (Intune)
1989 OMA-URI:
1990 ```
1991 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox/DisableForgetButton
1992 ```
1993 Value (string):
1994 ```
1995 <enabled/> or <disabled/>
1996 ```
1997 #### macOS
1998 ```
1999 <dict>
2000   <key>DisableForgetButton</key>
2001   <true/> | <false/>
2002 </dict>
2003 ```
2004 #### policies.json
2005 ```
2006 {
2007   "policies": {
2008     "DisableForgetButton": true | false
2009   }
2010 }
2011 ```
2012 ### DisableFormHistory
2013 Turn off saving information on web forms and the search bar.
2014
2015 **Compatibility:** Firefox 60, Firefox ESR 60\
2016 **CCK2 Equivalent:** `disableFormFill`\
2017 **Preferences Affected:** `browser.formfill.enable`
2018
2019 #### Windows (GPO)
2020 ```
2021 Software\Policies\Mozilla\Firefox\DisableFormHistory = 0x1 | 0x0
2022 ```
2023 #### Windows (Intune)
2024 OMA-URI:
2025 ```
2026 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox/DisableFormHistory
2027 ```
2028 Value (string):
2029 ```
2030 <enabled/> or <disabled/>
2031 ```
2032 #### macOS
2033 ```
2034 <dict>
2035   <key>DisableFormHistory</key>
2036   <true/> | <false/>
2037 </dict>
2038 ```
2039 #### policies.json
2040 ```
2041 {
2042   "policies": {
2043     "DisableFormHistory": true | false
2044   }
2045 }
2046 ```
2047 ### DisableMasterPasswordCreation
2048 Remove the master password functionality.
2049
2050 If this value is true, it works the same as setting [`PrimaryPassword`](#primarypassword) to false and removes the primary password functionality.
2051
2052 If both `DisableMasterPasswordCreation` and `PrimaryPassword` are used, `DisableMasterPasswordCreation` takes precedent.
2053
2054 **Compatibility:** Firefox 60, Firefox ESR 60\
2055 **CCK2 Equivalent:** `noMasterPassword`\
2056 **Preferences Affected:** N/A
2057
2058 #### Windows (GPO)
2059 ```
2060 Software\Policies\Mozilla\Firefox\DisableMasterPasswordCreation = 0x1 | 0x0
2061 ```
2062 #### Windows (Intune)
2063 OMA-URI:
2064 ```
2065 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox/DisableMasterPasswordCreation
2066 ```
2067 Value (string):
2068 ```
2069 <enabled/> or <disabled/>
2070 ```
2071 #### macOS
2072 ```
2073 <dict>
2074   <key>DisableMasterPasswordCreation</key>
2075   <true/> | <false/>
2076 </dict>
2077 ```
2078 #### policies.json
2079 ```
2080 {
2081   "policies": {
2082     "DisableMasterPasswordCreation": true | false
2083   }
2084 }
2085 ```
2086 ### DisablePasswordReveal
2087 Do not allow passwords to be shown in saved logins
2088
2089 **Compatibility:** Firefox 71, Firefox ESR 68.3\
2090 **CCK2 Equivalent:** N/A
2091 **Preferences Affected:** N/A
2092
2093 #### Windows (GPO)
2094 ```
2095 Software\Policies\Mozilla\Firefox\DisablePasswordReveal = 0x1 | 0x0
2096 ```
2097 #### Windows (Intune)
2098 OMA-URI:
2099 ```
2100 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox/DisablePasswordReveal
2101 ```
2102 Value (string):
2103 ```
2104 <enabled/> or <disabled/>
2105 ```
2106 #### macOS
2107 ```
2108 <dict>
2109   <key>DisablePasswordReveal</key>
2110   <true/> | <false/>
2111 </dict>
2112 ```
2113 #### policies.json
2114 ```
2115 {
2116   "policies": {
2117     "DisablePasswordReveal": true | false
2118   }
2119 }
2120 ```
2121 ### DisablePocket
2122 Remove Pocket in the Firefox UI. It does not remove it from the new tab page.
2123
2124 **Compatibility:** Firefox 60, Firefox ESR 60\
2125 **CCK2 Equivalent:** `disablePocket`\
2126 **Preferences Affected:** `extensions.pocket.enabled`
2127
2128 #### Windows (GPO)
2129 ```
2130 Software\Policies\Mozilla\Firefox\DisablePocket = 0x1 | 0x0
2131 ```
2132 #### Windows (Intune)
2133 OMA-URI:
2134 ```
2135 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox/DisablePocket
2136 ```
2137 Value (string):
2138 ```
2139 <enabled/> or <disabled/>
2140 ```
2141 #### macOS
2142 ```
2143 <dict>
2144   <key>DisablePocket</key>
2145   <true/> | <false/>
2146 </dict>
2147 ```
2148 #### policies.json
2149 ```
2150 {
2151   "policies": {
2152     "DisablePocket": true | false
2153   }
2154 }
2155 ```
2156 ### DisablePrivateBrowsing
2157 Remove access to private browsing.
2158
2159 This policy is superseded by [`PrivateBrowsingModeAvailability`](#privatebrowsingmodeavailability)
2160
2161 **Compatibility:** Firefox 60, Firefox ESR 60\
2162 **CCK2 Equivalent:** `disablePrivateBrowsing`\
2163 **Preferences Affected:** N/A
2164
2165 #### Windows (GPO)
2166 ```
2167 Software\Policies\Mozilla\Firefox\DisablePrivateBrowsing = 0x1 | 0x0
2168 ```
2169 #### Windows (Intune)
2170 OMA-URI:
2171 ```
2172 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox/DisablePrivateBrowsing
2173 ```
2174 Value (string):
2175 ```
2176 <enabled/> or <disabled/>
2177 ```
2178 #### macOS
2179 ```
2180 <dict>
2181   <key>DisablePrivateBrowsing</key>
2182   <true/> | <false/>
2183 </dict>
2184 ```
2185 #### policies.json
2186 ```
2187 {
2188   "policies": {
2189     "DisablePrivateBrowsing": true | false
2190   }
2191 }
2192 ```
2193 ### DisableProfileImport
2194 Disables the "Import data from another browser" option in the bookmarks window.
2195
2196 **Compatibility:** Firefox 60, Firefox ESR 60\
2197 **CCK2 Equivalent:** N/A\
2198 **Preferences Affected:** N/A
2199
2200 #### Windows (GPO)
2201 ```
2202 Software\Policies\Mozilla\Firefox\DisableProfileImport = 0x1 | 0x0
2203 ```
2204 #### Windows (Intune)
2205 OMA-URI:
2206 ```
2207 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox/DisableProfileImport
2208 ```
2209 Value (string):
2210 ```
2211 <enabled/> or <disabled/>
2212 ```
2213 #### macOS
2214 ```
2215 <dict>
2216   <key>DisableProfileImport</key>
2217   <true/> | <false/>
2218 </dict>
2219 ```
2220 #### policies.json
2221 ```
2222 {
2223   "policies": {
2224     "DisableProfileImport": true | false
2225   }
2226 }
2227 ```
2228 ### DisableProfileRefresh
2229 Disable the Refresh Firefox button on about:support and support.mozilla.org, as well as the prompt that displays offering to refresh Firefox when you haven't used it in a while.
2230
2231 **Compatibility:** Firefox 60, Firefox ESR 60\
2232 **CCK2 Equivalent:** `disableResetFirefox`\
2233 **Preferences Affected:** `browser.disableResetPrompt`
2234
2235 #### Windows (GPO)
2236 ```
2237 Software\Policies\Mozilla\Firefox\DisableProfileRefresh = 0x1 | 0x0
2238 ```
2239 #### Windows (Intune)
2240 OMA-URI:
2241 ```
2242 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox/DisableProfileRefresh
2243 ```
2244 Value (string):
2245 ```
2246 <enabled/> or <disabled/>
2247 ```
2248 #### macOS
2249 ```
2250 <dict>
2251   <key>DisableProfileRefresh</key>
2252   <true/> | <false/>
2253 </dict>
2254 ```
2255 #### policies.json
2256 ```
2257 {
2258   "policies": {
2259     "DisableProfileRefresh": true | false
2260   }
2261 }
2262 ```
2263 ### DisableSafeMode
2264 Disable safe mode within the browser.
2265
2266 On Windows, this disables safe mode via the command line as well.
2267
2268 **Compatibility:** Firefox 60, Firefox ESR 60 (Windows, macOS)\
2269 **CCK2 Equivalent:** `disableSafeMode`\
2270 **Preferences Affected:** N/A
2271
2272 #### Windows (GPO)
2273 ```
2274 Software\Policies\Mozilla\Firefox\DisableSafeMode = 0x1 | 0x0
2275 ```
2276 #### Windows (Intune)
2277 OMA-URI:
2278 ```
2279 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox/DisableSafeMode
2280 ```
2281 Value (string):
2282 ```
2283 <enabled/> or <disabled/>
2284 ```
2285 #### macOS
2286 ```
2287 <dict>
2288   <key>DisableSafeMode</key>
2289   <true/> | <false/>
2290 </dict>
2291 ```
2292 #### policies.json
2293 ```
2294 {
2295   "policies": {
2296     "DisableSafeMode": true | false
2297   }
2298 }
2299 ```
2300 ### DisableSecurityBypass
2301 Prevent the user from bypassing security in certain cases.
2302
2303 `InvalidCertificate` prevents adding an exception when an invalid certificate is shown.
2304
2305 `SafeBrowsing` prevents selecting "ignore the risk" and visiting a harmful site anyway.
2306
2307 These policies only affect what happens when an error is shown, they do not affect any settings in preferences.
2308
2309 **Compatibility:** Firefox 60, Firefox ESR 60\
2310 **CCK2 Equivalent:** N/A\
2311 **Preferences Affected:** `security.certerror.hideAddException`, `browser.safebrowsing.allowOverride`
2312
2313 #### Windows (GPO)
2314 ```
2315 Software\Policies\Mozilla\Firefox\DisableSecurityBypass\InvalidCertificate = 0x1 | 0x0
2316 Software\Policies\Mozilla\Firefox\DisableSecurityBypass\SafeBrowsing = 0x1 | 0x0
2317 ```
2318 #### Windows (Intune)
2319 OMA-URI:
2320 ```
2321 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox/P_DisableSecurityBypass_InvalidCertificate
2322 ```
2323 Value (string):
2324 ```
2325 <enabled/> or <disabled/>
2326 ```
2327 OMA-URI:
2328 ```
2329 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox/P_DisableSecurityBypass_SafeBrowsing
2330 ```
2331 Value (string):
2332 ```
2333 <enabled/> or <disabled/>
2334 ```
2335
2336 #### macOS
2337 ```
2338 <dict>
2339   <key>DisableSecurityBypass</key>
2340   <dict>
2341     <key>InvalidCertificate</key>
2342     <true/> | <false/>
2343     <key>SafeBrowsing</key>
2344     <true/> | <false/>
2345   </dict>
2346 </dict>
2347 ```
2348 #### policies.json
2349 ```
2350 {
2351   "policies": {
2352     "DisableSecurityBypass": {
2353       "InvalidCertificate": true | false,
2354       "SafeBrowsing": true | false
2355     }
2356   }
2357 }
2358 ```
2359 ### DisableSetDesktopBackground
2360 Remove the "Set As Desktop Background..." menuitem when right clicking on an image.
2361
2362 **Compatibility:** Firefox 60, Firefox ESR 60\
2363 **CCK2 Equivalent:** `removeSetDesktopBackground`\
2364 **Preferences Affected:** N/A
2365
2366 #### Windows (GPO)
2367 ```
2368 Software\Policies\Mozilla\Firefox\DisableSetDesktopBackground = 0x1 | 0x0
2369 ```
2370 #### Windows (Intune)
2371 OMA-URI:
2372 ```
2373 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox/DisableSetDesktopBackground
2374 ```
2375 Value (string):
2376 ```
2377 <enabled/> or <disabled/>
2378 ```
2379 #### macOS
2380 ```
2381 <dict>
2382   <key>DisableSetDesktopBackground</key>
2383   <true/> | <false/>
2384 </dict>
2385 ```
2386 #### policies.json
2387 ```
2388 {
2389   "policies": {
2390     "DisableSetDesktopBackground": true | false
2391   }
2392 }
2393 ```
2394 ### DisableSystemAddonUpdate
2395 Prevent system add-ons from being installed or updated.
2396
2397 **Compatibility:** Firefox 60, Firefox ESR 60\
2398 **CCK2 Equivalent:** N/A\
2399 **Preferences Affected:** N/A
2400
2401 #### Windows (GPO)
2402 ```
2403 Software\Policies\Mozilla\Firefox\DisableSystemAddonUpdate = 0x1 | 0x0
2404 ```
2405 #### Windows (Intune)
2406 OMA-URI:
2407 ```
2408 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox/DisableSystemAddonUpdate
2409 ```
2410 Value (string):
2411 ```
2412 <enabled/> or <disabled/>
2413 ```
2414 #### macOS
2415 ```
2416 <dict>
2417   <key>DisableSystemAddonUpdate</key>
2418   <true/> | <false/>
2419 </dict>
2420 ```
2421 #### policies.json
2422 ```
2423 {
2424   "policies": {
2425     "DisableSystemAddonUpdate": true | false
2426   }
2427 }
2428 ```
2429 ### DisableTelemetry
2430 Prevent the upload of telemetry data.
2431
2432 As of Firefox 83 and Firefox ESR 78.5, local storage of telemetry data is disabled as well.
2433
2434 Mozilla recommends that you do not disable telemetry. Information collected through telemetry helps us build a better product for businesses like yours.
2435
2436 **Compatibility:** Firefox 60, Firefox ESR 60\
2437 **CCK2 Equivalent:** `disableTelemetry`\
2438 **Preferences Affected:** `datareporting.healthreport.uploadEnabled`, `datareporting.policy.dataSubmissionEnabled`, `toolkit.telemetry.archive.enabled`
2439
2440 #### Windows (GPO)
2441 ```
2442 Software\Policies\Mozilla\Firefox\DisableTelemetry = 0x1 | 0x0
2443 ```
2444 #### Windows (Intune)
2445 OMA-URI:
2446 ```
2447 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox/DisableTelemetry
2448 ```
2449 Value (string):
2450 ```
2451 <enabled/> or <disabled/>
2452 ```
2453 #### macOS
2454 ```
2455 <dict>
2456   <key>DisableTelemetry</key>
2457   <true/> | <false/>
2458 </dict>
2459 ```
2460 #### policies.json
2461 ```
2462 {
2463   "policies": {
2464     "DisableTelemetry": true | false
2465   }
2466 }
2467 ```
2468 ### DisableThirdPartyModuleBlocking
2469 Do not allow blocking third-party modules from the `about:third-party` page.
2470
2471 This policy only works on Windows through GPO (not policies.json).
2472
2473 **Compatibility:** Firefox 110 (Windows only, GPO only)\
2474 **CCK2 Equivalent:** N/A\
2475 **Preferences Affected:** N/A
2476
2477 #### Windows (GPO)
2478 ```
2479 Software\Policies\Mozilla\Firefox\DisableThirdPartyModuleBlocking = = 0x1 | 0x0
2480 ```
2481 #### Windows (Intune)
2482 OMA-URI:
2483 ```
2484 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox/DisableThirdPartyModuleBlocking
2485 ```
2486 Value (string):
2487 ```
2488 <enabled/> or <disabled/>
2489 ```
2490 ### DisplayBookmarksToolbar
2491 Set the initial state of the bookmarks toolbar. A user can still change how it is displayed.
2492
2493 `always` means the bookmarks toolbar is always shown.
2494
2495 `never` means the bookmarks toolbar is not shown.
2496
2497 `newtab` means the bookmarks toolbar is only shown on the new tab page.
2498
2499 **Compatibility:** Firefox 109, Firefox ESR 102.7\
2500 **CCK2 Equivalent:** N/A\
2501 **Preferences Affected:** N/A
2502
2503 #### Windows (GPO)
2504 ```
2505 Software\Policies\Mozilla\Firefox\DisplayBookmarksToolbar = "always", "never", "newtab"
2506 ```
2507 #### Windows (Intune)
2508 OMA-URI:
2509 ```
2510 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox/DisplayBookmarksToolbar_Enum
2511 ```
2512 Value (string):
2513 ```
2514 <enabled/>
2515 <data id="DisplayBookmarksToolbar" value="always | never | newtab"/>
2516 ```
2517 #### macOS
2518 ```
2519 <dict>
2520   <key>DisplayBookmarksToolbar</key>
2521   <string>always | never | newtab</string>
2522 </dict>
2523 ```
2524 #### policies.json
2525 ```
2526 {
2527   "policies": {
2528     "DisplayBookmarksToolbar": "always" | "never" | "newtab"
2529   }
2530 }
2531 ```
2532 ### DisplayMenuBar
2533 Set the state of the menubar.
2534
2535 `always` means the menubar is shown and cannot be hidden.
2536
2537 `never` means the menubar is hidden and cannot be shown.
2538
2539 `default-on` means the menubar is on by default but can be hidden.
2540
2541 `default-off` means the menubar is off by default but can be shown.
2542
2543 **Compatibility:** Firefox 73, Firefox ESR 68.5 (Windows, some Linux)\
2544 **CCK2 Equivalent:** `displayMenuBar`\
2545 **Preferences Affected:** N/A
2546
2547 #### Windows (GPO)
2548 ```
2549 Software\Policies\Mozilla\Firefox\DisplayMenuBar = "always", "never", "default-on", "default-off"
2550 ```
2551 #### Windows (Intune)
2552 OMA-URI:
2553 ```
2554 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox/DisplayMenuBar_Enum
2555 ```
2556 Value (string):
2557 ```
2558 <enabled/>
2559 <data id="DisplayMenuBar" value="always | never | default-on | default-off"/>
2560 ```
2561 #### macOS
2562 ```
2563 <dict>
2564   <key>DisplayMenuBar</key>
2565   <string>always | never | default-on | default-off</string>
2566 </dict>
2567 ```
2568 #### policies.json
2569 ```
2570 {
2571   "policies": {
2572     "DisplayMenuBar": "always", "never", "default-on", "default-off"
2573   }
2574 }
2575 ```
2576 ### DNSOverHTTPS
2577 Configure DNS over HTTPS.
2578
2579 `Enabled` determines whether DNS over HTTPS is enabled
2580
2581 `ProviderURL` is a URL to another provider.
2582
2583 `Locked` prevents the user from changing DNS over HTTPS preferences.
2584
2585 `ExcludedDomains` excludes domains from DNS over HTTPS.
2586
2587 `Fallback` determines whether or not Firefox will use your default DNS resolver if there is a problem with the secure DNS provider.
2588
2589 **Compatibility:** Firefox 63, Firefox ESR 68 (ExcludedDomains added in 75/68.7) (Fallback added in 124)\
2590 **CCK2 Equivalent:** N/A\
2591 **Preferences Affected:** `network.trr.mode`, `network.trr.uri`
2592
2593 #### Windows (GPO)
2594 ```
2595 Software\Policies\Mozilla\Firefox\DNSOverHTTPS\Enabled = 0x1 | 0x0
2596 Software\Policies\Mozilla\Firefox\DNSOverHTTPS\ProviderURL = "URL_TO_ALTERNATE_PROVIDER"
2597 Software\Policies\Mozilla\Firefox\DNSOverHTTPS\Locked = 0x1 | 0x0
2598 Software\Policies\Mozilla\Firefox\DNSOverHTTPS\ExcludedDomains\1 = "example.com"
2599 Software\Policies\Mozilla\Firefox\DNSOverHTTPS\Fallback = 0x1 | 0x0
2600 ```
2601 #### Windows (Intune)
2602 OMA-URI:
2603 ```
2604 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~DNSOverHTTPS/DNSOverHTTPS_Enabled
2605 ```
2606 Value (string):
2607 ```
2608 <enabled/> or <disabled/>
2609 ```
2610 OMA-URI:
2611 ```
2612 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~DNSOverHTTPS/DNSOverHTTPS_ProviderURL
2613 ```
2614 Value (string):
2615 ```
2616 <enabled/>
2617 <data id="String" value="URL_TO_ALTERNATE_PROVIDER"/>
2618 ```
2619 OMA-URI:
2620 ```
2621 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~DNSOverHTTPS/DNSOverHTTPS_Locked
2622 ```
2623 Value (string):
2624 ```
2625 <enabled/> or <disabled/>
2626 ```
2627 OMA-URI:
2628 ```
2629 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~DNSOverHTTPS/DNSOverHTTPS_ExcludedDomains
2630 ```
2631 Value (string):
2632 ```
2633 <enabled/>
2634 <data id="List" value="1&#xF000;example.com"/>
2635 ```
2636 OMA-URI:
2637 ```
2638 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~DNSOverHTTPS/DNSOverHTTPS_Fallback
2639 ```
2640 Value (string):
2641 ```
2642 <enabled/> or <disabled/>
2643 ```
2644 #### macOS
2645 ```
2646 <dict>
2647   <key>DNSOverHTTPS</key>
2648   <dict>
2649     <key>Enabled</key>
2650     <true/> | <false/>
2651     <key>ProviderURL</key>
2652     <string>URL_TO_ALTERNATE_PROVIDER</string>
2653     <key>Locked</key>
2654     <true/> | <false/>
2655     <key>ExcludedDomains</key>
2656     <array>
2657       <string>example.com</string>
2658     </array>
2659     <key>Fallback</key>
2660     <true/> | <false/>
2661   </dict>
2662 </dict>
2663 ```
2664 #### policies.json
2665 ```
2666 {
2667   "policies": {
2668     "DNSOverHTTPS": {
2669       "Enabled":  true | false,
2670       "ProviderURL": "URL_TO_ALTERNATE_PROVIDER",
2671       "Locked": true | false,
2672       "ExcludedDomains": ["example.com"],
2673       "Fallback": true | false,
2674     }
2675   }
2676 }
2677 ```
2678 ### DontCheckDefaultBrowser
2679 Don't check if Firefox is the default browser at startup.
2680
2681 **Compatibility:** Firefox 60, Firefox ESR 60\
2682 **CCK2 Equivalent:** `dontCheckDefaultBrowser`\
2683 **Preferences Affected:** `browser.shell.checkDefaultBrowser`
2684
2685 #### Windows (GPO)
2686 ```
2687 Software\Policies\Mozilla\Firefox\DontCheckDefaultBrowser = 0x1 | 0x0
2688 ```
2689 #### Windows (Intune)
2690 OMA-URI:
2691 ```
2692 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox/DontCheckDefaultBrowser
2693 ```
2694 Value (string):
2695 ```
2696 <enabled/> or <disabled/>
2697 ```
2698 #### macOS
2699 ```
2700 <dict>
2701   <key>DontCheckDefaultBrowser</key>
2702   <true/> | <false/>
2703 </dict>
2704 ```
2705 #### policies.json
2706 ```
2707 {
2708   "policies": {
2709     "DontCheckDefaultBrowser": true | false
2710   }
2711 }
2712 ```
2713 ### DownloadDirectory
2714 Set and lock the download directory.
2715
2716 You can use ${home} for the native home directory.
2717
2718 **Compatibility:** Firefox 68, Firefox ESR 68\
2719 **CCK2 Equivalent:** N/A\
2720 **Preferences Affected:** `browser.download.dir`, `browser.download.folderList`, `browser.download.useDownloadDir`
2721
2722 #### Windows (GPO)
2723 ```
2724 Software\Policies\Mozilla\Firefox\DownloadDirectory = "${home}\Downloads"
2725 ```
2726 #### Windows (Intune)
2727 OMA-URI:
2728 ```
2729 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox/DownloadDirectory
2730 ```
2731 Value (string):
2732 ```
2733 <enabled/>
2734 <data id="Preferences_String" value="${home}\Downloads"/>
2735 ```
2736 #### macOS
2737 ```
2738 <dict>
2739   <key>DownloadDirectory</key>
2740   <string>${home}/Downloads</string>
2741 </dict>
2742 ```
2743 #### policies.json (macOS and Linux)
2744 ```
2745 {
2746   "policies": {
2747     "DownloadDirectory": "${home}/Downloads"
2748 }
2749 ```
2750 #### policies.json (Windows)
2751 ```
2752 {
2753   "policies": {
2754     "DownloadDirectory": "${home}\\Downloads"
2755 }
2756 ```
2757 ### EnableTrackingProtection
2758 Configure tracking protection.
2759
2760 If this policy is not configured, tracking protection is not enabled by default in the browser, but it is enabled by default in private browsing and the user can change it.
