README.md

   1 **These policies are in active development and so might contain changes that do not work with current versions of Firefox.**
   2
   3 **You should use the [officially released versions](https://github.com/mozilla/policy-templates/releases) if you are deploying changes.**
   4
   5 Official policy documentation has been moved to https://mozilla.github.io/policy-templates/.
   6
   7 I'm maintaining things in the README.md until we can update links in Firefox.
   8
   9 Firefox policies can be specified using the [Group Policy templates on Windows](https://github.com/mozilla/policy-templates/tree/master/windows), [Intune on Windows](https://support.mozilla.org/kb/managing-firefox-intune), [configuration profiles on macOS](https://github.com/mozilla/policy-templates/tree/master/mac), or by creating a file called `policies.json`. On Windows, create a directory called `distribution` where the EXE is located and place the file there. On Mac, the file goes into `Firefox.app/Contents/Resources/distribution`.  On Linux, the file goes into `firefox/distribution`, where `firefox` is the installation directory for firefox, which varies by distribution or you can specify system-wide policy by placing the file in `/etc/firefox/policies`.
  10
  11 Unfortunately, JSON files do not support comments, but you can add extra entries to the JSON to use as comments. You will see an error in about:policies, but the policies will still work properly. For example:
  12
  13 ```
  14 {
  15   "policies": {
  16     "Authentication": {
  17       "SPNEGO": ["mydomain.com", "https://myotherdomain.com"]
  18     }
  19     "Authentication_Comment": "These domains are required for us"
  20   }
  21 }
  22 ```
  23
  24 | Policy Name | Description
  25 | --- | --- |
  26 | **[`3rdparty`](#3rdparty)** | Set policies that WebExtensions can access via chrome.storage.managed.
  27 | **[`AllowedDomainsForApps`](#alloweddomainsforapps)** | Define domains allowed to access Google Workspace.
  28 | **[`AppAutoUpdate`](#appautoupdate)** | Enable or disable automatic application update.
  29 | **[`AppUpdatePin`](#appupdatepin)** | Prevent Firefox from being updated beyond the specified version.
  30 | **[`AppUpdateURL`](#appupdateurl)** | Change the URL for application update.
  31 | **[`Authentication`](#authentication)** | Configure sites that support integrated authentication.
  32 | **[`AutoLaunchProtocolsFromOrigins`](#autolaunchprotocolsfromorigins)** | Define a list of external protocols that can be used from listed origins without prompting the user.
  33 | **[`BackgroundAppUpdate`](#backgroundappupdate)** | Enable or disable the background updater (Windows only).
  34 | **[`BlockAboutAddons`](#blockaboutaddons)** | Block access to the Add-ons Manager (about:addons).
  35 | **[`BlockAboutConfig`](#blockaboutconfig)** | Block access to about:config.
  36 | **[`BlockAboutProfiles`](#blockaboutprofiles)** | Block access to About Profiles (about:profiles).
  37 | **[`BlockAboutSupport`](#blockaboutsupport)** | Block access to Troubleshooting Information (about:support).
  38 | **[`Bookmarks`](#bookmarks)** | Add bookmarks in either the bookmarks toolbar or menu.
  39 | **[`CaptivePortal`](#captiveportal)** | Enable or disable the detection of captive portals.
  40 | **[`Certificates`](#certificates)** |
  41 | **[`Certificates -> ImportEnterpriseRoots`](#certificates--importenterpriseroots)** | Trust certificates that have been added to the operating system certificate store by a user or administrator.
  42 | **[`Certificates -> Install`](#certificates--install)** | Install certificates into the Firefox certificate store.
  43 | **[`Containers`](#containers)** | Set policies related to [containers](https://addons.mozilla.org/firefox/addon/multi-account-containers/).
  44 | **[`Cookies`](#cookies)** | Configure cookie preferences.
  45 | **[`DefaultDownloadDirectory`](#defaultdownloaddirectory)** | Set the default download directory.
  46 | **[`DisableAppUpdate`](#disableappupdate)** | Turn off application updates.
  47 | **[`DisableBuiltinPDFViewer`](#disablebuiltinpdfviewer)** | Disable the built in PDF viewer.
  48 | **[`DisabledCiphers`](#disabledciphers)** | Disable ciphers.
  49 | **[`DisableDefaultBrowserAgent`](#disabledefaultbrowseragent)** | Prevent the default browser agent from taking any actions (Windows only).
  50 | **[`DisableDeveloperTools`](#disabledevelopertools)** | Remove access to all developer tools.
  51 | **[`DisableFeedbackCommands`](#disablefeedbackcommands)** | Disable the menus for reporting sites.
  52 | **[`DisableFirefoxAccounts`](#disablefirefoxaccounts)** | Disable Firefox Accounts integration (Sync).
  53 | **[`DisableFirefoxScreenshots`](#disablefirefoxscreenshots)** | Remove access to Firefox Screenshots.
  54 | **[`DisableFirefoxStudies`](#disablefirefoxstudies)** | Disable Firefox studies (Shield).
  55 | **[`DisableForgetButton`](#disableforgetbutton)** | Disable the "Forget" button.
  56 | **[`DisableFormHistory`](#disableformhistory)** | Turn off saving information on web forms and the search bar.
  57 | **[`DisableMasterPasswordCreation`](#disablemasterpasswordcreation)** | Remove the master password functionality.
  58 | **[`DisablePasswordReveal`](#disablepasswordreveal)** | Do not allow passwords to be revealed in saved logins.
  59 | **[`DisablePocket`](#disablepocket)** | Remove Pocket in the Firefox UI.
  60 | **[`DisablePrivateBrowsing`](#disableprivatebrowsing)** | Remove access to private browsing.
  61 | **[`DisableProfileImport`](#disableprofileimport)** | Disables the "Import data from another browser" option in the bookmarks window.
  62 | **[`DisableProfileRefresh`](#disableprofilerefresh)** | Disable the Refresh Firefox button on about:support and support.mozilla.org
  63 | **[`DisableSafeMode`](#disablesafemode)** | Disable safe mode within the browser.
  64 | **[`DisableSecurityBypass`](#disablesecuritybypass)** | Prevent the user from bypassing security in certain cases.
  65 | **[`DisableSetDesktopBackground`](#disablesetdesktopbackground)** | Remove the "Set As Desktop Background..." menuitem when right clicking on an image.
  66 | **[`DisableSystemAddonUpdate`](#disablesystemaddonupdate)** | Prevent system add-ons from being installed or updated.
  67 | **[`DisableTelemetry`](#disabletelemetry)** | DisableTelemetry
  68 | **[`DisableThirdPartyModuleBlocking`](#disablethirdpartymoduleblocking)** | Do not allow blocking third-party modules.
  69 | **[`DisplayBookmarksToolbar`](#displaybookmarkstoolbar)** | Set the initial state of the bookmarks toolbar.
  70 | **[`DisplayMenuBar`](#displaymenubar)** | Set the state of the menubar.
  71 | **[`DNSOverHTTPS`](#dnsoverhttps)** | Configure DNS over HTTPS.
  72 | **[`DontCheckDefaultBrowser`](#dontcheckdefaultbrowser)** | Don't check if Firefox is the default browser at startup.
  73 | **[`DownloadDirectory`](#downloaddirectory)** | Set and lock the download directory.
  74 | **[`EnableTrackingProtection`](#enabletrackingprotection)** | Configure tracking protection.
  75 | **[`EncryptedMediaExtensions`](#encryptedmediaextensions)** | Enable or disable Encrypted Media Extensions and optionally lock it.
  76 | **[`EnterprisePoliciesEnabled`](#enterprisepoliciesenabled)** | Enable policy support on macOS.
  77 | **[`ExemptDomainFileTypePairsFromFileTypeDownloadWarnings`](#exemptdomainfiletypepairsfromfiletypedownloadwarnings)** | Disable warnings based on file extension for specific file types on domains.
  78 | **[`Extensions`](#extensions)** | Control the installation, uninstallation and locking of extensions.
  79 | **[`ExtensionSettings`](#extensionsettings)** | Manage all aspects of extensions.
  80 | **[`ExtensionUpdate`](#extensionupdate)** | Control extension updates.
  81 | **[`FirefoxHome`](#firefoxhome)** | Customize the Firefox Home page.
  82 | **[`GoToIntranetSiteForSingleWordEntryInAddressBar`](#gotointranetsiteforsinglewordentryinaddressbar)** | Force direct intranet site navigation instead of searching when typing single word entries in the address bar.
  83 | **[`Handlers`](#handlers)** | Configure default application handlers.
  84 | **[`HardwareAcceleration`](#hardwareacceleration)** | Control hardware acceleration.
  85 | **[`Homepage`](#homepage)** | Configure the default homepage and how Firefox starts.
  86 | **[`InstallAddonsPermission`](#installaddonspermission)** | Configure the default extension install policy as well as origins for extension installs are allowed.
  87 | **[`LegacyProfiles`](#legacyprofiles)** | Disable the feature enforcing a separate profile for each installation.
  88 | **[`LegacySameSiteCookieBehaviorEnabled`](#legacysamesitecookiebehaviorenabled)** | Enable default legacy SameSite cookie behavior setting.
  89 | **[`LegacySameSiteCookieBehaviorEnabledForDomainList`](#legacysamesitecookiebehaviorenabledfordomainlist)** | Revert to legacy SameSite behavior for cookies on specified sites.
  90 | **[`LocalFileLinks`](#localfilelinks)** | Enable linking to local files by origin.
  91 | **[`ManagedBookmarks`](#managedbookmarks)** | Configures a list of bookmarks managed by an administrator that cannot be changed by the user.
  92 | **[`ManualAppUpdateOnly`](#manualappupdateonly)** | Allow manual updates only and do not notify the user about updates.
  93 | **[`NetworkPrediction`](#networkprediction)** | Enable or disable network prediction (DNS prefetching).
  94 | **[`NewTabPage`](#newtabpage)** | Enable or disable the New Tab page.
  95 | **[`NoDefaultBookmarks`](#nodefaultbookmarks)** | Disable the creation of default bookmarks.
  96 | **[`OfferToSaveLogins`](#offertosavelogins)** | Control whether or not Firefox offers to save passwords.
  97 | **[`OfferToSaveLoginsDefault`](#offertosaveloginsdefault)** | Set the default value for whether or not Firefox offers to save passwords.
  98 | **[`OverrideFirstRunPage`](#overridefirstrunpage)** | Override the first run page.
  99 | **[`OverridePostUpdatePage`](#overridepostupdatepage)** | Override the upgrade page.
 100 | **[`PasswordManagerEnabled`](#passwordmanagerenabled)** | Remove (some) access to the password manager.
 101 | **[`PasswordManagerExceptions`](#passwordmanagerexceptions)** | Prevent Firefox from saving passwords for specific sites.
 102 | **[`PDFjs`](#pdfjs)** | Disable or configure PDF.js, the built-in PDF viewer.
 103 | **[`Permissions`](#permissions)** | Set permissions associated with camera, microphone, location, and notifications.
 104 | **[`PictureInPicture`](#pictureinpicture)** | Enable or disable Picture-in-Picture.
 105 | **[`PopupBlocking`](#popupblocking)** | Configure the default pop-up window policy as well as origins for which pop-up windows are allowed.
 106 | **[`Preferences`](#preferences)** | Set and lock preferences.
 107 | **[`PrimaryPassword`](#primarypassword)** | Require or prevent using a primary (formerly master) password.
 108 | **[`PromptForDownloadLocation`](#promptfordownloadlocation)** | Ask where to save each file before downloading.
 109 | **[`Proxy`](#proxy)** | Configure proxy settings.
 110 | **[`RequestedLocales`](#requestedlocales)** | Set the the list of requested locales for the application in order of preference.
 111 | **[`SanitizeOnShutdown` (All)](#sanitizeonshutdown-all)** | Clear all data on shutdown.
 112 | **[`SanitizeOnShutdown` (Selective)](#sanitizeonshutdown-selective)** | Clear data on shutdown.
 113 | **[`SearchBar`](#searchbar)** | Set whether or not search bar is displayed.
 114 | **[`SearchEngines`](#searchengines-this-policy-is-only-available-on-the-esr)** |
 115 | **[`SearchEngines -> Add`](#searchengines--add)** | Add new search engines.
 116 | **[`SearchEngines -> Default`](#searchengines--default)** | Set the default search engine.
 117 | **[`SearchEngines -> PreventInstalls`](#searchengines--preventinstalls)** | Prevent installing search engines from webpages.
 118 | **[`SearchEngines -> Remove`](#searchengines--remove)** | Hide built-in search engines.
 119 | **[`SearchSuggestEnabled`](#searchsuggestenabled)** | Enable search suggestions.
 120 | **[`SecurityDevices`](#securitydevices)** | Install PKCS #11 modules.
 121 | **[`ShowHomeButton`](#showhomebutton)** | Show the home button on the toolbar.
 122 | **[`SSLVersionMax`](#sslversionmax)** | Set and lock the maximum version of TLS.
 123 | **[`SSLVersionMin`](#sslversionmin)** | Set and lock the minimum version of TLS.
 124 | **[`StartDownloadsInTempDirectory`](#startdownloadsintempdirectory)** | Force downloads to start off in a local, temporary location rather than the default download directory.
 125 | **[`SupportMenu`](#supportmenu)** | Add a menuitem to the help menu for specifying support information.
 126 | **[`UserMessaging`](#usermessaging)** | Don't show certain messages to the user.
 127 | **[`UseSystemPrintDialog`](#usesystemprintdialog)** | Print using the system print dialog instead of print preview.
 128 | **[`WebsiteFilter`](#websitefilter)** | Block websites from being visited.
 129 | **[`WindowsSSO`](#windowssso)** | Allow Windows single sign-on for Microsoft, work, and school accounts.
 130
 131 ### 3rdparty
 132
 133 Allow WebExtensions to configure policy. For more information, see [Adding policy support to your extension](https://extensionworkshop.com/documentation/enterprise/adding-policy-support-to-your-extension/).
 134
 135 For GPO and Intune, the extension developer should provide an ADMX file.
 136
 137 **Compatibility:** Firefox 68\
 138 **CCK2 Equivalent:** N/A\
 139 **Preferences Affected:** N/A
 140
 141 #### macOS
 142 ```
 143 <dict>
 144   <key>3rdparty</key>
 145   <dict>
 146     <key>Extensions</key>
 147     <dict>
 148       <key>uBlock0@raymondhill.net</key>
 149       <dict>
 150         <key>adminSettings</key>
 151         <dict>
 152           <key>selectedFilterLists</key>
 153           <array>
 154             <string>ublock-privacy</string>
 155             <string>ublock-badware</string>
 156             <string>ublock-filters</string>
 157             <string>user-filters</string>
 158           </array>
 159         </dict>
 160       </dict>
 161     </dict>
 162   </dict>
 163 </dict>
 164 ```
 165 #### policies.json
 166 ```
 167 {
 168   "policies": {
 169     "3rdparty": {
 170       "Extensions": {
 171         "uBlock0@raymondhill.net": {
 172           "adminSettings": {
 173             "selectedFilterLists": [
 174               "ublock-privacy",
 175               "ublock-badware",
 176               "ublock-filters",
 177               "user-filters"
 178             ]
 179           }
 180         }
 181       }
 182     }
 183   }
 184 }
 185 ```
 186
 187 ### AllowedDomainsForApps
 188
 189 Define domains allowed to access Google Workspace.
 190
 191 This policy is based on the [Chrome policy](https://chromeenterprise.google/policies/#AllowedDomainsForApps) of the same name.
 192
 193 If this policy is enabled, users can only access Google Workspace using accounts from the specified domains. If you want to allow Gmail, you can add ```consumer_accounts``` to the list.
 194
 195 **Compatibility:** Firefox 89, Firefox ESR 78.11\
 196 **CCK2 Equivalent:** N/A\
 197 **Preferences Affected:** N/A
 198
 199 #### Windows (GPO)
 200 ```
 201 Software\Policies\Mozilla\Firefox\AllowedDomainsForApps = "managedfirefox.com,example.com"
 202 ```
 203 #### Windows (Intune)
 204 OMA-URI:
 205 ```
 206 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox/AllowedDomainsForApps
 207 ```
 208 Value (string):
 209 ```
 210 <enabled/>
 211 <data id="AllowedDomainsForApps" value="managedfirefox.com,example.com"/>
 212 ```
 213 #### macOS
 214 ```
 215 <dict>
 216   <key>AllowedDomainsForApps</key>
 217   <string>managedfirefox.com,example.com</string>
 218 </dict>
 219 ```
 220 #### policies.json
 221 ```
 222 {
 223   "policies": {
 224     "AllowedDomainsForApps": "managedfirefox.com,example.com"
 225   }
 226 }
 227 ```
 228 ### AppAutoUpdate
 229
 230 Enable or disable **automatic** application update.
 231
 232 If set to true, application updates are installed without user approval within Firefox. The operating system might still require approval.
 233
 234 If set to false, application updates are downloaded but the user can choose when to install the update.
 235
 236 If you have disabled updates via `DisableAppUpdate`, this policy has no effect.
 237
 238 **Compatibility:** Firefox 75, Firefox ESR 68.7\
 239 **CCK2 Equivalent:** N/A\
 240 **Preferences Affected:** `app.update.auto`
 241
 242 #### Windows (GPO)
 243 ```
 244 Software\Policies\Mozilla\Firefox\AppAutoUpdate = 0x1 | 0x0
 245 ```
 246 #### Windows (Intune)
 247 OMA-URI:
 248 ```
 249 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox/AppAutoUpdate
 250 ```
 251 Value (string):
 252 ```
 253 <enabled/> or <disabled/>
 254 ```
 255 #### macOS
 256 ```
 257 <dict>
 258   <key>AppAutoUpdate</key>
 259   <true/> | <false/>
 260 </dict>
 261 ```
 262 #### policies.json
 263 ```
 264 {
 265   "policies": {
 266     "AppAutoUpdate": true | false
 267   }
 268 }
 269 ```
 270 ### AppUpdatePin
 271
 272 Prevent Firefox from being updated beyond the specified version.
 273
 274 You can specify the any version as ```xx.``` and Firefox will be updated with all minor versions, but will not be updated beyond the major version.
 275
 276 You can also specify the version as ```xx.xx``` and Firefox will be updated with all patch versions, but will not be updated beyond the minor version.
 277
 278 You should specify a version that exists or is guaranteed to exist. If you specify a version that doesn't end up existing, Firefox will update beyond that version.
 279
 280 **Compatibility:** Firefox 102,\
 281 **CCK2 Equivalent:** N/A\
 282 **Preferences Affected:** N/A
 283
 284 #### Windows (GPO)
 285 ```
 286 Software\Policies\Mozilla\Firefox\AppUpdatePin = "106."
 287 ```
 288 #### Windows (Intune)
 289 OMA-URI:
 290 ```
 291 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox/AppUpdatePin
 292 ```
 293 Value (string):
 294 ```
 295 <enabled/>
 296 <data id="AppUpdatePin" value="106."/>
 297 ```
 298 #### macOS
 299 ```
 300 <dict>
 301   <key>AppUpdatePin</key>
 302   <string>106.</string>
 303 </dict>
 304 ```
 305 #### policies.json
 306 ```
 307 {
 308   "policies": {
 309     "AppUpdatePin": "106."
 310   }
 311 }
 312 ```
 313 ### AppUpdateURL
 314
 315 Change the URL for application update if you are providing Firefox updates from a custom update server.
 316
 317 **Compatibility:** Firefox 62, Firefox ESR 60.2\
 318 **CCK2 Equivalent:** N/A\
 319 **Preferences Affected:** `app.update.url`
 320
 321 #### Windows (GPO)
 322 ```
 323 Software\Policies\Mozilla\Firefox\AppUpdateURL = "https://yoursite.com"
 324 ```
 325 #### Windows (Intune)
 326 OMA-URI:
 327 ```
 328 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox/AppUpdateURL
 329 ```
 330 Value (string):
 331 ```
 332 <enabled/>
 333 <data id="AppUpdateURL" value="https://yoursite.com"/>
 334 ```
 335 #### macOS
 336 ```
 337 <dict>
 338   <key>AppUpdateURL</key>
 339   <string>https://yoursite.com</string>
 340 </dict>
 341 ```
 342 #### policies.json
 343 ```
 344 {
 345   "policies": {
 346     "AppUpdateURL": "https://yoursite.com"
 347   }
 348 }
 349 ```
 350 ### Authentication
 351
 352 Configure sites that support integrated authentication.
 353
 354 See [Integrated authentication](https://htmlpreview.github.io/?https://github.com/mdn/archived-content/blob/main/files/en-us/mozilla/integrated_authentication/raw.html) for more information.
 355
 356 `PrivateBrowsing` enables integrated authentication in private browsing.
 357
 358 **Compatibility:** Firefox 60, Firefox ESR 60 (AllowNonFQDN added in 62/60.2, AllowProxies added in 70/68.2, Locked added in 71/68.3, PrivateBrowsing added in 77/68.9)\
 359 **CCK2 Equivalent:** N/A\
 360 **Preferences Affected:** `network.negotiate-auth.trusted-uris`,`network.negotiate-auth.delegation-uris`,`network.automatic-ntlm-auth.trusted-uris`,`network.automatic-ntlm-auth.allow-non-fqdn`,`network.negotiate-auth.allow-non-fqdn`,`network.automatic-ntlm-auth.allow-proxies`,`network.negotiate-auth.allow-proxies`,`network.auth.private-browsing-sso`
 361
 362 #### Windows (GPO)
 363 ```
 364 Software\Policies\Mozilla\Firefox\Authentication\SPNEGO\1 = "mydomain.com"
 365 Software\Policies\Mozilla\Firefox\Authentication\SPNEGO\2 = "https://myotherdomain.com"
 366 Software\Policies\Mozilla\Firefox\Authentication\Delegated\1 = "mydomain.com"
 367 Software\Policies\Mozilla\Firefox\Authentication\Delegated\2 = "https://myotherdomain.com"
 368 Software\Policies\Mozilla\Firefox\Authentication\NTLM\1 = "mydomain.com"
 369 Software\Policies\Mozilla\Firefox\Authentication\NTLM\2 = "https://myotherdomain.com"
 370 Software\Policies\Mozilla\Firefox\Authentication\AllowNonFQDN\SPNEGO = 0x1 | 0x0
 371 Software\Policies\Mozilla\Firefox\Authentication\AllowNonFQDN\NTLM = 0x1 | 0x0
 372 Software\Policies\Mozilla\Firefox\Authentication\AllowProxies\SPNEGO = 0x1 | 0x0
 373 Software\Policies\Mozilla\Firefox\Authentication\AllowProxies\NTLM = 0x1 | 0x0
 374 Software\Policies\Mozilla\Firefox\Authentication\Locked = 0x1 | 0x0
 375 Software\Policies\Mozilla\Firefox\Authentication\PrivateBrowsing = 0x1 | 0x0
 376 ```
 377 #### Windows (Intune)
 378 OMA-URI:
 379 ```
 380 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~Authentication/Authentication_SPNEGO
 381 ```
 382 Value (string):
 383 ```
 384 <enabled/>
 385 <data id="Authentication" value="1&#xF000;mydomain&#xF000;2&#xF000;https://myotherdomain.com"/>
 386 ```
 387 OMA-URI:
 388 ```
 389 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~Authentication/Authentication_Delegated
 390 ```
 391 Value (string):
 392 ```
 393 <enabled/>
 394 <data id="Authentication" value="1&#xF000;mydomain&#xF000;2&#xF000;https://myotherdomain.com"/>
 395 ```
 396 OMA-URI:
 397 ```
 398 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~Authentication/Authentication_NTLM
 399 ```
 400 Value (string):
 401 ```
 402 <enabled/>
 403 <data id="Authentication" value="1&#xF000;mydomain&#xF000;2&#xF000;https://myotherdomain.com"/>
 404 ```
 405 OMA-URI:
 406 ```
 407 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~Authentication/Authentication_AllowNonFQDN
 408 ```
 409 Value (string):
 410 ```
 411 <enabled/>
 412 <data id="Authentication_AllowNonFQDN_NTLM" value="true | false"/>
 413 <data id="Authentication_AllowNonFQDN_SPNEGO" value="true | false"/>
 414 ```
 415 OMA-URI:
 416 ```
 417 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~Authentication/Authentication_Locked
 418 ```
 419 Value (string):
 420 ```
 421 <enabled/> or <disabled/>
 422 ```
 423 OMA-URI:
 424 ```
 425 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~Authentication/Authentication_PrivateBrowsing
 426 ```
 427 Value (string):
 428 ```
 429 <enabled/> or <disabled/>
 430 ```
 431 #### macOS
 432 ```
 433 <dict>
 434   <key>Authentication</key>
 435   <dict>
 436     <key>SPNEGO</key>
 437     <array>
 438       <string>mydomain.com</string>
 439       <string>https://myotherdomain.com</string>
 440     </array>
 441     <key>Delegated</key>
 442     <array>
 443       <string>mydomain.com</string>
 444       <string>https://myotherdomain.com</string>
 445     </array>
 446     <key>NTLM</key>
 447     <array>
 448       <string>mydomain.com</string>
 449       <string>https://myotherdomain.com</string>
 450     </array>
 451     <key>AllowNonFQDN</key>
 452       <dict>
 453       <key>SPNEGO</key>
 454       <true/> | <false/>
 455       <key>NTLM</key>
 456       <true/> | <false/>
 457     </dict>
 458     <key>AllowProxies</key>
 459       <dict>
 460       <key>SPNEGO</key>
 461       <true/> | <false/>
 462       <key>NTLM</key>
 463       <true/> | <false/>
 464     </dict>
 465     <key>Locked</key>
 466     <true/> | <false/>
 467     <key>PrivateBrowsing</key>
 468     <true/> | <false/>
 469   </dict>
 470 </dict>
 471 ```
 472 #### policies.json
 473 ```
 474 {
 475   "policies": {
 476     "Authentication": {
 477       "SPNEGO": ["mydomain.com", "https://myotherdomain.com"],
 478       "Delegated": ["mydomain.com", "https://myotherdomain.com"],
 479       "NTLM": ["mydomain.com", "https://myotherdomain.com"],
 480       "AllowNonFQDN": {
 481         "SPNEGO": true | false,
 482         "NTLM": true | false
 483       },
 484       "AllowProxies": {
 485         "SPNEGO": true | false,
 486         "NTLM": true | false
 487       },
 488       "Locked": true | false,
 489       "PrivateBrowsing": true | false
 490     }
 491   }
 492 }
 493 ```
 494 ### AutoLaunchProtocolsFromOrigins
 495 Define a list of external protocols that can be used from listed origins without prompting the user. The origin is the scheme plus the hostname.