2761
2762 If `Value` is set to false, tracking protection is disabled and locked in both the regular browser and private browsing.
2763
2764 If `Value` is set to true, tracking protection is enabled by default in both the regular browser and private browsing and the `Locked` value determines whether or not a user can change it.
2765
2766 If `Cryptomining` is set to true, cryptomining scripts on websites are blocked.
2767
2768 If `Fingerprinting` is set to true, fingerprinting scripts on websites are blocked.
2769
2770 If `EmailTracking` is set to true, hidden email tracking pixels and scripts on websites are blocked. (Firefox 112)
2771
2772 `Exceptions` are origins for which tracking protection is not enabled.
2773
2774 **Compatibility:** Firefox 60, Firefox ESR 60 (Cryptomining and Fingerprinting added in 70/68.2, Exceptions added in 73/68.5)\
2775 **CCK2 Equivalent:** N/A\
2776 **Preferences Affected:** `privacy.trackingprotection.enabled`, `privacy.trackingprotection.pbmode.enabled`, `privacy.trackingprotection.cryptomining.enabled`, `privacy.trackingprotection.fingerprinting.enabled`
2777
2778 #### Windows (GPO)
2779 ```
2780 Software\Policies\Mozilla\Firefox\EnableTrackingProtection\Value = 0x1 | 0x0
2781 Software\Policies\Mozilla\Firefox\EnableTrackingProtection\Locked = 0x1 | 0x0
2782 Software\Policies\Mozilla\Firefox\EnableTrackingProtection\Cryptomining = 0x1 | 0x0
2783 Software\Policies\Mozilla\Firefox\EnableTrackingProtection\Fingerprinting = 0x1 | 0x0
2784 Software\Policies\Mozilla\Firefox\EnableTrackingProtection\Exceptions\1 = "https://example.com"
2785 ```
2786 #### Windows (Intune)
2787 OMA-URI:
2788 ```
2789 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~TrackingProtection/A_TrackingProtection_Value
2790 ```
2791 Value (string):
2792 ```
2793 <enabled/> or <disabled/>
2794 ```
2795 OMA-URI:
2796 ```
2797 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~TrackingProtection/B_TrackingProtection_Cryptomining
2798 ```
2799 Value (string):
2800 ```
2801 <enabled/> or <disabled/>
2802 ```
2803 OMA-URI:
2804 ```
2805 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~TrackingProtection/C_TrackingProtection_Fingerprinting
2806 ```
2807 Value (string):
2808 ```
2809 <enabled/> or <disabled/>
2810 ```
2811 OMA-URI:
2812 ```
2813 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~TrackingProtection/D_TrackingProtection_Exceptions
2814 ```
2815 Value (string):
2816 ```
2817 <enabled/>
2818 <data id="TrackingProtection_Exceptions" value="1&#xF000;https://example.com"/>
2819 ```
2820 OMA-URI:
2821 ```
2822 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~TrackingProtection/E_TrackingProtection_Locked
2823 ```
2824 Value (string):
2825 ```
2826 <enabled/> or <disabled/>
2827 ```
2828 #### macOS
2829 ```
2830 <dict>
2831   <key>EnableTrackingProtection</key>
2832   <dict>
2833     <key>Value</key>
2834     <true/> | <false/>
2835     <key>Locked</key>
2836     <true/> | <false/>
2837     <key>Cryptomining</key>
2838     <true/> | <false/>
2839     <key>Fingerprinting</key>
2840     <true/> | <false/>
2841     <key>Exceptions</key>
2842     <array>
2843       <string>https://example.com</string>
2844     </array>
2845   </dict>
2846 </dict>
2847 ```
2848 #### policies.json
2849 ```
2850 {
2851   "policies": {
2852     "EnableTrackingProtection": {
2853       "Value": true | false,
2854       "Locked": true | false,
2855       "Cryptomining": true | false,
2856       "Fingerprinting": true | false,
2857       "Exceptions": ["https://example.com"]
2858     }
2859   }
2860 }
2861 ```
2862 ### EncryptedMediaExtensions
2863 Enable or disable Encrypted Media Extensions and optionally lock it.
2864
2865 If `Enabled` is set to false, encrypted media extensions (like Widevine) are not downloaded by Firefox unless the user consents to installing them.
2866
2867 If `Locked` is set to true and `Enabled` is set to false, Firefox will not download encrypted media extensions (like Widevine) or ask the user to install them.
2868
2869 **Compatibility:** Firefox 77, Firefox ESR 68.9\
2870 **CCK2 Equivalent:** N/A\
2871 **Preferences Affected:** `media.eme.enabled`
2872
2873 #### Windows (GPO)
2874 ```
2875 Software\Policies\Mozilla\Firefox\EncryptedMediaExtensions\Enabled = 0x1 | 0x0
2876 Software\Policies\Mozilla\Firefox\EncryptedMediaExtensions\Locked = 0x1 | 0x0
2877 ```
2878 #### Windows (Intune)
2879 OMA-URI:
2880 ```
2881 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~EncryptedMediaExtensions/EncryptedMediaExtensions_Enabled
2882 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~EncryptedMediaExtensions/EncryptedMediaExtensions_Locked
2883 ```
2884 Value (string):
2885 ```
2886 <enabled/>or <disabled/>
2887 ```
2888 #### macOS
2889 ```
2890 <dict>
2891   <key>EncryptedMediaExtensions</key>
2892   <dict>
2893     <key>Enabled</key>
2894     <true/> | <false/>
2895     <key>Locked</key>
2896     <true/> | <false/>
2897   </dict>
2898 </dict>
2899 ```
2900 #### policies.json
2901 ```
2902 {
2903   "policies": {
2904     "EncryptedMediaExtensions": {
2905       "Enabled": true | false,
2906       "Locked": true | false
2907     }
2908   }
2909 }
2910 ```
2911 ### EnterprisePoliciesEnabled
2912 Enable policy support on macOS.
2913
2914 **Compatibility:** Firefox 63, Firefox ESR 60.3 (macOS only)\
2915 **CCK2 Equivalent:** N/A\
2916 **Preferences Affected:** N/A
2917
2918 #### macOS
2919 ```
2920 <dict>
2921   <key>EnterprisePoliciesEnabled</key>
2922   <true/>
2923 </dict>
2924 ```
2925 ### ExemptDomainFileTypePairsFromFileTypeDownloadWarnings
2926
2927 Disable warnings based on file extension for specific file types on domains.
2928
2929 This policy is based on the [Chrome policy](https://chromeenterprise.google/policies/#ExemptDomainFileTypePairsFromFileTypeDownloadWarnings) of the same name.
2930
2931 Important: The documentation for the policy for both Edge and Chrome is incorrect. The ```domains``` value must be a domain, not a URL pattern. Also, we do not support using ```*``` to mean all domains.
2932
2933 **Compatibility:** Firefox 102\
2934 **CCK2 Equivalent:** N/A\
2935 **Preferences Affected:** N/A
2936
2937 #### Windows (GPO)
2938 Software\Policies\Mozilla\Firefox\ExemptDomainFileTypePairsFromFileTypeDownloadWarnings (REG_MULTI_SZ) =
2939 ```
2940 [
2941   {
2942      "file_extension": "jnlp",
2943      "domains": ["example.com"]
2944   }
2945 ]
2946 ```
2947 #### Windows (Intune)
2948 OMA-URI:
2949 ```
2950 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox/ExemptDomainFileTypePairsFromFileTypeDownloadWarnings
2951 ```
2952 Value (string):
2953 ```
2954 <enabled/>
2955 <data id="JSON" value='
2956 [
2957   {
2958      "file_extension": "jnlp",
2959      "domains": ["example.com"]
2960   }
2961 ]
2962 '/>
2963 ```
2964 If you are using custom ADMX and ADML administrative templates in Intune, you can use this OMA-URI instead
2965 to workaround the limit on the length of strings. Put all of your JSON on one line.
2966
2967 OMA-URI:
2968 ```
2969 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~Extensions/ExemptDomainFileTypePairsFromFileTypeDownloadWarningsOneLine
2970 ```
2971 Value (string):
2972 ```
2973 <enabled/>
2974 <data id="JSONOneLine" value='[]'/>
2975 ```
2976 #### macOS
2977 ```
2978 <dict>
2979   <key>ExemptDomainFileTypePairsFromFileTypeDownloadWarnings</key>
2980   <array>
2981     <dict>
2982       <key>file_extension</key>
2983       <string>jnlp</string>
2984       <key>domains</key>
2985       <array>
2986         <string>example.com</string>
2987       </array>
2988     </dict>
2989   </array>
2990 </dict>
2991 ```
2992 #### policies.json
2993 ```
2994 {
2995   "policies": {
2996     "ExemptDomainFileTypePairsFromFileTypeDownloadWarnings": [{
2997       "file_extension": "jnlp",
2998       "domains": ["example.com"]
2999     }]
3000   }
3001 }
3002 ```
3003 ### Extensions
3004 Control the installation, uninstallation and locking of extensions.
3005
3006 We strongly recommend that you use the **[`ExtensionSettings`](#extensionsettings)** policy. It has the same functionality and adds more. It does not support native paths, though, so you'll have to use file:/// URLs.
3007
3008 This method will be deprecated in the near future.
3009
3010 `Install` is a list of URLs or native paths for extensions to be installed.
3011
3012 `Uninstall` is a list of extension IDs that should be uninstalled if found.
3013
3014 `Locked` is a list of extension IDs that the user cannot disable or uninstall.
3015
3016 **Compatibility:** Firefox 60, Firefox ESR 60\
3017 **CCK2 Equivalent:** `addons`\
3018 **Preferences Affected:** N/A
3019
3020 #### Windows (GPO)
3021 ```
3022 Software\Policies\Mozilla\Firefox\Extensions\Install\1 = "https://addons.mozilla.org/firefox/downloads/somefile.xpi"
3023 Software\Policies\Mozilla\Firefox\Extensions\Install\2 = "//path/to/xpi"
3024 Software\Policies\Mozilla\Firefox\Extensions\Uninstall\1 = "bad_addon_id@mozilla.org"
3025 Software\Policies\Mozilla\Firefox\Extensions\Locked\1 = "addon_id@mozilla.org"
3026 ```
3027 #### Windows (Intune)
3028 OMA-URI:
3029 ```
3030 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~Extensions/Extensions_Install
3031 ```
3032 Value (string):
3033 ```
3034 <enabled/>
3035 <data id="Extensions" value="1&#xF000;https://addons.mozilla.org/firefox/downloads/somefile.xpi&#xF000;2&#xF000;//path/to/xpi"/>
3036 ```
3037 OMA-URI:
3038 ```
3039 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~Extensions/Extensions_Uninstall
3040 ```
3041 Value (string):
3042 ```
3043 <enabled/>
3044 <data id="Extensions" value="1&#xF000;bad_addon_id@mozilla.org"/>
3045 ```
3046 OMA-URI:
3047 ```
3048 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~Extensions/Extensions_Locked
3049 ```
3050 Value (string):
3051 ```
3052 <enabled/>
3053 <data id="Extensions" value="1&#xF000;addon_id@mozilla.org"/>
3054 ```
3055 #### macOS
3056 ```
3057 <dict>
3058   <key>Extensions</key>
3059   <dict>
3060     <key>Install</key>
3061     <array>
3062       <string>https://addons.mozilla.org/firefox/downloads/somefile.xpi</string>
3063       <string>//path/to/xpi</string>
3064     </array>
3065     <key>Uninstall</key>
3066     <array>
3067       <string>bad_addon_id@mozilla.org</string>
3068     </array>
3069     <key>Locked</key>
3070     <array>
3071       <string>addon_id@mozilla.org</string>
3072     </array>
3073   </dict>
3074 </dict>
3075 ```
3076 #### policies.json
3077 ```
3078 {
3079   "policies": {
3080     "Extensions": {
3081       "Install": ["https://addons.mozilla.org/firefox/downloads/somefile.xpi", "//path/to/xpi"],
3082       "Uninstall": ["bad_addon_id@mozilla.org"],
3083       "Locked":  ["addon_id@mozilla.org"]
3084     }
3085   }
3086 }
3087 ```
3088 ### ExtensionSettings
3089 Manage all aspects of extensions. This policy is based heavily on the [Chrome policy](https://dev.chromium.org/administrators/policy-list-3/extension-settings-full) of the same name.
3090
3091 This policy maps an extension ID to its configuration. With an extension ID, the configuration will be applied to the specified extension only. A default configuration can be set for the special ID "*", which will apply to all extensions that don't have a custom configuration set in this policy.
3092
3093 To obtain an extension ID, install the extension and go to about:support. You will see the ID in the Extensions section. I've also created an extension that makes it easy to find the ID of extensions on AMO. You can download it [here](https://github.com/mkaply/queryamoid/releases/tag/v0.1).
3094 Or you can ask the Mozilla Addons API, see [docs](https://mozilla.github.io/addons-server/topics/api/addons.html#detail), which returns the ID as `guid`: https://addons.mozilla.org/api/v5/addons/addon/ublock-origin/
3095
3096 **Note:**
3097 If the extension ID is a UUID ({12345678-1234-1234-1234-1234567890ab}), you must include the curly braces around the ID.
3098
3099 The configuration for each extension is another dictionary that can contain the fields documented below.
3100
3101 | Name | Description |
3102 | --- | --- |
3103 | `installation_mode` | Maps to a string indicating the installation mode for the extension. The valid strings are `allowed`,`blocked`,`force_installed`, and `normal_installed`.
3104 | &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;`allowed` | Allows the extension to be installed by the user. This is the default behavior. There is no need for an install_url; it will automatically be allowed based on the ID.
3105 | &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;`blocked`| Blocks installation of the extension and removes it from the device if already installed.
3106 | &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;`force_installed`| The extension is automatically installed and can't be removed by the user. This option is not valid for the default configuration and requires an install_url.
3107 | &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;`normal_installed`| The extension is automatically installed but can be disabled by the user. This option is not valid for the default configuration and requires an install_url.
3108 | `install_url`| Maps to a URL indicating where Firefox can download a force_installed or normal_installed extension.  If installing from the local file system, use a [```file:///``` URL](https://en.wikipedia.org/wiki/File_URI_scheme). If installing from the addons.mozilla.org, use the following URL (substituting ID with the extension ID or with the short name from the URL on AMO), https://addons.mozilla.org/firefox/downloads/latest/ID/latest.xpi. Languages packs are available from https://releases.mozilla.org/pub/firefox/releases/VERSION/PLATFORM/xpi/LANGUAGE.xpi. If you need to update the extension, you can change the name of the extension and it will be automatically updated. Extensions installed from file URLs will additional be updated when their internal version changes.
3109 | `install_sources` | A list of sources from which installing extensions is allowed using URL match patterns. **This is unnecessary if you are only allowing the installation of certain extensions by ID.** Each item in this list is an extension-style match pattern. Users will be able to easily install items from any URL that matches an item in this list. Both the location of the *.xpi file and the page where the download is started from (i.e.  the referrer) must be allowed by these patterns. This setting can be used only for the default configuration.
3110 | `allowed_types` | This setting whitelists the allowed types of extension/apps that can be installed in Firefox. The value is a list of strings, each of which should be one of the following: "extension", "theme", "dictionary", "locale" This setting can be used only for the default configuration.
3111 | `blocked_install_message` | This maps to a string specifying the error message to display to users if they're blocked from installing an extension. This setting allows you to append text to the generic error message displayed when the extension is blocked. This could be be used to direct users to your help desk, explain why a particular extension is blocked, or something else. This setting can be used only for the default configuration.
3112 | `restricted_domains` | An array of domains on which content scripts can't be run. This setting can be used only for the default configuration.
3113 | `updates_disabled` | (Firefox 89, Firefox ESR 78.11) Boolean that indicates whether or not to disable automatic updates for an individual extension.
3114 | `default_area` | (Firefox 113) String that indicates where to place the extension icon by default. Possible values are `navbar` and `menupanel`.
3115 | `temporarily_allow_weak_signatures`| (Firefox 127) A boolean that indicates whether to allow installing extensions signed using deprecated signature algorithms.
3116
3117 **Compatibility:** Firefox 69, Firefox ESR 68.1 (As of Firefox 85, Firefox ESR 78.7, installing a theme makes it the default.)\
3118 **CCK2 Equivalent:** N/A\
3119 **Preferences Affected:** N/A
3120
3121 #### Windows (GPO)
3122 Software\Policies\Mozilla\Firefox\ExtensionSettings (REG_MULTI_SZ) =
3123 ```
3124 {
3125   "*": {
3126     "blocked_install_message": "Custom error message.",
3127     "install_sources": ["https://yourwebsite.com/*"],
3128     "installation_mode": "blocked",
3129     "allowed_types": ["extension"]
3130   },
3131   "uBlock0@raymondhill.net": {
3132     "installation_mode": "force_installed",
3133     "install_url": "https://addons.mozilla.org/firefox/downloads/latest/ublock-origin/latest.xpi"  # using slug / short name
3134   },
3135   "adguardadblocker@adguard.com": {
3136     "installation_mode": "force_installed",
3137     "install_url": "https://addons.mozilla.org/firefox/downloads/latest/adguardadblocker@adguard.com/latest.xpi"  # using extension ID
3138   },
3139   "https-everywhere@eff.org": {
3140     "installation_mode": "allowed",
3141     "updates_disabled": false
3142   }
3143 }
3144 ```
3145 #### Windows (Intune)
3146 OMA-URI:
3147 ```
3148 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~Extensions/ExtensionSettings
3149 ```
3150 Value (string):
3151 ```
3152 <enabled/>
3153 <data id="ExtensionSettings" value='
3154 {
3155   "*": {
3156     "blocked_install_message": "Custom error message.",
3157     "install_sources": ["https://yourwebsite.com/*"],
3158     "installation_mode": "blocked",
3159     "allowed_types": ["extension"]
3160   },
3161   "uBlock0@raymondhill.net": {
3162     "installation_mode": "force_installed",
3163     "install_url": "https://addons.mozilla.org/firefox/downloads/latest/ublock-origin/latest.xpi"
3164   },
3165   "adguardadblocker@adguard.com": {
3166     "installation_mode": "force_installed",
3167     "install_url": "https://addons.mozilla.org/firefox/downloads/latest/adguardadblocker@adguard.com/latest.xpi"
3168   },
3169   {
3170     "https-everywhere@eff.org": {
3171     "installation_mode": "allowed",
3172     "updates_disabled": false
3173   }
3174 }'/>
3175 ```
3176 If you are using custom ADMX and ADML administrative templates in Intune, you can use this OMA-URI instead
3177 to workaround the limit on the length of strings. Put all of your JSON on one line.
3178
3179 OMA-URI:
3180 ```
3181 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~Extensions/ExtensionSettingsOneLine
3182 ```
3183 Value (string):
3184 ```
3185 <enabled/>
3186 <data id="JSONOneLine" value='{}'/>
3187 ```
3188 #### macOS
3189 ```
3190 <dict>
3191   <key>ExtensionSettings</key>
3192   <dict>
3193     <key>*</key>
3194     <dict>
3195       <key>blocked_install_message</key>
3196       <string>Custom error message.</string>
3197       <key>install_sources</key>
3198       <array>
3199         <string>"https://yourwebsite.com/*"</string>
3200       </array>
3201       <key>installation_mode</key>
3202       <string>blocked</string>
3203       <key>allowed_types</key>
3204       <array>
3205         <string>extension</string>
3206       </array>
3207     </dict>
3208     <key>uBlock0@raymondhill.net</key>
3209     <dict>
3210       <key>installation_mode</key>
3211       <string>force_installed</string>
3212       <key>install_url</key>
3213       <string>https://addons.mozilla.org/firefox/downloads/latest/ublock-origin/latest.xpi</string>
3214     </dict>
3215     <key>adguardadblocker@adguard.com</key>
3216     <dict>
3217       <key>installation_mode</key>
3218       <string>force_installed</string>
3219       <key>install_url</key>
3220       <string>https://addons.mozilla.org/firefox/downloads/latest/adguardadblocker@adguard.com/latest.xpi</string>
3221     </dict>
3222     <key>https-everywhere@eff.org</key>
3223     <dict>
3224       <key>installation_mode</key>
3225       <string>allowed</string>
3226       <key>updates_disabled</key>
3227       <true/> | <false/>
3228     </dict>
3229   </dict>
3230 </dict>
3231 ```
3232 #### policies.json
3233 ```
3234 {
3235   "policies": {
3236     "ExtensionSettings": {
3237       "*": {
3238         "blocked_install_message": "Custom error message.",
3239         "install_sources": ["https://yourwebsite.com/*"],
3240         "installation_mode": "blocked",
3241         "allowed_types": ["extension"]
3242       },
3243       "uBlock0@raymondhill.net": {
3244         "installation_mode": "force_installed",
3245         "install_url": "https://addons.mozilla.org/firefox/downloads/latest/ublock-origin/latest.xpi"
3246       },
3247       "adguardadblocker@adguard.com": {
3248         "installation_mode": "force_installed",
3249         "install_url": "https://addons.mozilla.org/firefox/downloads/latest/adguardadblocker@adguard.com/latest.xpi"
3250       },
3251       "https-everywhere@eff.org": {
3252         "installation_mode": "allowed",
3253         "updates_disabled": false
3254       }
3255     }
3256   }
3257 }
3258 ```
3259 ### ExtensionUpdate
3260 Control extension updates.
3261
3262 **Compatibility:** Firefox 67, Firefox ESR 60.7\
3263 **CCK2 Equivalent:** N/A\
3264 **Preferences Affected:** `extensions.update.enabled`
3265
3266 #### Windows (GPO)
3267 ```
3268 Software\Policies\Mozilla\Firefox\ExtensionUpdate = 0x1 | 0x0
3269 ```
3270 #### Windows (Intune)
3271 OMA-URI:
3272 ```
3273 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~Extensions/ExtensionUpdate
3274 ```
3275 Value (string):
3276 ```
3277 <enabled/> or <disabled/>
3278 ```
3279 #### macOS
3280 ```
3281 <dict>
3282   <key>ExtensionUpdate</key>
3283   <true/> | <false/>
3284 </dict>
3285 ```
3286 #### policies.json
3287 ```
3288 {
3289   "policies": {
3290     "ExtensionUpdate": true | false
3291   }
3292 }
3293 ```
3294 ### FirefoxHome
3295 Customize the Firefox Home page.
3296
3297 **Compatibility:** Firefox 68, Firefox ESR 68 (SponsoredTopSites and SponsoredPocket were added in Firefox 95, Firefox ESR 91.4, Snippets was deprecated in Firefox 122)
3298 **CCK2 Equivalent:** N/A\
3299 **Preferences Affected:** `browser.newtabpage.activity-stream.showSearch`, `browser.newtabpage.activity-stream.feeds.topsites`, `browser.newtabpage.activity-stream.feeds.section.highlights`, `browser.newtabpage.activity-stream.feeds.section.topstories`, `browser.newtabpage.activity-stream.feeds.snippets`, `browser.newtabpage.activity-stream.showSponsoredTopSites`, `browser.newtabpage.activity-stream.showSponsored`
3300
3301 #### Windows (GPO)
3302 ```
3303 Software\Policies\Mozilla\Firefox\FirefoxHome\Search = 0x1 | 0x0
3304 Software\Policies\Mozilla\Firefox\FirefoxHome\TopSites = 0x1 | 0x0
3305 Software\Policies\Mozilla\Firefox\FirefoxHome\SponsoredTopSites = 0x1 | 0x0
3306 Software\Policies\Mozilla\Firefox\FirefoxHome\Highlights = 0x1 | 0x0
3307 Software\Policies\Mozilla\Firefox\FirefoxHome\Pocket = 0x1 | 0x0
3308 Software\Policies\Mozilla\Firefox\FirefoxHome\SponsoredPocket = 0x1 | 0x0
3309 Software\Policies\Mozilla\Firefox\FirefoxHome\Snippets = 0x1 | 0x0
3310 Software\Policies\Mozilla\Firefox\FirefoxHome\Locked = 0x1 | 0x0
3311 ```
3312 #### Windows (Intune)
3313 OMA-URI:
3314 ```
3315 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox/CustomizeFirefoxHome
3316 ```
3317 Value (string):
3318 ```
3319 <enabled/>
3320 <data id="FirefoxHome_Search"  value="true | false"/>
3321 <data id="FirefoxHome_TopSites"  value="true | false"/>
3322 <data id="FirefoxHome_SponsoredTopSites"  value="true | false"/>
3323 <data id="FirefoxHome_Highlights"  value="true | false"/>
3324 <data id="FirefoxHome_Pocket"  value="true | false"/>
3325 <data id="FirefoxHome_SponsoredPocket"  value="true | false"/>
3326 <data id="FirefoxHome_Snippets"  value="true | false"/>
3327 <data id="FirefoxHome_Locked"  value="true | false"/>
3328 ```
3329 #### macOS
3330 ```
3331 <dict>
3332   <key>FirefoxHome</key>
3333   <dict>
3334     <key>Search</key>
3335     <true/> | <false/>
3336     <key>TopSites</key>
3337     <true/> | <false/>
3338     <key>SponsoredTopSites</key>
3339     <true/> | <false/>
3340     <key>Highlights</key>
3341     <true/> | <false/>
3342     <key>Pocket</key>
3343     <true/> | <false/>
3344     <key>SponsoredPocket</key>
3345     <true/> | <false/>
3346     <key>Snippets</key>
3347     <true/> | <false/>
3348     <key>Locked</key>
3349     <true/> | <false/>
3350   </dict>
3351 </dict>
3352 ```
3353 #### policies.json
3354 ```
3355 {
3356   "policies": {
3357     "FirefoxHome": {
3358       "Search": true | false,
3359       "TopSites": true | false,
3360       "SponsoredTopSites": true | false,
3361       "Highlights": true | false,
3362       "Pocket": true | false,
3363       "SponsoredPocket": true | false,
3364       "Snippets": true | false,
3365       "Locked": true | false
3366     }
3367   }
3368 }
3369 ```
3370 ### FirefoxSuggest
3371 Customize Firefox Suggest (US only).
3372
3373 **Compatibility:** Firefox 118, Firefox ESR 115.3.
3374 **CCK2 Equivalent:** N/A\
3375 **Preferences Affected:** `browser.urlbar.suggest.quicksuggest.nonsponsored`, `browser.urlbar.suggest.quicksuggest.sponsored`, `browser.urlbar.quicksuggest.dataCollection.enabled`
3376
3377 #### Windows (GPO)
3378 ```
3379 Software\Policies\Mozilla\Firefox\FirefoxSuggest\WebSuggestions = 0x1 | 0x0
3380 Software\Policies\Mozilla\Firefox\FirefoxSuggest\SponsoredSuggestions = 0x1 | 0x0
3381 Software\Policies\Mozilla\Firefox\FirefoxSuggest\ImproveSuggest = 0x1 | 0x0
3382 Software\Policies\Mozilla\Firefox\FirefoxSuggest\Locked = 0x1 | 0x0
3383 ```
3384 #### Windows (Intune)
3385 OMA-URI:
3386 ```
3387 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~FirefoxSuggest/FirefoxSuggest_WebSuggestions
3388 ```
3389 Value (string):
3390 ```
3391 <enabled/> or <disabled/>
3392 ```
3393 OMA-URI:
3394 ```
3395 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~FirefoxSuggest/FirefoxSuggest_SponsoredSuggestions
3396 ```
3397 Value (string):
3398 ```
3399 <enabled/> or <disabled/>
3400 ```
3401 OMA-URI:
3402 ```
3403 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~FirefoxSuggest/FirefoxSuggest_ImproveSuggest
3404 ```
3405 Value (string):
3406 ```
3407 <enabled/> or <disabled/>
3408 ```
3409 OMA-URI:
3410 ```
3411 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~FirefoxSuggest/FirefoxSuggest_Locked
3412 ```
3413 Value (string):
3414 ```
3415 <enabled/> or <disabled/>
3416 ```
3417 #### macOS
3418 ```
3419 <dict>
3420   <key>FirefoxSuggest</key>
3421   <dict>
3422     <key>WebSuggestions</key>
3423     <true/> | <false/>
3424     <key>SponsoredSuggestions</key>
3425     <true/> | <false/>
3426     <key>ImproveSuggest</key>
3427     <true/> | <false/>
3428     <key>Locked</key>
3429     <true/> | <false/>
3430   </dict>
3431 </dict>
3432 ```
3433 #### policies.json
3434 ```
3435 {
3436   "policies": {
3437     "FirefoxSuggest": {
3438       "WebSuggestions": true | false,
3439       "SponsoredSuggestions": true | false,
3440       "ImproveSuggest": true | false,
3441       "Locked": true | false
3442     }
3443   }
3444 }
3445 ```
3446 ### GoToIntranetSiteForSingleWordEntryInAddressBar
3447 Whether to always go through the DNS server before sending a single word search string to a search engine.
3448
3449 If the site exists, it will navigate to the website. If the intranet responds with a 404, the page will show a 404. If the intranet does not respond, the browser will attempt a search.
3450
3451 The second result in the URL bar will be a search result to allow users to conduct a web search exactly as it was entered.
3452
3453 If instead you would like to enable the ability to have your domain appear as a valid URL and to disallow the browser from ever searching that term using the first result that matches it, add the pref `browser.fixup.domainwhitelist.YOUR_DOMAIN` (where `YOUR_DOMAIN` is the name of the domain you'd like to add), and set the pref to `true`. The URL bar will then suggest `YOUR_DOMAIN` when the user fully types `YOUR_DOMAIN`. If the user attempts to load that domain and it fails to load, it will show an "Unable to connect" error page.
3454
3455 You can also whitelist a domain suffix that is not part of the [Public Suffix List](https://publicsuffix.org/) by adding the pref `browser.fixup.domainsuffixwhitelist.YOUR_DOMAIN_SUFFIX` with a value of `true`.
3456
3457 Additionally, if you want users to see a "Did you mean to go to 'YOUR_DOMAIN'" prompt below the URL bar if they land on a search results page instead of an intranet domain that provides a response, set the pref `browser.urlbar.dnsResolveSingleWordsAfterSearch` to `1`. Enabling this will cause the browser to commit a DNS check after every single word search. If the browser receives a response from the intranet, a prompt will ask the user if they'd like to instead navigate to `YOUR_DOMAIN`. If the user presses the **yes** button, `browser.fixup.domainwhitelist.YOUR_DOMAIN` will be set to `true`.
3458
3459 **Compatibility:** Firefox 104, Firefox ESR 102.2\
3460 **CCK2 Equivalent:** `N/A`\
3461 **Preferences Affected:** `browser.fixup.dns_first_for_single_words`
3462
3463 #### Windows (GPO)
3464 ```
3465 Software\Policies\Mozilla\Firefox\GoToIntranetSiteForSingleWordEntryInAddressBar = 0x1 | 0x0
3466 ```
3467 #### Windows (Intune)
3468 OMA-URI:
3469 ```
3470 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox/GoToIntranetSiteForSingleWordEntryInAddressBar
3471 ```
3472 Value (string):
3473 ```
3474 <enabled/> or <disabled/>
3475 ```
3476 #### macOS
3477 ```
3478 <dict>
3479   <key>GoToIntranetSiteForSingleWordEntryInAddressBar</key>
3480   <true/> | <false/>
3481 </dict>
3482 ```
3483 #### policies.json
3484 ```
3485 {
3486   "policies": {
3487     "GoToIntranetSiteForSingleWordEntryInAddressBar": true | false
3488   }
3489 }
3490 ```
3491 ### Handlers
3492 Configure default application handlers. This policy is based on the internal format of `handlers.json`.
3493
3494 You can configure handlers based on a mime type (`mimeTypes`), a file's extension (`extensions`), or a protocol (`schemes`).
3495
3496 Within each handler type, you specify the given mimeType/extension/scheme as a key and use the following subkeys to describe how it is handled.
3497
3498 | Name | Description |
3499 | --- | --- |
3500 | `action`| Can be either `saveToDisk`, `useHelperApp`, `useSystemDefault`.
3501 | `ask` | If `true`, the user is asked if what they want to do with the file. If `false`, the action is taken without user intervention.
3502 | `handlers` | An array of handlers with the first one being the default. If you don't want to have a default handler, use an empty object for the first handler. Choose between path or uriTemplate.
3503 | &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;`name` | The display name of the handler (might not be used).
3504 | &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;`path`| The native path to the executable to be used.
3505 | &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;`uriTemplate`| A url to a web based application handler. The URL must be https and contain a %s to be used for substitution.
3506
3507 **Compatibility:** Firefox 78, Firefox ESR 78\
3508 **CCK2 Equivalent:** N/A\
3509 **Preferences Affected:** N/A
3510
3511 #### Windows (GPO)
3512 Software\Policies\Mozilla\Firefox\Handlers (REG_MULTI_SZ) =
3513 ```
3514 {
3515   "mimeTypes": {
3516     "application/msword": {
3517       "action": "useSystemDefault",
3518       "ask": true | false
3519     }
3520   },
3521   "schemes": {
3522     "mailto": {
3523       "action": "useHelperApp",
3524       "ask": true | false,
3525       "handlers": [{
3526         "name": "Gmail",
3527         "uriTemplate": "https://mail.google.com/mail/?extsrc=mailto&url=%s"
3528       }]
3529     }
3530   },
3531   "extensions": {
3532     "pdf": {
3533       "action": "useHelperApp",
3534       "ask": true | false,
3535       "handlers": [{
3536         "name": "Adobe Acrobat",
3537         "path": "C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\AcroRd32.exe"
3538       }]
3539     }
3540   }
3541 }
3542 ```
3543 #### Windows (Intune)
3544 OMA-URI:
3545 ```
3546 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox/Handlers
3547 ```
3548 Value (string):
3549 ```
3550 <enabled/>
3551 <data id="Handlers" value='
3552 {
3553   "mimeTypes": {
3554     "application/msword": {
3555       "action": "useSystemDefault",
3556       "ask": true | false
3557     }
3558   },
3559   "schemes": {
3560     "mailto": {
3561       "action": "useHelperApp",
3562       "ask": true | false,
3563       "handlers": [{
3564         "name": "Gmail",
3565         "uriTemplate": "https://mail.google.com/mail/?extsrc=mailto&amp;url=%s"
3566       }]
3567     }
3568   },
3569   "extensions": {
3570     "pdf": {
3571       "action": "useHelperApp",
3572       "ask": true | false,
3573       "handlers": [{
3574         "name": "Adobe Acrobat",
3575         "path": "C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\AcroRd32.exe"
3576       }]
3577     }
3578   }
3579 }
3580 '/>
3581 ```
3582 If you are using custom ADMX and ADML administrative templates in Intune, you can use this OMA-URI instead
3583 to workaround the limit on the length of strings. Put all of your JSON on one line.
3584
3585 OMA-URI:
3586 ```
3587 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~Extensions/HandlersOneLine
3588 ```
3589 Value (string):
3590 ```
3591 <enabled/>
3592 <data id="JSONOneLine" value='{}'/>
3593 ```
3594 #### macOS
3595 ```
3596 <dict>
3597   <key>Handlers</key>
3598   <dict>
3599     <key>mimeTypes</key>
3600     <dict>
3601       <key>application/msword</key>
3602       <dict>
3603         <key>action</key>
3604         <string>useSystemDefault</string>
3605         <key>ask</key>
3606         <true/> | <false/>
3607       </dict>
3608     </dict>
3609     <key>schemes</key>
3610     <dict>
3611       <key>mailto</key>
3612       <dict>
3613         <key>action</key>
3614         <string>useHelperApp</string>
3615         <key>ask</key>
3616         <true/> | <false/>
3617         <key>handlers</key>
3618         <array>
3619           <dict>
3620             <key>name</key>
3621             <string>Gmail</string>
3622             <key>uriTemplate</key>
3623             <string>https://mail.google.com/mail/?extsrc=mailto&url=%s</string>
3624           </dict>
3625         </array>
3626       </dict>
3627     </dict>
3628     <key>extensions</key>
3629     <dict>
3630       <key>pdf</key>
3631       <dict>
3632         <key>action</key>
3633         <string>useHelperApp</string>
3634         <key>ask</key>
3635         <true/> | <false/>
3636         <key>handlers</key>
3637         <array>
3638           <dict>
3639             <key>name</key>
3640             <string>Adobe Acrobat</string>
3641             <key>path</key>
3642             <string>/System/Applications/Preview.app</string>
3643           </dict>
3644         </array>
3645       </dict>
3646     </dict>
3647   </dict>
3648 </dict>
3649 ```
3650 #### policies.json
3651 ```
3652 {
3653   "policies": {
3654     "Handlers": {
3655       "mimeTypes": {
3656         "application/msword": {
3657           "action": "useSystemDefault",
3658           "ask": false
3659         }
3660       },
3661       "schemes": {
3662         "mailto": {
3663           "action": "useHelperApp",
3664           "ask": true | false,
3665           "handlers": [{
3666             "name": "Gmail",
3667             "uriTemplate": "https://mail.google.com/mail/?extsrc=mailto&url=%s"
3668           }]
3669         }
3670       },
3671       "extensions": {
3672         "pdf": {
3673           "action": "useHelperApp",
3674           "ask": true | false,
3675           "handlers": [{
3676             "name": "Adobe Acrobat",
3677             "path": "/usr/bin/acroread"
3678           }]
3679         }
3680       }
3681     }
3682   }
3683 }
3684 ```
3685 ### HardwareAcceleration
3686 Control hardware acceleration.
3687
3688 **Compatibility:** Firefox 60, Firefox ESR 60\
3689 **CCK2 Equivalent:** N/A\
3690 **Preferences Affected:** `layers.acceleration.disabled`
3691
3692 #### Windows (GPO)
3693 ```
3694 Software\Policies\Mozilla\Firefox\HardwareAcceleration = 0x1 | 0x0
3695 ```
3696 #### Windows (Intune)
3697 OMA-URI:
3698 ```
3699 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox/HardwareAcceleration
3700 ```
3701 Value (string):
3702 ```
3703 <enabled/> or <disabled/>
3704 ```
3705 #### macOS
3706 ```
3707 <dict>
3708   <key>HardwareAcceleration</key>
3709   <true/> | <false/>
3710 </dict>
3711 ```
3712 #### policies.json
3713 ```
3714 {
3715   "policies": {
3716     "HardwareAcceleration": true | false
3717   }
3718 }
3719 ```
3720 ### Homepage
3721 Configure the default homepage and how Firefox starts.
3722
3723 `URL` is the default homepage.
3724
3725 `Locked` prevents the user from changing homepage preferences.
3726
3727 `Additional` allows for more than one homepage.
3728
3729 `StartPage` is how Firefox starts. The choices are no homepage, the default homepage or the previous session.
3730
3731 With Firefox 78, an additional option as added for `Startpage`, `homepage-locked`. If this is value is set for the Startpage, the user will always get the homepage at startup and cannot choose to restore their session.
3732
3733 **Compatibility:** Firefox 60, Firefox ESR 60 (StartPage was added in Firefox 60, Firefox ESR 60.4, homepage-locked added in Firefox 78)\
3734 **CCK2 Equivalent:** `homePage`,`lockHomePage`\
3735 **Preferences Affected:** `browser.startup.homepage`, `browser.startup.page`
3736
3737 #### Windows (GPO)
3738 ```
3739 Software\Policies\Mozilla\Firefox\Homepage\URL = "https://example.com"
3740 Software\Policies\Mozilla\Firefox\Homepage\Locked = 0x1 | 0x0
3741 Software\Policies\Mozilla\Firefox\Homepage\Additional\1 = "https://example.org"
3742 Software\Policies\Mozilla\Firefox\Homepage\Additional\2 = "https://example.edu"
3743 Software\Policies\Mozilla\Firefox\Homepage\StartPage = "none" | "homepage" | "previous-session" | "homepage-locked"
3744 ```
3745 #### Windows (Intune)
3746 OMA-URI:
3747 ```
3748 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~Homepage/HomepageURL
3749 ```
3750 Value (string):
3751 ```
3752 <enabled/>
3753
3754 <data id="HomepageURL" value="https://example.com"/>
3755 <data id="HomepageLocked" value="true | false"/>
3756 ```
3757 OMA-URI:
3758 ```
3759 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~Homepage/HomepageAdditional
3760 ```
3761 Value (string):
3762 ```
3763 <enabled/>
3764
3765 <data id="HomepageAdditional" value="1&#xF000;http://example.org&#xF000;2&#xF000;http://example.edu"/>
3766 ```
3767 OMA-URI:
3768 ```
3769 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~Homepage/HomepageStartPage
3770 ```
3771 Value (string):
3772 ```
3773 <enabled/>
3774
3775 <data id="StartPage" value="none | homepage | previous-session"/>
3776 ```
3777 #### macOS
3778 ```
3779 <dict>
3780   <key>Homepage</key>
3781   <dict>
3782     <key>URL</key>
3783     <string>http://example.com</string>
3784     <key>Locked</key>
3785     <true/> | <false/>
3786     <key>Additional</key>
3787     <array>
3788       <string>http://example.org</string>
3789       <string>http://example.edu</string>
3790     </array>
3791     <key>StartPage</key>
3792     <string>none | homepage | previous-session | homepage-locked</string>
3793   </dict>
3794 </dict>
3795 ```
3796 #### policies.json
3797 ```
3798 {
3799   "policies": {
3800     "Homepage": {
3801       "URL": "http://example.com/",
3802       "Locked": true | false,
3803       "Additional": ["http://example.org/",
3804                      "http://example.edu/"],
3805       "StartPage": "none" | "homepage" | "previous-session" | "homepage-locked"
3806     }
3807   }
3808 }
3809 ```
3810 ### HttpAllowlist
3811 Configure sites that will not be upgraded to HTTPS.
3812
3813 The sites are specified as a list of origins.
3814
3815 **Compatibility:** Firefox 127\
3816 **CCK2 Equivalent:** N/A\
3817 **Preferences Affected:** N/A
3818
3819 #### Windows (GPO)
3820 ```
3821 Software\Policies\Mozilla\Firefox\HttpAllowlist\1 = "http://example.org"
3822 Software\Policies\Mozilla\Firefox\HttpAllowlist\2 = "http://example.edu"
3823 ```
3824 #### Windows (Intune)
3825 OMA-URI:
3826 ```
3827 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox/HttpAllowlist
3828 ```
3829 Value (string):
3830 ```
3831 <enabled/>
3832 <data id="List" value="1&#xF000;http://example.org&#xF000;2&#xF000;http://example.edu"/>
3833 ```
3834 #### macOS
3835 ```
3836 <dict>
3837   <key>HttpAllowlist</key>
3838   <array>
3839     <string>http://example.org</string>
3840     <string>http://example.edu</string>
3841   </array>
3842 </dict>
3843 ```
3844 #### policies.json
3845 ```
3846 {
3847   "policies": {
3848     "HttpAllowlist": ["http://example.org",
3849                        "http://example.edu"]
3850   }
3851 }
3852 ```
3853 ### HttpsOnlyMode
3854 Configure HTTPS-Only Mode.
3855
3856 | Value | Description
3857 | --- | --- |
3858 | allowed | HTTPS-Only Mode is off by default, but the user can turn it on.