 496
 497 The syntax of this policy is exactly the same as the [Chrome AutoLaunchProtocolsFromOrigins policy](https://cloud.google.com/docs/chrome-enterprise/policies/?policy=AutoLaunchProtocolsFromOrigins) except that you can only use valid origins (not just hostnames). This also means that you cannot specify an asterisk for all origins.
 498
 499 The schema is:
 500 ```
 501 {
 502  "items": {
 503   "properties": {
 504    "allowed_origins": {
 505     "items": {
 506      "type": "string"
 507     },
 508     "type": "array"
 509    },
 510    "protocol": {
 511     "type": "string"
 512    }
 513   },
 514   "required": [
 515    "protocol",
 516    "allowed_origins"
 517   ],
 518   "type": "object"
 519  },
 520  "type": "array"
 521 }
 522 ```
 523 **Compatibility:** Firefox 90, Firefox ESR 78.12\
 524 **CCK2 Equivalent:** N/A\
 525 **Preferences Affected:** N/A
 526
 527 #### Windows (GPO)
 528 Software\Policies\Mozilla\Firefox\AutoLaunchProtocolsFromOrigins (REG_MULTI_SZ) =
 529 ```
 530 [
 531   {
 532     "protocol": "zoommtg",
 533     "allowed_origins": [
 534       "https://somesite.zoom.us"
 535     ]
 536   }
 537 ]
 538 ```
 539 #### Windows (Intune)
 540 OMA-URI:
 541 ```
 542 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox/AutoLaunchProtocolsFromOrigins
 543 ```
 544 Value (string):
 545 ```
 546 <enabled/>
 547 <data id="JSON" value='
 548 [
 549   {
 550     "protocol": "zoommtg",
 551     "allowed_origins": [
 552       "https://somesite.zoom.us"
 553     ]
 554   }
 555 ]'/>
 556 ```
 557 #### macOS
 558 ```
 559 <dict>
 560   <key>AutoLaunchProtocolsFromOrigins</key>
 561   <array>
 562     <dict>
 563       <key>protocol</key>
 564       <string>zoommtg</string>
 565       <key>allowed_origins</key>
 566       <array>
 567         <string>https://somesite.zoom.us</string>
 568       </array>
 569     </dict>
 570   </array>
 571 </dict>
 572 ```
 573 #### policies.json
 574 ```
 575 {
 576   "policies": {
 577     "AutoLaunchProtocolsFromOrigins": [{
 578       "protocol": "zoommtg",
 579       "allowed_origins": [
 580         "https://somesite.zoom.us"
 581       ]
 582     }]
 583   }
 584 }
 585 ```
 586 ### BackgroundAppUpdate
 587
 588 Enable or disable **automatic** application update **in the background**, when the application is not running.
 589
 590 If set to true, application updates may be installed (without user approval) in the background, even when the application is not running. The operating system might still require approval.
 591
 592 If set to false, the application will not try to install updates when the application is not running.
 593
 594 If you have disabled updates via `DisableAppUpdate` or disabled automatic updates via `AppAutoUpdate`, this policy has no effect.
 595
 596 **Compatibility:** Firefox 90 (Windows only)\
 597 **CCK2 Equivalent:** N/A\
 598 **Preferences Affected:** `app.update.background.enabled`
 599
 600 #### Windows (GPO)
 601 ```
 602 Software\Policies\Mozilla\Firefox\BackgroundAppUpdate = 0x1 | 0x0
 603 ```
 604 #### Windows (Intune)
 605 OMA-URI:
 606 ```
 607 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox/BackgroundAppUpdate
 608 ```
 609 Value (string):
 610 ```
 611 <enabled/> or <disabled/>
 612 ```
 613 #### macOS
 614 ```
 615 <dict>
 616   <key>BackgroundAppUpdate</key>
 617   <true/> | <false/>
 618 </dict>
 619 ```
 620 #### policies.json
 621 ```
 622 {
 623   "policies": {
 624     "BackgroundAppUpdate": true | false
 625   }
 626 }
 627 ```
 628 ### BlockAboutAddons
 629
 630 Block access to the Add-ons Manager (about:addons).
 631
 632 **Compatibility:** Firefox 60, Firefox ESR 60\
 633 **CCK2 Equivalent:** `disableAddonsManager`\
 634 **Preferences Affected:** N/A
 635
 636 #### Windows (GPO)
 637 ```
 638 Software\Policies\Mozilla\Firefox\BlockAboutAddons = 0x1 | 0x0
 639 ```
 640 #### Windows (Intune)
 641 OMA-URI:
 642 ```
 643 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox/BlockAboutAddons
 644 ```
 645 Value (string):
 646 ```
 647 <enabled/> or <disabled/>
 648 ```
 649 #### macOS
 650 ```
 651 <dict>
 652   <key>BlockAboutAddons</key>
 653   <true/> | <false/>
 654 </dict>
 655 ```
 656 #### policies.json
 657 ```
 658 {
 659   "policies": {
 660     "BlockAboutAddons": true | false
 661   }
 662 }
 663 ```
 664 ### BlockAboutConfig
 665
 666 Block access to about:config.
 667
 668 **Compatibility:** Firefox 60, Firefox ESR 60\
 669 **CCK2 Equivalent:** `disableAboutConfig`\
 670 **Preferences Affected:** N/A
 671
 672 #### Windows (GPO)
 673 ```
 674 Software\Policies\Mozilla\Firefox\BlockAboutConfig = 0x1 | 0x0
 675 ```
 676 #### Windows (Intune)
 677 OMA-URI:
 678 ```
 679 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox/BlockAboutConfig
 680 ```
 681 Value (string):
 682 ```
 683 <enabled/> or <disabled/>
 684 ```
 685 #### macOS
 686 ```
 687 <dict>
 688   <key>BlockAboutConfig</key>
 689   <true/> | <false/>
 690 </dict>
 691 ```
 692 #### policies.json
 693 ```
 694 {
 695   "policies": {
 696     "BlockAboutConfig": true | false
 697   }
 698 }
 699 ```
 700 ### BlockAboutProfiles
 701
 702 Block access to About Profiles (about:profiles).
 703
 704 **Compatibility:** Firefox 60, Firefox ESR 60\
 705 **CCK2 Equivalent:** `disableAboutProfiles`\
 706 **Preferences Affected:** N/A
 707
 708 #### Windows (GPO)
 709 ```
 710 Software\Policies\Mozilla\Firefox\BlockAboutProfiles = 0x1 | 0x0
 711 ```
 712 #### Windows (Intune)
 713 OMA-URI:
 714 ```
 715 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox/BlockAboutProfiles
 716 ```
 717 Value (string):
 718 ```
 719 <enabled/> or <disabled/>
 720 ```
 721 #### macOS
 722 ```
 723 <dict>
 724   <key>BlockAboutProfiles</key>
 725   <true/> | <false/>
 726 </dict>
 727 ```
 728 #### policies.json
 729 ```
 730 {
 731   "policies": {
 732     "BlockAboutProfiles": true | false
 733   }
 734 }
 735 ```
 736 ### BlockAboutSupport
 737
 738 Block access to Troubleshooting Information (about:support).
 739
 740 **Compatibility:** Firefox 60, Firefox ESR 60\
 741 **CCK2 Equivalent:** `disableAboutSupport`\
 742 **Preferences Affected:** N/A
 743
 744 #### Windows (GPO)
 745 ```
 746 Software\Policies\Mozilla\Firefox\BlockAboutSupport = 0x1 | 0x0
 747 ```
 748 #### Windows (Intune)
 749 OMA-URI:
 750 ```
 751 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox/BlockAboutSupport
 752 ```
 753 Value (string):
 754 ```
 755 <enabled/> or <disabled/>
 756 ```
 757 #### macOS
 758 ```
 759 <dict>
 760   <key>BlockAboutSupport</key>
 761   <true/> | <false/>
 762 </dict>
 763 ```
 764 #### policies.json
 765 ```
 766 {
 767   "policies": {
 768     "BlockAboutSupport": true | false
 769   }
 770 }
 771 ```
 772 ### Bookmarks
 773
 774 Note: [`ManagedBookmarks`](#managedbookmarks) is the new recommended way to add bookmarks. This policy will continue to be supported.
 775
 776 Add bookmarks in either the bookmarks toolbar or menu. Only `Title` and `URL` are required. If `Placement` is not specified, the bookmark will be placed on the toolbar. If `Folder` is specified, it is automatically created and bookmarks with the same folder name are grouped together.
 777
 778 If you want to clear all bookmarks set with this policy, you can set the value to an empty array (```[]```). This can be on Windows via the new Bookmarks (JSON) policy available with GPO and Intune.
 779
 780 **Compatibility:** Firefox 60, Firefox ESR 60\
 781 **CCK2 Equivalent:** `bookmarks.toolbar`,`bookmarks.menu`\
 782 **Preferences Affected:** N/A
 783
 784 #### Windows (GPO)
 785 ```
 786 Software\Policies\Mozilla\Firefox\Bookmarks\1\Title = "Example"
 787 Software\Policies\Mozilla\Firefox\Bookmarks\1\URL = "https://example.com"
 788 Software\Policies\Mozilla\Firefox\Bookmarks\1\Favicon = "https://example.com/favicon.ico"
 789 Software\Policies\Mozilla\Firefox\Bookmarks\1\Placement = "toolbar" | "menu"
 790 Software\Policies\Mozilla\Firefox\Bookmarks\1\Folder = "FolderName"
 791
 792 Software\Policies\Mozilla\Firefox\Bookmarks (REG_MULTI_SZ) =
 793 ```
 794 []
 795 ```
 796
 797 ```
 798 #### Windows (Intune)
 799 OMA-URI:
 800 ```
 801 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~Bookmarks/Bookmark01
 802 ```
 803 Value (string):
 804 ```
 805 <enabled/>
 806 <data id="BookmarkTitle" value="Example"/>
 807 <data id="BookmarkURL" value="https://example.com"/>
 808 <data id="BookmarkFavicon" value="https://example.com/favicon.ico"/>
 809 <data id="BookmarkPlacement" value="toolbar | menu"/>
 810 <data id="BookmarkFolder" value="FolderName"/>
 811 ```
 812 OMA-URI:
 813 ```
 814 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox/Bookmarks
 815 ```
 816 Value (string):
 817 ```
 818 <enabled/>
 819 <data id="JSON" value='[]'/>
 820 ```
 821 #### macOS
 822 ```
 823 <dict>
 824   <key>Bookmarks</key>
 825   <array>
 826     <dict>
 827       <key>Title</key>
 828       <string>Example</string>
 829       <key>URL</key>
 830       <string>https://example.com</string>
 831       <key>Favicon</key>
 832       <string>https://example.com/favicon.ico</string>
 833       <key>Placement</key>
 834       <string>toolbar | menu</string>
 835       <key>Folder</key>
 836       <string>FolderName</string>
 837     </dict>
 838   </array>
 839 </dict>
 840 ```
 841 #### policies.json
 842 ```
 843 {
 844   "policies": {
 845     "Bookmarks": [
 846       {
 847         "Title": "Example",
 848         "URL": "https://example.com",
 849         "Favicon": "https://example.com/favicon.ico",
 850         "Placement": "toolbar" | "menu",
 851         "Folder": "FolderName"
 852       }
 853     ]
 854   }
 855 }
 856 ```
 857 ### CaptivePortal
 858 Enable or disable the detection of captive portals.
 859
 860 **Compatibility:** Firefox 67, Firefox ESR 60.7\
 861 **CCK2 Equivalent:** N/A\
 862 **Preferences Affected:** `network.captive-portal-service.enabled`
 863
 864 #### Windows (GPO)
 865 ```
 866 Software\Policies\Mozilla\Firefox\CaptivePortal = 0x1 | 0x0
 867 ```
 868 #### Windows (Intune)
 869 OMA-URI:
 870 ```
 871 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox/CaptivePortal
 872 ```
 873 Value (string):
 874 ```
 875 <enabled/> or <disabled/>
 876 ```
 877 #### macOS
 878 ```
 879 <dict>
 880   <key>CaptivePortal</key>
 881   <true/> | <false/>
 882 </dict>
 883 ```
 884 #### policies.json
 885 ```
 886 {
 887   "policies": {
 888     "CaptivePortal": true | false
 889   }
 890 }
 891 ```
 892 ### Certificates
 893
 894 ### Certificates | ImportEnterpriseRoots
 895
 896 Trust certificates that have been added to the operating system certificate store by a user or administrator.
 897
 898 Note: This policy only works on Windows and macOS. For Linux discussion, see [bug 1600509](https://bugzilla.mozilla.org/show_bug.cgi?id=1600509).
 899
 900 See https://support.mozilla.org/kb/setting-certificate-authorities-firefox for more detail.
 901
 902 **Compatibility:** Firefox 60, Firefox ESR 60 (macOS support in Firefox 63, Firefox ESR 68)\
 903 **CCK2 Equivalent:** N/A\
 904 **Preferences Affected:** `security.enterprise_roots.enabled`
 905
 906 #### Windows (GPO)
 907 ```
 908 Software\Policies\Mozilla\Firefox\Certificates\ImportEnterpriseRoots = 0x1 | 0x0
 909 ```
 910 #### Windows (Intune)
 911 OMA-URI:
 912 ```
 913 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~Certificates/Certificates_ImportEnterpriseRoots
 914 ```
 915 Value (string):
 916 ```
 917 <enabled/> or <disabled/>
 918 ```
 919 #### macOS
 920 ```
 921 <dict>
 922   <key>Certificates</key>
 923   <dict>
 924     <key>ImportEnterpriseRoots</key>
 925     <true/> | <false/>
 926   </dict>
 927 </dict>
 928 ```
 929 #### policies.json
 930 ```
 931 {
 932   "policies": {
 933     "Certificates": {
 934       "ImportEnterpriseRoots": true | false
 935     }
 936   }
 937 }
 938 ```
 939 ### Certificates | Install
 940
 941 Install certificates into the Firefox certificate store. If only a filename is specified, Firefox searches for the file in the following locations:
 942
 943 - Windows
 944   - %USERPROFILE%\AppData\Local\Mozilla\Certificates
 945   - %USERPROFILE%\AppData\Roaming\Mozilla\Certificates
 946 - macOS
 947   - /Library/Application Support/Mozilla/Certificates
 948   - ~/Library/Application Support/Mozilla/Certificates
 949 - Linux
 950   - /usr/lib/mozilla/certificates
 951   - /usr/lib64/mozilla/certificates
 952   - ~/.mozilla/certificates
 953
 954 Starting with Firefox 65, Firefox 60.5 ESR, a fully qualified path can be used, including UNC paths. You should use the native path style for your operating system. We do not support using %USERPROFILE% or other environment variables on Windows.
 955
 956 If you are specifying the path in the policies.json file on Windows, you need to escape your backslashes (`\\`) which means that for UNC paths, you need to escape both (`\\\\`). If you use group policy, you only need one backslash.
 957
 958 Certificates are installed using the trust string `CT,CT,`.
 959
 960 Binary (DER) and ASCII (PEM) certificates are both supported.
 961
 962 **Compatibility:** Firefox 64, Firefox ESR 64\
 963 **CCK2 Equivalent:** `certs.ca`\
 964 **Preferences Affected:** N/A
 965
 966 #### Windows (GPO)
 967 ```
 968 Software\Policies\Mozilla\Firefox\Certificates\Install\1 = "cert1.der"
 969 Software\Policies\Mozilla\Firefox\Certificates\Install\2 = "C:\Users\username\cert2.pem"
 970 ```
 971 #### Windows (Intune)
 972 OMA-URI:
 973 ```
 974 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~Certificates/Certificates_Install
 975 ```
 976 Value (string):
 977 ```
 978 <enabled/>
 979 <data id="Certificates_Install" value="1&#xF000;cert1.der&#xF000;2&#xF000;C:\Users\username\cert2.pem"/>
 980 ```
 981 #### macOS
 982 ```
 983 <dict>
 984   <key>Certificates</key>
 985   <dict>
 986     <key>Install</key>
 987     <array>
 988       <string>cert1.der</string>
 989       <string>/Users/username/cert2.pem</string>
 990     </array>
 991   </dict>
 992 </dict>
 993 ```
 994 #### policies.json
 995 ```
 996 {
 997   "policies": {
 998     "Certificates": {
 999       "Install": ["cert1.der", "/home/username/cert2.pem"]
1000     }
1001   }
1002 }
1003 ```
1004 ### Containers
1005 Set policies related to [containers](https://addons.mozilla.org/firefox/addon/multi-account-containers/).
1006
1007 Currently you can set the initial set of containers.
1008
1009 For each container, you can specify the name, icon, and color.
1010
1011 | Name | Description |
1012 | --- | --- |
1013 | `name`| Name of container
1014 | `icon` | Can be `fingerprint`, `briefcase`, `dollar`, `cart`, `vacation`, `gift`, `food`, `fruit`, `pet`, `tree`, `chill`, `circle`, `fence`
1015 | `color` | Can be `blue`, `turquoise`, `green`, `yellow`, `orange`, `red`, `pink`, `purple`, `toolbar`
1016
1017 **Compatibility:** Firefox 113\
1018 **CCK2 Equivalent:** N/A\
1019 **Preferences Affected:** N/A
1020
1021 #### Windows (GPO)
1022 Software\Policies\Mozilla\Firefox\Containers (REG_MULTI_SZ) =
1023 ```
1024 {
1025   "Default": [
1026     {
1027       "name": "My container",
1028       "icon": "pet",
1029       "color": "turquoise"
1030     }
1031   ]
1032 }
1033 ```
1034 #### Windows (Intune)
1035 OMA-URI:
1036 ```
1037 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox/Containers
1038 ```
1039 Value (string):
1040 ```
1041 <enabled/>
1042 <data id="JSON" value='
1043 {
1044   "Default": [
1045     {
1046       "name": "My container",
1047       "icon": "pet",
1048       "color": "turquoise"
1049     }
1050   ]
1051 }
1052 '/>
1053 ```
1054 #### macOS
1055 ```
1056 <dict>
1057   <key>Default</key>
1058   <dict>
1059     <key>Containers</key>
1060     <array>
1061       <dict>
1062         <key>name</key>
1063         <string>My container</string>
1064         <key>icon</key>
1065         <string>pet</string>
1066         <key>color</key>
1067         <string>turquoise</string>
1068       </dict>
1069     </array>
1070   </dict>
1071 </dict>
1072 ```
1073 #### policies.json
1074 ```
1075 {
1076   "policies": {
1077     "Containers": {
1078       "Default": [
1079         {
1080           "name": "My container",
1081           "icon": "pet",
1082           "color": "turquoise"
1083         }
1084       ]
1085     }
1086   }
1087 }
1088 ```
1089 ### Cookies
1090 Configure cookie preferences.
1091
1092 `Allow` is a list of origins (not domains) where cookies are always allowed. You must include http or https.
1093
1094 `AllowSession` is a list of origins (not domains) where cookies are only allowed for the current session. You must include http or https.
1095
1096 `Block` is a list of origins (not domains) where cookies are always blocked. You must include http or https.
1097
1098 `Behavior` sets the default behavior for cookies based on the values below.
1099
1100 `BehaviorPrivateBrowsing` sets the default behavior for cookies in private browsing based on the values below.
1101
1102 | Value | Description
1103 | --- | --- |
1104 | accept | Accept all cookies
1105 | reject-foreign | Reject third party cookies
1106 | reject | Reject all cookies
1107 | limit-foreign | Reject third party cookies for sites you haven't visited
1108 | reject-tracker | Reject cookies for known trackers (default)
1109 | reject-tracker-and-partition-foreign | Reject cookies for known trackers and partition third-party cookies (Total Cookie Protection) (default for private browsing)
1110
1111 `ExpireAtSessionEnd` determines when cookies expire.
1112
1113 `Locked` prevents the user from changing cookie preferences.
1114
1115 **Compatibility:** Firefox 60, Firefox ESR 60 (RejectTracker added in Firefox 63, AllowSession added in Firefox 79/78.1, Behavior added in Firefox 95/91.4)\
1116 **CCK2 Equivalent:** N/A\
1117 **Preferences Affected:** `network.cookie.cookieBehavior`, `network.cookie.cookieBehavior.pbmode`, `network.cookie.lifetimePolicy`
1118
1119 #### Windows (GPO)
1120 ```
1121 Software\Policies\Mozilla\Firefox\Cookies\Allow\1 = "https://example.com"
1122 Software\Policies\Mozilla\Firefox\Cookies\AllowSession\1 = "https://example.edu"
1123 Software\Policies\Mozilla\Firefox\Cookies\Block\1 = "https://example.org"
1124 Software\Policies\Mozilla\Firefox\Cookies\Default = 0x1 | 0x0
1125 Software\Policies\Mozilla\Firefox\Cookies\AcceptThirdParty = "always" | "never" | "from-visited"
1126 Software\Policies\Mozilla\Firefox\Cookies\ExpireAtSessionEnd = 0x1 | 0x0
1127 Software\Policies\Mozilla\Firefox\Cookies\RejectTracker = 0x1 | 0x0
1128 Software\Policies\Mozilla\Firefox\Cookies\Behavior = "accept" | "reject-foreign" | "reject" | "limit-foreign" | "reject-tracker" | "reject-tracker-and-partition-foreign"
1129 Software\Policies\Mozilla\Firefox\Cookies\BehaviorPrivateBrowsing = "accept" | "reject-foreign" | "reject" | "limit-foreign" | "reject-tracker" | "reject-tracker-and-partition-foreign"
1130 Software\Policies\Mozilla\Firefox\Cookies\Locked = 0x1 | 0x0
1131 ```
1132 #### Windows (Intune)
1133 OMA-URI:
1134 ```
1135 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~Cookies/Cookies_Allow
1136 ```
1137 Value (string):
1138 ```
1139 <enabled/>
1140 <data id="Permissions" value="1&#xF000;https://example.com"/>
1141 ```
1142 OMA-URI:
1143 ```
1144 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~Cookies/Cookies_AllowSession
1145 ```
1146 Value (string):
1147 ```
1148 <enabled/>
1149 <data id="Permissions" value="1&#xF000;https://example.edu"/>
1150 ```
1151 OMA-URI:
1152 ```
1153 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~Cookies/Cookies_Block
1154 ```
1155 Value (string):
1156 ```
1157 <enabled/>
1158 <data id="Permissions" value="1&#xF000;https://example.org"/>
1159 ```
1160 OMA-URI:
1161 ```
1162 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~Cookies/Cookies_Default
1163 ```
1164 Value (string):
1165 ```
1166 <enabled/> or <disabled/>
1167 ```
1168 OMA-URI:
1169 ```
1170 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~Cookies/Cookies_AcceptThirdParty
1171 ```
1172 Value (string):
1173 ```
1174 <enabled/>
1175 <data id="Cookies_AcceptThirdParty" value="always | never | from-visited"/>
1176 ```
1177 OMA-URI:
1178 ```
1179 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~Cookies/Cookies_ExpireAtSessionEnd
1180 ```
1181 Value (string):
1182 ```
1183 <enabled/> or <disabled/>
1184 ```
1185 OMA-URI:
1186 ```
1187 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~Cookies/Cookies_RejectTracker
1188 ```
1189 Value (string):
1190 ```
1191 <enabled/> or <disabled/>
1192 ```
1193 OMA-URI:
1194 ```
1195 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~Cookies/Cookies_Locked
1196 ```
1197 Value (string):
1198 ```
1199 <enabled/> or <disabled/>
1200 ```
1201 OMA-URI:
1202 ```
1203 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~Cookies/Cookies_Behavior
1204 ```
1205 Value (string):
1206 ```
1207 <enabled/>
1208 <data id="Cookies_Behavior" value="accept | reject-foreign | reject | limit-foreign | reject-tracker | reject-tracker-and-partition-foreign"/>
1209 ```
1210 OMA-URI:
1211 ```
1212 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~Cookies/Cookies_BehaviorPrivateBrowsing
1213 ```
1214 Value (string):
1215 ```
1216 <enabled/>
1217 <data id="Cookies_BehaviorPrivateBrowsing" value="accept | reject-foreign | reject | limit-foreign | reject-tracker | reject-tracker-and-partition-foreign"/>
1218 ```
1219 #### macOS
1220 ```
1221 <dict>
1222   <key>Cookies</key>
1223   <dict>
1224     <key>Allow</key>
1225     <array>
1226       <string>http://example.com</string>
1227     </array>
1228     <key>AllowSession</key>
1229     <array>
1230       <string>http://example.edu</string>
1231     </array>
1232     <key>Block</key>
1233     <array>
1234       <string>http://example.org</string>
1235     </array>
1236     <key>Default</key>
1237     <true/> | <false/>
1238     <key>AcceptThirdParty</key>
1239     <string>always | never | from-visited</string>
1240     <key>ExpireAtSessionEnd</key>
1241     <true/> | <false/>
1242     <key>RejectTracker</key>
1243     <true/> | <false/>
1244     <key>Locked</key>
1245     <true/> | <false/>
1246     <key>Behavior</key>
1247     <string>accept | reject-foreign | reject | limit-foreign | reject-tracker | reject-tracker-and-partition-foreign</string>
1248     <key>BehaviorPrivateBrowsing</key>
1249     <string>accept | reject-foreign | reject | limit-foreign | reject-tracker | reject-tracker-and-partition-foreign</string>
1250   </dict>
1251 </dict>
1252 ```
1253 #### policies.json
1254 ```
1255 {
1256   "policies": {
1257     "Cookies": {
1258       "Allow": ["http://example.org/"],
1259       "AllowSession": ["http://example.edu/"],
1260       "Block": ["http://example.edu/"],
1261       "Default": true | false,
1262       "AcceptThirdParty": "always" | "never" | "from-visited",
1263       "ExpireAtSessionEnd": true | false,
1264       "RejectTracker": true | false,
1265       "Locked": true | false,
1266       "Behavior": "accept" | "reject-foreign" | "reject" | "limit-foreign" | "reject-tracker" | "reject-tracker-and-partition-foreign",
1267       "BehaviorPrivateBrowsing": "accept" | "reject-foreign" | "reject" | "limit-foreign" | "reject-tracker" | "reject-tracker-and-partition-foreign",
1268     }
1269   }
1270 }
1271 ```
1272 ### DefaultDownloadDirectory
1273 Set the default download directory.
1274
1275 You can use ${home} for the native home directory.
1276
1277 **Compatibility:** Firefox 68, Firefox ESR 68\
1278 **CCK2 Equivalent:** N/A\
1279 **Preferences Affected:** `browser.download.dir`, `browser.download.folderList`
1280
1281 #### Windows (GPO)
1282 ```
1283 Software\Policies\Mozilla\Firefox\DefaultDownloadDirectory = "${home}\Downloads"
1284 ```
1285 #### Windows (Intune)
1286 OMA-URI:
1287 ```
1288 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox/DefaultDownloadDirectory
1289 ```
1290 Value (string):
1291 ```
1292 <enabled/>
1293 <data id="Preferences_String" value="${home}\Downloads"/>
1294 ```
1295 #### macOS
1296 ```
1297 <dict>
1298   <key>DefaultDownloadDirectory</key>
1299   <string>${home}/Downloads</string>
1300 </dict>
1301 ```
1302 #### policies.json (macOS and Linux)
1303 ```
1304 {
1305   "policies": {
1306     "DefaultDownloadDirectory": "${home}/Downloads"
1307   }
1308 }
1309 ```
1310 #### policies.json (Windows)
1311 ```
1312 {
1313   "policies": {
1314     "DefaultDownloadDirectory": "${home}\\Downloads"
1315   }
1316 }
1317 ```
1318 ### DisableAppUpdate
1319 Turn off application updates within Firefox.
1320
1321 **Compatibility:** Firefox 60, Firefox ESR 60\
1322 **CCK2 Equivalent:** `disableFirefoxUpdates`\
1323 **Preferences Affected:** N/A
1324
1325 #### Windows (GPO)
1326 ```
1327 Software\Policies\Mozilla\Firefox\DisableAppUpdate = 0x1 | 0x0
1328 ```
1329 #### Windows (Intune)
1330 OMA-URI:
1331 ```
1332 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox/DisableAppUpdate
1333 ```
1334 Value (string):
1335 ```
1336 <enabled/> or <disabled/>
1337 ```
1338 #### macOS
1339 ```
1340 <dict>
1341   <key>DisableAppUpdate</key>
1342   <true/> | <false/>
1343 </dict>
1344 ```
1345 #### policies.json
1346 ```
1347 {
1348   "policies": {
1349     "DisableAppUpdate": true | false
1350   }
1351 }
1352 ```
1353 ### DisableBuiltinPDFViewer
1354 Disable the built in PDF viewer. PDF files are downloaded and sent externally.
1355
1356 **Compatibility:** Firefox 60, Firefox ESR 60\
1357 **CCK2 Equivalent:** `disablePDFjs`\
1358 **Preferences Affected:** `pdfjs.disabled`
1359
1360 #### Windows (GPO)
1361 ```
1362 Software\Policies\Mozilla\Firefox\DisableBuiltinPDFViewer = 0x1 | 0x0
1363 ```
1364 #### Windows (Intune)
1365 OMA-URI:
1366 ```
1367 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox/DisableBuiltinPDFViewer
1368 ```
1369 Value (string):
1370 ```
1371 <enabled/> or <disabled/>
1372 ```
1373 #### macOS
1374 ```
1375 <dict>
1376   <key>DisableBuiltinPDFViewer</key>
1377   <true/> | <false/>
1378 </dict>
1379 ```
1380 #### policies.json
1381 ```
1382 {
1383   "policies": {
1384     "DisableBuiltinPDFViewer": true | false
1385   }
1386 }
1387 ```
1388 ### DisabledCiphers
1389 Disable specific cryptographic ciphers, listed below.
1390
1391 ```
1392 TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256
1393 TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256
1394 TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256
1395 TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256
1396 TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384
1397 TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384
1398 TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA
1399 TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA
1400 TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA
1401 TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA
1402 TLS_DHE_RSA_WITH_AES_128_CBC_SHA
1403 TLS_DHE_RSA_WITH_AES_256_CBC_SHA
1404 TLS_RSA_WITH_AES_128_GCM_SHA256
1405 TLS_RSA_WITH_AES_256_GCM_SHA384
1406 TLS_RSA_WITH_AES_128_CBC_SHA
1407 TLS_RSA_WITH_AES_256_CBC_SHA
1408 TLS_RSA_WITH_3DES_EDE_CBC_SHA
1409 ```
1410
1411 **Preferences Affected:** `security.ssl3.ecdhe_rsa_aes_128_gcm_sha256`, `security.ssl3.ecdhe_ecdsa_aes_128_gcm_sha256`, `security.ssl3.ecdhe_ecdsa_chacha20_poly1305_sha256`, `security.ssl3.ecdhe_rsa_chacha20_poly1305_sha256`, `security.ssl3.ecdhe_ecdsa_aes_256_gcm_sha384`, `security.ssl3.ecdhe_rsa_aes_256_gcm_sha384`, `security.ssl3.ecdhe_rsa_aes_128_sha`, `security.ssl3.ecdhe_ecdsa_aes_128_sha`, `security.ssl3.ecdhe_rsa_aes_256_sha`, `security.ssl3.ecdhe_ecdsa_aes_256_sha`, `security.ssl3.dhe_rsa_aes_128_sha`, `security.ssl3.dhe_rsa_aes_256_sha`, `security.ssl3.rsa_aes_128_gcm_sha256`, `security.ssl3.rsa_aes_256_gcm_sha384`, `security.ssl3.rsa_aes_128_sha`, `security.ssl3.rsa_aes_256_sha`, `security.ssl3.deprecated.rsa_des_ede3_sha`
1412
1413 ---
1414 **Note:**
1415
1416 This policy was updated in Firefox 78 to allow enabling ciphers as well. Setting the value to true disables the cipher, setting the value to false enables the cipher. Previously setting the value to true or false disabled the cipher.
1417
1418 ---
1419 **Compatibility:** Firefox 76, Firefox ESR 68.8 (TLS_RSA_WITH_AES_128_GCM_SHA256 and TLS_RSA_WITH_AES_256_GCM_SHA384 were added in Firefox 78, TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA, TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA, TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA38, TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256, TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384, and TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256 were added in Firefox 97 and Firefox 91.6)\
1420 **CCK2 Equivalent:** N/A\
1421 **Preferences Affected:** N/A
1422
1423 #### Windows (GPO)
1424 ```
1425 Software\Policies\Mozilla\Firefox\DisabledCiphers\CIPHER_NAME = 0x1 | 0x0
1426 ```
1427 #### Windows (Intune)
1428 OMA-URI:
1429 ```
1430 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~DisabledCiphers/DisabledCiphers_CIPHER_NAME
1431
1432 ```
1433 Value (string):
1434 ```
1435 <enabled/> or <disabled/>
1436 ```
1437 #### macOS
1438 ```
1439 <dict>
1440   <key>DisabledCiphers</key>
1441     <dict>
1442       <key>CIPHER_NAME</key>
1443       <true/> | <false/>
1444     </dict>
1445 </dict>
1446 ```
1447 #### policies.json
1448 ```
1449 {
1450   "policies": {
1451     "DisabledCiphers": {
1452       "CIPHER_NAME": true | false,
1453     }
1454   }
1455 }
1456 ```
1457 ### DisableDefaultBrowserAgent
1458 Prevent the default browser agent from taking any actions. Only applicable to Windows; other platforms don’t have the agent.
1459
1460 The browser agent is a Windows-only scheduled task which runs in the background to collect and submit data about the browser that the user has set as their OS default. More information is available [here](https://firefox-source-docs.mozilla.org/toolkit/mozapps/defaultagent/default-browser-agent/index.html).
1461
1462 **Compatibility:** Firefox 75, Firefox ESR 68.7 (Windows only)\
1463 **CCK2 Equivalent:** N/A\
1464 **Preferences Affected:** N/A
1465
1466 #### Windows (GPO)
1467 ```
1468 Software\Policies\Mozilla\Firefox\DisableDefaultBrowserAgent = 0x1 | 0x0
1469 ```
1470 #### Windows (Intune)
1471 OMA-URI:
1472 ```
1473 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox/DisableDefaultBrowserAgent
1474 ```
1475 Value (string):
1476 ```
1477 <enabled/> or <disabled/>
1478 ```
1479 #### policies.json
1480 ```
1481 {
1482   "policies": {
1483     "DisableDefaultBrowserAgent": true | false
1484   }
1485 }
1486 ```
1487 ### DisableDeveloperTools
1488 Remove access to all developer tools.
1489
1490 **Compatibility:** Firefox 60, Firefox ESR 60\
1491 **CCK2 Equivalent:** `removeDeveloperTools`\
1492 **Preferences Affected:** `devtools.policy.disabled`
1493
1494 #### Windows (GPO)
1495 ```
1496 Software\Policies\Mozilla\Firefox\DisableDeveloperTools = 0x1 | 0x0`
1497 ```
1498 #### Windows (Intune)
1499 OMA-URI:
1500 ```
1501 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox/DisableDeveloperTools
1502 ```
1503 Value (string):
1504 ```
1505 <enabled/> or <disabled/>
1506 ```
1507 #### macOS
1508 ```
1509 <dict>
1510   <key>DisableDeveloperTools</key>
1511   <true/> | <false/>
1512 </dict>
1513 ```
1514 #### policies.json
1515 ```
1516 {
1517   "policies": {
1518     "DisableDeveloperTools": true | false
1519   }
1520 }
1521 ```
1522 ### DisableFeedbackCommands
1523 Disable the menus for reporting sites (Submit Feedback, Report Deceptive Site).
1524
1525 **Compatibility:** Firefox 60, Firefox ESR 60\
1526 **CCK2 Equivalent:** N/A\
1527 **Preferences Affected:** N/A
1528
1529 #### Windows (GPO)
1530 ```
1531 Software\Policies\Mozilla\Firefox\DisableFeedbackCommands = 0x1 | 0x0
1532 ```
1533 #### Windows (Intune)
1534 OMA-URI:
1535 ```
1536 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox/DisableFeedbackCommands
1537 ```
1538 Value (string):
1539 ```
1540 <enabled/> or <disabled/>
1541 ```
1542 #### macOS
1543 ```
1544 <dict>
1545   <key>DisableFeedbackCommands</key>
1546   <true/> | <false/>
1547 </dict>
1548 ```
1549 #### policies.json
1550 ```
1551 {
1552   "policies": {
1553     "DisableFeedbackCommands": true | false
1554   }
1555 }
1556 ```
1557 ### DisableFirefoxAccounts
1558 Disable Firefox Accounts integration (Sync).
1559
1560 **Compatibility:** Firefox 60, Firefox ESR 60\
1561 **CCK2 Equivalent:** `disableSync`\
1562 **Preferences Affected:** `identity.fxaccounts.enabled`
1563
1564 #### Windows (GPO)
1565 ```
1566 Software\Policies\Mozilla\Firefox\DisableFirefoxAccounts = 0x1 | 0x0
1567 ```
1568 #### Windows (Intune)
1569 OMA-URI:
1570 ```
1571 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox/DisableFirefoxAccounts
1572 ```
1573 Value (string):
1574 ```
1575 <enabled/> or <disabled/>
1576 ```
1577 #### macOS
1578 ```
1579 <dict>
1580   <key>DisableFirefoxAccounts</key>
1581   <true/> | <false/>
1582 </dict>
1583 ```
1584 #### policies.json
1585 ```
1586 {
1587   "policies": {
1588     "DisableFirefoxAccounts": true | false
1589   }
1590 }
1591 ```
1592 ### DisableFirefoxScreenshots
1593 Remove access to Firefox Screenshots.
1594
1595 **Compatibility:** Firefox 60, Firefox ESR 60\
1596 **CCK2 Equivalent:** N/A\
1597 **Preferences Affected:** `extensions.screenshots.disabled`
1598
1599 #### Windows (GPO)
1600 ```
1601 Software\Policies\Mozilla\Firefox\DisableFirefoxScreenshots = 0x1 | 0x0
1602 ```
1603 #### Windows (Intune)
1604 OMA-URI:
1605 ```
1606 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox/DisableFirefoxScreenshots
1607 ```
1608 Value (string):
1609 ```
1610 <enabled/> or <disabled/>
1611 ```
1612 #### macOS
1613 ```
1614 <dict>
1615   <key>DisableFirefoxScreenshots</key>
1616   <true/> | <false/>
1617 </dict>
1618 ```
1619 #### policies.json
1620 ```
1621 {
1622   "policies": {
1623     "DisableFirefoxScreenshots": true | false
1624   }
1625 }
1626 ```
1627 ### DisableFirefoxStudies
1628 Disable Firefox studies (Shield).
1629
1630 **Compatibility:** Firefox 60, Firefox ESR 60\
1631 **CCK2 Equivalent:** N/A\
1632 **Preferences Affected:** N/A
1633
1634 #### Windows (GPO)
1635 ```
1636 Software\Policies\Mozilla\Firefox\DisableFirefoxStudies = 0x1 | 0x0
1637 ```
1638 #### Windows (Intune)
1639 OMA-URI:
1640 ```
1641 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox/DisableFirefoxStudies
1642 ```
1643 Value (string):
1644 ```
1645 <enabled/> or <disabled/>
1646 ```
1647 #### macOS
1648 ```
1649 <dict>
1650   <key>DisableFirefoxStudies</key>
1651   <true/> | <false/>
1652 </dict>
1653 ```
1654 #### policies.json
1655 ```
1656 {
1657   "policies": {
1658     "DisableFirefoxStudies": true | false
1659   }
1660 }
1661 ```
1662 ### DisableForgetButton
1663 Disable the "Forget" button.
1664
1665 **Compatibility:** Firefox 60, Firefox ESR 60\
1666 **CCK2 Equivalent:** `disableForget`\
1667 **Preferences Affected:** N/A
1668
1669 #### Windows (GPO)
1670 ```
1671 Software\Policies\Mozilla\Firefox\DisableForgetButton = 0x1 | 0x0
1672 ```
1673 #### Windows (Intune)
1674 OMA-URI:
1675 ```
1676 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox/DisableForgetButton
1677 ```
1678 Value (string):
1679 ```
1680 <enabled/> or <disabled/>
1681 ```
1682 #### macOS
1683 ```
1684 <dict>
1685   <key>DisableForgetButton</key>
1686   <true/> | <false/>
1687 </dict>
1688 ```
1689 #### policies.json
1690 ```
1691 {
1692   "policies": {
1693     "DisableForgetButton": true | false
1694   }
1695 }
1696 ```
1697 ### DisableFormHistory
1698 Turn off saving information on web forms and the search bar.
1699
1700 **Compatibility:** Firefox 60, Firefox ESR 60\
1701 **CCK2 Equivalent:** `disableFormFill`\
1702 **Preferences Affected:** `browser.formfill.enable`
1703
1704 #### Windows (GPO)
1705 ```
1706 Software\Policies\Mozilla\Firefox\DisableFormHistory = 0x1 | 0x0
1707 ```
1708 #### Windows (Intune)
1709 OMA-URI:
1710 ```
1711 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox/DisableFormHistory
1712 ```
1713 Value (string):
1714 ```
1715 <enabled/> or <disabled/>
1716 ```
1717 #### macOS
1718 ```
1719 <dict>
1720   <key>DisableFormHistory</key>
1721   <true/> | <false/>
1722 </dict>
1723 ```
1724 #### policies.json
1725 ```
1726 {
1727   "policies": {
1728     "DisableFormHistory": true | false
1729   }
1730 }
1731 ```
1732 ### DisableMasterPasswordCreation
1733 Remove the master password functionality.
1734
1735 If this value is true, it works the same as setting [`PrimaryPassword`](#primarypassword) to false and removes the primary password functionality.
1736
1737 If both `DisableMasterPasswordCreation` and `PrimaryPassword` are used, `DisableMasterPasswordCreation` takes precedent.
1738
1739 **Compatibility:** Firefox 60, Firefox ESR 60\
1740 **CCK2 Equivalent:** `noMasterPassword`\
1741 **Preferences Affected:** N/A
1742
1743 #### Windows (GPO)
1744 ```
1745 Software\Policies\Mozilla\Firefox\DisableMasterPasswordCreation = 0x1 | 0x0
1746 ```
1747 #### Windows (Intune)
1748 OMA-URI:
1749 ```
1750 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox/DisableMasterPasswordCreation
1751 ```
1752 Value (string):
1753 ```
1754 <enabled/> or <disabled/>
1755 ```
1756 #### macOS
1757 ```
1758 <dict>
1759   <key>DisableMasterPasswordCreation</key>
1760   <true/> | <false/>
1761 </dict>
1762 ```
1763 #### policies.json
1764 ```
1765 {
1766   "policies": {
1767     "DisableMasterPasswordCreation": true | false
1768   }
1769 }
1770 ```
1771 ### DisablePasswordReveal
1772 Do not allow passwords to be shown in saved logins
1773
1774 **Compatibility:** Firefox 71, Firefox ESR 68.3\
1775 **CCK2 Equivalent:** N/A
1776 **Preferences Affected:** N/A
1777
1778 #### Windows (GPO)
1779 ```
1780 Software\Policies\Mozilla\Firefox\DisablePasswordReveal = 0x1 | 0x0
1781 ```
1782 #### Windows (Intune)
1783 OMA-URI:
1784 ```
1785 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox/DisablePasswordReveal
1786 ```
1787 Value (string):
1788 ```
1789 <enabled/> or <disabled/>
1790 ```
1791 #### macOS
1792 ```
1793 <dict>
1794   <key>DisablePasswordReveal</key>
1795   <true/> | <false/>
1796 </dict>
1797 ```
1798 #### policies.json
1799 ```
1800 {
1801   "policies": {
1802     "DisablePasswordReveal": true | false
1803   }
1804 }
1805 ```
1806 ### DisablePocket
1807 Remove Pocket in the Firefox UI. It does not remove it from the new tab page.
1808
1809 **Compatibility:** Firefox 60, Firefox ESR 60\
1810 **CCK2 Equivalent:** `disablePocket`\
1811 **Preferences Affected:** `extensions.pocket.enabled`
1812
1813 #### Windows (GPO)
1814 ```
1815 Software\Policies\Mozilla\Firefox\DisablePocket = 0x1 | 0x0
1816 ```
1817 #### Windows (Intune)
1818 OMA-URI:
1819 ```
1820 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox/DisablePocket
1821 ```
1822 Value (string):
1823 ```
1824 <enabled/> or <disabled/>
1825 ```
1826 #### macOS
1827 ```
1828 <dict>
1829   <key>DisablePocket</key>
1830   <true/> | <false/>
1831 </dict>
1832 ```
1833 #### policies.json
1834 ```
1835 {
1836   "policies": {
1837     "DisablePocket": true | false
1838   }
1839 }
1840 ```
1841 ### DisablePrivateBrowsing
1842 Remove access to private browsing.
1843
1844 **Compatibility:** Firefox 60, Firefox ESR 60\
1845 **CCK2 Equivalent:** `disablePrivateBrowsing`\
1846 **Preferences Affected:** N/A
1847
1848 #### Windows (GPO)
1849 ```
1850 Software\Policies\Mozilla\Firefox\DisablePrivateBrowsing = 0x1 | 0x0
1851 ```
1852 #### Windows (Intune)
1853 OMA-URI:
1854 ```
1855 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox/DisablePrivateBrowsing
1856 ```
1857 Value (string):
1858 ```
1859 <enabled/> or <disabled/>
1860 ```
1861 #### macOS
1862 ```
1863 <dict>
1864   <key>DisablePrivateBrowsing</key>
1865   <true/> | <false/>
1866 </dict>
1867 ```
1868 #### policies.json
1869 ```
1870 {
1871   "policies": {
1872     "DisablePrivateBrowsing": true | false
1873   }
1874 }
1875 ```
1876 ### DisableProfileImport
1877 Disables the "Import data from another browser" option in the bookmarks window.
1878
1879 **Compatibility:** Firefox 60, Firefox ESR 60\
1880 **CCK2 Equivalent:** N/A\
1881 **Preferences Affected:** N/A
1882
1883 #### Windows (GPO)
1884 ```
1885 Software\Policies\Mozilla\Firefox\DisableProfileImport = 0x1 | 0x0
1886 ```
1887 #### Windows (Intune)
1888 OMA-URI:
1889 ```
1890 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox/DisableProfileImport
1891 ```
1892 Value (string):
1893 ```
1894 <enabled/> or <disabled/>
1895 ```
1896 #### macOS
1897 ```
1898 <dict>
1899   <key>DisableProfileImport</key>
1900   <true/> | <false/>
1901 </dict>
1902 ```
1903 #### policies.json
1904 ```
1905 {
1906   "policies": {
1907     "DisableProfileImport": true | false
1908   }
1909 }
1910 ```
1911 ### DisableProfileRefresh
1912 Disable the Refresh Firefox button on about:support and support.mozilla.org, as well as the prompt that displays offering to refresh Firefox when you haven't used it in a while.
1913
1914 **Compatibility:** Firefox 60, Firefox ESR 60\
1915 **CCK2 Equivalent:** `disableResetFirefox`\
1916 **Preferences Affected:** `browser.disableResetPrompt`
1917
1918 #### Windows (GPO)
1919 ```
1920 Software\Policies\Mozilla\Firefox\DisableProfileRefresh = 0x1 | 0x0
1921 ```
1922 #### Windows (Intune)
1923 OMA-URI:
1924 ```
1925 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox/DisableProfileRefresh
1926 ```
1927 Value (string):
1928 ```
1929 <enabled/> or <disabled/>
1930 ```
1931 #### macOS
1932 ```
1933 <dict>
1934   <key>DisableProfileRefresh</key>
1935   <true/> | <false/>
1936 </dict>
1937 ```
1938 #### policies.json
1939 ```
1940 {
1941   "policies": {
1942     "DisableProfileRefresh": true | false
1943   }
1944 }
1945 ```
1946 ### DisableSafeMode
1947 Disable safe mode within the browser.
1948
1949 On Windows, this disables safe mode via the command line as well.
1950
1951 **Compatibility:** Firefox 60, Firefox ESR 60 (Windows, macOS)\
1952 **CCK2 Equivalent:** `disableSafeMode`\
1953 **Preferences Affected:** N/A
1954
1955 #### Windows (GPO)
1956 ```
1957 Software\Policies\Mozilla\Firefox\DisableSafeMode = 0x1 | 0x0
1958 ```
1959 #### Windows (Intune)
1960 OMA-URI:
1961 ```
1962 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox/DisableSafeMode
1963 ```
1964 Value (string):
1965 ```
1966 <enabled/> or <disabled/>
1967 ```
1968 #### macOS
1969 ```
1970 <dict>
1971   <key>DisableSafeMode</key>
1972   <true/> | <false/>
1973 </dict>
1974 ```
1975 #### policies.json
1976 ```
1977 {
1978   "policies": {
1979     "DisableSafeMode": true | false
1980   }
1981 }
1982 ```
1983 ### DisableSecurityBypass
1984 Prevent the user from bypassing security in certain cases.
1985
1986 `InvalidCertificate` prevents adding an exception when an invalid certificate is shown.
1987
1988 `SafeBrowsing` prevents selecting "ignore the risk" and visiting a harmful site anyway.
1989
1990 **Compatibility:** Firefox 60, Firefox ESR 60\
1991 **CCK2 Equivalent:** N/A\
1992 **Preferences Affected:** `security.certerror.hideAddException`, `browser.safebrowsing.allowOverride`
1993
1994 #### Windows (GPO)
1995 ```
1996 Software\Policies\Mozilla\Firefox\DisableSecurityBypass\InvalidCertificate = 0x1 | 0x0
1997 Software\Policies\Mozilla\Firefox\DisableSecurityBypass\SafeBrowsing = 0x1 | 0x0
1998 ```
1999 #### Windows (Intune)
2000 OMA-URI:
2001 ```
2002 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox/P_DisableSecurityBypass_InvalidCertificate
2003 ```
2004 Value (string):
2005 ```
2006 <enabled/> or <disabled/>
2007 ```
2008 OMA-URI:
2009 ```
2010 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox/P_DisableSecurityBypass_SafeBrowsing
2011 ```
2012 Value (string):
2013 ```
2014 <enabled/> or <disabled/>
2015 ```
2016
2017 #### macOS
2018 ```
2019 <dict>
2020   <key>DisableSecurityBypass</key>
2021   <dict>
2022     <key>InvalidCertificate</key>
2023     <true/> | <false/>
2024     <key>SafeBrowsing</key>
2025     <true/> | <false/>
2026   </dict>
2027 </dict>
2028 ```
2029 #### policies.json
2030 ```
2031 {
2032   "policies": {
2033     "DisableSecurityBypass": {
2034       "InvalidCertificate": true | false,
2035       "SafeBrowsing": true | false
2036     }
2037   }
2038 }
2039 ```
2040 ### DisableSetDesktopBackground
2041 Remove the "Set As Desktop Background..." menuitem when right clicking on an image.
2042
2043 **Compatibility:** Firefox 60, Firefox ESR 60\
2044 **CCK2 Equivalent:** `removeSetDesktopBackground`\
2045 **Preferences Affected:** N/A
2046
2047 #### Windows (GPO)
2048 ```
2049 Software\Policies\Mozilla\Firefox\DisableSetDesktopBackground = 0x1 | 0x0
2050 ```
2051 #### Windows (Intune)
2052 OMA-URI:
2053 ```
2054 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox/DisableSetDesktopBackground
2055 ```
2056 Value (string):
2057 ```
2058 <enabled/> or <disabled/>
2059 ```
2060 #### macOS
2061 ```
2062 <dict>
2063   <key>DisableSetDesktopBackground</key>
2064   <true/> | <false/>
2065 </dict>
2066 ```
2067 #### policies.json
2068 ```
2069 {
2070   "policies": {
2071     "DisableSetDesktopBackground": true | false
2072   }
2073 }
2074 ```
2075 ### DisableSystemAddonUpdate
2076 Prevent system add-ons from being installed or updated.
2077
2078 **Compatibility:** Firefox 60, Firefox ESR 60\
2079 **CCK2 Equivalent:** N/A\
2080 **Preferences Affected:** N/A
2081
2082 #### Windows (GPO)
2083 ```
2084 Software\Policies\Mozilla\Firefox\DisableSystemAddonUpdate = 0x1 | 0x0
2085 ```
2086 #### Windows (Intune)
2087 OMA-URI:
2088 ```
2089 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox/DisableSystemAddonUpdate
2090 ```
2091 Value (string):
2092 ```
2093 <enabled/> or <disabled/>
2094 ```
2095 #### macOS
2096 ```
2097 <dict>
2098   <key>DisableSystemAddonUpdate</key>
2099   <true/> | <false/>
2100 </dict>
2101 ```
2102 #### policies.json
2103 ```
2104 {
2105   "policies": {
2106     "DisableSystemAddonUpdate": true | false
2107   }
2108 }
2109 ```
2110 ### DisableTelemetry
2111 Prevent the upload of telemetry data.
2112
2113 As of Firefox 83 and Firefox ESR 78.5, local storage of telemetry data is disabled as well.
2114
2115 Mozilla recommends that you do not disable telemetry. Information collected through telemetry helps us build a better product for businesses like yours.