3859 | disallowed | HTTPS-Only Mode is off and the user can't turn it on.
3860 | enabled | HTTPS-Only Mode is on by default, but the user can turn it off.
3861 | force_enabled | HTTPS-Only Mode is on and the user can't turn it off.
3862
3863 **Compatibility:** Firefox 127\
3864 **CCK2 Equivalent:** N/A\
3865 **Preferences Affected:** `dom.security.https_only_mode`
3866
3867 #### Windows (GPO)
3868 ```
3869 Software\Policies\Mozilla\Firefox\HttpsOnlyMode = "allowed", "disallowed", "enabled", "force_enabled"
3870 ```
3871 #### Windows (Intune)
3872 OMA-URI:
3873 ```
3874 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox/HttpsOnlyMode
3875 ```
3876 Value (string):
3877 ```
3878 <enabled/>
3879 <data id="HttpsOnlyMode" value="allowed | disallowed | enabled | force_enabled"/>
3880 ```
3881 #### macOS
3882 ```
3883 <dict>
3884   <key>HttpsOnlyMode</key>
3885   <string>allowed | disallowed | enabled | force_enabled</string>
3886 </dict>
3887 ```
3888 #### policies.json
3889 ```
3890 {
3891   "policies": {
3892     "HttpsOnlyMode": "allowed" | "disallowed" | "enabled" | "force_enabled"
3893   }
3894 }
3895 ```
3896 ### InstallAddonsPermission
3897 Configure the default extension install policy as well as origins for extension installs are allowed. This policy does not override turning off all extension installs.
3898
3899 `Allow` is a list of origins where extension installs are allowed.
3900
3901 `Default` determines whether or not extension installs are allowed by default.
3902
3903 **Compatibility:** Firefox 60, Firefox ESR 60\
3904 **CCK2 Equivalent:** `permissions.install`\
3905 **Preferences Affected:** `xpinstall.enabled`, `browser.newtabpage.activity-stream.asrouter.userprefs.cfr.addons`, `browser.newtabpage.activity-stream.asrouter.userprefs.cfr.features`
3906
3907 #### Windows (GPO)
3908 ```
3909 Software\Policies\Mozilla\Firefox\InstallAddonsPermission\Allow\1 = "https://example.org"
3910 Software\Policies\Mozilla\Firefox\InstallAddonsPermission\Allow\2 = "https://example.edu"
3911 Software\Policies\Mozilla\Firefox\InstallAddonsPermission\Default = 0x1 | 0x0
3912 ```
3913 #### Windows (Intune)
3914 OMA-URI:
3915 ```
3916 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~Addons/InstallAddonsPermission_Allow
3917 ```
3918 Value (string):
3919 ```
3920 <enabled/>
3921 <data id="Permissions" value="1&#xF000;https://example.org&#xF000;2&#xF000;https://example.edu"/>
3922 ```
3923 OMA-URI:
3924 ```
3925 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~Addons/InstallAddonsPermission_Default
3926 ```
3927 Value (string):
3928 ```
3929 <enabled/>
3930 ```
3931 #### macOS
3932 ```
3933 <dict>
3934   <key>InstallAddonsPermission</key>
3935   <dict>
3936     <key>Allow</key>
3937     <array>
3938       <string>http://example.org</string>
3939       <string>http://example.edu</string>
3940     </array>
3941     <key>Default</key>
3942     <true/> | <false/>
3943   </dict>
3944 </dict>
3945 ```
3946 #### policies.json
3947 ```
3948 {
3949   "policies": {
3950     "InstallAddonsPermission": {
3951       "Allow": ["http://example.org/",
3952                 "http://example.edu/"],
3953       "Default": true | false
3954     }
3955   }
3956 }
3957 ```
3958 ### LegacyProfiles
3959 Disable the feature enforcing a separate profile for each installation.
3960
3961 If this policy set to true, Firefox will not try to create different profiles for installations of Firefox in different directories. This is the equivalent of the MOZ_LEGACY_PROFILES environment variable.
3962
3963 If this policy set to false, Firefox will create a new profile for each unique installation of Firefox.
3964
3965 This policy only work on Windows via GPO (not policies.json).
3966
3967 **Compatibility:** Firefox 70, Firefox ESR 68.2 (Windows only, GPO only)\
3968 **CCK2 Equivalent:** N/A\
3969 **Preferences Affected:** N/A
3970
3971 #### Windows (GPO)
3972 ```
3973 Software\Policies\Mozilla\Firefox\LegacyProfiles = = 0x1 | 0x0
3974 ```
3975 #### Windows (Intune)
3976 OMA-URI:
3977 ```
3978 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox/LegacyProfiles
3979 ```
3980 Value (string):
3981 ```
3982 <enabled/> or <disabled/>
3983 ```
3984 ### LegacySameSiteCookieBehaviorEnabled
3985 Enable default legacy SameSite cookie behavior setting.
3986
3987 If this policy is set to true, it reverts all cookies to legacy SameSite behavior which means that cookies that don't explicitly specify a ```SameSite``` attribute are treated as if they were ```SameSite=None```.
3988
3989 **Compatibility:** Firefox 96\
3990 **CCK2 Equivalent:** N/A\
3991 **Preferences Affected:** `network.cookie.sameSite.laxByDefault`
3992
3993 #### Windows (GPO)
3994 ```
3995 Software\Policies\Mozilla\Firefox\LegacySameSiteCookieBehaviorEnabled = = 0x1 | 0x0
3996 ```
3997 #### Windows (Intune)
3998 OMA-URI:
3999 ```
4000 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox/LegacySameSiteCookieBehaviorEnabled
4001 ```
4002 Value (string):
4003 ```
4004 <enabled/> or <disabled/>
4005 ```
4006 #### macOS
4007 ```
4008 <dict>
4009   <key>LegacySameSiteCookieBehaviorEnabled</key>
4010   <true/> | <false/>
4011 </dict>
4012 ```
4013 #### policies.json
4014 ```
4015 {
4016   "policies": {
4017     "LegacySameSiteCookieBehaviorEnabled": true | false
4018 }
4019 ```
4020 ### LegacySameSiteCookieBehaviorEnabledForDomainList
4021 Revert to legacy SameSite behavior for cookies on specified sites.
4022
4023 If this policy is set to true, cookies set for domains in this list will revert to legacy SameSite behavior which means that cookies that don't explicitly specify a ```SameSite``` attribute are treated as if they were ```SameSite=None```.
4024
4025 **Compatibility:** Firefox 96\
4026 **CCK2 Equivalent:** N/A\
4027 **Preferences Affected:** `network.cookie.sameSite.laxByDefault.disabledHosts`
4028
4029 #### Windows (GPO)
4030 ```
4031 Software\Policies\Mozilla\Firefox\LegacySameSiteCookieBehaviorEnabledForDomainList\1 = "example.org"
4032 Software\Policies\Mozilla\Firefox\LegacySameSiteCookieBehaviorEnabledForDomainList\2 = "example.edu"
4033 ```
4034 #### Windows (Intune)
4035 OMA-URI:
4036 ```
4037 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox/LegacySameSiteCookieBehaviorEnabledForDomainList
4038 ```
4039 Value (string):
4040 ```
4041 <enabled/>
4042 <data id="LegacySameSiteCookieBehaviorEnabledForDomainList" value="1&#xF000;example.org&#xF000;2&#xF000;example.edu"/>
4043 ```
4044 #### macOS
4045 ```
4046 <dict>
4047   <key>LegacySameSiteCookieBehaviorEnabledForDomainList</key>
4048   <array>
4049     <string>example.org</string>
4050     <string>example.edu</string>
4051   </array>
4052 </dict>
4053 ```
4054 #### policies.json
4055 ```
4056 {
4057   "policies": {
4058     "LegacySameSiteCookieBehaviorEnabledForDomainList": ["example.org",
4059                                                          "example.edu"]
4060   }
4061 }
4062 ```
4063 ### LocalFileLinks
4064 Enable linking to local files by origin.
4065
4066 **Compatibility:** Firefox 68, Firefox ESR 68\
4067 **CCK2 Equivalent:** N/A\
4068 **Preferences Affected:** `capability.policy.localfilelinks.*`
4069
4070 #### Windows (GPO)
4071 ```
4072 Software\Policies\Mozilla\Firefox\LocalFileLinks\1 = "https://example.org"
4073 Software\Policies\Mozilla\Firefox\LocalFileLinks\2 = "https://example.edu"
4074 ```
4075 #### Windows (Intune)
4076 OMA-URI:
4077 ```
4078 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox/LocalFileLinks
4079 ```
4080 Value (string):
4081 ```
4082 <enabled/>
4083 <data id="LocalFileLinks" value="1&#xF000;https://example.org&#xF000;2&#xF000;https://example.edu"/>
4084 ```
4085 #### macOS
4086 ```
4087 <dict>
4088   <key>LocalFileLinks</key>
4089   <array>
4090     <string>http://example.org</string>
4091     <string>http://example.edu</string>
4092   </array>
4093 </dict>
4094 ```
4095 #### policies.json
4096 ```
4097 {
4098   "policies": {
4099     "LocalFileLinks": ["http://example.org/",
4100                        "http://example.edu/"]
4101   }
4102 }
4103 ```
4104 ### ManagedBookmarks
4105 Configures a list of bookmarks managed by an administrator that cannot be changed by the user.
4106
4107 The bookmarks are only added as a button on the personal toolbar. They are not in the bookmarks folder.
4108
4109 The syntax of this policy is exactly the same as the [Chrome ManagedBookmarks policy](https://cloud.google.com/docs/chrome-enterprise/policies/?policy=ManagedBookmarks). The schema is:
4110 ```
4111 {
4112  "items": {
4113   "id": "BookmarkType",
4114   "properties": {
4115    "children": {
4116     "items": {
4117      "$ref": "BookmarkType"
4118     },
4119     "type": "array"
4120    },
4121    "name": {
4122     "type": "string"
4123    },
4124    "toplevel_name": {
4125     "type": "string"
4126    },
4127    "url": {
4128     "type": "string"
4129    }
4130   },
4131   "type": "object"
4132  },
4133  "type": "array"
4134 }
4135 ```
4136 **Compatibility:** Firefox 83, Firefox ESR 78.5\
4137 **CCK2 Equivalent:** N/A\
4138 **Preferences Affected:** N/A
4139
4140 #### Windows (GPO)
4141 Software\Policies\Mozilla\Firefox\ManagedBookmarks (REG_MULTI_SZ) =
4142 ```
4143 [
4144   {
4145     "toplevel_name": "My managed bookmarks folder"
4146   },
4147   {
4148     "url": "example.com",
4149     "name": "Example"
4150   },
4151   {
4152     "name": "Mozilla links",
4153     "children": [
4154       {
4155         "url": "https://mozilla.org",
4156         "name": "Mozilla.org"
4157       },
4158       {
4159         "url": "https://support.mozilla.org/",
4160         "name": "SUMO"
4161       }
4162     ]
4163   }
4164 ]
4165 ```
4166 #### Windows (Intune)
4167 OMA-URI:
4168 ```
4169 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox/ManagedBookmarks
4170 ```
4171 Value (string):
4172 ```
4173 <enabled/>
4174 <data id="JSON" value='
4175 [
4176   {
4177     "toplevel_name": "My managed bookmarks folder"
4178   },
4179   {
4180     "url": "example.com",
4181     "name": "Example"
4182   },
4183   {
4184     "name": "Mozilla links",
4185     "children": [
4186       {
4187         "url": "https://mozilla.org",
4188         "name": "Mozilla.org"
4189       },
4190       {
4191         "url": "https://support.mozilla.org/",
4192         "name": "SUMO"
4193       }
4194     ]
4195   }
4196 ]'/>
4197 ```
4198 If you are using custom ADMX and ADML administrative templates in Intune, you can use this OMA-URI instead
4199 to workaround the limit on the length of strings. Put all of your JSON on one line.
4200
4201 OMA-URI:
4202 ```
4203 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~Extensions/ManagedBoomarksOneLine
4204 ```
4205 Value (string):
4206 ```
4207 <enabled/>
4208 <data id="JSONOneLine" value='[]'/>
4209 ```
4210 #### macOS
4211 ```
4212 <dict>
4213   <key>ManagedBookmarks</key>
4214   <array>
4215     <dict>
4216       <key>toplevel_name</key>
4217       <string>My managed bookmarks folder</string>
4218       <dict>
4219         <key>url</key>
4220         <string>example.com</string>
4221         <key>name</key>
4222         <string>Example</string>
4223       </dict>
4224       <dict>
4225       <key>name</key>
4226       <string>Mozilla links</string>
4227       <key>children</key>
4228       <array>
4229         <dict>
4230           <key>url</key>
4231           <string>https://mozilla.org</string>
4232           <key>name</key>
4233           <string>Mozilla</string>
4234         </dict>
4235         <dict>
4236           <key>url</key>
4237           <string>https://support.mozilla.org/</string>
4238           <key>name</key>
4239           <string>SUMO</string>
4240         </dict>
4241       </array>
4242     </dict>
4243   </array>
4244 </dict>
4245 ```
4246 #### policies.json
4247 ```
4248 {
4249   "policies": {
4250     "ManagedBookmarks": [
4251       {
4252         "toplevel_name": "My managed bookmarks folder"
4253       },
4254       {
4255         "url": "example.com",
4256         "name": "Example"
4257       },
4258       {
4259         "name": "Mozilla links",
4260         "children": [
4261           {
4262             "url": "https://mozilla.org",
4263             "name": "Mozilla.org"
4264           },
4265           {
4266             "url": "https://support.mozilla.org/",
4267             "name": "SUMO"
4268           }
4269         ]
4270       }
4271     ]
4272   }
4273 }
4274 ```
4275 ### ManualAppUpdateOnly
4276
4277 Switch to manual updates only.
4278
4279 If this policy is enabled:
4280  1. The user will never be prompted to install updates
4281  2. Firefox will not check for updates in the background, though it will check automatically when an update UI is displayed (such as the one in the About dialog). This check will be used to show "Update to version X" in the UI, but will not automatically download the update or prompt the user to update in any other way.
4282  3. The update UI will work as expected, unlike when using DisableAppUpdate.
4283
4284 This policy is primarily intended for advanced end users, not for enterprises, but it is available via GPO.
4285
4286 **Compatibility:** Firefox 87\
4287 **CCK2 Equivalent:** N/A\
4288 **Preferences Affected:** N/A
4289
4290 #### Windows (GPO)
4291 ```
4292 Software\Policies\Mozilla\Firefox\ManualAppUpdateOnly = 0x1 | 0x0
4293 ```
4294 #### Windows (Intune)
4295 OMA-URI:
4296 ```
4297 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox/ManualAppUpdateOnly
4298 ```
4299 Value (string):
4300 ```
4301 <enabled/> or <disabled/>
4302 ```
4303 #### macOS
4304 ```
4305 <dict>
4306   <key>ManualAppUpdateOnly</key>
4307   <true/> | <false/>
4308 </dict>
4309 ```
4310 #### policies.json
4311 ```
4312 {
4313   "policies": {
4314     "ManualAppUpdateOnly": true | false
4315   }
4316 }
4317 ```
4318 ### MicrosoftEntraSSO
4319 Allow single sign-on for Microsoft Entra accounts on macOS.
4320
4321 If this policy is set to true, Firefox will use credentials stored in the Company Portal to sign in to Microsoft Entra accounts.
4322
4323 **Compatibility:** Firefox 132.0.1, Firefox ESR 128.5\
4324 **CCK2 Equivalent:** N/A\
4325 **Preferences Affected:** `network.http.microsoft-entra-sso.enabled`
4326
4327 #### macOS
4328 ```
4329 <dict>
4330   <key>MicrosoftEntraSSO</key>
4331   <true/> | <false/>
4332 </dict>
4333 ```
4334 #### policies.json
4335 ```
4336 {
4337   "policies": {
4338     "MicrosoftEntraSSO": true | false
4339   }
4340 }
4341 ```
4342 ### NetworkPrediction
4343 Enable or disable network prediction (DNS prefetching).
4344
4345 **Compatibility:** Firefox 67, Firefox ESR 60.7\
4346 **CCK2 Equivalent:** N/A\
4347 **Preferences Affected:** `network.dns.disablePrefetch`, `network.dns.disablePrefetchFromHTTPS`
4348
4349 #### Windows (GPO)
4350 ```
4351 Software\Policies\Mozilla\Firefox\NetworkPrediction = 0x1 | 0x0
4352 ```
4353 #### Windows (Intune)
4354 OMA-URI:
4355 ```
4356 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox/NetworkPrediction
4357 ```
4358 Value (string):
4359 ```
4360 <enabled/> or <disabled/>
4361 ```
4362 #### macOS
4363 ```
4364 <dict>
4365   <key>NetworkPrediction</key>
4366   <true/> | <false/>
4367 </dict>
4368 ```
4369 #### policies.json
4370 ```
4371 {
4372   "policies": {
4373     "NetworkPrediction": true | false
4374 }
4375 ```
4376 ### NewTabPage
4377 Enable or disable the New Tab page.
4378
4379 **Compatibility:** Firefox 68, Firefox ESR 68\
4380 **CCK2 Equivalent:** N/A\
4381 **Preferences Affected:** `browser.newtabpage.enabled`
4382
4383 #### Windows (GPO)
4384 ```
4385 Software\Policies\Mozilla\Firefox\NewTabPage = 0x1 | 0x0
4386 ```
4387 #### Windows (Intune)
4388 OMA-URI:
4389 ```
4390 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox/NewTabPage
4391 ```
4392 Value (string):
4393 ```
4394 <enabled/> or <disabled/>
4395 ```
4396 #### macOS
4397 ```
4398 <dict>
4399   <key>NewTabPage</key>
4400   <true/> | <false/>
4401 </dict>
4402 ```
4403 #### policies.json
4404 ```
4405 {
4406   "policies": {
4407     "NewTabPage": true | false
4408 }
4409 ```
4410 ### NoDefaultBookmarks
4411 Disable the creation of default bookmarks.
4412
4413 This policy is only effective if the user profile has not been created yet.
4414
4415 **Compatibility:** Firefox 60, Firefox ESR 60\
4416 **CCK2 Equivalent:** `removeDefaultBookmarks`\
4417 **Preferences Affected:** N/A
4418
4419 #### Windows (GPO)
4420 ```
4421 Software\Policies\Mozilla\Firefox\NoDefaultBookmarks = 0x1 | 0x0
4422 ```
4423 #### Windows (Intune)
4424 OMA-URI:
4425 ```
4426 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox/NoDefaultBookmarks
4427 ```
4428 Value (string):
4429 ```
4430 <enabled/> or <disabled/>
4431 ```
4432 #### macOS
4433 ```
4434 <dict>
4435   <key>NoDefaultBookmarks</key>
4436   <true/> | <false/>
4437 </dict>
4438 ```
4439 #### policies.json
4440 ```
4441 {
4442   "policies": {
4443     "NoDefaultBookmarks": true | false
4444   }
4445 }
4446 ```
4447 ### OfferToSaveLogins
4448 Control whether or not Firefox offers to save passwords.
4449
4450 **Compatibility:** Firefox 60, Firefox ESR 60\
4451 **CCK2 Equivalent:** `dontRememberPasswords`\
4452 **Preferences Affected:** `signon.rememberSignons`
4453
4454 #### Windows (GPO)
4455 ```
4456 Software\Policies\Mozilla\Firefox\OfferToSaveLogins = 0x1 | 0x0
4457 ```
4458 #### Windows (Intune)
4459 OMA-URI:
4460 ```
4461 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox/OfferToSaveLogins
4462 ```
4463 Value (string):
4464 ```
4465 <enabled/> or <disabled/>
4466 ```
4467 #### macOS
4468 ```
4469 <dict>
4470   <key>OfferToSaveLogins</key>
4471   <true/> | <false/>
4472 </dict>
4473 ```
4474 #### policies.json
4475 ```
4476 {
4477   "policies": {
4478     "OfferToSaveLogins": true | false
4479   }
4480 }
4481 ```
4482 ### OfferToSaveLoginsDefault
4483 Sets the default value of signon.rememberSignons without locking it.
4484
4485 **Compatibility:** Firefox 70, Firefox ESR 60.2\
4486 **CCK2 Equivalent:** `dontRememberPasswords`\
4487 **Preferences Affected:** `signon.rememberSignons`
4488
4489 #### Windows (GPO)
4490 ```
4491 Software\Policies\Mozilla\Firefox\OfferToSaveLoginsDefault = 0x1 | 0x0
4492 ```
4493 #### Windows (Intune)
4494 OMA-URI:
4495 ```
4496 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox/OfferToSaveLoginsDefault
4497 ```
4498 Value (string):
4499 ```
4500 <enabled/> or <disabled/>
4501 ```
4502 #### macOS
4503 ```
4504 <dict>
4505   <key>OfferToSaveLoginsDefault</key>
4506   <true/> | <false/>
4507 </dict>
4508 ```
4509 #### policies.json
4510 ```
4511 {
4512   "policies": {
4513     "OfferToSaveLoginsDefault": true | false
4514   }
4515 }
4516 ```
4517 ### OverrideFirstRunPage
4518 Override the first run page. If the value is an empty string (""), the first run page is not displayed.
4519
4520 Starting with Firefox 83, Firefox ESR 78.5, you can also specify multiple URLS separated by a vertical bar (|).
4521
4522 **Compatibility:** Firefox 60, Firefox ESR 60\
4523 **CCK2 Equivalent:** `welcomePage`,`noWelcomePage`\
4524 **Preferences Affected:** `startup.homepage_welcome_url`
4525
4526 #### Windows (GPO)
4527 ```
4528 Software\Policies\Mozilla\Firefox\OverrideFirstRunPage = "http://example.org"
4529 ```
4530 #### Windows (Intune)
4531 OMA-URI:
4532 ```
4533 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox/OverrideFirstRunPage
4534 ```
4535 Value (string):
4536 ```
4537 <enabled/>
4538 <data id="OverridePage" value="https://example.com"/>
4539 ```
4540 #### macOS
4541 ```
4542 <dict>
4543   <key>OverrideFirstRunPage</key>
4544   <string>http://example.org</string>
4545 </dict>
4546 ```
4547 #### policies.json
4548 ```
4549 {
4550   "policies": {
4551     "OverrideFirstRunPage": "http://example.org"
4552   }
4553 }
4554 ```
4555 ### OverridePostUpdatePage
4556 Override the upgrade page. If the value is an empty string (""), no extra pages are displayed when Firefox is upgraded.
4557
4558 **Compatibility:** Firefox 60, Firefox ESR 60\
4559 **CCK2 Equivalent:** `upgradePage`,`noUpgradePage`\
4560 **Preferences Affected:** `startup.homepage_override_url`
4561
4562 #### Windows (GPO)
4563 ```
4564 Software\Policies\Mozilla\Firefox\OverridePostUpdatePage = "http://example.org"
4565 ```
4566 #### Windows (Intune)
4567 OMA-URI:
4568 ```
4569 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox/OverridePostUpdatePage
4570 ```
4571 Value (string):
4572 ```
4573 <enabled/>
4574 <data id="OverridePage" value="https://example.com"/>
4575 ```
4576 #### macOS
4577 ```
4578 <dict>
4579   <key>OverridePostUpdatePage</key>
4580   <string>http://example.org</string>
4581 </dict>
4582 ```
4583 #### policies.json
4584 ```
4585 {
4586   "policies": {
4587     "OverridePostUpdatePage": "http://example.org"
4588   }
4589 }
4590 ```
4591 ### PasswordManagerEnabled
4592 Remove access to the password manager via preferences and blocks about:logins on Firefox 70.
4593
4594 **Compatibility:** Firefox 70, Firefox ESR 60.2\
4595 **CCK2 Equivalent:** N/A\
4596 **Preferences Affected:** `pref.privacy.disable_button.view_passwords`, `signon.rememberSignons`
4597
4598 #### Windows (GPO)
4599 ```
4600 Software\Policies\Mozilla\Firefox\PasswordManagerEnabled = 0x1 | 0x0
4601 ```
4602 #### Windows (Intune)
4603 OMA-URI:
4604 ```
4605 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox/PasswordManagerEnabled
4606 ```
4607 Value (string):
4608 ```
4609 <enabled/> or <disabled/>
4610 ```
4611 #### macOS
4612 ```
4613 <dict>
4614   <key>PasswordManagerEnabled</key>
4615   <true/> | <false/>
4616 </dict>
4617 ```
4618 #### policies.json
4619 ```
4620 {
4621   "policies": {
4622     "PasswordManagerEnabled": true | false
4623   }
4624 }
4625 ```
4626 ### PasswordManagerExceptions
4627 Prevent Firefox from saving passwords for specific sites.
4628
4629 The sites are specified as a list of origins.
4630
4631 **Compatibility:** Firefox 101\
4632 **CCK2 Equivalent:** N/A\
4633 **Preferences Affected:** N/A
4634
4635 #### Windows (GPO)
4636 ```
4637 Software\Policies\Mozilla\Firefox\PasswordManagerExceptions\1 = "https://example.org"
4638 Software\Policies\Mozilla\Firefox\PasswordManagerExceptions\2 = "https://example.edu"
4639 ```
4640 #### Windows (Intune)
4641 OMA-URI:
4642 ```
4643 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox/PasswordManagerExceptions
4644 ```
4645 Value (string):
4646 ```
4647 <enabled/>
4648 <data id="List" value="1&#xF000;https://example.org&#xF000;2&#xF000;https://example.edu"/>
4649 ```
4650 #### macOS
4651 ```
4652 <dict>
4653   <key>PasswordManagerExceptions</key>
4654   <array>
4655     <string>https://example.org</string>
4656     <string>https://example.edu</string>
4657   </array>
4658 </dict>
4659 ```
4660 #### policies.json
4661 ```
4662 {
4663   "policies": {
4664     "PasswordManagerExceptions": ["https://example.org",
4665                                   "https://example.edu"]
4666   }
4667 }
4668 ```
4669 ### PDFjs
4670 Disable or configure PDF.js, the built-in PDF viewer.
4671
4672 If `Enabled` is set to false, the built-in PDF viewer is disabled.
4673
4674 If `EnablePermissions` is set to true, the built-in PDF viewer will honor document permissions like preventing the copying of text.
4675
4676 Note: DisableBuiltinPDFViewer has not been deprecated. You can either continue to use it, or switch to using PDFjs->Enabled to disable the built-in PDF viewer. This new permission was added because we needed a place for PDFjs->EnabledPermissions.
4677
4678 **Compatibility:** Firefox 77, Firefox ESR 68.9\
4679 **CCK2 Equivalent:** N/A\
4680 **Preferences Affected:** `pdfjs.disabled`, `pdfjs.enablePermissions`
4681
4682 #### Windows (GPO)
4683 ```
4684 Software\Policies\Mozilla\Firefox\PDFjs\Enabled = 0x1 | 0x0
4685 Software\Policies\Mozilla\Firefox\PDFjs\EnablePermissions = 0x1 | 0x0
4686 ```
4687 #### Windows (Intune)
4688 OMA-URI:
4689 ```
4690 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~PDFjs/PDFjs_Enabled
4691 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~PDFjs/PDFjs_EnablePermissions
4692 ```
4693 Value (string):
4694 ```
4695 <enabled/>or <disabled/>
4696 ```
4697 #### macOS
4698 ```
4699 <dict>
4700   <key>PDFjs</key>
4701   <dict>
4702     <key>Enabled</key>
4703     <true/> | <false/>
4704     <key>EnablePermissions</key>
4705     <true/> | <false/>
4706   </dict>
4707 </dict>
4708 ```
4709 #### policies.json
4710 ```
4711 {
4712   "policies": {
4713     "PDFjs": {
4714       "Enabled": true | false,
4715       "EnablePermissions": true | false
4716     }
4717   }
4718 }
4719 ```
4720 ### Permissions
4721 Set permissions associated with camera, microphone, location, notifications, autoplay, and virtual reality. Because these are origins, not domains, entries with unique ports must be specified separately. This explicitly means that it is not possible to add wildcards. See examples below.
4722
4723 `Allow` is a list of origins where the feature is allowed.
4724
4725 `Block` is a list of origins where the feature is not allowed.
4726
4727 `BlockNewRequests` determines whether or not new requests can be made for the feature.
4728
4729 `Locked` prevents the user from changing preferences for the feature.
4730
4731 `Default` specifies the default value for Autoplay. block-audio-video is not supported on Firefox ESR 68.
4732
4733 **Compatibility:** Firefox 62, Firefox ESR 60.2 (Autoplay added in Firefox 74, Firefox ESR 68.6, Autoplay Default/Locked added in Firefox 76, Firefox ESR 68.8, VirtualReality added in Firefox 80, Firefox ESR 78.2)\
4734 **CCK2 Equivalent:** N/A\
4735 **Preferences Affected:** `permissions.default.camera`, `permissions.default.microphone`, `permissions.default.geo`, `permissions.default.desktop-notification`, `media.autoplay.default`, `permissions.default.xr`
4736
4737 #### Windows (GPO)
4738 ```
4739 Software\Policies\Mozilla\Firefox\Permissions\Camera\Allow\1 = "https://example.org"
4740 Software\Policies\Mozilla\Firefox\Permissions\Camera\Allow\2 = "https://example.com"
4741 Software\Policies\Mozilla\Firefox\Permissions\Camera\Block\1 = "https://example.edu"
4742 Software\Policies\Mozilla\Firefox\Permissions\Camera\BlockNewRequests = 0x1 | 0x0
4743 Software\Policies\Mozilla\Firefox\Permissions\Camera\Locked = 0x1 | 0x0
4744 Software\Policies\Mozilla\Firefox\Permissions\Microphone\Allow\1 = "https://example.org"
4745 Software\Policies\Mozilla\Firefox\Permissions\Microphone\Allow\2 = "https://example.com"
4746 Software\Policies\Mozilla\Firefox\Permissions\Microphone\Block\1 = "https://example.edu"
4747 Software\Policies\Mozilla\Firefox\Permissions\Microphone\BlockNewRequests = 0x1 | 0x0
4748 Software\Policies\Mozilla\Firefox\Permissions\Microphone\Locked = 0x1 | 0x0
4749 Software\Policies\Mozilla\Firefox\Permissions\Location\Allow\1 = "https://example.org"
4750 Software\Policies\Mozilla\Firefox\Permissions\Location\Allow\2 = "https://example.com"
4751 Software\Policies\Mozilla\Firefox\Permissions\Location\Block\1 = "https://example.edu"
4752 Software\Policies\Mozilla\Firefox\Permissions\Location\BlockNewRequests = 0x1 | 0x0
4753 Software\Policies\Mozilla\Firefox\Permissions\Location\Locked = 0x1 | 0x0
4754 Software\Policies\Mozilla\Firefox\Permissions\Notifications\Allow\1 = "https://example.org"
4755 Software\Policies\Mozilla\Firefox\Permissions\Notifications\Allow\2 = "https://example.com"
4756 Software\Policies\Mozilla\Firefox\Permissions\Notifications\Block\1 = "https://example.edu"
4757 Software\Policies\Mozilla\Firefox\Permissions\Notifications\BlockNewRequests = 0x1 | 0x0
4758 Software\Policies\Mozilla\Firefox\Permissions\Notifications\Locked = 0x1 | 0x0
4759 Software\Policies\Mozilla\Firefox\Permissions\Autoplay\Allow\1 = "https://example.org"
4760 Software\Policies\Mozilla\Firefox\Permissions\Autoplay\Allow\2 = "https://example.com"
4761 Software\Policies\Mozilla\Firefox\Permissions\Autoplay\Block\1 = "https://example.edu"
4762 Software\Policies\Mozilla\Firefox\Permissions\Autoplay\Default = "allow-audio-video" | "block-audio" | "block-audio-video"
4763 Software\Policies\Mozilla\Firefox\Permissions\Autoplay\Locked = 0x1 | 0x0
4764 Software\Policies\Mozilla\Firefox\Permissions\VirtualReality\Allow\1 = "https://example.org"
4765 Software\Policies\Mozilla\Firefox\Permissions\VirtualReality\Allow\2 = "https://example.com"
4766 Software\Policies\Mozilla\Firefox\Permissions\VirtualReality\Block\1 = "https://example.edu"
4767 Software\Policies\Mozilla\Firefox\Permissions\VirtualReality\BlockNewRequests = 0x1 | 0x0
4768 Software\Policies\Mozilla\Firefox\Permissions\VirtualReality\Locked = 0x1 | 0x0
4769 ```
4770 #### Windows (Intune)
4771 OMA-URI:
4772 ```
4773 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~Permissions~Camera/Camera_Allow
4774 ```
4775 Value (string):
4776 ```
4777 <enabled/>
4778 <data id="Permissions" value="1&#xF000;https://example.org&#xF000;2&#xF000;https://example.com"/>
4779 ```
4780 OMA-URI:
4781 ```
4782 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~Permissions~Camera/Camera_Block
4783 ```
4784 Value (string):
4785 ```
4786 <enabled/>
4787 <data id="Permissions" value="1&#xF000;https://example.edu"/>
4788 ```
4789 OMA-URI:
4790 ```
4791 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~Permissions~Camera/Camera_BlockNewRequests
4792 ```
4793 Value (string):
4794 ```
4795 <enabled/> or <disabled/>
4796 ```
4797 OMA-URI:
4798 ```
4799 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~Permissions~Camera/Camera_Locked
4800 ```
4801 Value (string):
4802 ```
4803 <enabled/> or <disabled/>
4804 ```
4805 OMA-URI:
4806 ```
4807 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~Permissions~Microphone/Microphone_Allow
4808 ```
4809 Value (string):
4810 ```
4811 <enabled/>
4812 <data id="Permissions" value="1&#xF000;https://example.org&#xF000;2&#xF000;https://example.com"/>
4813 ```
4814 OMA-URI:
4815 ```
4816 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~Permissions~Microphone/Microphone_Block
4817 ```
4818 Value (string):
4819 ```
4820 <enabled/>
4821 <data id="Permissions" value="1&#xF000;https://example.edu"/>
4822 ```
4823 OMA-URI:
4824 ```
4825 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~Permissions~Microphone/Microphone_BlockNewRequests
4826 ```
4827 Value (string):
4828 ```
4829 <enabled/> or <disabled/>
4830 ```
4831 OMA-URI:
4832 ```
4833 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~Permissions~Microphone/Microphone_Locked
4834 ```
4835 Value (string):
4836 ```
4837 <enabled/> or <disabled/>
4838 ```
4839 OMA-URI:
4840 ```
4841 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~Permissions~Location/Location_Allow
4842 ```
4843 Value (string):
4844 ```
4845 <enabled/>
4846 <data id="Permissions" value="1&#xF000;https://example.org&#xF000;2&#xF000;https://example.com"/>
4847 ```
4848 OMA-URI:
4849 ```
4850 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~Permissions~Location/Location_Block
4851 ```
4852 Value (string):
4853 ```
4854 <enabled/>
4855 <data id="Permissions" value="1&#xF000;https://example.edu"/>
4856 ```
4857 OMA-URI:
4858 ```
4859 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~Permissions~Location/Location_BlockNewRequests
4860 ```
4861 Value (string):
4862 ```
4863 <enabled/> or <disabled/>
4864 ```
4865 OMA-URI:
4866 ```
4867 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~Permissions~Location/Location_Locked
4868 ```
4869 Value (string):
4870 ```
4871 <enabled/> or <disabled/>
4872 ```
4873 OMA-URI:
4874 ```
4875 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~Permissions~Notifications/Notifications_Allow
4876 ```
4877 Value (string):
4878 ```
4879 <enabled/>
4880 <data id="Permissions" value="1&#xF000;https://example.org&#xF000;2&#xF000;https://example.com"/>
4881 ```
4882 OMA-URI:
4883 ```
4884 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~Permissions~Notifications/Notifications_BlockNewRequests
4885 ```
4886 Value (string):
4887 ```
4888 <enabled/> or <disabled/>
4889 ```
4890 OMA-URI:
4891 ```
4892 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~Permissions~Notifications/Notifications_Locked
4893 ```
4894 Value (string):
4895 ```
4896 <enabled/> or <disabled/>
4897 ```
4898 OMA-URI:
4899 ```
4900 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~Permissions~Autoplay/Autoplay_Allow
4901 ```
4902 Value (string):
4903 ```
4904 <enabled/>
4905 <data id="Permissions" value="1&#xF000;https://example.org&#xF000;2&#xF000;https://example.com"/>
4906 ```
4907 OMA-URI:
4908 ```
4909 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~Permissions~Autoplay/Autoplay_Block
4910 ```
4911 Value (string):
4912 ```
4913 <enabled/>
4914 <data id="Permissions" value="1&#xF000;https://example.edu"/>
4915 ```
4916 OMA-URI:
4917 ```
4918 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~Permissions~Autoplay/Autoplay_Default
4919 ```
4920 Value (string):
4921 ```
4922 <enabled/>
4923 <data id="Autoplay_Default" value="allow-audio-video | block-audio | block-audio-video"/>
4924 ```
4925 OMA-URI:
4926 ```
4927 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~Permissions~Autoplay/Autoplay_Locked
4928 ```
4929 Value (string):
4930 ```
4931 <enabled/> or <disabled/>
4932 ```
4933 OMA-URI:
4934 ```
4935 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~Permissions~VirtualReality/VirtualReality_Allow
4936 ```
4937 Value (string):
4938 ```
4939 <enabled/>
4940 <data id="Permissions" value="1&#xF000;https://example.org&#xF000;2&#xF000;https://example.com"/>
4941 ```
4942 OMA-URI:
4943 ```
4944 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~Permissions~VirtualReality/VirtualReality_Block
4945 ```
4946 Value (string):
4947 ```
4948 <enabled/>
4949 <data id="Permissions" value="1&#xF000;https://example.edu"/>
4950 ```
4951 OMA-URI:
4952 ```
4953 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~Permissions~VirtualReality/VirtualReality_BlockNewRequests
4954 ```
4955 Value (string):
4956 ```
4957 <enabled/> or <disabled/>
4958 ```
4959 OMA-URI:
4960 ```
4961 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~Permissions~Notifications/VirtualReality_Locked
4962 ```
4963 Value (string):
4964 ```
4965 <enabled/> or <disabled/>
4966 ```
4967 #### macOS
4968 ```
4969 <dict>
4970   <key>Permissions</key>
4971   <dict>
4972     <key>Camera</key>
4973     <dict>
4974       <key>Allow</key>
4975       <array>
4976         <string>https://example.org</string>
4977         <string>https://example.org:1234</string>
4978       </array>
4979       <key>Block</key>
4980       <array>
4981         <string>https://example.edu</string>
4982       </array>
4983       <key>BlockNewRequests</key>
4984       <true/> | <false/>
4985       <key>Locked</key>
4986       <true/> | <false/>
4987     </dict>
4988     <key>Microphone</key>
4989     <dict>
4990       <key>Allow</key>
4991       <array>
4992         <string>https://example.org</string>
4993       </array>
4994       <key>Block</key>
4995       <array>
4996         <string>https://example.edu</string>
4997       </array>
4998       <key>BlockNewRequests</key>
4999       <true/> | <false/>
5000       <key>Locked</key>
5001       <true/> | <false/>
5002     </dict>
5003     <key>Location</key>
5004     <dict>
5005       <key>Allow</key>
5006       <array>
5007         <string>https://example.org</string>
5008       </array>
5009       <key>Block</key>
5010       <array>
5011         <string>https://example.edu</string>
5012       </array>
5013       <key>BlockNewRequests</key>
5014       <true/> | <false/>
5015       <key>Locked</key>
5016       <true/> | <false/>
5017     </dict>
5018     <key>Notifications</key>
5019     <dict>
5020       <key>Allow</key>
5021       <array>
5022         <string>https://example.org</string>
5023       </array>
5024       <key>Block</key>
5025       <array>
5026         <string>https://example.edu</string>
5027       </array>
5028       <key>BlockNewRequests</key>
5029       <true/>
5030       <key>Locked</key>
5031       <true/>
5032     </dict>
5033     <key>Autoplay</key>
5034     <dict>
5035       <key>Allow</key>
5036       <array>
5037         <string>https://example.org</string>
5038       </array>
5039       <key>Block</key>
5040       <array>
5041         <string>https://example.edu</string>
5042       </array>
5043       <key>Default</key>
5044       <string>allow-audio-video | block-audio | block-audio-video</string>
5045       <key>Locked</key>
5046       <true/> | <false/>
5047     </dict>
5048   </dict>
5049 </dict>
5050 ```
5051 #### policies.json
5052 ```
5053 {
5054   "policies": {
5055     "Permissions": {
5056       "Camera": {
5057         "Allow": ["https://example.org","https://example.org:1234"],
5058         "Block": ["https://example.edu"],
5059         "BlockNewRequests": true | false,
5060         "Locked": true | false
5061       },
5062       "Microphone": {
5063         "Allow": ["https://example.org"],
5064         "Block": ["https://example.edu"],
5065         "BlockNewRequests": true | false,
5066         "Locked": true | false
5067       },
5068       "Location": {
5069         "Allow": ["https://example.org"],
5070         "Block": ["https://example.edu"],
5071         "BlockNewRequests": true | false,
5072         "Locked": true | false
5073       },
5074       "Notifications": {
5075         "Allow": ["https://example.org"],
5076         "Block": ["https://example.edu"],
5077         "BlockNewRequests": true | false,
5078         "Locked": true | false
5079       },
5080       "Autoplay": {
5081         "Allow": ["https://example.org"],
5082         "Block": ["https://example.edu"],
5083         "Default": "allow-audio-video" | "block-audio" | "block-audio-video",
5084         "Locked": true | false
5085       }
5086     }
5087   }
5088 }
5089 ```
5090 ### PictureInPicture
5091
5092 Enable or disable Picture-in-Picture as well as prevent the user from enabling or disabling it (Locked).
5093
5094 **Compatibility:** Firefox 78, Firefox ESR 78\
5095 **CCK2 Equivalent:** N/A\
5096 **Preferences Affected:** `media.videocontrols.picture-in-picture.video-toggle.enabled`
5097
5098 #### Windows (GPO)
5099 ```
5100 Software\Policies\Mozilla\Firefox\PictureInPicture\Enabled = 0x1 | 0x0
5101 Software\Policies\Mozilla\Firefox\PictureInPicture\Locked = 0x1 | 0x0
5102
5103 ```
5104 #### Windows (Intune)
5105 OMA-URI:
5106 ```
5107 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~PictureInPicture/PictureInPicture_Enabled
5108 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~PictureInPicture/PictureInPicture_Locked
5109 ```
5110 Value (string):
5111 ```
5112 <enabled/> or <disabled/>
5113 ```
5114 #### macOS
5115 ```
5116 <dict>
5117   <key>PictureInPicture</key>
5118   <dict>
5119     <key>Enabled</key>
5120     <true/> | <false/>
5121     <key>Locked</key>
5122     <true/> | <false/>
5123   </dict>
5124 </dict>
5125 ```
5126 #### policies.json
5127 ```
5128 {
5129   "policies": {
5130     "PictureInPicture": {
5131       "Enabled": true | false,
5132       "Locked": true | false
5133     }
5134   }
5135 }
5136 ```
5137 ### PopupBlocking
5138 Configure the default pop-up window policy as well as origins for which pop-up windows are allowed.
5139
5140 `Allow` is a list of origins where popup-windows are allowed.
5141
5142 `Default` determines whether or not pop-up windows are allowed by default.
5143
5144 `Locked` prevents the user from changing pop-up preferences.