2116
2117 **Compatibility:** Firefox 60, Firefox ESR 60\
2118 **CCK2 Equivalent:** `disableTelemetry`\
2119 **Preferences Affected:** `datareporting.healthreport.uploadEnabled`, `datareporting.policy.dataSubmissionEnabled`, `toolkit.telemetry.archive.enabled`
2120
2121 #### Windows (GPO)
2122 ```
2123 Software\Policies\Mozilla\Firefox\DisableTelemetry = 0x1 | 0x0
2124 ```
2125 #### Windows (Intune)
2126 OMA-URI:
2127 ```
2128 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox/DisableTelemetry
2129 ```
2130 Value (string):
2131 ```
2132 <enabled/> or <disabled/>
2133 ```
2134 #### macOS
2135 ```
2136 <dict>
2137   <key>DisableTelemetry</key>
2138   <true/> | <false/>
2139 </dict>
2140 ```
2141 #### policies.json
2142 ```
2143 {
2144   "policies": {
2145     "DisableTelemetry": true | false
2146   }
2147 }
2148 ```
2149 ### DisableThirdPartyModuleBlocking
2150 Do not allow blocking third-party modules from the `about:third-party` page.
2151
2152 This policy only works on Windows through GPO (not policies.json).
2153
2154 **Compatibility:** Firefox 110 (Windows only, GPO only)\
2155 **CCK2 Equivalent:** N/A\
2156 **Preferences Affected:** N/A
2157
2158 #### Windows (GPO)
2159 ```
2160 Software\Policies\Mozilla\Firefox\DisableThirdPartyModuleBlocking = = 0x1 | 0x0
2161 ```
2162 #### Windows (Intune)
2163 OMA-URI:
2164 ```
2165 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox/DisableThirdPartyModuleBlocking
2166 ```
2167 Value (string):
2168 ```
2169 <enabled/> or <disabled/>
2170 ```
2171 ### DisplayBookmarksToolbar
2172 Set the initial state of the bookmarks toolbar. A user can still change how it is displayed.
2173
2174 `always` means the bookmarks toolbar is always shown.
2175
2176 `never` means the bookmarks toolbar is not shown.
2177
2178 `newtab` means the bookmarks toolbar is only shown on the new tab page.
2179
2180 **Compatibility:** Firefox 109, Firefox ESR 102.7\
2181 **CCK2 Equivalent:** N/A\
2182 **Preferences Affected:** N/A
2183
2184 #### Windows (GPO)
2185 ```
2186 Software\Policies\Mozilla\Firefox\DisplayBookmarksToolbar = "always", "never", "newtab"
2187 ```
2188 #### Windows (Intune)
2189 OMA-URI:
2190 ```
2191 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox/DisplayBookmarksToolbar_Enum
2192 ```
2193 Value (string):
2194 ```
2195 <enabled/>
2196 <data id="DisplayBookmarksToolbar" value="always | never | newtab"/>
2197 ```
2198 #### macOS
2199 ```
2200 <dict>
2201   <key>DisplayBookmarksToolbar</key>
2202   <string>always | never | newtab</string>
2203 </dict>
2204 ```
2205 #### policies.json
2206 ```
2207 {
2208   "policies": {
2209     "DisplayBookmarksToolbar": "always" | "never" | "newtab"
2210   }
2211 }
2212 ```
2213 ### DisplayMenuBar
2214 Set the state of the menubar.
2215
2216 `always` means the menubar is shown and cannot be hidden.
2217
2218 `never` means the menubar is hidden and cannot be shown.
2219
2220 `default-on` means the menubar is on by default but can be hidden.
2221
2222 `default-off` means the menubar is off by default but can be shown.
2223
2224 **Compatibility:** Firefox 73, Firefox ESR 68.5 (Windows, some Linux)\
2225 **CCK2 Equivalent:** `displayMenuBar`\
2226 **Preferences Affected:** N/A
2227
2228 #### Windows (GPO)
2229 ```
2230 Software\Policies\Mozilla\Firefox\DisplayMenuBar = "always", "never", "default-on", "default-off"
2231 ```
2232 #### Windows (Intune)
2233 OMA-URI:
2234 ```
2235 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox/DisplayMenuBar_Enum
2236 ```
2237 Value (string):
2238 ```
2239 <enabled/>
2240 <data id="DisplayMenuBar" value="always | never | default-on | default-off"/>
2241 ```
2242 #### macOS
2243 ```
2244 <dict>
2245   <key>DisplayMenuBar</key>
2246   <string>always | never | default-on | default-off</string>
2247 </dict>
2248 ```
2249 #### policies.json
2250 ```
2251 {
2252   "policies": {
2253     "DisplayMenuBar": "always", "never", "default-on", "default-off"
2254   }
2255 }
2256 ```
2257 ### DNSOverHTTPS
2258 Configure DNS over HTTPS.
2259
2260 `Enabled` determines whether DNS over HTTPS is enabled
2261
2262 `ProviderURL` is a URL to another provider.
2263
2264 `Locked` prevents the user from changing DNS over HTTPS preferences.
2265
2266 `ExcludedDomains` excludes domains from DNS over HTTPS.
2267
2268 **Compatibility:** Firefox 63, Firefox ESR 68 (ExcludedDomains added in 75/68.7)\
2269 **CCK2 Equivalent:** N/A\
2270 **Preferences Affected:** `network.trr.mode`, `network.trr.uri`
2271
2272 #### Windows (GPO)
2273 ```
2274 Software\Policies\Mozilla\Firefox\DNSOverHTTPS\Enabled = 0x1 | 0x0
2275 Software\Policies\Mozilla\Firefox\DNSOverHTTPS\ProviderURL = "URL_TO_ALTERNATE_PROVIDER"
2276 Software\Policies\Mozilla\Firefox\DNSOverHTTPS\Locked = 0x1 | 0x0
2277 Software\Policies\Mozilla\Firefox\DNSOverHTTPS\ExcludedDomains\1 = "example.com"
2278 ```
2279 #### Windows (Intune)
2280 OMA-URI:
2281 ```
2282 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~DNSOverHTTPS/DNSOverHTTPS_Enabled
2283 ```
2284 Value (string):
2285 ```
2286 <enabled/> or <disabled/>
2287 ```
2288 OMA-URI:
2289 ```
2290 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~DNSOverHTTPS/DNSOverHTTPS_ProviderURL
2291 ```
2292 Value (string):
2293 ```
2294 <enabled/>
2295 <data id="String" value="URL_TO_ALTERNATE_PROVIDER"/>
2296 ```
2297 OMA-URI:
2298 ```
2299 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~DNSOverHTTPS/DNSOverHTTPS_Locked
2300 ```
2301 Value (string):
2302 ```
2303 <enabled/> or <disabled/>
2304 ```
2305 OMA-URI:
2306 ```
2307 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~DNSOverHTTPS/DNSOverHTTPS_ExcludedDomains
2308 ```
2309 Value (string):
2310 ```
2311 <enabled/>
2312 <data id="List" value="1&#xF000;example.com"/>
2313 ```
2314 #### macOS
2315 ```
2316 <dict>
2317   <key>DNSOverHTTPS</key>
2318   <dict>
2319     <key>Enabled</key>
2320     <true/> | <false/>
2321     <key>ProviderURL</key>
2322     <string>URL_TO_ALTERNATE_PROVIDER</string>
2323     <key>Locked</key>
2324     <true/> | <false/>
2325     <key>ExcludedDomains</key>
2326     <array>
2327       <string>example.com</string>
2328     </array>
2329   </dict>
2330 </dict>
2331 ```
2332 #### policies.json
2333 ```
2334 {
2335   "policies": {
2336     "DNSOverHTTPS": {
2337       "Enabled":  true | false,
2338       "ProviderURL": "URL_TO_ALTERNATE_PROVIDER",
2339       "Locked": true | false,
2340       "ExcludedDomains": ["example.com"]
2341     }
2342   }
2343 }
2344 ```
2345 ### DontCheckDefaultBrowser
2346 Don't check if Firefox is the default browser at startup.
2347
2348 **Compatibility:** Firefox 60, Firefox ESR 60\
2349 **CCK2 Equivalent:** `dontCheckDefaultBrowser`\
2350 **Preferences Affected:** `browser.shell.checkDefaultBrowser`
2351
2352 #### Windows (GPO)
2353 ```
2354 Software\Policies\Mozilla\Firefox\DontCheckDefaultBrowser = 0x1 | 0x0
2355 ```
2356 #### Windows (Intune)
2357 OMA-URI:
2358 ```
2359 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox/DontCheckDefaultBrowser
2360 ```
2361 Value (string):
2362 ```
2363 <enabled/> or <disabled/>
2364 ```
2365 #### macOS
2366 ```
2367 <dict>
2368   <key>DontCheckDefaultBrowser</key>
2369   <true/> | <false/>
2370 </dict>
2371 ```
2372 #### policies.json
2373 ```
2374 {
2375   "policies": {
2376     "DontCheckDefaultBrowser": true | false
2377   }
2378 }
2379 ```
2380 ### DownloadDirectory
2381 Set and lock the download directory.
2382
2383 You can use ${home} for the native home directory.
2384
2385 **Compatibility:** Firefox 68, Firefox ESR 68\
2386 **CCK2 Equivalent:** N/A\
2387 **Preferences Affected:** `browser.download.dir`, `browser.download.folderList`, `browser.download.useDownloadDir`
2388
2389 #### Windows (GPO)
2390 ```
2391 Software\Policies\Mozilla\Firefox\DownloadDirectory = "${home}\Downloads"
2392 ```
2393 #### Windows (Intune)
2394 OMA-URI:
2395 ```
2396 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox/DownloadDirectory
2397 ```
2398 Value (string):
2399 ```
2400 <enabled/>
2401 <data id="Preferences_String" value="${home}\Downloads"/>
2402 ```
2403 #### macOS
2404 ```
2405 <dict>
2406   <key>DownloadDirectory</key>
2407   <string>${home}/Downloads</string>
2408 </dict>
2409 ```
2410 #### policies.json (macOS and Linux)
2411 ```
2412 {
2413   "policies": {
2414     "DownloadDirectory": "${home}/Downloads"
2415 }
2416 ```
2417 #### policies.json (Windows)
2418 ```
2419 {
2420   "policies": {
2421     "DownloadDirectory": "${home}\\Downloads"
2422 }
2423 ```
2424 ### EnableTrackingProtection
2425 Configure tracking protection.
2426
2427 If this policy is not configured, tracking protection is not enabled by default in the browser, but it is enabled by default in private browsing and the user can change it.
2428
2429 If `Value` is set to false, tracking protection is disabled and locked in both the regular browser and private browsing.
2430
2431 If `Value` is set to true, tracking protection is enabled by default in both the regular browser and private browsing and the `Locked` value determines whether or not a user can change it.
2432
2433 If `Cryptomining` is set to true, cryptomining scripts on websites are blocked.
2434
2435 If `Fingerprinting` is set to true, fingerprinting scripts on websites are blocked.
2436
2437 If `EmailTracking` is set to true, hidden email tracking pixels and scripts on websites are blocked. (Firefox 112)
2438
2439 `Exceptions` are origins for which tracking protection is not enabled.
2440
2441 **Compatibility:** Firefox 60, Firefox ESR 60 (Cryptomining and Fingerprinting added in 70/68.2, Exceptions added in 73/68.5)\
2442 **CCK2 Equivalent:** N/A\
2443 **Preferences Affected:** `privacy.trackingprotection.enabled`, `privacy.trackingprotection.pbmode.enabled`, `privacy.trackingprotection.cryptomining.enabled`, `privacy.trackingprotection.fingerprinting.enabled`
2444
2445 #### Windows (GPO)
2446 ```
2447 Software\Policies\Mozilla\Firefox\EnableTrackingProtection\Value = 0x1 | 0x0
2448 Software\Policies\Mozilla\Firefox\EnableTrackingProtection\Locked = 0x1 | 0x0
2449 Software\Policies\Mozilla\Firefox\EnableTrackingProtection\Cryptomining = 0x1 | 0x0
2450 Software\Policies\Mozilla\Firefox\EnableTrackingProtection\Fingerprinting = 0x1 | 0x0
2451 Software\Policies\Mozilla\Firefox\EnableTrackingProtection\Exceptions\1 = "https://example.com"
2452 ```
2453 #### Windows (Intune)
2454 OMA-URI:
2455 ```
2456 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~TrackingProtection/A_TrackingProtection_Value
2457 ```
2458 Value (string):
2459 ```
2460 <enabled/> or <disabled/>
2461 ```
2462 OMA-URI:
2463 ```
2464 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~TrackingProtection/B_TrackingProtection_Cryptomining
2465 ```
2466 Value (string):
2467 ```
2468 <enabled/> or <disabled/>
2469 ```
2470 OMA-URI:
2471 ```
2472 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~TrackingProtection/C_TrackingProtection_Fingerprinting
2473 ```
2474 Value (string):
2475 ```
2476 <enabled/> or <disabled/>
2477 ```
2478 OMA-URI:
2479 ```
2480 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~TrackingProtection/D_TrackingProtection_Exceptions
2481 ```
2482 Value (string):
2483 ```
2484 <enabled/>
2485 <data id="TrackingProtection_Exceptions" value="1&#xF000;https://example.com"/>
2486 ```
2487 OMA-URI:
2488 ```
2489 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~TrackingProtection/E_TrackingProtection_Locked
2490 ```
2491 Value (string):
2492 ```
2493 <enabled/> or <disabled/>
2494 ```
2495 #### macOS
2496 ```
2497 <dict>
2498   <key>EnableTrackingProtection</key>
2499   <dict>
2500     <key>Value</key>
2501     <true/> | <false/>
2502     <key>Locked</key>
2503     <true/> | <false/>
2504     <key>Cryptomining</key>
2505     <true/> | <false/>
2506     <key>Fingerprinting</key>
2507     <true/> | <false/>
2508     <key>Exceptions</key>
2509     <array>
2510       <string>https://example.com</string>
2511     </array>
2512   </dict>
2513 </dict>
2514 ```
2515 #### policies.json
2516 ```
2517 {
2518   "policies": {
2519     "EnableTrackingProtection": {
2520       "Value": true | false,
2521       "Locked": true | false,
2522       "Cryptomining": true | false,
2523       "Fingerprinting": true | false,
2524       "Exceptions": ["https://example.com"]
2525     }
2526   }
2527 }
2528 ```
2529 ### EncryptedMediaExtensions
2530 Enable or disable Encrypted Media Extensions and optionally lock it.
2531
2532 If `Enabled` is set to false, encrypted media extensions (like Widevine) are not downloaded by Firefox unless the user consents to installing them.
2533
2534 If `Locked` is set to true and `Enabled` is set to false, Firefox will not download encrypted media extensions (like Widevine) or ask the user to install them.
2535
2536 **Compatibility:** Firefox 77, Firefox ESR 68.9\
2537 **CCK2 Equivalent:** N/A\
2538 **Preferences Affected:** `media.eme.enabled`
2539
2540 #### Windows (GPO)
2541 ```
2542 Software\Policies\Mozilla\Firefox\EncryptedMediaExtensions\Enabled = 0x1 | 0x0
2543 Software\Policies\Mozilla\Firefox\EncryptedMediaExtensions\Locked = 0x1 | 0x0
2544 ```
2545 #### Windows (Intune)
2546 OMA-URI:
2547 ```
2548 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~EncryptedMediaExtensions/EncryptedMediaExtensions_Enabled
2549 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~EncryptedMediaExtensions/EncryptedMediaExtensions_Locked
2550 ```
2551 Value (string):
2552 ```
2553 <enabled/>or <disabled/>
2554 ```
2555 #### macOS
2556 ```
2557 <dict>
2558   <key>EncryptedMediaExtensions</key>
2559   <dict>
2560     <key>Enabled</key>
2561     <true/> | <false/>
2562     <key>Locked</key>
2563     <true/> | <false/>
2564   </dict>
2565 </dict>
2566 ```
2567 #### policies.json
2568 ```
2569 {
2570   "policies": {
2571     "EncryptedMediaExtensions": {
2572       "Enabled": true | false,
2573       "Locked": true | false
2574     }
2575   }
2576 }
2577 ```
2578 ### EnterprisePoliciesEnabled
2579 Enable policy support on macOS.
2580
2581 **Compatibility:** Firefox 63, Firefox ESR 60.3 (macOS only)\
2582 **CCK2 Equivalent:** N/A\
2583 **Preferences Affected:** N/A
2584
2585 #### macOS
2586 ```
2587 <dict>
2588   <key>EnterprisePoliciesEnabled</key>
2589   <true/>
2590 </dict>
2591 ```
2592 ### ExemptDomainFileTypePairsFromFileTypeDownloadWarnings
2593
2594 Disable warnings based on file extension for specific file types on domains.
2595
2596 This policy is based on the [Chrome policy](https://chromeenterprise.google/policies/#ExemptDomainFileTypePairsFromFileTypeDownloadWarnings) of the same name.
2597
2598 Important: The documentation for the policy for both Edge and Chrome is incorrect. The ```domains``` value must be a domain, not a URL pattern. Also, we do not support using ```*``` to mean all domains.
2599
2600 **Compatibility:** Firefox 102\
2601 **CCK2 Equivalent:** N/A\
2602 **Preferences Affected:** N/A
2603
2604 #### Windows (GPO)
2605 Software\Policies\Mozilla\Firefox\ExemptDomainFileTypePairsFromFileTypeDownloadWarnings (REG_MULTI_SZ) =
2606 ```
2607 [
2608   {
2609      "file_extension": "jnlp",
2610      "domains": ["example.com"]
2611   }
2612 ]
2613 ```
2614 #### Windows (Intune)
2615 OMA-URI:
2616 ```
2617 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox/ExemptDomainFileTypePairsFromFileTypeDownloadWarnings
2618 ```
2619 Value (string):
2620 ```
2621 <enabled/>
2622 <data id="JSON" value='
2623 [
2624   {
2625      "file_extension": "jnlp",
2626      "domains": ["example.com"]
2627   }
2628 ]
2629 '/>
2630 ```
2631 #### macOS
2632 ```
2633 <dict>
2634   <key>ExemptDomainFileTypePairsFromFileTypeDownloadWarnings</key>
2635   <array>
2636     <dict>
2637       <key>file_extension</key>
2638       <string>jnlp</string>
2639       <key>domains</key>
2640       <array>
2641         <string>example.com</string>
2642       </array>
2643     </dict>
2644   </array>
2645 </dict>
2646 ```
2647 #### policies.json
2648 ```
2649 {
2650   "policies": {
2651     "ExemptDomainFileTypePairsFromFileTypeDownloadWarnings": [{
2652       "file_extension": "jnlp",
2653       "domains": ["example.com"]
2654     }]
2655   }
2656 }
2657 ```
2658 ### Extensions
2659 Control the installation, uninstallation and locking of extensions.
2660
2661 While this policy is not technically deprecated, it is recommended that you use the **[`ExtensionSettings`](#extensionsettings)** policy. It has the same functionality and adds more. It does not support native paths, though, so you'll have to use file:/// URLs.
2662
2663 `Install` is a list of URLs or native paths for extensions to be installed.
2664
2665 `Uninstall` is a list of extension IDs that should be uninstalled if found.
2666
2667 `Locked` is a list of extension IDs that the user cannot disable or uninstall.
2668
2669 **Compatibility:** Firefox 60, Firefox ESR 60\
2670 **CCK2 Equivalent:** `addons`\
2671 **Preferences Affected:** N/A
2672
2673 #### Windows (GPO)
2674 ```
2675 Software\Policies\Mozilla\Firefox\Extensions\Install\1 = "https://addons.mozilla.org/firefox/downloads/somefile.xpi"
2676 Software\Policies\Mozilla\Firefox\Extensions\Install\2 = "//path/to/xpi"
2677 Software\Policies\Mozilla\Firefox\Extensions\Uninstall\1 = "bad_addon_id@mozilla.org"
2678 Software\Policies\Mozilla\Firefox\Extensions\Locked\1 = "addon_id@mozilla.org"
2679 ```
2680 #### Windows (Intune)
2681 OMA-URI:
2682 ```
2683 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~Extensions/Extensions_Install
2684 ```
2685 Value (string):
2686 ```
2687 <enabled/>
2688 <data id="Extensions" value="1&#xF000;https://addons.mozilla.org/firefox/downloads/somefile.xpi&#xF000;2&#xF000;//path/to/xpi"/>
2689 ```
2690 OMA-URI:
2691 ```
2692 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~Extensions/Extensions_Uninstall
2693 ```
2694 Value (string):
2695 ```
2696 <enabled/>
2697 <data id="Extensions" value="1&#xF000;bad_addon_id@mozilla.org"/>
2698 ```
2699 OMA-URI:
2700 ```
2701 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~Extensions/Extensions_Locked
2702 ```
2703 Value (string):
2704 ```
2705 <enabled/>
2706 <data id="Extensions" value="1&#xF000;addon_id@mozilla.org"/>
2707 ```
2708 #### macOS
2709 ```
2710 <dict>
2711   <key>Extensions</key>
2712   <dict>
2713     <key>Install</key>
2714     <array>
2715       <string>https://addons.mozilla.org/firefox/downloads/somefile.xpi</string>
2716       <string>//path/to/xpi</string>
2717     </array>
2718     <key>Uninstall</key>
2719     <array>
2720       <string>bad_addon_id@mozilla.org</string>
2721     </array>
2722     <key>Locked</key>
2723     <array>
2724       <string>addon_id@mozilla.org</string>
2725     </array>
2726   </dict>
2727 </dict>
2728 ```
2729 #### policies.json
2730 ```
2731 {
2732   "policies": {
2733     "Extensions": {
2734       "Install": ["https://addons.mozilla.org/firefox/downloads/somefile.xpi", "//path/to/xpi"],
2735       "Uninstall": ["bad_addon_id@mozilla.org"],
2736       "Locked":  ["addon_id@mozilla.org"]
2737     }
2738   }
2739 }
2740 ```
2741 ### ExtensionSettings
2742 Manage all aspects of extensions. This policy is based heavily on the [Chrome policy](https://dev.chromium.org/administrators/policy-list-3/extension-settings-full) of the same name.
2743
2744 This policy maps an extension ID to its configuration. With an extension ID, the configuration will be applied to the specified extension only. A default configuration can be set for the special ID "*", which will apply to all extensions that don't have a custom configuration set in this policy.
2745
2746 To obtain an extension ID, install the extension and go to about:support. You will see the ID in the Extensions section. I've also created an extension that makes it easy to find the ID of extensions on AMO. You can download it [here](https://github.com/mkaply/queryamoid/releases/tag/v0.1).
2747
2748 The configuration for each extension is another dictionary that can contain the fields documented below.
2749
2750 | Name | Description |
2751 | --- | --- |
2752 | `installation_mode` | Maps to a string indicating the installation mode for the extension. The valid strings are `allowed`,`blocked`,`force_installed`, and `normal_installed`.
2753 | &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;`allowed` | Allows the extension to be installed by the user. This is the default behavior. There is no need for an install_url; it will automatically be allowed based on the ID.
2754 | &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;`blocked`| Blocks installation of the extension and removes it from the device if already installed.
2755 | &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;`force_installed`| The extension is automatically installed and can't be removed by the user. This option is not valid for the default configuration and requires an install_url.
2756 | &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;`normal_installed`| The extension is automatically installed but can be disabled by the user. This option is not valid for the default configuration and requires an install_url.
2757 | `install_url`| Maps to a URL indicating where Firefox can download a force_installed or normal_installed extension.  If installing from the local file system, use a [```file:///``` URL](https://en.wikipedia.org/wiki/File_URI_scheme). If installing from the addons.mozilla.org, use the following URL (substituting SHORT_NAME from the URL on AMO), https://addons.mozilla.org/firefox/downloads/latest/SHORT_NAME/latest.xpi. Languages packs are available from https://releases.mozilla.org/pub/firefox/releases/VERSION/PLATFORM/xpi/LANGUAGE.xpi. If you need to update the extension, you can change the name of the extension and it will be automatically updated. Extensions installed from file URLs will additional be updated when their internal version changes.
2758 | `install_sources` | A list of sources from which installing extensions is allowed using URL match patterns. **This is unnecessary if you are only allowing the installation of certain extensions by ID.** Each item in this list is an extension-style match pattern. Users will be able to easily install items from any URL that matches an item in this list. Both the location of the *.xpi file and the page where the download is started from (i.e.  the referrer) must be allowed by these patterns. This setting can be used only for the default configuration.
2759 | `allowed_types` | This setting whitelists the allowed types of extension/apps that can be installed in Firefox. The value is a list of strings, each of which should be one of the following: "extension", "theme", "dictionary", "locale" This setting can be used only for the default configuration.
2760 | `blocked_install_message` | This maps to a string specifying the error message to display to users if they're blocked from installing an extension. This setting allows you to append text to the generic error message displayed when the extension is blocked. This could be be used to direct users to your help desk, explain why a particular extension is blocked, or something else. This setting can be used only for the default configuration.
2761 | `restricted_domains` | An array of domains on which content scripts can't be run. This setting can be used only for the default configuration.
2762 | `updates_disabled` | (Firefox 89, Firefox ESR 78.11) Boolean that indicates whether or not to disable automatic updates for an individual extension.
2763
2764 **Compatibility:** Firefox 69, Firefox ESR 68.1 (As of Firefox 85, Firefox ESR 78.7, installing a theme makes it the default.)\
2765 **CCK2 Equivalent:** N/A\
2766 **Preferences Affected:** N/A
2767
2768 #### Windows (GPO)
2769 Software\Policies\Mozilla\Firefox\ExtensionSettings (REG_MULTI_SZ) =
2770 ```
2771 {
2772   "*": {
2773     "blocked_install_message": "Custom error message.",
2774     "install_sources": ["https://yourwebsite.com/*"],
2775     "installation_mode": "blocked",
2776     "allowed_types": ["extension"]
2777   },
2778   "uBlock0@raymondhill.net": {
2779     "installation_mode": "force_installed",
2780     "install_url": "https://addons.mozilla.org/firefox/downloads/latest/ublock-origin/latest.xpi"
2781   },
2782   "https-everywhere@eff.org": {
2783     "installation_mode": "allowed"
2784   }
2785 }
2786 ```
2787 #### Windows (Intune)
2788 OMA-URI:
2789 ```
2790 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~Extensions/ExtensionSettings
2791 ```
2792 Value (string):
2793 ```
2794 <enabled/>
2795 <data id="ExtensionSettings" value='
2796 {
2797   "*": {
2798     "blocked_install_message": "Custom error message.",
2799     "install_sources": ["https://yourwebsite.com/*"],
2800     "installation_mode": "blocked",
2801     "allowed_types": ["extension"]
2802   },
2803   "uBlock0@raymondhill.net": {
2804     "installation_mode": "force_installed",
2805     "install_url": "https://addons.mozilla.org/firefox/downloads/latest/ublock-origin/latest.xpi"
2806   },
2807     "https-everywhere@eff.org": {
2808     "installation_mode": "allowed"
2809   }
2810 }'/>
2811 ```
2812 #### macOS
2813 ```
2814 <dict>
2815   <key>ExtensionSettings</key>
2816   <dict>
2817     <key>*</key>
2818     <dict>
2819       <key>blocked_install_message</key>
2820       <string>Custom error message.</string>
2821       <key>install_sources</key>
2822       <array>
2823         <string>"https://yourwebsite.com/*"</string>
2824       </array>
2825       <key>installation_mode</key>
2826       <string>blocked</string>
2827       <key>allowed_types</key>
2828       <array>
2829         <string>extension</string>
2830       </array>
2831     </dict>
2832     <key>uBlock0@raymondhill.net</key>
2833     <dict>
2834       <key>installation_mode</key>
2835        <string>force_installed</string>
2836       <key>install_url</key>
2837       <string>https://addons.mozilla.org/firefox/downloads/latest/ublock-origin/latest.xpi</string>
2838     </dict>
2839     <key>https-everywhere@eff.org</key>
2840     <dict>
2841       <key>installation_mode</key>
2842        <string>allowed</string>
2843     </dict>
2844   </dict>
2845 </dict>
2846 ```
2847 #### policies.json
2848 ```
2849 {
2850   "policies": {
2851     "ExtensionSettings": {
2852       "*": {
2853         "blocked_install_message": "Custom error message.",
2854         "install_sources": ["https://yourwebsite.com/*"],
2855         "installation_mode": "blocked",
2856         "allowed_types": ["extension"]
2857       },
2858       "uBlock0@raymondhill.net": {
2859         "installation_mode": "force_installed",
2860         "install_url": "https://addons.mozilla.org/firefox/downloads/latest/ublock-origin/latest.xpi"
2861       },
2862       "https-everywhere@eff.org": {
2863         "installation_mode": "allowed"
2864       }
2865     }
2866   }
2867 }
2868 ```
2869 ### ExtensionUpdate
2870 Control extension updates.
2871
2872 **Compatibility:** Firefox 67, Firefox ESR 60.7\
2873 **CCK2 Equivalent:** N/A\
2874 **Preferences Affected:** `extensions.update.enabled`
2875
2876 #### Windows (GPO)
2877 ```
2878 Software\Policies\Mozilla\Firefox\ExtensionUpdate = 0x1 | 0x0
2879 ```
2880 #### Windows (Intune)
2881 OMA-URI:
2882 ```
2883 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~Extensions/ExtensionUpdate
2884 ```
2885 Value (string):
2886 ```
2887 <enabled/> or <disabled/>
2888 ```
2889 #### macOS
2890 ```
2891 <dict>
2892   <key>ExtensionUpdate</key>
2893   <true/> | <false/>
2894 </dict>
2895 ```
2896 #### policies.json
2897 ```
2898 {
2899   "policies": {
2900     "ExtensionUpdate": true | false
2901   }
2902 }
2903 ```
2904 ### FirefoxHome
2905 Customize the Firefox Home page.
2906
2907 **Compatibility:** Firefox 68, Firefox ESR 68 (SponsoredTopSites and SponsoredPocket were added in Firefox 95, Firefox ESR 91.4)
2908 **CCK2 Equivalent:** N/A\
2909 **Preferences Affected:** `browser.newtabpage.activity-stream.showSearch`, `browser.newtabpage.activity-stream.feeds.topsites`, `browser.newtabpage.activity-stream.feeds.section.highlights`, `browser.newtabpage.activity-stream.feeds.section.topstories`, `browser.newtabpage.activity-stream.feeds.snippets`, `browser.newtabpage.activity-stream.showSponsoredTopSites`, `browser.newtabpage.activity-stream.showSponsored`
2910
2911 #### Windows (GPO)
2912 ```
2913 Software\Policies\Mozilla\Firefox\FirefoxHome\Search = 0x1 | 0x0
2914 Software\Policies\Mozilla\Firefox\FirefoxHome\TopSites = 0x1 | 0x0
2915 Software\Policies\Mozilla\Firefox\FirefoxHome\SponsoredTopSites = 0x1 | 0x0
2916 Software\Policies\Mozilla\Firefox\FirefoxHome\Highlights = 0x1 | 0x0
2917 Software\Policies\Mozilla\Firefox\FirefoxHome\Pocket = 0x1 | 0x0
2918 Software\Policies\Mozilla\Firefox\FirefoxHome\SponsoredPocket = 0x1 | 0x0
2919 Software\Policies\Mozilla\Firefox\FirefoxHome\Snippets = 0x1 | 0x0
2920 Software\Policies\Mozilla\Firefox\FirefoxHome\Locked = 0x1 | 0x0
2921 ```
2922 #### Windows (Intune)
2923 OMA-URI:
2924 ```
2925 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox/CustomizeFirefoxHome
2926 ```
2927 Value (string):
2928 ```
2929 <enabled/>
2930 <data id="FirefoxHome_Search"  value="true | false"/>
2931 <data id="FirefoxHome_TopSites"  value="true | false"/>
2932 <data id="FirefoxHome_SponsoredTopSites"  value="true | false"/>
2933 <data id="FirefoxHome_Highlights"  value="true | false"/>
2934 <data id="FirefoxHome_Pocket"  value="true | false"/>
2935 <data id="FirefoxHome_SponsoredPocket"  value="true | false"/>
2936 <data id="FirefoxHome_Snippets"  value="true | false"/>
2937 <data id="FirefoxHome_Locked"  value="true | false"/>
2938 ```
2939 #### macOS
2940 ```
2941 <dict>
2942   <key>FirefoxHome</key>
2943   <dict>
2944     <key>Search</key>
2945     <true/> | <false/>
2946     <key>TopSites</key>
2947     <true/> | <false/>
2948     <key>SponsoredTopSites</key>
2949     <true/> | <false/>
2950     <key>Highlights</key>
2951     <true/> | <false/>
2952     <key>Pocket</key>
2953     <true/> | <false/>
2954     <key>SponsoredPocket</key>
2955     <true/> | <false/>
2956     <key>Snippets</key>
2957     <true/> | <false/>
2958     <key>Locked</key>
2959     <true/> | <false/>
2960   </dict>
2961 </dict>
2962 ```
2963 #### policies.json
2964 ```
2965 {
2966   "policies": {
2967     "FirefoxHome": {
2968       "Search": true | false,
2969       "TopSites": true | false,
2970       "SponsoredTopSites": true | false,
2971       "Highlights": true | false,
2972       "Pocket": true | false,
2973       "SponsoredPocket": true | false,
2974       "Snippets": true | false,
2975       "Locked": true | false
2976     }
2977   }
2978 }
2979 ```
2980 ### GoToIntranetSiteForSingleWordEntryInAddressBar
2981 Whether to always go through the DNS server before sending a single word search string to a search engine.
2982
2983 If the site exists, it will navigate to the website. If the intranet responds with a 404, the page will show a 404. If the intranet does not respond, the browser will attempt a search.
2984
2985 The second result in the URL bar will be a search result to allow users to conduct a web search exactly as it was entered.
2986
2987 If instead you would like to enable the ability to have your domain appear as a valid URL and to disallow the browser from ever searching that term using the first result that matches it, add the pref `browser.fixup.domainwhitelist.YOUR_DOMAIN` (where `YOUR_DOMAIN` is the name of the domain you'd like to add), and set the pref to `true`. The URL bar will then suggest `YOUR_DOMAIN` when the user fully types `YOUR_DOMAIN`. If the user attempts to load that domain and it fails to load, it will show an "Unable to connect" error page.
2988
2989 You can also whitelist a domain suffix that is not part of the [Public Suffix List](https://publicsuffix.org/) by adding the pref `browser.fixup.domainsuffixwhitelist.YOUR_DOMAIN_SUFFIX` with a value of `true`.
2990
2991 Additionally, if you want users to see a "Did you mean to go to 'YOUR_DOMAIN'" prompt below the URL bar if they land on a search results page instead of an intranet domain that provides a response, set the pref `browser.urlbar.dnsResolveSingleWordsAfterSearch` to `1`. Enabling this will cause the browser to commit a DNS check after every single word search. If the browser receives a response from the intranet, a prompt will ask the user if they'd like to instead navigate to `YOUR_DOMAIN`. If the user presses the **yes** button, `browser.fixup.domainwhitelist.YOUR_DOMAIN` will be set to `true`.
2992
2993 **Compatibility:** Firefox 104, Firefox ESR 102.2\
2994 **CCK2 Equivalent:** `N/A`\
2995 **Preferences Affected:** `browser.fixup.dns_first_for_single_words`
2996
2997 #### Windows (GPO)
2998 ```
2999 Software\Policies\Mozilla\Firefox\GoToIntranetSiteForSingleWordEntryInAddressBar = 0x1 | 0x0
3000 ```
3001 #### Windows (Intune)
3002 OMA-URI:
3003 ```
3004 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox/GoToIntranetSiteForSingleWordEntryInAddressBar
3005 ```
3006 Value (string):
3007 ```
3008 <enabled/> or <disabled/>
3009 ```
3010 #### macOS
3011 ```
3012 <dict>
3013   <key>GoToIntranetSiteForSingleWordEntryInAddressBar</key>
3014   <true/> | <false/>
3015 </dict>
3016 ```
3017 #### policies.json
3018 ```
3019 {
3020   "policies": {
3021     "GoToIntranetSiteForSingleWordEntryInAddressBar": true | false
3022   }
3023 }
3024 ```
3025 ### Handlers
3026 Configure default application handlers. This policy is based on the internal format of `handlers.json`.
3027
3028 You can configure handlers based on a mime type (`mimeTypes`), a file's extension (`extensions`), or a protocol (`schemes`).
3029
3030 Within each handler type, you specify the given mimeType/extension/scheme as a key and use the following subkeys to describe how it is handled.
3031
3032 | Name | Description |
3033 | --- | --- |
3034 | `action`| Can be either `saveToDisk`, `useHelperApp`, `useSystemDefault`.
3035 | `ask` | If `true`, the user is asked if what they want to do with the file. If `false`, the action is taken without user intervention.
3036 | `handlers` | An array of handlers with the first one being the default. If you don't want to have a default handler, use an empty object for the first handler. Choose between path or uriTemplate.
3037 | &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;`name` | The display name of the handler (might not be used).
3038 | &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;`path`| The native path to the executable to be used.
3039 | &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;`uriTemplate`| A url to a web based application handler. The URL must be https and contain a %s to be used for substitution.
3040
3041 **Compatibility:** Firefox 78, Firefox ESR 78\
3042 **CCK2 Equivalent:** N/A\
3043 **Preferences Affected:** N/A
3044
3045 #### Windows (GPO)
3046 Software\Policies\Mozilla\Firefox\Handlers (REG_MULTI_SZ) =
3047 ```
3048 {
3049   "mimeTypes": {
3050     "application/msword": {
3051       "action": "useSystemDefault",
3052       "ask": true | false
3053     }
3054   },
3055   "schemes": {
3056     "mailto": {
3057       "action": "useHelperApp",
3058       "ask": true | false,
3059       "handlers": [{
3060         "name": "Gmail",
3061         "uriTemplate": "https://mail.google.com/mail/?extsrc=mailto&url=%s"
3062       }]
3063     }
3064   },
3065   "extensions": {
3066     "pdf": {
3067       "action": "useHelperApp",
3068       "ask": true | false,
3069       "handlers": [{
3070         "name": "Adobe Acrobat",
3071         "path": "C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\AcroRd32.exe"
3072       }]
3073     }
3074   }
3075 }
3076 ```
3077 #### Windows (Intune)
3078 OMA-URI:
3079 ```
3080 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox/Handlers
3081 ```
3082 Value (string):
3083 ```
3084 <enabled/>
3085 <data id="Handlers" value='
3086 {
3087   "mimeTypes": {
3088     "application/msword": {
3089       "action": "useSystemDefault",
3090       "ask": true | false
3091     }
3092   },
3093   "schemes": {
3094     "mailto": {
3095       "action": "useHelperApp",
3096       "ask": true | false,
3097       "handlers": [{
3098         "name": "Gmail",
3099         "uriTemplate": "https://mail.google.com/mail/?extsrc=mailto&amp;url=%s"
3100       }]
3101     }
3102   },
3103   "extensions": {
3104     "pdf": {
3105       "action": "useHelperApp",
3106       "ask": true | false,
3107       "handlers": [{
3108         "name": "Adobe Acrobat",
3109         "path": "C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\AcroRd32.exe"
3110       }]
3111     }
3112   }
3113 }
3114 '/>
3115 ```
3116 #### macOS
3117 ```
3118 <dict>
3119   <key>Handlers</key>
3120   <dict>
3121     <key>mimeTypes</key>
3122     <dict>
3123       <key>application/msword</key>
3124       <dict>
3125         <key>action</key>
3126         <string>useSystemDefault</string>
3127         <key>ask</key>
3128         <true/> | <false/>
3129       </dict>
3130     </dict>
3131     <key>schemes</key>
3132     <dict>
3133       <key>mailto</key>
3134       <dict>
3135         <key>action</key>
3136         <string>useHelperApp</string>
3137         <key>ask</key>
3138         <true/> | <false/>
3139         <key>handlers</key>
3140         <array>
3141           <dict>
3142             <key>name</key>
3143             <string>Gmail</string>
3144             <key>uriTemplate</key>
3145             <string>https://mail.google.com/mail/?extsrc=mailto&url=%s</string>
3146           </dict>
3147         </array>
3148       </dict>
3149     </dict>
3150     <key>extensions</key>
3151     <dict>
3152       <key>pdf</key>
3153       <dict>
3154         <key>action</key>
3155         <string>useHelperApp</string>
3156         <key>ask</key>
3157         <true/> | <false/>
3158         <key>handlers</key>
3159         <array>
3160           <dict>
3161             <key>name</key>
3162             <string>Adobe Acrobat</string>
3163             <key>path</key>
3164             <string>/System/Applications/Preview.app</string>
3165           </dict>
3166         </array>
3167       </dict>
3168     </dict>
3169   </dict>
3170 </dict>
3171 ```
3172 #### policies.json
3173 ```
3174 {
3175   "policies": {
3176     "Handlers": {
3177       "mimeTypes": {
3178         "application/msword": {
3179           "action": "useSystemDefault",
3180           "ask": false
3181         }
3182       },
3183       "schemes": {
3184         "mailto": {
3185           "action": "useHelperApp",
3186           "ask": true | false,
3187           "handlers": [{
3188             "name": "Gmail",
3189             "uriTemplate": "https://mail.google.com/mail/?extsrc=mailto&url=%s"
3190           }]
3191         }
3192       },
3193       "extensions": {
3194         "pdf": {
3195           "action": "useHelperApp",
3196           "ask": true | false,
3197           "handlers": [{
3198             "name": "Adobe Acrobat",
3199             "path": "/usr/bin/acroread"
3200           }]
3201         }
3202       }
3203     }
3204   }
3205 }
3206 ```
3207 ### HardwareAcceleration
3208 Control hardware acceleration.
3209
3210 **Compatibility:** Firefox 60, Firefox ESR 60\
3211 **CCK2 Equivalent:** N/A\
3212 **Preferences Affected:** `layers.acceleration.disabled`
3213
3214 #### Windows (GPO)
3215 ```
3216 Software\Policies\Mozilla\Firefox\HardwareAcceleration = 0x1 | 0x0
3217 ```
3218 #### Windows (Intune)
3219 OMA-URI:
3220 ```
3221 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox/HardwareAcceleration
3222 ```
3223 Value (string):
3224 ```
3225 <enabled/> or <disabled/>
3226 ```
3227 #### macOS
3228 ```
3229 <dict>
3230   <key>HardwareAcceleration</key>
3231   <true/> | <false/>
3232 </dict>
3233 ```
3234 #### policies.json
3235 ```
3236 {
3237   "policies": {
3238     "HardwareAcceleration": true | false
3239   }
3240 }
3241 ```
3242 ### Homepage
3243 Configure the default homepage and how Firefox starts.
3244
3245 `URL` is the default homepage.
3246
3247 `Locked` prevents the user from changing homepage preferences.
3248
3249 `Additional` allows for more than one homepage.
3250
3251 `StartPage` is how Firefox starts. The choices are no homepage, the default homepage or the previous session.
3252
3253 With Firefox 78, an additional option as added for `Startpage`, `homepage-locked`. If this is value is set for the Startpage, the user will always get the homepage at startup and cannot choose to restore their session.
3254
3255 **Compatibility:** Firefox 60, Firefox ESR 60 (StartPage was added in Firefox 60, Firefox ESR 60.4, homepage-locked added in Firefox 78)\
3256 **CCK2 Equivalent:** `homePage`,`lockHomePage`\
3257 **Preferences Affected:** `browser.startup.homepage`, `browser.startup.page`
3258
3259 #### Windows (GPO)
3260 ```
3261 Software\Policies\Mozilla\Firefox\Homepage\URL = "https://example.com"
3262 Software\Policies\Mozilla\Firefox\Homepage\Locked = 0x1 | 0x0
3263 Software\Policies\Mozilla\Firefox\Homepage\Additional\1 = "https://example.org"
3264 Software\Policies\Mozilla\Firefox\Homepage\Additional\2 = "https://example.edu"
3265 Software\Policies\Mozilla\Firefox\Homepage\StartPage = "none" | "homepage" | "previous-session" | "homepage-locked"
3266 ```
3267 #### Windows (Intune)
3268 OMA-URI:
3269 ```
3270 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~Homepage/HomepageURL
3271 ```
3272 Value (string):
3273 ```
3274 <enabled/>
3275
3276 <data id="HomepageURL" value="https://example.com"/>
3277 <data id="HomepageLocked" value="true | false"/>
3278 ```
3279 OMA-URI:
3280 ```
3281 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~Homepage/HomepageAdditional
3282 ```
3283 Value (string):
3284 ```
3285 <enabled/>
3286
3287 <data id="HomepageAdditional" value="1&#xF000;http://example.org&#xF000;2&#xF000;http://example.edu"/>
3288 ```
3289 OMA-URI:
3290 ```
3291 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~Homepage/HomepageStartPage
3292 ```
3293 Value (string):
3294 ```
3295 <enabled/>
3296
3297 <data id="StartPage" value="none | homepage | previous-session"/>
3298 ```
3299 #### macOS
3300 ```
3301 <dict>
3302   <key>Homepage</key>
3303   <dict>
3304     <key>URL</key>
3305     <string>http://example.com</string>
3306     <key>Locked</key>
3307     <true/> | <false/>
3308     <key>Additional</key>
3309     <array>
3310       <string>http://example.org</string>
3311       <string>http://example.edu</string>
3312     </array>
3313     <key>StartPage</key>
3314     <string>none | homepage | previous-session | homepage-locked</string>
3315   </dict>
3316 </dict>
3317 ```
3318 #### policies.json
3319 ```
3320 {
3321   "policies": {
3322     "Homepage": {
3323       "URL": "http://example.com/",
3324       "Locked": true | false,
3325       "Additional": ["http://example.org/",
3326                      "http://example.edu/"],
3327       "StartPage": "none" | "homepage" | "previous-session" | "homepage-locked"
3328     }
3329   }
3330 }
3331 ```
3332 ### InstallAddonsPermission
3333 Configure the default extension install policy as well as origins for extension installs are allowed. This policy does not override turning off all extension installs.
3334
3335 `Allow` is a list of origins where extension installs are allowed.
3336
3337 `Default` determines whether or not extension installs are allowed by default.
3338
3339 **Compatibility:** Firefox 60, Firefox ESR 60\
3340 **CCK2 Equivalent:** `permissions.install`\
3341 **Preferences Affected:** `xpinstall.enabled`
3342
3343 #### Windows (GPO)
3344 ```
3345 Software\Policies\Mozilla\Firefox\InstallAddonsPermission\Allow\1 = "https://example.org"
3346 Software\Policies\Mozilla\Firefox\InstallAddonsPermission\Allow\2 = "https://example.edu"
3347 Software\Policies\Mozilla\Firefox\InstallAddonsPermission\Default = 0x1 | 0x0
3348 ```
3349 #### Windows (Intune)
3350 OMA-URI:
3351 ```
3352 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~Addons/InstallAddonsPermission_Allow
3353 ```
3354 Value (string):
3355 ```
3356 <enabled/>
3357 <data id="Permissions" value="1&#xF000;https://example.org&#xF000;2&#xF000;https://example.edu"/>
3358 ```
3359 OMA-URI:
3360 ```
3361 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~Addons/InstallAddonsPermission_Default
3362 ```
3363 Value (string):
3364 ```
3365 <enabled/>
3366 ```
3367 #### macOS
3368 ```
3369 <dict>
3370   <key>InstallAddonsPermission</key>
3371   <dict>
3372     <key>Allow</key>
3373     <array>
3374       <string>http://example.org</string>
3375       <string>http://example.edu</string>
3376     </array>
3377     <key>Default</key>
3378     <true/> | <false/>
3379   </dict>
3380 </dict>
3381 ```
3382 #### policies.json
3383 ```
3384 {
3385   "policies": {
3386     "InstallAddonsPermission": {
3387       "Allow": ["http://example.org/",
3388                 "http://example.edu/"],
3389       "Default": true | false
3390     }
3391   }
3392 }
3393 ```
3394 ### LegacyProfiles
3395 Disable the feature enforcing a separate profile for each installation.
3396
3397 If this policy set to true, Firefox will not try to create different profiles for installations of Firefox in different directories. This is the equivalent of the MOZ_LEGACY_PROFILES environment variable.
3398
3399 If this policy set to false, Firefox will create a new profile for each unique installation of Firefox.
3400
3401 This policy only work on Windows via GPO (not policies.json).
3402
3403 **Compatibility:** Firefox 70, Firefox ESR 68.2 (Windows only, GPO only)\
3404 **CCK2 Equivalent:** N/A\
3405 **Preferences Affected:** N/A
3406
3407 #### Windows (GPO)
3408 ```
3409 Software\Policies\Mozilla\Firefox\LegacyProfiles = = 0x1 | 0x0
3410 ```
3411 #### Windows (Intune)
3412 OMA-URI:
3413 ```
3414 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox/LegacyProfiles
3415 ```
3416 Value (string):
3417 ```
3418 <enabled/> or <disabled/>
3419 ```
3420 ### LegacySameSiteCookieBehaviorEnabled
3421 Enable default legacy SameSite cookie behavior setting.
3422
3423 If this policy is set to true, it reverts all cookies to legacy SameSite behavior which means that cookies that don't explicitly specify a ```SameSite``` attribute are treated as if they were ```SameSite=None```.
3424
3425 **Compatibility:** Firefox 96\
3426 **CCK2 Equivalent:** N/A\
3427 **Preferences Affected:** `network.cookie.sameSite.laxByDefault`
3428
3429 #### Windows (GPO)
3430 ```
3431 Software\Policies\Mozilla\Firefox\LegacySameSiteCookieBehaviorEnabled = = 0x1 | 0x0
3432 ```
3433 #### Windows (Intune)
3434 OMA-URI:
3435 ```
3436 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox/LegacySameSiteCookieBehaviorEnabled
3437 ```
3438 Value (string):
3439 ```
3440 <enabled/> or <disabled/>
3441 ```
3442 #### macOS
3443 ```
3444 <dict>
3445   <key>LegacySameSiteCookieBehaviorEnabled</key>
3446   <true/> | <false/>
3447 </dict>
3448 ```
3449 #### policies.json
3450 ```
3451 {
3452   "policies": {
3453     "LegacySameSiteCookieBehaviorEnabled": true | false
3454 }
3455 ```
3456 ### LegacySameSiteCookieBehaviorEnabledForDomainList
3457 Revert to legacy SameSite behavior for cookies on specified sites.
3458
3459 If this policy is set to true, cookies set for domains in this list will revert to legacy SameSite behavior which means that cookies that don't explicitly specify a ```SameSite``` attribute are treated as if they were ```SameSite=None```.