5145
5146 **Compatibility:** Firefox 60, Firefox ESR 60\
5147 **CCK2 Equivalent:** `permissions.popup`\
5148 **Preferences Affected:** `dom.disable_open_during_load`
5149
5150 #### Windows (GPO)
5151 ```
5152 Software\Policies\Mozilla\Firefox\PopupBlocking\Allow\1 = "https://example.org"
5153 Software\Policies\Mozilla\Firefox\PopupBlocking\Allow\2 = "https://example.edu"
5154 Software\Policies\Mozilla\Firefox\PopupBlocking\Default = 0x1 | 0x0
5155 Software\Policies\Mozilla\Firefox\PopupBlocking\Locked = 0x1 | 0x0
5156 ```
5157 #### Windows (Intune)
5158 OMA-URI:
5159 ```
5160 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~Popups/PopupBlocking_Allow
5161 ```
5162 Value (string):
5163 ```
5164 <enabled/>
5165 <data id="Permissions" value="1&#xF000;https://example.org&#xF000;2&#xF000;https://example.edu"/>
5166 ```
5167 OMA-URI:
5168 ```
5169 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~Popups/PopupBlocking_Default
5170 ```
5171 Value (string):
5172 ```
5173 <enabled/> or <disabled/>
5174 ```
5175 OMA-URI:
5176 ```
5177 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~Popups/PopupBlocking_Locked
5178 ```
5179 Value (string):
5180 ```
5181 <enabled/> or <disabled/>
5182 ```
5183 #### macOS
5184 ```
5185 <dict>
5186   <key>PopupBlocking</key>
5187   <dict>
5188     <key>Allow</key>
5189     <array>
5190       <string>http://example.org</string>
5191       <string>http://example.edu</string>
5192     </array>
5193     <key>Default</key>
5194     <true/> | <false/>
5195     <key>Locked</key>
5196     <true/> | <false/>
5197   </dict>
5198 </dict>
5199 ```
5200 #### policies.json
5201 ```
5202 {
5203   "policies": {
5204     "PopupBlocking": {
5205       "Allow": ["http://example.org/",
5206                 "http://example.edu/"],
5207       "Default": true | false,
5208       "Locked": true | false
5209     }
5210   }
5211 }
5212 ```
5213 ### PostQuantumKeyAgreementEnabled
5214 Enable post-quantum key agreement for TLS.
5215
5216 **Compatibility:** Firefox 127\
5217 **CCK2 Equivalent:** N/A\
5218 **Preferences Affected:** `security.tls.enable_kyber`, `network.http.http3.enable_kyber` (Firefox 128)
5219
5220 #### Windows (GPO)
5221 ```
5222 Software\Policies\Mozilla\Firefox\PostQuantumKeyAgreementEnabled = 0x1 | 0x0
5223 ```
5224 #### Windows (Intune)
5225 OMA-URI:
5226 ```
5227 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox/PostQuantumKeyAgreementEnabled
5228 ```
5229 Value (string):
5230 ```
5231 <enabled/> or <disabled/>
5232 ```
5233 #### macOS
5234 ```
5235 <dict>
5236   <key>PostQuantumKeyAgreementEnabled</key>
5237   <true/> | <false/>
5238 </dict>
5239 ```
5240 #### policies.json
5241 ```
5242 {
5243   "policies": {
5244     "PostQuantumKeyAgreementEnabled": true | false
5245   }
5246 }
5247 ```
5248 ### Preferences
5249 Set and lock preferences.
5250
5251 **NOTE** On Windows, in order to use this policy, you must clear all settings in the old **Preferences (Deprecated)** section in group policy.
5252
5253 Previously you could only set and lock a subset of preferences. Starting with Firefox 81 and Firefox ESR 78.3 you can set many more preferences. You can also set default preferences, user preferences and you can clear preferences.
5254
5255 Preferences that start with the following prefixes are supported:
5256 ```
5257 accessibility.
5258 alerts.* (Firefox 122, Firefox ESR 115.7)
5259 app.update.* (Firefox 86, Firefox ESR 78.8)
5260 browser.
5261 datareporting.policy.
5262 dom.
5263 extensions.
5264 general.autoScroll (Firefox 83, Firefox ESR 78.5)
5265 general.smoothScroll (Firefox 83, Firefox ESR 78.5)
5266 geo.
5267 gfx.
5268 identity.fxaccounts.toolbar (Firefox 133)
5269 intl.
5270 keyword.enabled (Firefox 95, Firefox ESR 91.4)
5271 layers.
5272 layout.
5273 media.
5274 network.
5275 pdfjs. (Firefox 84, Firefox ESR 78.6)
5276 places.
5277 pref.
5278 print.
5279 privacy.globalprivacycontrol.enabled (Firefox 127, Firefox ESR 128.0)
5280 privacy.userContext.enabled (Firefox 126, Firefox ESR 115.11)
5281 privacy.userContext.ui.enabled (Firefox 126, Firefox ESR 115.11)
5282 signon. (Firefox 83, Firefox ESR 78.5)
5283 spellchecker. (Firefox 84, Firefox ESR 78.6)
5284 toolkit.legacyUserProfileCustomizations.stylesheets (Firefox 95, Firefox ESR 91.4)
5285 ui.
5286 widget.
5287 xpinstall.signatures.required (Firefox ESR 102.10, Firefox ESR only)
5288 xpinstall.whitelist.required (Firefox 118, Firefox ESR 115.3)
5289 ```
5290 as well as the following security preferences:
5291
5292 | Preference | Type | Default
5293 | --- | --- | --- |
5294 | security.default_personal_cert | string | Ask Every Time
5295 | &nbsp;&nbsp;&nbsp;&nbsp;If set to Select Automatically, Firefox automatically chooses the default personal certificate.
5296 | security.disable_button.openCertManager | string | N/A
5297 | &nbsp;&nbsp;&nbsp;&nbsp;If set to true and locked, the View Certificates button in preferences is disabled (Firefox 121, Firefox ESR 115.6)
5298 | security.disable_button.openDeviceManager | string | N/A
5299 | &nbsp;&nbsp;&nbsp;&nbsp;If set to true and locked, the Security Devices button in preferences is disabled (Firefox 121, Firefox ESR 115.6)
5300 | security.insecure_connection_text.enabled | bool | false
5301 | &nbsp;&nbsp;&nbsp;&nbsp;If set to true, adds the words "Not Secure" for insecure sites.
5302 | security.insecure_connection_text.pbmode.enabled | bool | false
5303 | &nbsp;&nbsp;&nbsp;&nbsp;If set to true, adds the words "Not Secure" for insecure sites in private browsing.
5304 | security.mixed_content.block_active_content | boolean | true
5305 | &nbsp;&nbsp;&nbsp;&nbsp;If set to true, mixed active content (HTTP subresources such as scripts, fetch requests, etc. on a HTTPS page) will be blocked.
5306 | security.mixed_content.block_display_content | boolean | false
5307 | &nbsp;&nbsp;&nbsp;&nbsp;If set to true, mixed passive/display content (HTTP subresources such as images, videos, etc. on a HTTPS page) will be blocked and ```security.mixed_content.upgrade_display_content``` will be ignored. (Firefox 127, Firefox ESR 128.0)
5308 | security.mixed_content.upgrade_display_content | boolean | true
5309 | &nbsp;&nbsp;&nbsp;&nbsp;If set to false, mixed passive/display content (HTTP subresources such as images, videos, etc. on a HTTPS page) will NOT be upgraded to HTTPS. (Firefox 127, Firefox ESR 128.0)
5310 | security.osclientcerts.autoload | boolean | false
5311 | &nbsp;&nbsp;&nbsp;&nbsp;If true, client certificates are loaded from the operating system certificate store.
5312 | security.OCSP.enabled | integer | 1
5313 | &nbsp;&nbsp;&nbsp;&nbsp;If 0, do not fetch OCSP. If 1, fetch OCSP for DV and EV certificates. If 2, fetch OCSP only for EV certificates.
5314 | security.OCSP.require | boolean | false
5315 | &nbsp;&nbsp;&nbsp;&nbsp; If true, if an OCSP request times out, the connection fails.
5316 | security.osclientcerts.assume_rsa_pss_support | boolean | true
5317 | &nbsp;&nbsp;&nbsp;&nbsp; If false, we don't assume an RSA key can do RSA-PSS. (Firefox 114, Firefox ESR 102.12)
5318 | security.pki.certificate_transparency.mode | integer | 0
5319 | &nbsp;&nbsp;&nbsp;&nbsp; Configures Certificate Transparency support mode (Firefox 133)
5320 | security.ssl.enable_ocsp_stapling | boolean | true
5321 | &nbsp;&nbsp;&nbsp;&nbsp; If false, OCSP stapling is not enabled.
5322 | security.ssl.errorReporting.enabled | boolean | true
5323 | &nbsp;&nbsp;&nbsp;&nbsp;If false, SSL errors cannot be sent to Mozilla.
5324 | security.ssl.require_safe_negotiation | boolean | false
5325 | &nbsp;&nbsp;&nbsp;&nbsp;If true, Firefox will only negotiate TLS connections with servers that indicate they support secure renegotiation. (Firefox 118, Firefox ESR 115.3)
5326 | security.tls.enable_0rtt_data | boolean | true
5327 | &nbsp;&nbsp;&nbsp;&nbsp;If false, TLS early data is turned off. (Firefox 93, Firefox 91.2, Firefox 78.15)
5328 | security.tls.hello_downgrade_check | boolean | true
5329 | &nbsp;&nbsp;&nbsp;&nbsp;If false, the TLS 1.3 downgrade check is disabled.
5330 | security.tls.version.enable-deprecated | boolean | false
5331 | &nbsp;&nbsp;&nbsp;&nbsp;If true, browser will accept TLS 1.0. and TLS 1.1. (Firefox 86, Firefox 78.8)
5332 | security.warn_submit_secure_to_insecure | boolean | true
5333 | &nbsp;&nbsp;&nbsp;&nbsp;If false, no warning is shown when submitting a form from https to http.
5334
5335 Using the preference as the key, set the `Value` to the corresponding preference value.
5336
5337 `Status` can be "default", "locked", "user" or "clear"
5338
5339 * `"default"`: Read/Write: Settings appear as default even if factory default differs.
5340 * `"locked"`: Read-Only: Settings appear as default even if factory default differs.
5341 * `"user"`: Read/Write: Settings appear as changed if it differs from factory default.
5342 * `"clear"`: Read/Write: `Value` has no effect. Resets to factory defaults on each startup.
5343
5344 `"user"` preferences persist across invocations of Firefox. It is the equivalent of a user setting the preference. They are most useful when a preference is needed very early in startup so it can't be set as default by policy. An example of this is ```toolkit.legacyUserProfileCustomizations.stylesheets```.
5345
5346 `"user"` preferences persist even if the policy is removed, so if you need to remove them, you should use the clear policy.
5347
5348 You can also set the `Type` starting in Firefox 123 and Firefox ESR 115.8. It can be `number`, `boolean` or `string`. This is especially useful if you are seeing 0 or 1 values being converted to booleans when set as user preferences.
5349
5350 See the examples below for more detail.
5351
5352 IMPORTANT: Make sure you're only setting a particular preference using this mechanism and not some other way.
5353
5354 Status
5355 **Compatibility:** Firefox 81, Firefox ESR 78.3\
5356 **CCK2 Equivalent:** `preferences`\
5357 **Preferences Affected:** Many
5358
5359 #### Windows (GPO)
5360 Software\Policies\Mozilla\Firefox\Preferences (REG_MULTI_SZ) =
5361 ```
5362 {
5363   "accessibility.force_disabled": {
5364     "Value": 1,
5365     "Status": "default",
5366     "Type": "number"
5367
5368   },
5369   "browser.cache.disk.parent_directory": {
5370     "Value": "SOME_NATIVE_PATH",
5371     "Status": "user"
5372   },
5373   "browser.tabs.warnOnClose": {
5374     "Value": false,
5375     "Status": "locked"
5376   }
5377 }
5378 ```
5379 #### Windows (Intune)
5380 OMA-URI:
5381 ```
5382 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox/Preferences
5383 ```
5384 Value (string):
5385 ```
5386 <enabled/>
5387 <data id="JSON" value='
5388 {
5389   "accessibility.force_disabled": {
5390     "Value": 1,
5391     "Status": "default",
5392     "Type": "number"
5393   },
5394   "browser.cache.disk.parent_directory": {
5395     "Value": "SOME_NATIVE_PATH",
5396     "Status": "user"
5397   },
5398   "browser.tabs.warnOnClose": {
5399     "Value": false,
5400     "Status": "locked"
5401   }
5402 }'/>
5403 ```
5404 If you are using custom ADMX and ADML administrative templates in Intune, you can use this OMA-URI instead
5405 to workaround the limit on the length of strings. Put all of your JSON on one line.
5406
5407 OMA-URI:
5408 ```
5409 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~Extensions/PreferencesOneLine
5410 ```
5411 Value (string):
5412 ```
5413 <enabled/>
5414 <data id="JSONOneLine" value='{}'/>
5415 ```
5416 #### macOS
5417 ```
5418 <dict>
5419   <key>Preferences</key>
5420   <dict>
5421     <key>accessibility.force_disabled</key>
5422     <dict>
5423       <key>Value</key>
5424       <integer>1</integer>
5425       <key>Status</key>
5426       <string>default</string>
5427       <key>Type</key>
5428       <string>number</string>
5429     </dict>
5430     <key>browser.cache.disk.parent_directory</key>
5431     <dict>
5432       <key>Value</key>
5433       <string>SOME_NATIVE_PATH</string>
5434       <key>Status</key>
5435       <string>user</string>
5436     </dict>
5437     <key>browser.tabs.warnOnClose</key>
5438     <dict>
5439       <key>Value</key>
5440       <false/>
5441       <key>Status</key>
5442       <string>locked</string>
5443     </dict>
5444   </dict>
5445 </dict>
5446 ```
5447 #### policies.json
5448 ```
5449 {
5450   "policies": {
5451     "Preferences": {
5452       "accessibility.force_disabled": {
5453         "Value": 1,
5454         "Status": "default"
5455         "Type": "number"
5456       },
5457       "browser.cache.disk.parent_directory": {
5458         "Value": "SOME_NATIVE_PATH",
5459         "Status": "user"
5460       },
5461       "browser.tabs.warnOnClose": {
5462         "Value": false,
5463         "Status": "locked"
5464       }
5465     }
5466   }
5467 }
5468 ```
5469 ### PrimaryPassword
5470 Require or prevent using a primary (formerly master) password.
5471
5472 If this value is true, a primary password is required. If this value is false, it works the same as if [`DisableMasterPasswordCreation`](#disablemasterpasswordcreation) was true and removes the primary password functionality.
5473
5474 If both DisableMasterPasswordCreation and PrimaryPassword are used, DisableMasterPasswordCreation takes precedent.
5475
5476 **Compatibility:** Firefox 79, Firefox ESR 78.1\
5477 **CCK2 Equivalent:** `noMasterPassword`\
5478 **Preferences Affected:** N/A
5479
5480 #### Windows (GPO)
5481 ```
5482 Software\Policies\Mozilla\Firefox\PrimaryPassword = 0x1 | 0x0
5483 ```
5484 #### Windows (Intune)
5485 OMA-URI:
5486 ```
5487 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox/PrimaryPassword
5488 ```
5489 Value (string):
5490 ```
5491 <enabled/> or <disabled/>
5492 ```
5493 #### macOS
5494 ```
5495 <dict>
5496   <key>PrimaryPassword</key>
5497   <true/> | <false/>
5498 </dict>
5499 ```
5500 #### policies.json
5501 ```
5502 {
5503   "policies": {
5504     "PrimaryPassword": true | false
5505   }
5506 }
5507 ```
5508 ### PrintingEnabled
5509 Enable or disable printing.
5510
5511 **Compatibility:** Firefox 120, Firefox ESR 115.5\
5512 **CCK2 Equivalent:** N/A\
5513 **Preferences Affected:** `print.enabled`
5514
5515 #### Windows (GPO)
5516 ```
5517 Software\Policies\Mozilla\Firefox\PrintingEnabled = 0x1 | 0x0
5518 ```
5519 #### Windows (Intune)
5520 OMA-URI:
5521 ```
5522 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox/PrintingEnabled
5523 ```
5524 Value (string):
5525 ```
5526 <enabled/> or <disabled/>
5527 ```
5528 #### macOS
5529 ```
5530 <dict>
5531   <key>PrintingEnabled</key>
5532   <true/> | <false/>
5533 </dict>
5534 ```
5535 #### policies.json
5536 ```
5537 {
5538   "policies": {
5539     "PrintingEnabled": true | false
5540   }
5541 }
5542 ```
5543 ### PrivateBrowsingModeAvailability
5544 Set availability of private browsing mode.
5545
5546 Possible values are `0` (Private Browsing mode is available), `1` (Private Browsing mode not available), and `2`(Private Browsing mode is forced).
5547
5548 This policy supersedes [`DisablePrivateBrowsing`](#disableprivatebrowsing)
5549
5550 Note: This policy missed Firefox ESR 128.2, but it will be in Firefox ESR 128.3.
5551
5552 **Compatibility:** Firefox 130, Firefox ESR 128.3\
5553 **CCK2 Equivalent:** N/A\
5554 **Preferences Affected:** N/A
5555
5556 #### Windows (GPO)
5557 ```
5558 Software\Policies\Mozilla\Firefox\PrivateBrowsingModeAvailability = 0x0 | 0x1 | 0x2
5559 ```
5560 #### Windows (Intune)
5561 OMA-URI:
5562 ```
5563 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox/PrivateBrowsingModeAvailability
5564 ```
5565 Value (string):
5566 ```
5567 <enabled/>
5568 <data id="PrivateBrowsingModeAvailability" value="0 | 1 | 2"/>
5569 ```
5570 #### macOS
5571 ```
5572 <dict>
5573   <key>PrivateBrowsingModeAvailability</key>
5574   <integer>0 | 1 | 2</integer>
5575 </dict>
5576 ```
5577 #### policies.json
5578 ```
5579 {
5580   "policies": {
5581     "PrivateBrowsingModeAvailability": 0 | 1 | 2
5582   }
5583 }
5584 ```
5585 ### PromptForDownloadLocation
5586 Ask where to save each file before downloading.
5587
5588 **Compatibility:** Firefox 68, Firefox ESR 68\
5589 **CCK2 Equivalent:** N/A\
5590 **Preferences Affected:** `browser.download.useDownloadDir`
5591
5592 #### Windows (GPO)
5593 ```
5594 Software\Policies\Mozilla\Firefox\PromptForDownloadLocation = 0x1 | 0x0
5595 ```
5596 #### Windows (Intune)
5597 OMA-URI:
5598 ```
5599 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox/PromptForDownloadLocation
5600 ```
5601 Value (string):
5602 ```
5603 <enabled/> or <disabled/>
5604 ```
5605 #### macOS
5606 ```
5607 <dict>
5608   <key>PromptForDownloadLocation</key>
5609   <true/> | <false/>
5610 </dict>
5611 ```
5612 #### policies.json
5613 ```
5614 {
5615   "policies": {
5616     "PromptForDownloadLocation": true | false
5617   }
5618 }
5619 ```
5620 ### Proxy
5621 Configure proxy settings. These settings correspond to the connection settings in Firefox preferences.
5622 To specify ports, append them to the hostnames with a colon (:).
5623
5624 Unless you lock this policy, changes the user already has in place will take effect.
5625
5626 `Mode` is the proxy method being used.
5627
5628 `Locked` is whether or not proxy settings can be changed.
5629
5630 `HTTPProxy` is the HTTP proxy server.
5631
5632 `UseHTTPProxyForAllProtocols` is whether or not the HTTP proxy should be used for all other proxies.
5633
5634 `SSLProxy` is the SSL proxy server.
5635
5636 `FTPProxy` is the FTP proxy server.
5637
5638 `SOCKSProxy` is the SOCKS proxy server
5639
5640 `SOCKSVersion` is the SOCKS version (4 or 5)
5641
5642 `Passthrough` is list of hostnames or IP addresses that will not be proxied. Use `<local>` to bypass proxying for all hostnames which do not contain periods.
5643
5644 `AutoConfigURL` is a  URL for proxy configuration (only used if Mode is autoConfig).
5645
5646 `AutoLogin` means do not prompt for authentication if password is saved.
5647
5648 `UseProxyForDNS` to use proxy DNS when using SOCKS v5.