3460
3461 **Compatibility:** Firefox 96\
3462 **CCK2 Equivalent:** N/A\
3463 **Preferences Affected:** `network.cookie.sameSite.laxByDefault.disabledHosts`
3464
3465 #### Windows (GPO)
3466 ```
3467 Software\Policies\Mozilla\Firefox\LegacySameSiteCookieBehaviorEnabledForDomainList\1 = "example.org"
3468 Software\Policies\Mozilla\Firefox\LegacySameSiteCookieBehaviorEnabledForDomainList\2 = "example.edu"
3469 ```
3470 #### Windows (Intune)
3471 OMA-URI:
3472 ```
3473 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox/LegacySameSiteCookieBehaviorEnabledForDomainList
3474 ```
3475 Value (string):
3476 ```
3477 <enabled/>
3478 <data id="LegacySameSiteCookieBehaviorEnabledForDomainList" value="1&#xF000;example.org&#xF000;2&#xF000;example.edu"/>
3479 ```
3480 #### macOS
3481 ```
3482 <dict>
3483   <key>LegacySameSiteCookieBehaviorEnabledForDomainList</key>
3484   <array>
3485     <string>example.org</string>
3486     <string>example.edu</string>
3487   </array>
3488 </dict>
3489 ```
3490 #### policies.json
3491 ```
3492 {
3493   "policies": {
3494     "LegacySameSiteCookieBehaviorEnabledForDomainList": ["example.org",
3495                                                          "example.edu"]
3496   }
3497 }
3498 ```
3499 ### LocalFileLinks
3500 Enable linking to local files by origin.
3501
3502 **Compatibility:** Firefox 68, Firefox ESR 68\
3503 **CCK2 Equivalent:** N/A\
3504 **Preferences Affected:** `capability.policy.localfilelinks.*`
3505
3506 #### Windows (GPO)
3507 ```
3508 Software\Policies\Mozilla\Firefox\LocalFileLinks\1 = "https://example.org"
3509 Software\Policies\Mozilla\Firefox\LocalFileLinks\2 = "https://example.edu"
3510 ```
3511 #### Windows (Intune)
3512 OMA-URI:
3513 ```
3514 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox/LocalFileLinks
3515 ```
3516 Value (string):
3517 ```
3518 <enabled/>
3519 <data id="LocalFileLinks" value="1&#xF000;https://example.org&#xF000;2&#xF000;https://example.edu"/>
3520 ```
3521 #### macOS
3522 ```
3523 <dict>
3524   <key>LocalFileLinks</key>
3525   <array>
3526     <string>http://example.org</string>
3527     <string>http://example.edu</string>
3528   </array>
3529 </dict>
3530 ```
3531 #### policies.json
3532 ```
3533 {
3534   "policies": {
3535     "LocalFileLinks": ["http://example.org/",
3536                        "http://example.edu/"]
3537   }
3538 }
3539 ```
3540 ### ManagedBookmarks
3541 Configures a list of bookmarks managed by an administrator that cannot be changed by the user.
3542
3543 The bookmarks are only added as a button on the personal toolbar. They are not in the bookmarks folder.
3544
3545 The syntax of this policy is exactly the same as the [Chrome ManagedBookmarks policy](https://cloud.google.com/docs/chrome-enterprise/policies/?policy=ManagedBookmarks). The schema is:
3546 ```
3547 {
3548  "items": {
3549   "id": "BookmarkType",
3550   "properties": {
3551    "children": {
3552     "items": {
3553      "$ref": "BookmarkType"
3554     },
3555     "type": "array"
3556    },
3557    "name": {
3558     "type": "string"
3559    },
3560    "toplevel_name": {
3561     "type": "string"
3562    },
3563    "url": {
3564     "type": "string"
3565    }
3566   },
3567   "type": "object"
3568  },
3569  "type": "array"
3570 }
3571 ```
3572 **Compatibility:** Firefox 83, Firefox ESR 78.5\
3573 **CCK2 Equivalent:** N/A\
3574 **Preferences Affected:** N/A
3575
3576 #### Windows (GPO)
3577 Software\Policies\Mozilla\Firefox\ManagedBookmarks (REG_MULTI_SZ) =
3578 ```
3579 [
3580   {
3581     "toplevel_name": "My managed bookmarks folder"
3582   },
3583   {
3584     "url": "example.com",
3585     "name": "Example"
3586   },
3587   {
3588     "name": "Mozilla links",
3589     "children": [
3590       {
3591         "url": "https://mozilla.org",
3592         "name": "Mozilla.org"
3593       },
3594       {
3595         "url": "https://support.mozilla.org/",
3596         "name": "SUMO"
3597       }
3598     ]
3599   }
3600 ]
3601 ```
3602 #### Windows (Intune)
3603 OMA-URI:
3604 ```
3605 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox/ManagedBookmarks
3606 ```
3607 Value (string):
3608 ```
3609 <enabled/>
3610 <data id="JSON" value='
3611 [
3612   {
3613     "toplevel_name": "My managed bookmarks folder"
3614   },
3615   {
3616     "url": "example.com",
3617     "name": "Example"
3618   },
3619   {
3620     "name": "Mozilla links",
3621     "children": [
3622       {
3623         "url": "https://mozilla.org",
3624         "name": "Mozilla.org"
3625       },
3626       {
3627         "url": "https://support.mozilla.org/",
3628         "name": "SUMO"
3629       }
3630     ]
3631   }
3632 ]'/>
3633 ```
3634 #### macOS
3635 ```
3636 <dict>
3637   <key>ManagedBookmarks</key>
3638   <array>
3639     <dict>
3640       <key>toplevel_name</key>
3641       <string>My managed bookmarks folder</string>
3642       <dict>
3643         <key>url</key>
3644         <string>example.com</string>
3645         <key>name</key>
3646         <string>Example</string>
3647       </dict>
3648       <dict>
3649       <key>name</key>
3650       <string>Mozilla links</string>
3651       <key>children</key>
3652       <array>
3653         <dict>
3654           <key>url</key>
3655           <string>https://mozilla.org</string>
3656           <key>name</key>
3657           <string>Mozilla</string>
3658         </dict>
3659         <dict>
3660           <key>url</key>
3661           <string>https://support.mozilla.org/</string>
3662           <key>name</key>
3663           <string>SUMO</string>
3664         </dict>
3665       </array>
3666     </dict>
3667   </array>
3668 </dict>
3669 ```
3670 #### policies.json
3671 ```
3672 {
3673   "policies": {
3674     "ManagedBookmarks": [
3675       {
3676         "toplevel_name": "My managed bookmarks folder"
3677       },
3678       {
3679         "url": "example.com",
3680         "name": "Example"
3681       },
3682       {
3683         "name": "Mozilla links",
3684         "children": [
3685           {
3686             "url": "https://mozilla.org",
3687             "name": "Mozilla.org"
3688           },
3689           {
3690             "url": "https://support.mozilla.org/",
3691             "name": "SUMO"
3692           }
3693         ]
3694       }
3695     ]
3696   }
3697 }
3698 ```
3699 ### ManualAppUpdateOnly
3700
3701 Switch to manual updates only.
3702
3703 If this policy is enabled:
3704  1. The user will never be prompted to install updates
3705  2. Firefox will not check for updates in the background, though it will check automatically when an update UI is displayed (such as the one in the About dialog). This check will be used to show "Update to version X" in the UI, but will not automatically download the update or prompt the user to update in any other way.
3706  3. The update UI will work as expected, unlike when using DisableAppUpdate.
3707
3708 This policy is primarily intended for advanced end users, not for enterprises.
3709
3710 **Compatibility:** Firefox 87\
3711 **CCK2 Equivalent:** N/A\
3712 **Preferences Affected:** N/A
3713
3714 #### policies.json
3715 ```
3716 {
3717   "policies": {
3718     "ManualAppUpdateOnly": true | false
3719   }
3720 }
3721 ```
3722 ### NetworkPrediction
3723 Enable or disable network prediction (DNS prefetching).
3724
3725 **Compatibility:** Firefox 67, Firefox ESR 60.7\
3726 **CCK2 Equivalent:** N/A\
3727 **Preferences Affected:** `network.dns.disablePrefetch`, `network.dns.disablePrefetchFromHTTPS`
3728
3729 #### Windows (GPO)
3730 ```
3731 Software\Policies\Mozilla\Firefox\NetworkPrediction = 0x1 | 0x0
3732 ```
3733 #### Windows (Intune)
3734 OMA-URI:
3735 ```
3736 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox/NetworkPrediction
3737 ```
3738 Value (string):
3739 ```
3740 <enabled/> or <disabled/>
3741 ```
3742 #### macOS
3743 ```
3744 <dict>
3745   <key>NetworkPrediction</key>
3746   <true/> | <false/>
3747 </dict>
3748 ```
3749 #### policies.json
3750 ```
3751 {
3752   "policies": {
3753     "NetworkPrediction": true | false
3754 }
3755 ```
3756 ### NewTabPage
3757 Enable or disable the New Tab page.
3758
3759 **Compatibility:** Firefox 68, Firefox ESR 68\
3760 **CCK2 Equivalent:** N/A\
3761 **Preferences Affected:** `browser.newtabpage.enabled`
3762
3763 #### Windows (GPO)
3764 ```
3765 Software\Policies\Mozilla\Firefox\NewTabPage = 0x1 | 0x0
3766 ```
3767 #### Windows (Intune)
3768 OMA-URI:
3769 ```
3770 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox/NewTabPage
3771 ```
3772 Value (string):
3773 ```
3774 <enabled/> or <disabled/>
3775 ```
3776 #### macOS
3777 ```
3778 <dict>
3779   <key>NewTabPage</key>
3780   <true/> | <false/>
3781 </dict>
3782 ```
3783 #### policies.json
3784 ```
3785 {
3786   "policies": {
3787     "NewTabPage": true | false
3788 }
3789 ```
3790 ### NoDefaultBookmarks
3791 Disable the creation of default bookmarks.
3792
3793 This policy is only effective if the user profile has not been created yet.
3794
3795 **Compatibility:** Firefox 60, Firefox ESR 60\
3796 **CCK2 Equivalent:** `removeDefaultBookmarks`\
3797 **Preferences Affected:** N/A
3798
3799 #### Windows (GPO)
3800 ```
3801 Software\Policies\Mozilla\Firefox\NoDefaultBookmarks = 0x1 | 0x0
3802 ```
3803 #### Windows (Intune)
3804 OMA-URI:
3805 ```
3806 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox/NoDefaultBookmarks
3807 ```
3808 Value (string):
3809 ```
3810 <enabled/> or <disabled/>
3811 ```
3812 #### macOS
3813 ```
3814 <dict>
3815   <key>NoDefaultBookmarks</key>
3816   <true/> | <false/>
3817 </dict>
3818 ```
3819 #### policies.json
3820 ```
3821 {
3822   "policies": {
3823     "NoDefaultBookmarks": true | false
3824   }
3825 }
3826 ```
3827 ### OfferToSaveLogins
3828 Control whether or not Firefox offers to save passwords.
3829
3830 **Compatibility:** Firefox 60, Firefox ESR 60\
3831 **CCK2 Equivalent:** `dontRememberPasswords`\
3832 **Preferences Affected:** `signon.rememberSignons`
3833
3834 #### Windows (GPO)
3835 ```
3836 Software\Policies\Mozilla\Firefox\OfferToSaveLogins = 0x1 | 0x0
3837 ```
3838 #### Windows (Intune)
3839 OMA-URI:
3840 ```
3841 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox/OfferToSaveLogins
3842 ```
3843 Value (string):
3844 ```
3845 <enabled/> or <disabled/>
3846 ```
3847 #### macOS
3848 ```
3849 <dict>
3850   <key>OfferToSaveLogins</key>
3851   <true/> | <false/>
3852 </dict>
3853 ```
3854 #### policies.json
3855 ```
3856 {
3857   "policies": {
3858     "OfferToSaveLogins": true | false
3859   }
3860 }
3861 ```
3862 ### OfferToSaveLoginsDefault
3863 Sets the default value of signon.rememberSignons without locking it.
3864
3865 **Compatibility:** Firefox 70, Firefox ESR 60.2\
3866 **CCK2 Equivalent:** `dontRememberPasswords`\
3867 **Preferences Affected:** `signon.rememberSignons`
3868
3869 #### Windows (GPO)
3870 ```
3871 Software\Policies\Mozilla\Firefox\OfferToSaveLoginsDefault = 0x1 | 0x0
3872 ```
3873 #### Windows (Intune)
3874 OMA-URI:
3875 ```
3876 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox/OfferToSaveLoginsDefault
3877 ```
3878 Value (string):
3879 ```
3880 <enabled/> or <disabled/>
3881 ```
3882 #### macOS
3883 ```
3884 <dict>
3885   <key>OfferToSaveLoginsDefault</key>
3886   <true/> | <false/>
3887 </dict>
3888 ```
3889 #### policies.json
3890 ```
3891 {
3892   "policies": {
3893     "OfferToSaveLoginsDefault": true | false
3894   }
3895 }
3896 ```
3897 ### OverrideFirstRunPage
3898 Override the first run page. If the value is an empty string (""), the first run page is not displayed.
3899
3900 Starting with Firefox 83, Firefox ESR 78.5, you can also specify multiple URLS separated by a vertical bar (|).
3901
3902 **Compatibility:** Firefox 60, Firefox ESR 60\
3903 **CCK2 Equivalent:** `welcomePage`,`noWelcomePage`\
3904 **Preferences Affected:** `startup.homepage_welcome_url`
3905
3906 #### Windows (GPO)
3907 ```
3908 Software\Policies\Mozilla\Firefox\OverrideFirstRunPage = "http://example.org"
3909 ```
3910 #### Windows (Intune)
3911 OMA-URI:
3912 ```
3913 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox/OverrideFirstRunPage
3914 ```
3915 Value (string):
3916 ```
3917 <enabled/>
3918 <data id="OverridePage" value="https://example.com"/>
3919 ```
3920 #### macOS
3921 ```
3922 <dict>
3923   <key>OverrideFirstRunPage</key>
3924   <string>http://example.org</string>
3925 </dict>
3926 ```
3927 #### policies.json
3928 ```
3929 {
3930   "policies": {
3931     "OverrideFirstRunPage": "http://example.org"
3932   }
3933 }
3934 ```
3935 ### OverridePostUpdatePage
3936 Override the upgrade page. If the value is an empty string (""), no extra pages are displayed when Firefox is upgraded.
3937
3938 **Compatibility:** Firefox 60, Firefox ESR 60\
3939 **CCK2 Equivalent:** `upgradePage`,`noUpgradePage`\
3940 **Preferences Affected:** `startup.homepage_override_url`
3941
3942 #### Windows (GPO)
3943 ```
3944 Software\Policies\Mozilla\Firefox\OverridePostUpdatePage = "http://example.org"
3945 ```
3946 #### Windows (Intune)
3947 OMA-URI:
3948 ```
3949 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox/OverridePostUpdatePage
3950 ```
3951 Value (string):
3952 ```
3953 <enabled/>
3954 <data id="OverridePage" value="https://example.com"/>
3955 ```
3956 #### macOS
3957 ```
3958 <dict>
3959   <key>OverridePostUpdatePage</key>
3960   <string>http://example.org</string>
3961 </dict>
3962 ```
3963 #### policies.json
3964 ```
3965 {
3966   "policies": {
3967     "OverridePostUpdatePage": "http://example.org"
3968   }
3969 }
3970 ```
3971 ### PasswordManagerEnabled
3972 Remove access to the password manager via preferences and blocks about:logins on Firefox 70.
3973
3974 **Compatibility:** Firefox 70, Firefox ESR 60.2\
3975 **CCK2 Equivalent:** N/A\
3976 **Preferences Affected:** `pref.privacy.disable_button.view_passwords`
3977
3978 #### Windows (GPO)
3979 ```
3980 Software\Policies\Mozilla\Firefox\PasswordManagerEnabled = 0x1 | 0x0
3981 ```
3982 #### Windows (Intune)
3983 OMA-URI:
3984 ```
3985 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox/PasswordManagerEnabled
3986 ```
3987 Value (string):
3988 ```
3989 <enabled/> or <disabled/>
3990 ```
3991 #### macOS
3992 ```
3993 <dict>
3994   <key>PasswordManagerEnabled</key>
3995   <true/> | <false/>
3996 </dict>
3997 ```
3998 #### policies.json
3999 ```
4000 {
4001   "policies": {
4002     "PasswordManagerEnabled": true | false
4003   }
4004 }
4005 ```
4006 ### PasswordManagerExceptions
4007 Prevent Firefox from saving passwords for specific sites.
4008
4009 The sites are specified as a list of origins.
4010
4011 **Compatibility:** Firefox 101\
4012 **CCK2 Equivalent:** N/A\
4013 **Preferences Affected:** N/A
4014
4015 #### Windows (GPO)
4016 ```
4017 Software\Policies\Mozilla\Firefox\PasswordManagerExceptions\1 = "https://example.org"
4018 Software\Policies\Mozilla\Firefox\PasswordManagerExceptions\2 = "https://example.edu"
4019 ```
4020 #### Windows (Intune)
4021 OMA-URI:
4022 ```
4023 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox/PasswordManagerExceptions
4024 ```
4025 Value (string):
4026 ```
4027 <enabled/>
4028 <data id="List" value="1&#xF000;https://example.org&#xF000;2&#xF000;https://example.edu"/>
4029 ```
4030 #### macOS
4031 ```
4032 <dict>
4033   <key>PasswordManagerExceptions</key>
4034   <array>
4035     <string>https://example.org</string>
4036     <string>https://example.edu</string>
4037   </array>
4038 </dict>
4039 ```
4040 #### policies.json
4041 ```
4042 {
4043   "policies": {
4044     "PasswordManagerExceptions": ["https://example.org",
4045                                   "https://example.edu"]
4046   }
4047 }
4048 ```
4049
4050 ### PDFjs
4051 Disable or configure PDF.js, the built-in PDF viewer.
4052
4053 If `Enabled` is set to false, the built-in PDF viewer is disabled.
4054
4055 If `EnablePermissions` is set to true, the built-in PDF viewer will honor document permissions like preventing the copying of text.
4056
4057 Note: DisableBuiltinPDFViewer has not been deprecated. You can either continue to use it, or switch to using PDFjs->Enabled to disable the built-in PDF viewer. This new permission was added because we needed a place for PDFjs->EnabledPermissions.
4058
4059 **Compatibility:** Firefox 77, Firefox ESR 68.9\
4060 **CCK2 Equivalent:** N/A\
4061 **Preferences Affected:** `pdfjs.diabled`, `pdfjs.enablePermissions`
4062
4063 #### Windows (GPO)
4064 ```
4065 Software\Policies\Mozilla\Firefox\PDFjs\Enabled = 0x1 | 0x0
4066 Software\Policies\Mozilla\Firefox\PDFjs\EnablePermissions = 0x1 | 0x0
4067 ```
4068 #### Windows (Intune)
4069 OMA-URI:
4070 ```
4071 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~PDFjs/PDFjs_Enabled
4072 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~PDFjs/PDFjs_EnablePermissions
4073 ```
4074 Value (string):
4075 ```
4076 <enabled/>or <disabled/>
4077 ```
4078 #### macOS
4079 ```
4080 <dict>
4081   <key>PDFjs</key>
4082   <dict>
4083     <key>Enabled</key>
4084     <true/> | <false/>
4085     <key>EnablePermissions</key>
4086     <true/> | <false/>
4087   </dict>
4088 </dict>
4089 ```
4090 #### policies.json
4091 ```
4092 {
4093   "policies": {
4094     "PDFjs": {
4095       "Enabled": true | false,
4096       "EnablePermissions": true | false
4097     }
4098   }
4099 }
4100 ```
4101 ### Permissions
4102 Set permissions associated with camera, microphone, location, notifications, autoplay, and virtual reality. Because these are origins, not domains, entries with unique ports must be specified separately. This explicitly means that it is not possible to add wildcards. See examples below.
4103
4104 `Allow` is a list of origins where the feature is allowed.
4105
4106 `Block` is a list of origins where the feature is not allowed.
4107
4108 `BlockNewRequests` determines whether or not new requests can be made for the feature.
4109
4110 `Locked` prevents the user from changing preferences for the feature.
4111
4112 `Default` specifies the default value for Autoplay. block-audio-video is not supported on Firefox ESR 68.
4113
4114 **Compatibility:** Firefox 62, Firefox ESR 60.2 (Autoplay added in Firefox 74, Firefox ESR 68.6, Autoplay Default/Locked added in Firefox 76, Firefox ESR 68.8, VirtualReality added in Firefox 80, Firefox ESR 78.2)\
4115 **CCK2 Equivalent:** N/A\
4116 **Preferences Affected:** `permissions.default.camera`, `permissions.default.microphone`, `permissions.default.geo`, `permissions.default.desktop-notification`, `media.autoplay.default`, `permissions.default.xr`
4117
4118 #### Windows (GPO)
4119 ```
4120 Software\Policies\Mozilla\Firefox\Permissions\Camera\Allow\1 = "https://example.org"
4121 Software\Policies\Mozilla\Firefox\Permissions\Camera\Allow\2 = "https://example.org:1234"
4122 Software\Policies\Mozilla\Firefox\Permissions\Camera\Block\1 = "https://example.edu"
4123 Software\Policies\Mozilla\Firefox\Permissions\Camera\BlockNewRequests = 0x1 | 0x0
4124 Software\Policies\Mozilla\Firefox\Permissions\Camera\Locked = 0x1 | 0x0
4125 Software\Policies\Mozilla\Firefox\Permissions\Microphone\Allow\1 = "https://example.org"
4126 Software\Policies\Mozilla\Firefox\Permissions\Microphone\Block\1 = "https://example.edu"
4127 Software\Policies\Mozilla\Firefox\Permissions\Microphone\BlockNewRequests = 0x1 | 0x0
4128 Software\Policies\Mozilla\Firefox\Permissions\Microphone\Locked = 0x1 | 0x0
4129 Software\Policies\Mozilla\Firefox\Permissions\Location\Allow\1 = "https://example.org"
4130 Software\Policies\Mozilla\Firefox\Permissions\Location\Block\1 = "https://example.edu"
4131 Software\Policies\Mozilla\Firefox\Permissions\Location\BlockNewRequests = 0x1 | 0x0
4132 Software\Policies\Mozilla\Firefox\Permissions\Location\Locked = 0x1 | 0x0
4133 Software\Policies\Mozilla\Firefox\Permissions\Notifications\Allow\1 = "https://example.org"
4134 Software\Policies\Mozilla\Firefox\Permissions\Notifications\Block\1 = "https://example.edu"
4135 Software\Policies\Mozilla\Firefox\Permissions\Notifications\BlockNewRequests = 0x1 | 0x0
4136 Software\Policies\Mozilla\Firefox\Permissions\Notifications\Locked = 0x1 | 0x0
4137 Software\Policies\Mozilla\Firefox\Permissions\Autoplay\Allow\1 = "https://example.org"
4138 Software\Policies\Mozilla\Firefox\Permissions\Autoplay\Block\1 = "https://example.edu"
4139 Software\Policies\Mozilla\Firefox\Permissions\Autoplay\Default = "allow-audio-video" | "block-audio" | "block-audio-video"
4140 Software\Policies\Mozilla\Firefox\Permissions\Autoplay\Locked = 0x1 | 0x0
4141 Software\Policies\Mozilla\Firefox\Permissions\VirtualReality\Allow\1 = "https://example.org"
4142 Software\Policies\Mozilla\Firefox\Permissions\VirtualReality\Block\1 = "https://example.edu"
4143 Software\Policies\Mozilla\Firefox\Permissions\VirtualReality\BlockNewRequests = 0x1 | 0x0
4144 Software\Policies\Mozilla\Firefox\Permissions\VirtualReality\Locked = 0x1 | 0x0
4145 ```
4146 #### Windows (Intune)
4147 OMA-URI:
4148 ```
4149 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~Permissions~Location/Location_BlockNewRequests
4150 ```
4151 Value (string):
4152 ```
4153 <enabled/> or <disabled/>
4154 ```
4155 OMA-URI:
4156 ```
4157 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~Permissions~Location/Location_Locked
4158 ```
4159 Value (string):
4160 ```
4161 <enabled/> or <disabled/>
4162 ```
4163 OMA-URI:
4164 ```
4165 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~Permissions~Notifications/Notifications_Allow
4166 ```
4167 Value (string):
4168 ```
4169 <enabled/>
4170 <data id="Permissions" value="1&#xF000;https://example.org"/>
4171 ```
4172 OMA-URI:
4173 ```
4174 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~Permissions~Notifications/Notifications_BlockNewRequests
4175 ```
4176 Value (string):
4177 ```
4178 <enabled/> or <disabled/>
4179 ```
4180 OMA-URI:
4181 ```
4182 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~Permissions~Notifications/Notifications_Locked
4183 ```
4184 Value (string):
4185 ```
4186 <enabled/> or <disabled/>
4187 ```
4188 OMA-URI:
4189 ```
4190 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~Permissions~Autoplay/Autoplay_Allow
4191 ```
4192 Value (string):
4193 ```
4194 <enabled/>
4195 <data id="Permissions" value="1&#xF000;https://example.org"/>
4196 ```
4197 OMA-URI:
4198 ```
4199 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~Permissions~Autoplay/Autoplay_Block
4200 ```
4201 Value (string):
4202 ```
4203 <enabled/>
4204 <data id="Permissions" value="1&#xF000;https://example.edu"/>
4205 ```
4206 OMA-URI:
4207 ```
4208 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~Permissions~Autoplay/Autoplay_Default
4209 ```
4210 Value (string):
4211 ```
4212 <enabled/>
4213 <data id="Autoplay_Default" value="allow-audio-video | block-audio | block-audio-video"/>
4214 ```
4215 OMA-URI:
4216 ```
4217 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~Permissions~Autoplay/Autoplay_Locked
4218 ```
4219 Value (string):
4220 ```
4221 <enabled/> or <disabled/>
4222 ```
4223 OMA-URI:
4224 ```
4225 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~Permissions~Notifications/VirtualReality_Allow
4226 ```
4227 Value (string):
4228 ```
4229 <enabled/>
4230 <data id="Permissions" value="1&#xF000;https://example.org"/>
4231 ```
4232 OMA-URI:
4233 ```
4234 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~Permissions~Notifications/VirtualReality_Block
4235 ```
4236 Value (string):
4237 ```
4238 <enabled/>
4239 <data id="Permissions" value="1&#xF000;https://example.edu"/>
4240 ```
4241 OMA-URI:
4242 ```
4243 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~Permissions~Notifications/VirtualReality_BlockNewRequests
4244 ```
4245 Value (string):
4246 ```
4247 <enabled/> or <disabled/>
4248 ```
4249 OMA-URI:
4250 ```
4251 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~Permissions~Notifications/VirtualReality_Locked
4252 ```
4253 Value (string):
4254 ```
4255 <enabled/> or <disabled/>
4256 ```
4257 #### macOS
4258 ```
4259 <dict>
4260   <key>Permissions</key>
4261   <dict>
4262     <key>Camera</key>
4263     <dict>
4264       <key>Allow</key>
4265       <array>
4266         <string>https://example.org</string>
4267         <string>https://example.org:1234</string>
4268       </array>
4269       <key>Block</key>
4270       <array>
4271         <string>https://example.edu</string>
4272       </array>
4273       <key>BlockNewRequests</key>
4274       <true/> | <false/>
4275       <key>Locked</key>
4276       <true/> | <false/>
4277     </dict>
4278     <key>Microphone</key>
4279     <dict>
4280       <key>Allow</key>
4281       <array>
4282         <string>https://example.org</string>
4283       </array>
4284       <key>Block</key>
4285       <array>
4286         <string>https://example.edu</string>
4287       </array>
4288       <key>BlockNewRequests</key>
4289       <true/> | <false/>
4290       <key>Locked</key>
4291       <true/> | <false/>
4292     </dict>
4293     <key>Location</key>
4294     <dict>
4295       <key>Allow</key>
4296       <array>
4297         <string>https://example.org</string>
4298       </array>
4299       <key>Block</key>
4300       <array>
4301         <string>https://example.edu</string>
4302       </array>
4303       <key>BlockNewRequests</key>
4304       <true/> | <false/>
4305       <key>Locked</key>
4306       <true/> | <false/>
4307     </dict>
4308     <key>Notifications</key>
4309     <dict>
4310       <key>Allow</key>
4311       <array>
4312         <string>https://example.org</string>
4313       </array>
4314       <key>Block</key>
4315       <array>
4316         <string>https://example.edu</string>
4317       </array>
4318       <key>BlockNewRequests</key>
4319       <true/>
4320       <key>Locked</key>
4321       <true/>
4322     </dict>
4323     <key>Autoplay</key>
4324     <dict>
4325       <key>Allow</key>
4326       <array>
4327         <string>https://example.org</string>
4328       </array>
4329       <key>Block</key>
4330       <array>
4331         <string>https://example.edu</string>
4332       </array>
4333       <key>Default</key>
4334       <string>allow-audio-video | block-audio | block-audio-video</string>
4335       <key>Locked</key>
4336       <true/> | <false/>
4337     </dict>
4338   </dict>
4339 </dict>
4340 ```
4341 #### policies.json
4342 ```
4343 {
4344   "policies": {
4345     "Permissions": {
4346       "Camera": {
4347         "Allow": ["https://example.org","https://example.org:1234"],
4348         "Block": ["https://example.edu"],
4349         "BlockNewRequests": true | false,
4350         "Locked": true | false
4351       },
4352       "Microphone": {
4353         "Allow": ["https://example.org"],
4354         "Block": ["https://example.edu"],
4355         "BlockNewRequests": true | false,
4356         "Locked": true | false
4357       },
4358       "Location": {
4359         "Allow": ["https://example.org"],
4360         "Block": ["https://example.edu"],
4361         "BlockNewRequests": true | false,
4362         "Locked": true | false
4363       },
4364       "Notifications": {
4365         "Allow": ["https://example.org"],
4366         "Block": ["https://example.edu"],
4367         "BlockNewRequests": true | false,
4368         "Locked": true | false
4369       },
4370       "Autoplay": {
4371         "Allow": ["https://example.org"],
4372         "Block": ["https://example.edu"],
4373         "Default": "allow-audio-video" | "block-audio" | "block-audio-video",
4374         "Locked": true | false
4375       }
4376     }
4377   }
4378 }
4379 ```
4380 ### PictureInPicture
4381
4382 Enable or disable Picture-in-Picture as well as prevent the user from enabling or disabling it (Locked).
4383
4384 **Compatibility:** Firefox 78, Firefox ESR 78\
4385 **CCK2 Equivalent:** N/A\
4386 **Preferences Affected:** `media.videocontrols.picture-in-picture.video-toggle.enabled`
4387
4388 #### Windows (GPO)
4389 ```
4390 Software\Policies\Mozilla\Firefox\PictureInPicture\Enabled = 0x1 | 0x0
4391 Software\Policies\Mozilla\Firefox\PictureInPicture\Locked = 0x1 | 0x0
4392
4393 ```
4394 #### Windows (Intune)
4395 OMA-URI:
4396 ```
4397 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~PictureInPicture/PictureInPicture_Enabled
4398 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~PictureInPicture/PictureInPicture_Locked
4399 ```
4400 Value (string):
4401 ```
4402 <enabled/> or <disabled/>
4403 ```
4404 #### macOS
4405 ```
4406 <dict>
4407   <key>PictureInPicture</key>
4408   <dict>
4409     <key>Enabled</key>
4410     <true/> | <false/>
4411     <key>Locked</key>
4412     <true/> | <false/>
4413   </dict>
4414 </dict>
4415 ```
4416 #### policies.json
4417 ```
4418 {
4419   "policies": {
4420     "PictureInPicture": {
4421       "Enabled": true | false,
4422       "Locked": true | false
4423     }
4424   }
4425 }
4426 ```
4427 ### PopupBlocking
4428 Configure the default pop-up window policy as well as origins for which pop-up windows are allowed.
4429
4430 `Allow` is a list of origins where popup-windows are allowed.
4431
4432 `Default` determines whether or not pop-up windows are allowed by default.
4433
4434 `Locked` prevents the user from changing pop-up preferences.
4435
4436 **Compatibility:** Firefox 60, Firefox ESR 60\
4437 **CCK2 Equivalent:** `permissions.popup`\
4438 **Preferences Affected:** `dom.disable_open_during_load`
4439
4440 #### Windows (GPO)
4441 ```
4442 Software\Policies\Mozilla\Firefox\PopupBlocking\Allow\1 = "https://example.org"
4443 Software\Policies\Mozilla\Firefox\PopupBlocking\Allow\2 = "https://example.edu"
4444 Software\Policies\Mozilla\Firefox\PopupBlocking\Default = 0x1 | 0x0
4445 Software\Policies\Mozilla\Firefox\PopupBlocking\Locked = 0x1 | 0x0
4446 ```
4447 #### Windows (Intune)
4448 OMA-URI:
4449 ```
4450 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~Popups/PopupBlocking_Allow
4451 ```
4452 Value (string):
4453 ```
4454 <enabled/>
4455 <data id="Permissions" value="1&#xF000;https://example.org&#xF000;2&#xF000;https://example.edu"/>
4456 ```
4457 OMA-URI:
4458 ```
4459 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~Popups/PopupBlocking_Default
4460 ```
4461 Value (string):
4462 ```
4463 <enabled/> or <disabled/>
4464 ```
4465 OMA-URI:
4466 ```
4467 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~Popups/PopupBlocking_Locked
4468 ```
4469 Value (string):
4470 ```
4471 <enabled/> or <disabled/>
4472 ```
4473 #### macOS
4474 ```
4475 <dict>
4476   <key>PopupBlocking</key>
4477   <dict>
4478     <key>Allow</key>
4479     <array>
4480       <string>http://example.org</string>
4481       <string>http://example.edu</string>
4482     </array>
4483     <key>Default</key>
4484     <true/> | <false/>
4485     <key>Locked</key>
4486     <true/> | <false/>
4487   </dict>
4488 </dict>
4489 ```
4490 #### policies.json
4491 ```
4492 {
4493   "policies": {
4494     "PopupBlocking": {
4495       "Allow": ["http://example.org/",
4496                 "http://example.edu/"],
4497       "Default": true | false,
4498       "Locked": true | false
4499     }
4500   }
4501 }
4502 ```
4503 ### Preferences
4504 Set and lock preferences.
4505
4506 **NOTE** On Windows, in order to use this policy, you must clear all settings in the old **Preferences (Deprecated)** section in group policy.
4507
4508 Previously you could only set and lock a subset of preferences. Starting with Firefox 81 and Firefox ESR 78.3 you can set many more preferences. You can also set default preferences, user preferences and you can clear preferences.
4509
4510 Preferences that start with the following prefixes are supported:
4511 ```
4512 accessibility.
4513 app.update.* (Firefox 86, Firefox 78.8)
4514 browser.
4515 datareporting.policy.
4516 dom.
4517 extensions.
4518 general.autoScroll (Firefox 83, Firefox ESR 78.5)
4519 general.smoothScroll (Firefox 83, Firefox ESR 78.5)
4520 geo.
4521 gfx.
4522 intl.
4523 keyword.enabled (Firefox 95, Firefox ESR 91.4)
4524 layers.
4525 layout.
4526 media.
4527 network.
4528 pdfjs. (Firefox 84, Firefox ESR 78.6)
4529 places.
4530 print.
4531 signon. (Firefox 83, Firefox ESR 78.5)
4532 spellchecker. (Firefox 84, Firefox ESR 78.6)
4533 toolkit.legacyUserProfileCustomizations.stylesheets (Firefox 95, Firefox ESR 91.4)
4534 ui.
4535 widget.
4536 xpinstall.signatures.required (Firefox ESR 102.10, Firefox ESR only)
4537 ```
4538 as well as the following security preferences:
4539
4540 | Preference | Type | Default
4541 | --- | --- | --- |
4542 | security.default_personal_cert | string | Ask Every Time
4543 | &nbsp;&nbsp;&nbsp;&nbsp;If set to Select Automatically, Firefox automatically chooses the default personal certificate.
4544 | security.insecure_connection_text.enabled | bool | false
4545 | &nbsp;&nbsp;&nbsp;&nbsp;If set to true, adds the words "Not Secure" for insecure sites.
4546 | security.insecure_connection_text.pbmode.enabled | bool | false
4547 | &nbsp;&nbsp;&nbsp;&nbsp;If set to true, adds the words "Not Secure" for insecure sites in private browsing.
4548 | security.mixed_content.block_active_content | boolean | true
4549 | &nbsp;&nbsp;&nbsp;&nbsp;If false, mixed active content (HTTP and HTTPS) is not blocked.
4550 | security.osclientcerts.autoload | boolean | false
4551 | &nbsp;&nbsp;&nbsp;&nbsp;If true, client certificates are loaded from the operating system certificate store.
4552 | security.OCSP.enabled | integer | 1
4553 | &nbsp;&nbsp;&nbsp;&nbsp;If 0, do not fetch OCSP. If 1, fetch OCSP for DV and EV certificates. If 2, fetch OCSP only for EV certificates
4554 | security.OCSP.require | boolean | false
4555 | &nbsp;&nbsp;&nbsp;&nbsp; If true, if an OCSP request times out, the connection fails.
4556 | security.osclientcerts.assume_rsa_pss_support | boolean | true
4557 | &nbsp;&nbsp;&nbsp;&nbsp; If false, we don't assume an RSA key can do RSA-PSS (Firefox 114, Firefox ESR 102.12).
4558 | security.ssl.enable_ocsp_stapling | boolean | true
4559 | &nbsp;&nbsp;&nbsp;&nbsp; If false, OCSP stapling is not enabled.
4560 | security.ssl.errorReporting.enabled | boolean | true
4561 | &nbsp;&nbsp;&nbsp;&nbsp;If false, SSL errors cannot be sent to Mozilla.
4562 | security.tls.enable_0rtt_data | boolean | true
4563 | &nbsp;&nbsp;&nbsp;&nbsp;If false, TLS early data is turned off (Firefox 93, Firefox 91.2, Firefox 78.15).
4564 | security.tls.hello_downgrade_check | boolean | true
4565 | &nbsp;&nbsp;&nbsp;&nbsp;If false, the TLS 1.3 downgrade check is disabled.
4566 | security.tls.version.enable-deprecated | boolean | false
4567 | &nbsp;&nbsp;&nbsp;&nbsp;If true, browser will accept TLS 1.0. and TLS 1.1 (Firefox 86, Firefox 78.8).
4568 | security.warn_submit_secure_to_insecure | boolean | true
4569 | &nbsp;&nbsp;&nbsp;&nbsp;If false, no warning is shown when submitting a form from https to http.
4570
4571 Using the preference as the key, set the `Value` to the corresponding preference value.
4572
4573 `Status` can be "default", "locked", "user" or "clear"
4574
4575 * `"default"`: Read/Write: Settings appear as default even if factory default differs.
4576 * `"locked"`: Read-Only: Settings appear as default even if factory default differs.
4577 * `"user"`: Read/Write: Settings appear as changed if it differs from factory default.
4578 * `"clear"`: Read/Write: `Value` has no effect. Resets to factory defaults on each startup.
4579
4580 `"user"` preferences persist across invocations of Firefox. It is the equivalent of a user setting the preference. They are most useful when a preference is needed very early in startup so it can't be set as default by policy. An example of this is ```toolkit.legacyUserProfileCustomizations.stylesheets```.
4581
4582 `"user"` preferences persist even if the policy is removed, so if you need to remove them, you should use the clear policy.
4583
4584 See the examples below for more detail.
4585
4586 IMPORTANT: Make sure you're only setting a particular preference using this mechanism and not some other way.
4587
4588 Status
4589 **Compatibility:** Firefox 81, Firefox ESR 78.3\
4590 **CCK2 Equivalent:** `preferences`\
4591 **Preferences Affected:** Many
4592
4593 #### Windows (GPO)
4594 Software\Policies\Mozilla\Firefox\Preferences (REG_MULTI_SZ) =
4595 ```
4596 {
4597   "accessibility.force_disabled": {
4598     "Value": 1,
4599     "Status": "default"
4600   },
4601   "browser.cache.disk.parent_directory": {
4602     "Value": "SOME_NATIVE_PATH",
4603     "Status": "user"
4604   },
4605   "browser.tabs.warnOnClose": {
4606     "Value": false,
4607     "Status": "locked"
4608   }
4609 }
4610 ```
4611 #### Windows (Intune)
4612 OMA-URI:
4613 ```
4614 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox/Preferences
4615 ```
4616 Value (string):
4617 ```
4618 <enabled/>
4619 <data id="JSON" value='
4620 {
4621   "accessibility.force_disabled": {
4622     "Value": 1,
4623     "Status": "default"
4624   },
4625   "browser.cache.disk.parent_directory": {
4626     "Value": "SOME_NATIVE_PATH",
4627     "Status": "user"
4628   },
4629   "browser.tabs.warnOnClose": {
4630     "Value": false,
4631     "Status": "locked"
4632   }
4633 }'/>
4634 ```
4635 #### macOS
4636 ```
4637 <dict>
4638   <key>Preferences</key>
4639   <dict>
4640     <key>accessibility.force_disabled</key>
4641     <dict>
4642       <key>Value</key>
4643       <integer>1</integer>
4644       <key>Status</key>
4645       <string>default</string>
4646     </dict>
4647     <key>browser.cache.disk.parent_directory</key>
4648     <dict>
4649       <key>Value</key>
4650       <string>SOME_NATIVE_PATH</string>
4651       <key>Status</key>
4652       <string>user</string>
4653     </dict>
4654     <key>browser.tabs.warnOnClose</key>
4655     <dict>
4656       <key>Value</key>
4657       <false/>
4658       <key>Status</key>
4659       <string>locked</string>
4660     </dict>
4661   </dict>
4662 </dict>
4663 ```
4664 #### policies.json
4665 ```
4666 {
4667   "policies": {
4668     "Preferences": {
4669       "accessibility.force_disabled": {
4670         "Value": 1,
4671         "Status": "default"
4672       },
4673       "browser.cache.disk.parent_directory": {
4674         "Value": "SOME_NATIVE_PATH",
4675         "Status": "user"
4676       },
4677       "browser.tabs.warnOnClose": {
4678         "Value": false,
4679         "Status": "locked"
4680       }
4681     }
4682   }
4683 }
4684 ```
4685 ### PrimaryPassword
4686 Require or prevent using a primary (formerly master) password.
4687
4688 If this value is true, a primary password is required. If this value is false, it works the same as if [`DisableMasterPasswordCreation`](#disablemasterpasswordcreation) was true and removes the primary password functionality.
4689
4690 If both DisableMasterPasswordCreation and PrimaryPassword are used, DisableMasterPasswordCreation takes precedent.
4691
4692 **Compatibility:** Firefox 79, Firefox ESR 78.1\
4693 **CCK2 Equivalent:** `noMasterPassword`\
4694 **Preferences Affected:** N/A
4695
4696 #### Windows (GPO)
4697 ```
4698 Software\Policies\Mozilla\Firefox\PrimaryPassword = 0x1 | 0x0
4699 ```
4700 #### Windows (Intune)
4701 OMA-URI:
4702 ```
4703 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox/PrimaryPassword
4704 ```
4705 Value (string):
4706 ```
4707 <enabled/> or <disabled/>
4708 ```
4709 #### macOS
4710 ```
4711 <dict>
4712   <key>PrimaryPassword</key>
4713   <true/> | <false/>
4714 </dict>
4715 ```
4716 #### policies.json
4717 ```
4718 {
4719   "policies": {
4720     "PrimaryPassword": true | false
4721   }
4722 }
4723 ```
4724 ### PromptForDownloadLocation
4725 Ask where to save each file before downloading.
4726
4727 **Compatibility:** Firefox 68, Firefox ESR 68\
4728 **CCK2 Equivalent:** N/A\
4729 **Preferences Affected:** `browser.download.useDownloadDir`
4730
4731 #### Windows (GPO)
4732 ```
4733 Software\Policies\Mozilla\Firefox\PromptForDownloadLocation = 0x1 | 0x0
4734 ```
4735 #### Windows (Intune)
4736 OMA-URI:
4737 ```
4738 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox/PromptForDownloadLocation
4739 ```
4740 Value (string):
4741 ```
4742 <enabled/> or <disabled/>
4743 ```
4744 #### macOS
4745 ```
4746 <dict>
4747   <key>PromptForDownloadLocation</key>
4748   <true/> | <false/>
4749 </dict>
4750 ```
4751 #### policies.json
4752 ```
4753 {
4754   "policies": {
4755     "PromptForDownloadLocation": true | false
4756   }
4757 }
4758 ```
4759 ### Proxy
4760 Configure proxy settings. These settings correspond to the connection settings in Firefox preferences.
4761 To specify ports, append them to the hostnames with a colon (:).
4762
4763 Unless you lock this policy, changes the user already has in place will take effect.
4764
4765 `Mode` is the proxy method being used.
4766
4767 `Locked` is whether or not proxy settings can be changed.
4768
4769 `HTTPProxy` is the HTTP proxy server.
4770
4771 `UseHTTPProxyForAllProtocols` is whether or not the HTTP proxy should be used for all other proxies.
4772
4773 `SSLProxy` is the SSL proxy server.
4774
4775 `FTPProxy` is the FTP proxy server.
4776
4777 `SOCKSProxy` is the SOCKS proxy server
4778
4779 `SOCKSVersion` is the SOCKS version (4 or 5)
4780
4781 `Passthrough` is list of hostnames or IP addresses that will not be proxied. Use `<local>` to bypass proxying for all hostnames which do not contain periods.
4782
4783 `AutoConfigURL` is a  URL for proxy configuration (only used if Mode is autoConfig).
4784
4785 `AutoLogin` means do not prompt for authentication if password is saved.
4786
4787 `UseProxyForDNS` to use proxy DNS when using SOCKS v5.
4788
4789 **Compatibility:** Firefox 60, Firefox ESR 60\
4790 **CCK2 Equivalent:** `networkProxy*`\
4791 **Preferences Affected:** `network.proxy.type`, `network.proxy.autoconfig_url`, `network.proxy.socks_remote_dns`, `signon.autologin.proxy`, `network.proxy.socks_version`, `network.proxy.no_proxies_on`, `network.proxy.share_proxy_settings`, `network.proxy.http`, `network.proxy.http_port`, `network.proxy.ftp`, `network.proxy.ftp_port`, `network.proxy.ssl`, `network.proxy.ssl_port`, `network.proxy.socks`, `network.proxy.socks_port`
4792
4793 #### Windows (GPO)
4794 ```
4795 Software\Policies\Mozilla\Firefox\Proxy\Mode = "none" | "system" | "manual" | "autoDetect" | "autoConfig"
4796 Software\Policies\Mozilla\Firefox\Proxy\Locked = 0x1 | 0x0
4797 Software\Policies\Mozilla\Firefox\=Proxy\HTTPProxy = https://httpproxy.example.com
4798 Software\Policies\Mozilla\Firefox\Proxy\UseHTTPProxyForAllProtocols = 0x1 | 0x0
4799 Software\Policies\Mozilla\Firefox\Proxy\SSLProxy = https://sslproxy.example.com
4800 Software\Policies\Mozilla\Firefox\Proxy\FTPProxy = https://ftpproxy.example.com
4801 Software\Policies\Mozilla\Firefox\Proxy\SOCKSProxy = https://socksproxy.example.com
4802 Software\Policies\Mozilla\Firefox\Proxy\SOCKSVersion = 0x4 | 0x5
4803 Software\Policies\Mozilla\Firefox\Proxy\Passthrough = <local>
4804 Software\Policies\Mozilla\Firefox\Proxy\AutoConfigURL = URL_TO_AUTOCONFIG
4805 Software\Policies\Mozilla\Firefox\Proxy\AutoLogin = 0x1 | 0x0
4806 Software\Policies\Mozilla\Firefox\Proxy\UseProxyForDNS = 0x1 | 0x0
4807 ```
4808 #### Windows (Intune)
4809 **Note**
4810 These setttings were moved to a category to make them easier to configure via Intune.
4811
4812 OMA-URI:
4813 ```
4814 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~ProxySettings/Proxy_Locked
4815 ```
4816 Value (string):
4817 ```
4818 <enabled/> or <disabled/>
4819 ```
4820 OMA-URI:
4821 ```
4822 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~ProxySettings/Proxy_ConnectionType
4823 ```
4824 Value (string):
4825 ```
4826 <enabled/>
4827 <data id="Proxy_ConnectionType" value="none | system | manual | autoDetect | autoConfig"/>
4828 ```
4829 OMA-URI:
4830 ```
4831 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~ProxySettings/Proxy_HTTPProxy
4832 ```
4833 Value (string):
4834 ```
4835 <enabled/>
4836 <data id="Proxy_HTTPProxy" value="httpproxy.example.com"/>
4837 ```
4838 OMA-URI:
4839 ```
4840 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~ProxySettings/Proxy_UseHTTPProxyForAllProtocols
4841 ```
4842 Value (string):
4843 ```
4844 <enabled/> or <disabled/>
4845 ```
4846 OMA-URI:
4847 ```
4848 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~ProxySettings/Proxy_SSLProxy
4849 ```
4850 Value (string):
4851 ```
4852 <enabled/>
4853 <data id="Proxy_SSLProxy" value="sslproxy.example.com"/>
4854 ```
4855 OMA-URI:
4856 ```
4857 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~ProxySettings/Proxy_SOCKSProxy
4858 ```
4859 Value (string):
4860 ```
4861 <enabled/>
4862 <data id="Proxy_SOCKSProxy" value="socksproxy.example.com"/>
4863 <data id="Proxy_SOCKSVersion" value="4 | 5"/>
4864 ```
4865 OMA-URI:
4866 ```
4867 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~ProxySettings/Proxy_AutoConfigURL
4868 ```
4869 Value (string):
4870 ```
4871 <enabled/>
4872 <data id="Proxy_AutoConfigURL" value="URL_TO_AUTOCONFIG"/>
4873 ```
4874 OMA-URI:
4875 ```
4876 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~ProxySettings/Proxy_Passthrough
4877 ```
4878 Value (string):
4879 ```
4880 <enabled/>
4881 <data id="Proxy_Passthrough" value="&lt;local&gt;"/>
4882 ```
4883 OMA-URI:
4884 ```
4885 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~ProxySettings/Proxy_AutoLogin
4886 ```
4887 Value (string):
4888 ```
4889 <enabled/> or <disabled/>
4890 ```
4891 OMA-URI:
4892 ```
4893 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~ProxySettings/Proxy_UseProxyForDNS
4894 ```
4895 Value (string):
4896 ```
4897 <enabled/> or <disabled/>
4898 ```
4899 OMA-URI (Old way):
4900 ```
4901 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox/Proxy
4902 ```
4903 Value (string):
4904 ```
4905 <enabled/>
4906 <data id="ProxyLocked" value="true | false"/>
4907 <data id="ConnectionType" value="none | system | manual | autoDetect | autoConfig"/>
4908 <data id="HTTPProxy" value="httpproxy.example.com"/>
4909 <data id="UseHTTPProxyForAllProtocols" value="true | false"/>
4910 <data id="SSLProxy" value="sslproxy.example.com"/>
4911 <data id="FTPProxy" value="ftpproxy.example.com"/>
4912 <data id="SOCKSProxy" value="socksproxy.example.com"/>
4913 <data id="SOCKSVersion" value="4 | 5"/>
4914 <data id="AutoConfigURL" value="URL_TO_AUTOCONFIG"/>
4915 <data id="Passthrough" value="<local>"/>
4916 <data id="AutoLogin" value="true | false"/>
4917 <data id="UseProxyForDNS" value="true | false"/>
4918 ```
4919 #### macOS
4920 ```
4921 <dict>
4922   <key>Proxy</key>
4923   <dict>
4924     <key>Mode</key>
4925     <string>none | system | manual | autoDetect | autoConfig</string>
4926     <key>Locked</key>
4927     <true> | </false>
4928     <key>HTTPProxy</key>
4929     <string>https://httpproxy.example.com</string>
4930     <key>UseHTTPProxyForAllProtocols</key>
4931     <true> | </false>
4932     <key>SSLProxy</key>
4933     <string>https://sslproxy.example.com</string>
4934     <key>FTPProxy</key>
4935     <string>https://ftpproxy.example.com</string>
4936     <key>SOCKSProxy</key>
4937     <string>https://socksproxy.example.com</string>
4938     <key>SOCKSVersion</key>
4939     <string>4 | 5</string>
4940     <key>Passthrough</key>
4941     <string>&lt;local>&gt;</string>
4942     <key>AutoConfigURL</key>
4943     <string>URL_TO_AUTOCONFIG</string>
4944     <key>AutoLogin</key>
4945     <true> | </false>
4946     <key>UseProxyForDNS</key>
4947     <true> | </false>
4948   </dict>
4949 </dict>
4950 ```
4951 #### policies.json
4952 ```
4953 {
4954   "policies": {
4955     "Proxy": {
4956       "Mode": "none" | "system" | "manual" | "autoDetect" | "autoConfig",
4957       "Locked": true | false,
4958       "HTTPProxy": "hostname",
4959       "UseHTTPProxyForAllProtocols": true | false,
4960       "SSLProxy": "hostname",
4961       "FTPProxy": "hostname",
4962       "SOCKSProxy": "hostname",
4963       "SOCKSVersion": 4 | 5,
4964       "Passthrough": "<local>",
4965       "AutoConfigURL": "URL_TO_AUTOCONFIG",
4966       "AutoLogin": true | false,
4967       "UseProxyForDNS": true | false
4968     }
4969   }
4970 }
4971 ```
4972 ### RequestedLocales
4973 Set the the list of requested locales for the application in order of preference. It will cause the corresponding language pack to become active.