5649
5650 **Compatibility:** Firefox 60, Firefox ESR 60\
5651 **CCK2 Equivalent:** `networkProxy*`\
5652 **Preferences Affected:** `network.proxy.type`, `network.proxy.autoconfig_url`, `network.proxy.socks_remote_dns`, `signon.autologin.proxy`, `network.proxy.socks_version`, `network.proxy.no_proxies_on`, `network.proxy.share_proxy_settings`, `network.proxy.http`, `network.proxy.http_port`, `network.proxy.ftp`, `network.proxy.ftp_port`, `network.proxy.ssl`, `network.proxy.ssl_port`, `network.proxy.socks`, `network.proxy.socks_port`
5653
5654 #### Windows (GPO)
5655 ```
5656 Software\Policies\Mozilla\Firefox\Proxy\Mode = "none" | "system" | "manual" | "autoDetect" | "autoConfig"
5657 Software\Policies\Mozilla\Firefox\Proxy\Locked = 0x1 | 0x0
5658 Software\Policies\Mozilla\Firefox\Proxy\HTTPProxy = https://httpproxy.example.com
5659 Software\Policies\Mozilla\Firefox\Proxy\UseHTTPProxyForAllProtocols = 0x1 | 0x0
5660 Software\Policies\Mozilla\Firefox\Proxy\SSLProxy = https://sslproxy.example.com
5661 Software\Policies\Mozilla\Firefox\Proxy\FTPProxy = https://ftpproxy.example.com
5662 Software\Policies\Mozilla\Firefox\Proxy\SOCKSProxy = https://socksproxy.example.com
5663 Software\Policies\Mozilla\Firefox\Proxy\SOCKSVersion = 0x4 | 0x5
5664 Software\Policies\Mozilla\Firefox\Proxy\Passthrough = <local>
5665 Software\Policies\Mozilla\Firefox\Proxy\AutoConfigURL = URL_TO_AUTOCONFIG
5666 Software\Policies\Mozilla\Firefox\Proxy\AutoLogin = 0x1 | 0x0
5667 Software\Policies\Mozilla\Firefox\Proxy\UseProxyForDNS = 0x1 | 0x0
5668 ```
5669 #### Windows (Intune)
5670 **Note**
5671 These setttings were moved to a category to make them easier to configure via Intune.
5672
5673 OMA-URI:
5674 ```
5675 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~ProxySettings/Proxy_Locked
5676 ```
5677 Value (string):
5678 ```
5679 <enabled/> or <disabled/>
5680 ```
5681 OMA-URI:
5682 ```
5683 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~ProxySettings/Proxy_ConnectionType
5684 ```
5685 Value (string):
5686 ```
5687 <enabled/>
5688 <data id="Proxy_ConnectionType" value="none | system | manual | autoDetect | autoConfig"/>
5689 ```
5690 OMA-URI:
5691 ```
5692 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~ProxySettings/Proxy_HTTPProxy
5693 ```
5694 Value (string):
5695 ```
5696 <enabled/>
5697 <data id="Proxy_HTTPProxy" value="httpproxy.example.com"/>
5698 ```
5699 OMA-URI:
5700 ```
5701 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~ProxySettings/Proxy_UseHTTPProxyForAllProtocols
5702 ```
5703 Value (string):
5704 ```
5705 <enabled/> or <disabled/>
5706 ```
5707 OMA-URI:
5708 ```
5709 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~ProxySettings/Proxy_SSLProxy
5710 ```
5711 Value (string):
5712 ```
5713 <enabled/>
5714 <data id="Proxy_SSLProxy" value="sslproxy.example.com"/>
5715 ```
5716 OMA-URI:
5717 ```
5718 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~ProxySettings/Proxy_SOCKSProxy
5719 ```
5720 Value (string):
5721 ```
5722 <enabled/>
5723 <data id="Proxy_SOCKSProxy" value="socksproxy.example.com"/>
5724 <data id="Proxy_SOCKSVersion" value="4 | 5"/>
5725 ```
5726 OMA-URI:
5727 ```
5728 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~ProxySettings/Proxy_AutoConfigURL
5729 ```
5730 Value (string):
5731 ```
5732 <enabled/>
5733 <data id="Proxy_AutoConfigURL" value="URL_TO_AUTOCONFIG"/>
5734 ```
5735 OMA-URI:
5736 ```
5737 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~ProxySettings/Proxy_Passthrough
5738 ```
5739 Value (string):
5740 ```
5741 <enabled/>
5742 <data id="Proxy_Passthrough" value="&lt;local&gt;"/>
5743 ```
5744 OMA-URI:
5745 ```
5746 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~ProxySettings/Proxy_AutoLogin
5747 ```
5748 Value (string):
5749 ```
5750 <enabled/> or <disabled/>
5751 ```
5752 OMA-URI:
5753 ```
5754 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~ProxySettings/Proxy_UseProxyForDNS
5755 ```
5756 Value (string):
5757 ```
5758 <enabled/> or <disabled/>
5759 ```
5760 OMA-URI (Old way):
5761 ```
5762 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox/Proxy
5763 ```
5764 Value (string):
5765 ```
5766 <enabled/>
5767 <data id="ProxyLocked" value="true | false"/>
5768 <data id="ConnectionType" value="none | system | manual | autoDetect | autoConfig"/>
5769 <data id="HTTPProxy" value="httpproxy.example.com"/>
5770 <data id="UseHTTPProxyForAllProtocols" value="true | false"/>
5771 <data id="SSLProxy" value="sslproxy.example.com"/>
5772 <data id="FTPProxy" value="ftpproxy.example.com"/>
5773 <data id="SOCKSProxy" value="socksproxy.example.com"/>
5774 <data id="SOCKSVersion" value="4 | 5"/>
5775 <data id="AutoConfigURL" value="URL_TO_AUTOCONFIG"/>
5776 <data id="Passthrough" value="<local>"/>
5777 <data id="AutoLogin" value="true | false"/>
5778 <data id="UseProxyForDNS" value="true | false"/>
5779 ```
5780 #### macOS
5781 ```
5782 <dict>
5783   <key>Proxy</key>
5784   <dict>
5785     <key>Mode</key>
5786     <string>none | system | manual | autoDetect | autoConfig</string>
5787     <key>Locked</key>
5788     <true> | </false>
5789     <key>HTTPProxy</key>
5790     <string>https://httpproxy.example.com</string>
5791     <key>UseHTTPProxyForAllProtocols</key>
5792     <true> | </false>
5793     <key>SSLProxy</key>
5794     <string>https://sslproxy.example.com</string>
5795     <key>FTPProxy</key>
5796     <string>https://ftpproxy.example.com</string>
5797     <key>SOCKSProxy</key>
5798     <string>https://socksproxy.example.com</string>
5799     <key>SOCKSVersion</key>
5800     <string>4 | 5</string>
5801     <key>Passthrough</key>
5802     <string>&lt;local>&gt;</string>
5803     <key>AutoConfigURL</key>
5804     <string>URL_TO_AUTOCONFIG</string>
5805     <key>AutoLogin</key>
5806     <true> | </false>
5807     <key>UseProxyForDNS</key>
5808     <true> | </false>
5809   </dict>
5810 </dict>
5811 ```
5812 #### policies.json
5813 ```
5814 {
5815   "policies": {
5816     "Proxy": {
5817       "Mode": "none" | "system" | "manual" | "autoDetect" | "autoConfig",
5818       "Locked": true | false,
5819       "HTTPProxy": "hostname",
5820       "UseHTTPProxyForAllProtocols": true | false,
5821       "SSLProxy": "hostname",
5822       "FTPProxy": "hostname",
5823       "SOCKSProxy": "hostname",
5824       "SOCKSVersion": 4 | 5,
5825       "Passthrough": "<local>",
5826       "AutoConfigURL": "URL_TO_AUTOCONFIG",
5827       "AutoLogin": true | false,
5828       "UseProxyForDNS": true | false
5829     }
5830   }
5831 }
5832 ```
5833 ### RequestedLocales
5834 Set the the list of requested locales for the application in order of preference. It will cause the corresponding language pack to become active.
5835
5836 Note: For Firefox 68, this can now be a string so that you can specify an empty value.
5837
5838 **Compatibility:** Firefox 64, Firefox ESR 60.4, Updated in Firefox 68, Firefox ESR 68\
5839 **CCK2 Equivalent:** N/A\
5840 **Preferences Affected:** N/A
5841 #### Windows (GPO)
5842 ```
5843 Software\Policies\Mozilla\Firefox\RequestedLocales\1 = "de"
5844 Software\Policies\Mozilla\Firefox\RequestedLocales\2 = "en-US"
5845
5846 or
5847
5848 Software\Policies\Mozilla\Firefox\RequestedLocales = "de,en-US"
5849 ```
5850 #### Windows (Intune)
5851 OMA-URI:
5852 ```
5853 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox/RequestedLocalesString
5854 ```
5855 Value (string):
5856 ```
5857 <enabled/>
5858 <data id="Preferences_String" value="de,en-US"/>
5859 ```
5860 #### macOS
5861 ```
5862 <dict>
5863   <key>RequestedLocales</key>
5864   <array>
5865     <string>de</string>
5866     <string>en-US</string>
5867   </array>
5868 </dict>
5869
5870 or
5871
5872 <dict>
5873   <key>RequestedLocales</key>
5874   <string>de,en-US</string>
5875 </dict>
5876
5877 ```
5878 #### policies.json
5879 ```
5880 {
5881   "policies": {
5882     "RequestedLocales": ["de", "en-US"]
5883   }
5884 }
5885
5886 or
5887
5888 {
5889   "policies": {
5890     "RequestedLocales": "de,en-US"
5891   }
5892 }
5893 ```
5894 <a name="SanitizeOnShutdown"></a>
5895
5896 ### SanitizeOnShutdown (Selective)
5897 Clear data on shutdown.
5898
5899 Note: Starting with Firefox 128, History clears FormData and Downloads as well.
5900
5901 `Cache`
5902
5903 `Cookies`
5904
5905 `Downloads` Download History (*Deprecated*)
5906
5907 `FormData` Form & Search History (*Deprecated*)
5908
5909 `History` Browsing History, Download History, Form & Search History.
5910
5911 `Sessions` Active Logins
5912
5913 `SiteSettings` Site Preferences
5914
5915 `OfflineApps` Offline Website Data (*Deprecated - part of Cookies*)
5916
5917 `Locked` prevents the user from changing these preferences.
5918
5919 **Compatibility:** Firefox 68, Firefox ESR 68 (Locked added in 74/68.6, History update in Firefox 128)\
5920 **CCK2 Equivalent:** N/A\
5921 **Preferences Affected:** `privacy.sanitize.sanitizeOnShutdown`, `privacy.clearOnShutdown.cache`, `privacy.clearOnShutdown.cookies`, `privacy.clearOnShutdown.downloads`, `privacy.clearOnShutdown.formdata`, `privacy.clearOnShutdown.history`, `privacy.clearOnShutdown.sessions`, `privacy.clearOnShutdown.siteSettings`, `privacy.clearOnShutdown.offlineApps`, `privacy.clearOnShutdown_v2.historyFormDataAndDownloads` (Firefox 128), `privacy.clearOnShutdown_v2.cookiesAndStorage` (Firefox 128), `privacy.clearOnShutdown_v2.cache` (Firefox 128), `privacy.clearOnShutdown_v2.siteSettings` (Firefox 128)
5922
5923 #### Windows (GPO)
5924 ```
5925 Software\Policies\Mozilla\Firefox\SanitizeOnShutdown\Cache = 0x1 | 0x0
5926 Software\Policies\Mozilla\Firefox\SanitizeOnShutdown\Cookies = 0x1 | 0x0
5927 Software\Policies\Mozilla\Firefox\SanitizeOnShutdown\History = 0x1 | 0x0
5928 Software\Policies\Mozilla\Firefox\SanitizeOnShutdown\Sessions = 0x1 | 0x0
5929 Software\Policies\Mozilla\Firefox\SanitizeOnShutdown\SiteSettings = 0x1 | 0x0
5930 Software\Policies\Mozilla\Firefox\SanitizeOnShutdown\Locked = 0x1 | 0x0
5931 ```
5932 #### Windows (Intune)
5933 OMA-URI:
5934 ```
5935 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~SanitizeOnShutdown/A_SanitizeOnShutdown_Cache
5936 ```
5937 Value (string):
5938 ```
5939 <enabled/> or <disabled/>
5940 ```
5941 OMA-URI:
5942 ```
5943 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~SanitizeOnShutdown/B_SanitizeOnShutdown_Cookies
5944 ```
5945 Value (string):
5946 ```
5947 <enabled/> or <disabled/>
5948 ```
5949 OMA-URI:
5950 ```
5951 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~SanitizeOnShutdown/E_SanitizeOnShutdown_History
5952 ```
5953 Value (string):
5954 ```
5955 <enabled/> or <disabled/>
5956 ```
5957 OMA-URI:
5958 ```
5959 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~SanitizeOnShutdown/F_SanitizeOnShutdown_Sessions
5960 ```
5961 Value (string):
5962 ```
5963 <enabled/> or <disabled/>
5964 ```
5965 OMA-URI:
5966 ```
5967 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~SanitizeOnShutdown/G_SanitizeOnShutdown_SiteSettings
5968 ```
5969 Value (string):
5970 ```
5971 <enabled/> or <disabled/>
5972 ```
5973 OMA-URI:
5974 ```
5975 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~SanitizeOnShutdown/I_SanitizeOnShutdown_Locked
5976 ```
5977 Value (string):
5978 ```
5979 <enabled/> or <disabled/>
5980 ```
5981 #### macOS
5982 ```
5983 <dict>
5984   <key>SanitizeOnShutdown</key>
5985   <dict>
5986     <key>Cache</key>
5987     <true/> | <false/>
5988     <key>Cookies</key>
5989     <true/> | <false/>
5990     <key>History</key>
5991     <true/> | <false/>
5992     <key>Sessions</key>
5993     <true/> | <false/>
5994     <key>SiteSettings</key>
5995     <true/> | <false/>
5996     <key>Locked</key>
5997     <true/> | <false/>
5998   </dict>
5999 </dict>
6000 ```
6001 #### policies.json
6002 ```
6003 {
6004   "policies": {
6005     "SanitizeOnShutdown": {
6006       "Cache": true | false,
6007       "Cookies": true | false,
6008       "History": true | false,
6009       "Sessions": true | false,
6010       "SiteSettings": true | false,
6011       "Locked": true | false
6012     }
6013   }
6014 }
6015 ```
6016 ### SanitizeOnShutdown (All)
6017 Clear all data on shutdown, including Browsing & Download History, Cookies, Active Logins, Cache, Form & Search History, Site Preferences and Offline Website Data.
6018
6019 **Compatibility:** Firefox 60, Firefox ESR 60\
6020 **CCK2 Equivalent:** N/A\
6021 **Preferences Affected:** `privacy.sanitize.sanitizeOnShutdown`, `privacy.clearOnShutdown.cache`, `privacy.clearOnShutdown.cookies`, `privacy.clearOnShutdown.downloads`, `privacy.clearOnShutdown.formdata`, `privacy.clearOnShutdown.history`, `privacy.clearOnShutdown.sessions`, `privacy.clearOnShutdown.siteSettings`, `privacy.clearOnShutdown.offlineApps`
6022 #### Windows (GPO)
6023 ```
6024 Software\Policies\Mozilla\Firefox\SanitizeOnShutdown = 0x1 | 0x0
6025 ```
6026 #### Windows (Intune)
6027 OMA-URI:
6028 ```
6029 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox/C_SanitizeOnShutdown
6030 ```
6031 Value (string):
6032 ```
6033 <enabled/> or <disabled/>
6034 ```
6035 #### macOS
6036 ```
6037 <dict>
6038   <key>SanitizeOnShutdown</key>
6039   <true/> | <false/>
6040 </dict>
6041 ```
6042 #### policies.json
6043 ```
6044 {
6045   "policies": {
6046     "SanitizeOnShutdown": true | false
6047   }
6048 }
6049 ```
6050 ### SearchBar
6051 Set whether or not search bar is displayed.
6052
6053 **Compatibility:** Firefox 60, Firefox ESR 60\
6054 **CCK2 Equivalent:** `showSearchBar`\
6055 **Preferences Affected:** N/A
6056
6057 #### Windows (GPO)
6058 ```
6059 Software\Policies\Mozilla\Firefox\SearchBar = "unified" | "separate"
6060 ```
6061
6062 #### Windows (Intune)
6063 OMA-URI:
6064 ```
6065 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox/SearchBar
6066 ```
6067 Value (string):
6068 ```
6069 <enabled/>
6070 <data id="SearchBar" value="unified | separate"/>
6071 ```
6072 #### macOS
6073 ```
6074 <dict>
6075   <key>SearchBar</key>
6076   <string>unified | separate</string>
6077 </dict>
6078 ```
6079 #### policies.json
6080 ```
6081 {
6082   "policies": {
6083     "SearchBar": "unified" | "separate"
6084   }
6085 }
6086 ```
6087 <a name="SearchEngines"></a>
6088
6089 ### SearchEngines (This policy is only available on the ESR.)
6090
6091 ### SearchEngines | Add
6092
6093 Add new search engines. Although there are only five engines available in the ADMX template, there is no limit. To add more in the ADMX template, you can duplicate the XML.
6094
6095 This policy is only available on the ESR. `Name` and `URLTemplate` are required.
6096
6097 `Name` is the name of the search engine.
6098
6099 `URLTemplate` is the search URL with {searchTerms} to substitute for the search term.
6100
6101 `Method` is either GET or POST
6102
6103 `IconURL` is a URL for the icon to use.
6104
6105 `Alias` is a keyword to use for the engine.
6106
6107 `Description` is a description of the search engine.
6108
6109 `PostData` is the POST data as name value pairs separated by &.
6110
6111 `SuggestURLTemplate` is a search suggestions URL with {searchTerms} to substitute for the search term.
6112
6113 `Encoding` is the query charset for the engine. It defaults to UTF-8.
6114
6115 **Compatibility:** Firefox ESR 60 (POST support in Firefox ESR 68, Encoding support in Firefox 91)\
6116 **CCK2 Equivalent:** `searchplugins`\
6117 **Preferences Affected:** N/A
6118
6119 #### Windows (GPO)
6120 ```
6121 Software\Policies\Mozilla\Firefox\SearchEngines\Add\1\Name = "Example1"
6122 Software\Policies\Mozilla\Firefox\SearchEngines\Add\1\URLTemplate = "https://www.example.org/q={searchTerms}"
6123 Software\Policies\Mozilla\Firefox\SearchEngines\Add\1\Method = "GET" | "POST"
6124 Software\Policies\Mozilla\Firefox\SearchEngines\Add\1\IconURL = "https://www.example.org/favicon.ico"
6125 Software\Policies\Mozilla\Firefox\SearchEngines\Add\1\Alias = "example"
6126 Software\Policies\Mozilla\Firefox\SearchEngines\Add\1\Description = "Example Description"
6127 Software\Policies\Mozilla\Firefox\SearchEngines\Add\1\SuggestURLTemplate = "https://www.example.org/suggestions/q={searchTerms}"
6128 Software\Policies\Mozilla\Firefox\SearchEngines\Add\1\PostData = "name=value&q={searchTerms}"
6129 ```
6130 #### Windows (Intune)
6131 OMA-URI:
6132 ```
6133 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~Search/SearchEngines_1
6134 ```
6135 Value (string):
6136 ```
6137 <enabled/>
6138 <data id="SearchEngine_Name" value="Example1"/>
6139 <data id="SearchEngine_URLTemplate" value="https://www.example.org/q={searchTerms"/>
6140 <data id="SearchEngine_Method" value="GET | POST"/>
6141 <data id="SearchEngine_IconURL" value="https://www.example.org/favicon.ico"/>
6142 <data id="SearchEngine_Alias" value="example"/>
6143 <data id="SearchEngine_Description" value="Example Description"/>
6144 <data id="SearchEngine_SuggestURLTemplate" value="https://www.example.org/suggestions/q={searchTerms}"/>
6145 <data id="SearchEngine_PostData" value="name=value&amp;q={searchTerms}"/>
6146 ```
6147 #### macOS
6148 ```
6149 <dict>
6150   <key>SearchEngines</key>
6151   <dict>
6152     <key>Add</key>
6153     <array>
6154       <dict>
6155         <key>Name</key>
6156         <string>Example1</string>
6157         <key>URLTemplate</key>
6158         <string>https://www.example.org/q={searchTerms}</string>
6159         <key>Method</key>
6160         <string>GET | POST </string>
6161         <key>IconURL</key>
6162         <string>https://www.example.org/favicon.ico</string>
6163         <key>Alias</key>
6164         <string>example</string>
6165         <key>Description</key>
6166         <string>Example Description</string>
6167         <key>SuggestURLTemplate</key>
6168         <string>https://www.example.org/suggestions/q={searchTerms}</string>
6169         <key>PostData</key>
6170         <string>name=value&q={searchTerms}</string>
6171       </dict>
6172     <array>
6173   </dict>
6174 </dict>
6175 ```
6176 #### policies.json
6177 ```
6178 {
6179   "policies": {
6180     "SearchEngines": {
6181       "Add": [
6182         {
6183           "Name": "Example1",
6184           "URLTemplate": "https://www.example.org/q={searchTerms}",
6185           "Method": "GET" | "POST",
6186           "IconURL": "https://www.example.org/favicon.ico",
6187           "Alias": "example",
6188           "Description": "Description",
6189           "PostData": "name=value&q={searchTerms}",
6190           "SuggestURLTemplate": "https://www.example.org/suggestions/q={searchTerms}"
6191         }
6192       ]
6193     }
6194   }
6195 }
6196 ```
6197 ### SearchEngines | Default
6198
6199 Set the default search engine. This policy is only available on the ESR.
6200
6201 **Compatibility:** Firefox ESR 60\
6202 **CCK2 Equivalent:** `defaultSearchEngine`\
6203 **Preferences Affected:** N/A
6204
6205 #### Windows (GPO)
6206 ```
6207 Software\Policies\Mozilla\Firefox\SearchEngines\Default = NAME_OF_SEARCH_ENGINE
6208 ```
6209 #### Windows (Intune)
6210 OMA-URI:
6211 ```
6212 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~Search/SearchEngines_Default
6213 ```
6214 Value (string):
6215 ```
6216 <enabled/>
6217 <data id="SearchEngines_Default" value="NAME_OF_SEARCH_ENGINE"/>
6218 ```
6219 #### macOS
6220 ```
6221 <dict>
6222   <key>SearchEngines</key>
6223   <dict>
6224     <key>Default</key>
6225     <string>NAME_OF_SEARCH_ENGINE</string>
6226   </dict>
6227 </dict>
6228 ```
6229 #### policies.json
6230 ```
6231 {
6232   "policies": {
6233     "SearchEngines": {
6234       "Default": "NAME_OF_SEARCH_ENGINE"
6235     }
6236   }
6237 }
6238 ```
6239 ### SearchEngines | PreventInstalls
6240
6241 Prevent installing search engines from webpages.
6242
6243 **Compatibility:** Firefox ESR 60\
6244 **CCK2 Equivalent:** `disableSearchEngineInstall`\
6245 **Preferences Affected:** N/A
6246
6247 #### Windows (GPO)
6248 ```
6249 Software\Policies\Mozilla\Firefox\SearchEngines\PreventInstalls = 0x1 | 0x0
6250 ```
6251 #### Windows (Intune)
6252 OMA-URI:
6253 ```
6254 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~Search/SearchEngines_PreventInstalls
6255 ```
6256 Value (string):
6257 ```
6258 <enabled/> or <disabled/>
6259 ```
6260 #### macOS
6261 ```
6262 <dict>
6263   <key>SearchEngines</key>
6264   <dict>
6265     <key>PreventInstalls</key>
6266     <true/> | <false/>
6267   </dict>
6268 </dict>
6269 ```
6270 #### policies.json
6271 ```
6272 {
6273   "policies": {
6274     "SearchEngines": {
6275       "PreventInstalls": true | false
6276     }
6277   }
6278 }
6279 ```
6280 ### SearchEngines | Remove
6281
6282 Hide built-in search engines. This policy is only available on the ESR.
6283
6284 **Compatibility:** Firefox ESR 60.2\
6285 **CCK2 Equivalent:** `removeDefaultSearchEngines` (removed all built-in engines)\
6286 **Preferences Affected:** N/A
6287
6288 #### Windows (GPO)
6289 ```
6290 Software\Policies\Mozilla\Firefox\SearchEngines\Remove\1 = NAME_OF_SEARCH_ENGINE
6291 ```
6292 #### Windows (Intune)
6293 OMA-URI:
6294 ```
6295 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~Search/SearchEngines_Remove
6296 ```
6297 Value (string):
6298 ```
6299 <enabled/>
6300 <data id="SearchEngines_Remove" value="1&#xF000;NAME_OF_SEARCH_ENGINE"/>
6301 ```
6302 #### macOS
6303 ```
6304 <dict>
6305   <key>SearchEngines</key>
6306   <dict>
6307     <key>Remove</key>
6308     <array>
6309       <string>NAME_OF_SEARCH_ENGINE</string>
6310     </array>
6311   </dict>
6312 </dict>
6313 ```
6314 #### policies.json
6315 ```
6316 {
6317   "policies": {
6318     "SearchEngines": {
6319       "Remove": ["NAME_OF_SEARCH_ENGINE"]
6320     }
6321   }
6322 }
6323 ```
6324 ### SearchSuggestEnabled
6325
6326 Enable search suggestions.
6327
6328 **Compatibility:** Firefox 68, Firefox ESR 68\
6329 **CCK2 Equivalent:** N/A\
6330 **Preferences Affected:** `browser.urlbar.suggest.searches`, `browser.search.suggest.enabled`
6331
6332 #### Windows (GPO)
6333 ```
6334 Software\Policies\Mozilla\Firefox\SearchSuggestEnabled = 0x1 | 0x0
6335 ```
6336 #### Windows (Intune)
6337 OMA-URI:
6338 ```
6339 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~Search/SearchSuggestEnabled
6340 ```
6341 Value (string):
6342 ```
6343 <enabled/> or <disabled/>
6344 ```
6345 #### macOS
6346 ```
6347 <dict>
6348   <key>SearchSuggestEnabled</key>
6349   <true/> | <false/>
6350 </dict>
6351 ```
6352 #### policies.json
6353 ```
6354 {
6355   "policies": {
6356     "SearchSuggestEnabled": true | false
6357   }
6358 }
6359 ```
6360 ### SecurityDevices
6361
6362 Add or delete PKCS #11 modules.
6363
6364 **Compatibility:** Firefox 114, Firefox ESR 112.12\
6365 **CCK2 Equivalent:** N/A\
6366 **Preferences Affected:** N/A
6367
6368 #### Windows (GPO)
6369 ```
6370 Software\Policies\Mozilla\Firefox\SecurityDevices\Add\NAME_OF_DEVICE_TO_ADD = PATH_TO_LIBRARY_FOR_DEVICE
6371 Software\Policies\Mozilla\Firefox\SecurityDevices\Remove\1 = NAME_OF_DEVICE_TO_REMOVE
6372 ```
6373 #### Windows (Intune)
6374 OMA-URI:
6375 ```
6376 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox/SecurityDevices/SecurityDevices_Add
6377 ```
6378 Value (string):
6379 ```
6380 <enabled/>
6381 <data id="SecurityDevices" value="NAME_OF_DEVICE_TO_ADD&#xF000;PATH_TO_LIBRARY_FOR_DEVICE"/>
6382 ```
6383 OMA-URI:
6384 ```
6385 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox/SecurityDevices/SecurityDevices_Delete
6386 ```
6387 Value (string):
6388 ```
6389 <enabled/>
6390 <data id="SecurityDevices" value="1&#xF000;NAME_OF_DEVICE_TO_REMOVE"/>
6391 ```
6392 #### macOS
6393 ```
6394 <dict>
6395   <key>SecurityDevices</key>
6396   <dict>
6397     <key>Add<key>
6398     <dict>
6399       <key>NAME_OF_DEVICE_TO_ADD</key>
6400       <string>PATH_TO_LIBRARY_FOR_DEVICE</string>
6401     </dict>
6402     <key>Delete</add>
6403     <array>
6404       <string>NAME_OF_DEVICE_TO_DELETE</string>
6405     </array>
6406   </dict>
6407 </dict>
6408 ```
6409 #### policies.json
6410 ```
6411 {
6412   "policies": {
6413     "SecurityDevices": {
6414       "Add": {
6415         "NAME_OF_DEVICE_TO_ADD": "PATH_TO_LIBRARY_FOR_DEVICE"
6416       },
6417       "Delete": ["NAME_OF_DEVICE_TO_DELETE"]
6418     }
6419   }
6420 }
6421 ```
6422 ### SecurityDevices (Deprecated)
6423
6424 Install PKCS #11 modules.
6425
6426 **Compatibility:** Firefox 64, Firefox ESR 60.4\
6427 **CCK2 Equivalent:** `certs.devices`\
6428 **Preferences Affected:** N/A
6429
6430 #### Windows (GPO)
6431 ```
6432 Software\Policies\Mozilla\Firefox\SecurityDevices\NAME_OF_DEVICE = PATH_TO_LIBRARY_FOR_DEVICE
6433 ```
6434 #### Windows (Intune)
6435 OMA-URI:
6436 ```
6437 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox/SecurityDevices
6438 ```
6439 Value (string):
6440 ```
6441 <enabled/>
6442 <data id="SecurityDevices" value="NAME_OF_DEVICE&#xF000;PATH_TO_LIBRARY_FOR_DEVICE"/>
6443 ```
6444 #### macOS
6445 ```
6446 <dict>
6447   <key>SecurityDevices</key>
6448   <dict>
6449     <key>NAME_OF_DEVICE</key>
6450     <string>PATH_TO_LIBRARY_FOR_DEVICE</string>
6451   </dict>
6452 </dict>
6453 ```
6454 #### policies.json
6455 ```
6456 {
6457   "policies": {
6458     "SecurityDevices": {
6459       "NAME_OF_DEVICE": "PATH_TO_LIBRARY_FOR_DEVICE"
6460     }
6461   }
6462 }
6463 ```
6464 ### ShowHomeButton
6465 Show the home button on the toolbar.
6466
6467 Future versions of Firefox will not show the home button by default.
6468
6469 **Compatibility:** Firefox 88, Firefox ESR 78.10\
6470 **CCK2 Equivalent:** N/A\
6471 **Preferences Affected:** N/A
6472
6473 #### Windows (GPO)
6474 ```
6475 Software\Policies\Mozilla\Firefox\ShowHomeButton = 0x1 | 0x0
6476 ```
6477 #### Windows (Intune)
6478 OMA-URI:
6479 ```
6480 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~Homepage/Homepage_ShowHomeButton
6481 ```
6482 Value (string):
6483 ```
6484 <enabled/> or <disabled/>
6485 ```
6486 #### macOS
6487 ```
6488 <dict>
6489   <key>ShowHomeButton</key>
6490   <true/> | <false/>
6491 </dict>
6492 ```
6493 #### policies.json
6494 ```
6495 {
6496   "policies": {
6497     "ShowHomeButton": true | false
6498   }
6499 }
6500 ```
6501 ### SSLVersionMax
6502
6503 Set and lock the maximum version of TLS. (Firefox defaults to a maximum of TLS 1.3.)
6504
6505 **Compatibility:** Firefox 66, Firefox ESR 60.6\
6506 **CCK2 Equivalent:** N/A\
6507 **Preferences Affected:** `security.tls.version.max`
6508
6509 #### Windows (GPO)
6510 ```
6511 Software\Policies\Mozilla\Firefox\SSLVersionMax = "tls1" | "tls1.1" | "tls1.2" | "tls1.3"
6512 ```
6513 #### Windows (Intune)
6514 OMA-URI:
6515 ```
6516 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox/SSLVersionMax
6517 ```
6518 Value (string):
6519 ```
6520 <enabled/>
6521 <data id="SSLVersion" value="tls1 | tls1.2 | tls1.3"/>
6522 ```
6523 #### macOS
6524 ```
6525 <dict>
6526   <key>SSLVersionMax</key>
6527   <string>tls1 | tls1.1 | tls1.2 | tls1.3</string>
6528 </dict>
6529 ```
6530
6531 #### policies.json
6532 ```
6533 {
6534   "policies": {
6535     "SSLVersionMax": "tls1" | "tls1.1" | "tls1.2" | "tls1.3"
6536   }
6537 }
6538 ```
6539 ### SSLVersionMin
6540
6541 Set and lock the minimum version of TLS. (Firefox defaults to a minimum of TLS 1.2.)
6542
6543 **Compatibility:** Firefox 66, Firefox ESR 60.6\
6544 **CCK2 Equivalent:** N/A\
6545 **Preferences Affected:** `security.tls.version.min`
6546
6547 #### Windows (GPO)
6548 ```
6549 Software\Policies\Mozilla\Firefox\SSLVersionMin = "tls1" | "tls1.1" | "tls1.2" | "tls1.3"
6550 ```
6551 #### Windows (Intune)
6552 OMA-URI:
6553 ```
6554 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox/SSLVersionMin
6555 ```
6556 Value (string):
6557 ```
6558 <enabled/>
6559 <data id="SSLVersion" value="tls1 | tls1.2 | tls1.3"/>
6560 ```
6561 #### macOS
6562 ```
6563 <dict>
6564   <key>SSLVersionMin</key>
6565   <string>tls1 | tls1.1 | tls1.2 | tls1.3</string>
6566 </dict>
6567 ```
6568
6569 #### policies.json
6570 ```
6571 {
6572   "policies": {
6573     "SSLVersionMin": "tls1" | "tls1.1" | "tls1.2" | "tls1.3"
6574   }
6575 }
6576 ```
6577 ### StartDownloadsInTempDirectory
6578 Force downloads to start off in a local, temporary location rather than the default download directory.
6579
6580 **Compatibility:** Firefox 102\
6581 **CCK2 Equivalent:** N/A\
6582 **Preferences Affected:** `browser.download.start_downloads_in_tmp_dir`
6583
6584 #### Windows (GPO)
6585 ```
6586 Software\Policies\Mozilla\Firefox\StartDownloadsInTempDirectory = 0x1 | 0x0
6587 ```
6588 #### Windows (Intune)
6589 OMA-URI:
6590 ```
6591 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox/StartDownloadsInTempDirectory
6592 ```
6593 Value (string):
6594 ```
6595 <enabled/> or <disabled/>
6596 ```
6597 #### macOS
6598 ```
6599 <dict>
6600   <key>StartDownloadsInTempDirectory</key>
6601   <true/> | <false/>
6602 </dict>
6603 ```
6604 #### policies.json
6605 ```
6606 {
6607   "policies": {
6608     "StartDownloadsInTempDirectory": true | false
6609 }
6610 ```
6611 ### SupportMenu
6612 Add a menuitem to the help menu for specifying support information.
6613
6614 **Compatibility:** Firefox 68.0.1, Firefox ESR 68.0.1\
6615 **CCK2 Equivalent:** helpMenu\
6616 **Preferences Affected:** N/A
6617
6618 #### Windows (GPO)
6619 ```
6620 Software\Policies\Mozilla\Firefox\SupportMenu\Title = "Support Menu"
6621 Software\Policies\Mozilla\Firefox\SupportMenu\URL = "http://example.com/support"
6622 Software\Policies\Mozilla\Firefox\SupportMenu\AccessKey = "S"
6623 ```
6624 #### Windows (Intune)
6625 OMA-URI:
6626 ```
6627 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox/SupportMenu
6628 ```
6629 Value (string):
6630 ```
6631 <enabled/>
6632 <data id="SupportMenuTitle" value="Support Menu"/>
6633 <data id="SupportMenuURL" value="http://example.com/support"/>
6634 <data id="SupportMenuAccessKey" value="S"/>
6635 ```
6636 #### macOS
6637 ```
6638 <dict>
6639   <key>SupportMenu</key>
6640   <dict>
6641     <key>Title</key>
6642     <string>SupportMenu</string>
6643     <key>URL</key>
6644     <string>http://example.com/support</string>
6645     <key>AccessKey</key>
6646     <string>S</string>
6647   </dict>
6648 </dict>
6649 ```
6650 #### policies.json
6651 ```
6652 {
6653   "policies": {
6654     "SupportMenu": {
6655       "Title": "Support Menu",
6656       "URL": "http://example.com/support",
6657       "AccessKey": "S"
6658     }
6659   }
6660 }
6661 ```
6662 ### TranslateEnabled
6663 Enable or disable webpage translation.
6664
6665 Note: Web page translation is done completely on the client, so there is no data or privacy risk.
6666
6667 If you only want to disable the popup, you can set the pref `browser.translations.automaticallyPopup` to false using the [Preferences](#preferences) policy.
6668
6669 **Compatibility:** Firefox 126\
6670 **CCK2 Equivalent:** N/A\
6671 **Preferences Affected:** `browser.translations.enable`
6672
6673 #### Windows (GPO)
6674 ```
6675 Software\Policies\Mozilla\Firefox\TranslateEnabled = 0x1 | 0x0
6676 ```
6677 #### Windows (Intune)
6678 OMA-URI:
6679 ```
6680 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox/TranslateEnabled
6681 ```
6682 Value (string):
6683 ```
6684 <enabled/> or <disabled/>
6685 ```
6686 #### macOS
6687 ```
6688 <dict>
6689   <key>TranslateEnabled</key>
6690   <true/> | <false/>
6691 </dict>
6692 ```
6693 #### policies.json
6694 ```
6695 {
6696   "policies": {
6697     "TranslateEnabled": true | false
6698   }
6699 }
6700 ```
6701 ### UserMessaging
6702
6703 Prevent Firefox from messaging the user in certain situations.
6704
6705 `WhatsNew` Remove the "What's New" icon and menuitem. (*Deprecated*)
6706
6707 `ExtensionRecommendations` If false, don't recommend extensions while the user is visiting web pages.
6708
6709 `FeatureRecommendations` If false, don't recommend browser features.
6710
6711 `UrlbarInterventions` If false, Don't offer Firefox specific suggestions in the URL bar.
6712
6713 `SkipOnboarding` If true, don't show onboarding messages on the new tab page.
6714
6715 `MoreFromMozilla` If false, don't show the "More from Mozilla" section in Preferences. (Firefox 98)
6716
6717 `FirefoxLabs` If false, don't show the "Firefox Labs" section in Preferences. (Firefox 130.0.1)
6718
6719 `Locked` prevents the user from changing user messaging preferences.
6720
6721 **Compatibility:** Firefox 75, Firefox ESR 68.7\
6722 **CCK2 Equivalent:** N/A\
6723 **Preferences Affected:** `browser.newtabpage.activity-stream.asrouter.userprefs.cfr.addons`, `browser.newtabpage.activity-stream.asrouter.userprefs.cfr.features`, `browser.aboutwelcome.enabled`, `browser.preferences.moreFromMozilla`, `browser.preferences.experimental`
6724
6725 #### Windows (GPO)
6726 ```
6727 Software\Policies\Mozilla\Firefox\UserMessaging\ExtensionRecommendations = 0x1 | 0x0
6728 Software\Policies\Mozilla\Firefox\UserMessaging\FeatureRecommendations = 0x1 | 0x0
6729 Software\Policies\Mozilla\Firefox\UserMessaging\UrlbarInterventions = 0x1 | 0x0
6730 Software\Policies\Mozilla\Firefox\UserMessaging\SkipOnboarding = 0x1 | 0x0
6731 Software\Policies\Mozilla\Firefox\UserMessaging\MoreFromMozilla = 0x1 | 0x0
6732 Software\Policies\Mozilla\Firefox\UserMessaging\FirefoxLabs = 0x1 | 0x0
6733 Software\Policies\Mozilla\Firefox\UserMessaging\Locked = 0x1 | 0x0
6734 ```
6735 #### Windows (Intune)
6736 OMA-URI:
6737 ```
6738 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~UserMessaging/UserMessaging_ExtensionRecommendations
6739 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~UserMessaging/UserMessaging_FeatureRecommendations
6740 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~UserMessaging/UserMessaging_UrlbarInterventions
6741 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~UserMessaging/UserMessaging_SkipOnboarding
6742 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~UserMessaging/UserMessaging_MoreFromMozilla
6743 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~UserMessaging/UserMessaging_FirefoxLabs
6744 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~UserMessaging/UserMessaging_Locked
6745 ```
6746 Value (string):
6747 ```
6748 <enabled/> or <disabled/>
6749 ```
6750 #### macOS
6751 ```
6752 <dict>
6753   <key>UserMessaging</key>
6754   <dict>
6755     <key>ExtensionRecommendations</key>
6756     <true/> | <false/>
6757     <key>FeatureRecommendations</key>
6758     <true/> | <false/>
6759     <key>UrlbarInterventions</key>
6760     <true/> | <false/>
6761     <key>SkipOnboarding</key>
6762     <true/> | <false/>
6763     <key>MoreFromMozilla</key>
6764     <true/> | <false/>
6765     <key>FirefoxLabs</key>
6766     <true/> | <false/>
6767     <key>Locked</key>
6768     <true/> | <false/>
6769   </dict>
6770 </dict>
6771 ```
6772 #### policies.json
6773 ```
6774 {
6775   "policies": {
6776     "UserMessaging": {
6777       "ExtensionRecommendations": true | false,
6778       "FeatureRecommendations": true | false,
6779       "UrlbarInterventions": true | false,
6780       "SkipOnboarding": true | false,
6781       "MoreFromMozilla": true | false,
6782       "FirefoxLabs": true | false,
6783       "Locked": true | false
6784     }
6785   }
6786 }
6787 ```
6788 ### UseSystemPrintDialog
6789 Use the system print dialog instead of the print preview window.
6790
6791 **Compatibility:** Firefox 102\
6792 **CCK2 Equivalent:** N/A\
6793 **Preferences Affected:** `print.prefer_system_dialog`
6794
6795 #### Windows (GPO)
6796 ```
6797 Software\Policies\Mozilla\Firefox\UseSystemPrintDialog = 0x1 | 0x0
6798 ```
6799 #### Windows (Intune)
6800 OMA-URI:
6801 ```
6802 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox/UseSystemPrintDialog
6803 ```
6804 Value (string):
6805 ```
6806 <enabled/> or <disabled/>
6807 ```
6808 #### macOS
6809 ```
6810 <dict>
6811   <key>UseSystemPrintDialog</key>
6812   <true/> | <false/>
6813 </dict>
6814 ```
6815 #### policies.json
6816 ```
6817 {
6818   "policies": {
6819     "UseSystemPrintDialog": true | false
6820   }
6821 }
6822 ```
6823 ### WebsiteFilter
6824 Block websites from being visited. The parameters take an array of Match Patterns, as documented in https://developer.mozilla.org/en-US/Add-ons/WebExtensions/Match_patterns.
6825 The arrays are limited to 1000 entries each.
6826
6827 If you want to block all URLs, you can use `<all_urls>` or `*://*/*`. You can't have just a `*` on the right side.
6828
6829 For specific protocols, use `https://*/*` or `http://*/*`.
6830
6831 As of Firefox 83 and Firefox ESR 78.5, file URLs are supported.
6832
6833 **Compatibility:** Firefox 60, Firefox ESR 60\
6834 **CCK2 Equivalent:** N/A\
6835 **Preferences Affected:** N/A
6836
6837 #### Windows (GPO)
6838 ```
6839 Software\Policies\Mozilla\Firefox\WebsiteFilter\Block\1 = "<all_urls>"
6840 Software\Policies\Mozilla\Firefox\WebsiteFilter\Exceptions\1 = "http://example.org/*"
6841 ```
6842 #### Windows (Intune)
6843 OMA-URI:
6844 ```
6845 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox/B_WebsiteFilter_Block
6846 ```
6847 Value (string):
6848 ```
6849 <enabled/> <data id="WebsiteFilter" value="1&#xF000;&#60;all_urls&#62;"/>
6850 ```
6851 OMA-URI:
6852 ```
6853 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox/B_WebsiteFilter_Exceptions
6854 ```
6855 Value (string):
6856 ```
6857 <enabled/>
6858 <data id="WebsiteFilter" value="1&#xF000;http://example.org/*"/>
6859 ```
6860 If you are using custom ADMX and ADML administrative templates in Intune, you can use this OMA-URI instead
6861 to workaround the limit on the length of strings. Put all of your JSON on one line.
6862
6863 OMA-URI:
6864 ```
6865 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~Extensions/WebsiteFilterOneLine
6866 ```
6867 Value (string):
6868 ```
6869 <enabled/>
6870 <data id="JSONOneLine" value='{"Block": ["<all_urls>"],"Exceptions": ["http://example.org/*"]}'/>
6871 ```
6872 #### macOS
6873 ```
6874 <dict>
6875   <key>WebsiteFilter</key>
6876   <dict>
6877     <key>Block</key>
6878     <array>
6879       <string><all_urls></string>
6880     </array>
6881     <key>Exceptions</key>
6882     <array>
6883       <string>http://example.org/*</string>
6884     </array>
6885   </dict>
6886
6887 </dict>
6888 ```
6889 #### policies.json
6890 ```
6891 {
6892   "policies": {
6893     "WebsiteFilter": {
6894       "Block": ["<all_urls>"],
6895       "Exceptions": ["http://example.org/*"]
6896     }
6897   }
6898 }
6899 ```
6900 ### WindowsSSO
6901 Allow Windows single sign-on for Microsoft, work, and school accounts.
6902
6903 If this policy is set to true, Firefox will use credentials stored in Windows to sign in to Microsoft, work, and school accounts.
6904
6905 **Compatibility:** Firefox 91\
6906 **CCK2 Equivalent:** N/A\
6907 **Preferences Affected:** `network.http.windows-sso.enabled`
6908
6909 #### Windows (GPO)
6910 ```
6911 Software\Policies\Mozilla\Firefox\WindowsSSO = 0x1 | 0x0
6912 ```
6913 #### Windows (Intune)
6914 OMA-URI:
6915 ```
6916 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox/WindowsSSO
6917 ```
6918 Value (string):
6919 ```
6920 <enabled/> or <disabled/>
6921 ```
6922 #### policies.json
6923 ```
6924 {
6925   "policies": {
6926     "WindowsSSO": true | false
6927   }
6928 }
6929 ```