4974
4975 Note: For Firefox 68, this can now be a string so that you can specify an empty value.
4976
4977 **Compatibility:** Firefox 64, Firefox ESR 60.4, Updated in Firefox 68, Firefox ESR 68\
4978 **CCK2 Equivalent:** N/A\
4979 **Preferences Affected:** N/A
4980 #### Windows (GPO)
4981 ```
4982 Software\Policies\Mozilla\Firefox\RequestedLocales\1 = "de"
4983 Software\Policies\Mozilla\Firefox\RequestedLocales\2 = "en-US"
4984
4985 or
4986
4987 Software\Policies\Mozilla\Firefox\RequestedLocales = "de,en-US"
4988 ```
4989 #### Windows (Intune)
4990 OMA-URI:
4991 ```
4992 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox/RequestedLocalesString
4993 ```
4994 Value (string):
4995 ```
4996 <enabled/>
4997 <data id="Preferences_String" value="de,en-US"/>
4998 ```
4999 #### macOS
5000 ```
5001 <dict>
5002   <key>RequestedLocales</key>
5003   <array>
5004     <string>de</string>
5005     <string>en-US</string>
5006   </array>
5007 </dict>
5008
5009 or
5010
5011 <dict>
5012   <key>RequestedLocales</key>
5013   <string>de,en-US</string>
5014 </dict>
5015
5016 ```
5017 #### policies.json
5018 ```
5019 {
5020   "policies": {
5021     "RequestedLocales": ["de", "en-US"]
5022   }
5023 }
5024
5025 or
5026
5027 {
5028   "policies": {
5029     "RequestedLocales": "de,en-US"
5030   }
5031 }
5032 ```
5033 <a name="SanitizeOnShutdown"></a>
5034
5035 ### SanitizeOnShutdown (Selective)
5036 Clear data on shutdown. Choose from Cache, Cookies, Download History, Form & Search History, Browsing History, Active Logins, Site Preferences and Offline Website Data.
5037
5038 Previously, these values were always locked. Starting with Firefox 74 and Firefox ESR 68.6, you can use the `Locked` option to either keep the values unlocked (set it to false), or lock only the values you set (set it to true). If you want the old behavior of locking everything, do not set `Locked` at all.
5039
5040 **Compatibility:** Firefox 68, Firefox ESR 68 (Locked added in 74/68.6)\
5041 **CCK2 Equivalent:** N/A\
5042 **Preferences Affected:** `privacy.sanitize.sanitizeOnShutdown`, `privacy.clearOnShutdown.cache`, `privacy.clearOnShutdown.cookies`, `privacy.clearOnShutdown.downloads`, `privacy.clearOnShutdown.formdata`, `privacy.clearOnShutdown.history`, `privacy.clearOnShutdown.sessions`, `privacy.clearOnShutdown.siteSettings`, `privacy.clearOnShutdown.offlineApps`
5043 #### Windows (GPO)
5044 ```
5045 Software\Policies\Mozilla\Firefox\SanitizeOnShutdown\Cache = 0x1 | 0x0
5046 Software\Policies\Mozilla\Firefox\SanitizeOnShutdown\Cookies = 0x1 | 0x0
5047 Software\Policies\Mozilla\Firefox\SanitizeOnShutdown\Downloads = 0x1 | 0x0
5048 Software\Policies\Mozilla\Firefox\SanitizeOnShutdown\FormData = 0x1 | 0x0
5049 Software\Policies\Mozilla\Firefox\SanitizeOnShutdown\History = 0x1 | 0x0
5050 Software\Policies\Mozilla\Firefox\SanitizeOnShutdown\Sessions = 0x1 | 0x0
5051 Software\Policies\Mozilla\Firefox\SanitizeOnShutdown\SiteSettings = 0x1 | 0x0
5052 Software\Policies\Mozilla\Firefox\SanitizeOnShutdown\OfflineApps = 0x1 | 0x0
5053 Software\Policies\Mozilla\Firefox\SanitizeOnShutdown\Locked = 0x1 | 0x0
5054 ```
5055 #### Windows (Intune)
5056 OMA-URI:
5057 ```
5058 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~SanitizeOnShutdown/A_SanitizeOnShutdown_Cache
5059 ```
5060 Value (string):
5061 ```
5062 <enabled/> or <disabled/>
5063 ```
5064 OMA-URI:
5065 ```
5066 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~SanitizeOnShutdown/B_SanitizeOnShutdown_Cookies
5067 ```
5068 Value (string):
5069 ```
5070 <enabled/> or <disabled/>
5071 ```
5072 OMA-URI:
5073 ```
5074 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~SanitizeOnShutdown/C_SanitizeOnShutdown_Downloads
5075 ```
5076 Value (string):
5077 ```
5078 <enabled/> or <disabled/>
5079 ```
5080 OMA-URI:
5081 ```
5082 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~SanitizeOnShutdown/D_SanitizeOnShutdown_FormData
5083 ```
5084 Value (string):
5085 ```
5086 <enabled/> or <disabled/>
5087 ```
5088 OMA-URI:
5089 ```
5090 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~SanitizeOnShutdown/E_SanitizeOnShutdown_History
5091 ```
5092 Value (string):
5093 ```
5094 <enabled/> or <disabled/>
5095 ```
5096 OMA-URI:
5097 ```
5098 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~SanitizeOnShutdown/F_SanitizeOnShutdown_Sessions
5099 ```
5100 Value (string):
5101 ```
5102 <enabled/> or <disabled/>
5103 ```
5104 OMA-URI:
5105 ```
5106 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~SanitizeOnShutdown/G_SanitizeOnShutdown_SiteSettings
5107 ```
5108 Value (string):
5109 ```
5110 <enabled/> or <disabled/>
5111 ```
5112 OMA-URI:
5113 ```
5114 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~SanitizeOnShutdown/H_SanitizeOnShutdown_OfflineApps
5115 ```
5116 Value (string):
5117 ```
5118 <enabled/> or <disabled/>
5119 ```
5120 OMA-URI:
5121 ```
5122 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~SanitizeOnShutdown/I_SanitizeOnShutdown_Locked
5123 ```
5124 Value (string):
5125 ```
5126 <enabled/> or <disabled/>
5127 ```
5128 #### macOS
5129 ```
5130 <dict>
5131   <key>SanitizeOnShutdown</key>
5132   <dict>
5133     <key>Cache</key>
5134     <true/> | <false/>
5135     <key>Cookies</key>
5136     <true/> | <false/>
5137     <key>Downloads</key>
5138     <true/> | <false/>
5139     <key>FormData</key>
5140     <true/> | <false/>
5141     <key>History</key>
5142     <true/> | <false/>
5143     <key>Sessions</key>
5144     <true/> | <false/>
5145     <key>SiteSettings</key>
5146     <true/> | <false/>
5147     <key>OfflineApps</key>
5148     <true/> | <false/>
5149     <key>Locked</key>
5150     <true/> | <false/>
5151   </dict>
5152 </dict>
5153 ```
5154 #### policies.json
5155 ```
5156 {
5157   "policies": {
5158     "SanitizeOnShutdown": {
5159       "Cache": true | false,
5160       "Cookies": true | false,
5161       "Downloads": true | false,
5162       "FormData": true | false,
5163       "History": true | false,
5164       "Sessions": true | false,
5165       "SiteSettings": true | false,
5166       "OfflineApps": true | false,
5167       "Locked": true | false
5168     }
5169   }
5170 }
5171 ```
5172 ### SanitizeOnShutdown (All)
5173 Clear all data on shutdown, including Browsing & Download History, Cookies, Active Logins, Cache, Form & Search History, Site Preferences and Offline Website Data.
5174
5175 **Compatibility:** Firefox 60, Firefox ESR 60\
5176 **CCK2 Equivalent:** N/A\
5177 **Preferences Affected:** `privacy.sanitize.sanitizeOnShutdown`, `privacy.clearOnShutdown.cache`, `privacy.clearOnShutdown.cookies`, `privacy.clearOnShutdown.downloads`, `privacy.clearOnShutdown.formdata`, `privacy.clearOnShutdown.history`, `privacy.clearOnShutdown.sessions`, `privacy.clearOnShutdown.siteSettings`, `privacy.clearOnShutdown.offlineApps`
5178 #### Windows (GPO)
5179 ```
5180 Software\Policies\Mozilla\Firefox\SanitizeOnShutdown = 0x1 | 0x0
5181 ```
5182 #### Windows (Intune)
5183 OMA-URI:
5184 ```
5185 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox/C_SanitizeOnShutdown
5186 ```
5187 Value (string):
5188 ```
5189 <enabled/> or <disabled/>
5190 ```
5191 #### macOS
5192 ```
5193 <dict>
5194   <key>SanitizeOnShutdown</key>
5195   <true/> | <false/>
5196 </dict>
5197 ```
5198 #### policies.json
5199 ```
5200 {
5201   "policies": {
5202     "SanitizeOnShutdown": true | false
5203   }
5204 }
5205 ```
5206 ### SearchBar
5207 Set whether or not search bar is displayed.
5208
5209 **Compatibility:** Firefox 60, Firefox ESR 60\
5210 **CCK2 Equivalent:** `showSearchBar`\
5211 **Preferences Affected:** N/A
5212
5213 #### Windows (GPO)
5214 ```
5215 Software\Policies\Mozilla\Firefox\SearchBar = "unified" | "separate"
5216 ```
5217
5218 #### Windows (Intune)
5219 OMA-URI:
5220 ```
5221 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox/SearchBar
5222 ```
5223 Value (string):
5224 ```
5225 <enabled/>
5226 <data id="SearchBar" value="unified | separate"/>
5227 ```
5228 #### macOS
5229 ```
5230 <dict>
5231   <key>SearchBar</key>
5232   <string>unified | separate</string>
5233 </dict>
5234 ```
5235 #### policies.json
5236 ```
5237 {
5238   "policies": {
5239     "SearchBar": "unified" | "separate"
5240   }
5241 }
5242 ```
5243 <a name="SearchEngines"></a>
5244
5245 ### SearchEngines (This policy is only available on the ESR.)
5246
5247 ### SearchEngines | Add
5248
5249 Add new search engines. Although there are only five engines available in the ADMX template, there is no limit. To add more in the ADMX template, you can duplicate the XML.
5250
5251 This policy is only available on the ESR. `Name` and `URLTemplate` are required.
5252
5253 `Name` is the name of the search engine.
5254
5255 `URLTemplate` is the search URL with {searchTerms} to substitute for the search term.
5256
5257 `Method` is either GET or POST
5258
5259 `IconURL` is a URL for the icon to use.
5260
5261 `Alias` is a keyword to use for the engine.
5262
5263 `Description` is a description of the search engine.
5264
5265 `PostData` is the POST data as name value pairs separated by &.
5266
5267 `SuggestURLTemplate` is a search suggestions URL with {searchTerms} to substitute for the search term.
5268
5269 `Encoding` is the query charset for the engine. It defaults to UTF-8.
5270
5271 **Compatibility:** Firefox ESR 60 (POST support in Firefox ESR 68, Encoding support in Firefox 91)\
5272 **CCK2 Equivalent:** `searchplugins`\
5273 **Preferences Affected:** N/A
5274
5275 #### Windows (GPO)
5276 ```
5277 Software\Policies\Mozilla\Firefox\SearchEngines\Add\1\Name = "Example1"
5278 Software\Policies\Mozilla\Firefox\SearchEngines\Add\1\URLTemplate = "https://www.example.org/q={searchTerms}"
5279 Software\Policies\Mozilla\Firefox\SearchEngines\Add\1\Method = "GET" | "POST"
5280 Software\Policies\Mozilla\Firefox\SearchEngines\Add\1\IconURL = "https://www.example.org/favicon.ico"
5281 Software\Policies\Mozilla\Firefox\SearchEngines\Add\1\Alias = "example"
5282 Software\Policies\Mozilla\Firefox\SearchEngines\Add\1\Description = "Example Description"
5283 Software\Policies\Mozilla\Firefox\SearchEngines\Add\1\SuggestURLTemplate = "https://www.example.org/suggestions/q={searchTerms}"
5284 Software\Policies\Mozilla\Firefox\SearchEngines\Add\1\PostData = "name=value&q={searchTerms}"
5285 ```
5286 #### Windows (Intune)
5287 OMA-URI:
5288 ```
5289 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~Search/SearchEngines_1
5290 ```
5291 Value (string):
5292 ```
5293 <enabled/>
5294 <data id="SearchEngine_Name" value="Example1"/>
5295 <data id="SearchEngine_URLTemplate" value="https://www.example.org/q={searchTerms"/>
5296 <data id="SearchEngine_Method" value="GET | POST"/>
5297 <data id="SearchEngine_IconURL" value="https://www.example.org/favicon.ico"/>
5298 <data id="SearchEngine_Alias" value="example"/>
5299 <data id="SearchEngine_Description" value="Example Description"/>
5300 <data id="SearchEngine_SuggestURLTemplate" value="https://www.example.org/suggestions/q={searchTerms}"/>
5301 <data id="SearchEngine_PostData" value="name=value&amp;q={searchTerms}"/>
5302 ```
5303 #### macOS
5304 ```
5305 <dict>
5306   <key>SearchEngines</key>
5307   <dict>
5308     <key>Add</key>
5309     <array>
5310       <dict>
5311         <key>Name</key>
5312         <string>Example1</string>
5313         <key>URLTemplate</key>
5314         <string>https://www.example.org/q={searchTerms}</string>
5315         <key>Method</key>
5316         <string>GET | POST </string>
5317         <key>IconURL</key>
5318         <string>https://www.example.org/favicon.ico</string>
5319         <key>Alias</key>
5320         <string>example</string>
5321         <key>Description</key>
5322         <string>Example Description</string>
5323         <key>SuggestURLTemplate</key>
5324         <string>https://www.example.org/suggestions/q={searchTerms}</string>
5325         <key>PostData</key>
5326         <string>name=value&q={searchTerms}</string>
5327       </dict>
5328     <array>
5329   </dict>
5330 </dict>
5331 ```
5332 #### policies.json
5333 ```
5334 {
5335   "policies": {
5336     "SearchEngines": {
5337       "Add": [
5338         {
5339           "Name": "Example1",
5340           "URLTemplate": "https://www.example.org/q={searchTerms}",
5341           "Method": "GET" | "POST",
5342           "IconURL": "https://www.example.org/favicon.ico",
5343           "Alias": "example",
5344           "Description": "Description",
5345           "PostData": "name=value&q={searchTerms}",
5346           "SuggestURLTemplate": "https://www.example.org/suggestions/q={searchTerms}"
5347         }
5348       ]
5349     }
5350   }
5351 }
5352 ```
5353 ### SearchEngines | Default
5354
5355 Set the default search engine. This policy is only available on the ESR.
5356
5357 **Compatibility:** Firefox ESR 60\
5358 **CCK2 Equivalent:** `defaultSearchEngine`\
5359 **Preferences Affected:** N/A
5360
5361 #### Windows (GPO)
5362 ```
5363 Software\Policies\Mozilla\Firefox\SearchEngines\Default = NAME_OF_SEARCH_ENGINE
5364 ```
5365 #### Windows (Intune)
5366 OMA-URI:
5367 ```
5368 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~Search/SearchEngines_Default
5369 ```
5370 Value (string):
5371 ```
5372 <enabled/>
5373 <data id="SearchEngines_Default" value="NAME_OF_SEARCH_ENGINE"/>
5374 ```
5375 #### macOS
5376 ```
5377 <dict>
5378   <key>SearchEngines</key>
5379   <dict>
5380     <key>Default</key>
5381     <string>NAME_OF_SEARCH_ENGINE</string>
5382   </dict>
5383 </dict>
5384 ```
5385 #### policies.json
5386 ```
5387 {
5388   "policies": {
5389     "SearchEngines": {
5390       "Default": "NAME_OF_SEARCH_ENGINE"
5391     }
5392   }
5393 }
5394 ```
5395 ### SearchEngines | PreventInstalls
5396
5397 Prevent installing search engines from webpages.
5398
5399 **Compatibility:** Firefox ESR 60\
5400 **CCK2 Equivalent:** `disableSearchEngineInstall`\
5401 **Preferences Affected:** N/A
5402
5403 #### Windows (GPO)
5404 ```
5405 Software\Policies\Mozilla\Firefox\SearchEngines\PreventInstalls = 0x1 | 0x0
5406 ```
5407 #### Windows (Intune)
5408 OMA-URI:
5409 ```
5410 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~Search/SearchEngines_PreventInstalls
5411 ```
5412 Value (string):
5413 ```
5414 <enabled/> or <disabled/>
5415 ```
5416 #### macOS
5417 ```
5418 <dict>
5419   <key>SearchEngines</key>
5420   <dict>
5421     <key>PreventInstalls</key>
5422     <true/> | <false/>
5423   </dict>
5424 </dict>
5425 ```
5426 #### policies.json
5427 ```
5428 {
5429   "policies": {
5430     "SearchEngines": {
5431       "PreventInstalls": true | false
5432     }
5433   }
5434 }
5435 ```
5436 ### SearchEngines | Remove
5437
5438 Hide built-in search engines. This policy is only available on the ESR.
5439
5440 **Compatibility:** Firefox ESR 60.2\
5441 **CCK2 Equivalent:** `removeDefaultSearchEngines` (removed all built-in engines)\
5442 **Preferences Affected:** N/A
5443
5444 #### Windows (GPO)
5445 ```
5446 Software\Policies\Mozilla\Firefox\SearchEngines\Remove\1 = NAME_OF_SEARCH_ENGINE
5447 ```
5448 #### Windows (Intune)
5449 OMA-URI:
5450 ```
5451 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~Search/SearchEngines_Remove
5452 ```
5453 Value (string):
5454 ```
5455 <enabled/>
5456 <data id="SearchEngines_Remove" value="1&#xF000;NAME_OF_SEARCH_ENGINE"/>
5457 ```
5458 #### macOS
5459 ```
5460 <dict>
5461   <key>SearchEngines</key>
5462   <dict>
5463     <key>Remove</key>
5464     <array>
5465       <string>NAME_OF_SEARCH_ENGINE</string>
5466     </array>
5467   </dict>
5468 </dict>
5469 ```
5470 #### policies.json
5471 ```
5472 {
5473   "policies": {
5474     "SearchEngines": {
5475       "Remove": ["NAME_OF_SEARCH_ENGINE"]
5476     }
5477   }
5478 }
5479 ```
5480 ### SearchSuggestEnabled
5481
5482 Enable search suggestions.
5483
5484 **Compatibility:** Firefox 68, Firefox ESR 68\
5485 **CCK2 Equivalent:** N/A\
5486 **Preferences Affected:** `browser.urlbar.suggest.searches`, `browser.search.suggest.enabled`
5487
5488 #### Windows (GPO)
5489 ```
5490 Software\Policies\Mozilla\Firefox\SearchSuggestEnabled = 0x1 | 0x0
5491 ```
5492 #### Windows (Intune)
5493 OMA-URI:
5494 ```
5495 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~Search/SearchSuggestEnabled
5496 ```
5497 Value (string):
5498 ```
5499 <enabled/> or <disabled/>
5500 ```
5501 #### macOS
5502 ```
5503 <dict>
5504   <key>SearchSuggestEnabled</key>
5505   <true/> | <false/>
5506 </dict>
5507 ```
5508 #### policies.json
5509 ```
5510 {
5511   "policies": {
5512     "SearchSuggestEnabled": true | false
5513   }
5514 }
5515 ```
5516 ### SecurityDevices
5517
5518 Add or delete PKCS #11 modules.
5519
5520 **Compatibility:** Firefox 114, Firefox ESR 112.12\
5521 **CCK2 Equivalent:** N/A\
5522 **Preferences Affected:** N/A
5523
5524 #### Windows (GPO)
5525 ```
5526 Software\Policies\Mozilla\Firefox\SecurityDevices\Add\NAME_OF_DEVICE_TO_ADD = PATH_TO_LIBRARY_FOR_DEVICE
5527 Software\Policies\Mozilla\Firefox\SecurityDevices\Remove\1 = NAME_OF_DEVICE_TO_REMOVE
5528 ```
5529 #### Windows (Intune)
5530 OMA-URI:
5531 ```
5532 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox/SecurityDevices/SecurityDevices_Add
5533 ```
5534 Value (string):
5535 ```
5536 <enabled/>
5537 <data id="SecurityDevices" value="NAME_OF_DEVICE_TO_ADD&#xF000;PATH_TO_LIBRARY_FOR_DEVICE"/>
5538 ```
5539 OMA-URI:
5540 ```
5541 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox/SecurityDevices/SecurityDevices_Delete
5542 ```
5543 Value (string):
5544 ```
5545 <enabled/>
5546 <data id="SecurityDevices" value="1&#xF000;NAME_OF_DEVICE_TO_REMOVE"/>
5547 ```
5548 #### macOS
5549 ```
5550 <dict>
5551   <key>SecurityDevices</key>
5552   <dict>
5553     <key>Add<key>
5554     <dict>
5555       <key>NAME_OF_DEVICE_TO_ADD</key>
5556       <string>PATH_TO_LIBRARY_FOR_DEVICE</string>
5557     </dict>
5558     <key>Delete</add>
5559     <array>
5560       <string>NAME_OF_DEVICE_TO_DELETE</string>
5561     </array>
5562   </dict>
5563 </dict>
5564 ```
5565 #### policies.json
5566 ```
5567 {
5568   "policies": {
5569     "SecurityDevices": {
5570       "Add": {
5571         "NAME_OF_DEVICE_TO_ADD": "PATH_TO_LIBRARY_FOR_DEVICE"
5572       },
5573       "Delete": ["NAME_OF_DEVICE_TO_DELETE"]
5574     }
5575   }
5576 }
5577 ```
5578 ### SecurityDevices (Deprecated)
5579
5580 Install PKCS #11 modules.
5581
5582 **Compatibility:** Firefox 64, Firefox ESR 60.4\
5583 **CCK2 Equivalent:** `certs.devices`\
5584 **Preferences Affected:** N/A
5585
5586 #### Windows (GPO)
5587 ```
5588 Software\Policies\Mozilla\Firefox\SecurityDevices\NAME_OF_DEVICE = PATH_TO_LIBRARY_FOR_DEVICE
5589 ```
5590 #### Windows (Intune)
5591 OMA-URI:
5592 ```
5593 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox/SecurityDevices
5594 ```
5595 Value (string):
5596 ```
5597 <enabled/>
5598 <data id="SecurityDevices" value="NAME_OF_DEVICE&#xF000;PATH_TO_LIBRARY_FOR_DEVICE"/>
5599 ```
5600 #### macOS
5601 ```
5602 <dict>
5603   <key>SecurityDevices</key>
5604   <dict>
5605     <key>NAME_OF_DEVICE</key>
5606     <string>PATH_TO_LIBRARY_FOR_DEVICE</string>
5607   </dict>
5608 </dict>
5609 ```
5610 #### policies.json
5611 ```
5612 {
5613   "policies": {
5614     "SecurityDevices": {
5615       "NAME_OF_DEVICE": "PATH_TO_LIBRARY_FOR_DEVICE"
5616     }
5617   }
5618 }
5619 ```
5620 ### ShowHomeButton
5621 Show the home button on the toolbar.
5622
5623 Future versions of Firefox will not show the home button by default.
5624
5625 **Compatibility:** Firefox 88, Firefox ESR 78.10\
5626 **CCK2 Equivalent:** N/A\
5627 **Preferences Affected:** N/A
5628
5629 #### Windows (GPO)
5630 ```
5631 Software\Policies\Mozilla\Firefox\ShowHomeButton = 0x1 | 0x0
5632 ```
5633 #### Windows (Intune)
5634 OMA-URI:
5635 ```
5636 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~Homepage/Homepage_ShowHomeButton
5637 ```
5638 Value (string):
5639 ```
5640 <enabled/> or <disabled/>
5641 ```
5642 #### macOS
5643 ```
5644 <dict>
5645   <key>ShowHomeButton</key>
5646   <true/> | <false/>
5647 </dict>
5648 ```
5649 #### policies.json
5650 ```
5651 {
5652   "policies": {
5653     "ShowHomeButton": true | false
5654   }
5655 }
5656 ```
5657 ### SSLVersionMax
5658
5659 Set and lock the maximum version of TLS. (Firefox defaults to a maximum of TLS 1.3.)
5660
5661 **Compatibility:** Firefox 66, Firefox ESR 60.6\
5662 **CCK2 Equivalent:** N/A\
5663 **Preferences Affected:** `security.tls.version.max`
5664
5665 #### Windows (GPO)
5666 ```
5667 Software\Policies\Mozilla\Firefox\SSLVersionMax = "tls1" | "tls1.1" | "tls1.2" | "tls1.3"
5668 ```
5669 #### Windows (Intune)
5670 OMA-URI:
5671 ```
5672 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox/SSLVersionMax
5673 ```
5674 Value (string):
5675 ```
5676 <enabled/>
5677 <data id="SSLVersion" value="tls1 | tls1.2 | tls1.3"/>
5678 ```
5679 #### macOS
5680 ```
5681 <dict>
5682   <key>SSLVersionMax</key>
5683   <string>tls1 | tls1.1 | tls1.2 | tls1.3</string>
5684 </dict>
5685 ```
5686
5687 #### policies.json
5688 ```
5689 {
5690   "policies": {
5691     "SSLVersionMax": "tls1" | "tls1.1" | "tls1.2" | "tls1.3"
5692   }
5693 }
5694 ```
5695 ### SSLVersionMin
5696
5697 Set and lock the minimum version of TLS. (Firefox defaults to a minimum of TLS 1.2.)
5698
5699 **Compatibility:** Firefox 66, Firefox ESR 60.6\
5700 **CCK2 Equivalent:** N/A\
5701 **Preferences Affected:** `security.tls.version.min`
5702
5703 #### Windows (GPO)
5704 ```
5705 Software\Policies\Mozilla\Firefox\SSLVersionMin = "tls1" | "tls1.1" | "tls1.2" | "tls1.3"
5706 ```
5707 #### Windows (Intune)
5708 OMA-URI:
5709 ```
5710 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox/SSLVersionMin
5711 ```
5712 Value (string):
5713 ```
5714 <enabled/>
5715 <data id="SSLVersion" value="tls1 | tls1.2 | tls1.3"/>
5716 ```
5717 #### macOS
5718 ```
5719 <dict>
5720   <key>SSLVersionMin</key>
5721   <string>tls1 | tls1.1 | tls1.2 | tls1.3</string>
5722 </dict>
5723 ```
5724
5725 #### policies.json
5726 ```
5727 {
5728   "policies": {
5729     "SSLVersionMin": "tls1" | "tls1.1" | "tls1.2" | "tls1.3"
5730   }
5731 }
5732 ```
5733 ### SupportMenu
5734 Add a menuitem to the help menu for specifying support information.
5735
5736 **Compatibility:** Firefox 68.0.1, Firefox ESR 68.0.1\
5737 **CCK2 Equivalent:** helpMenu\
5738 **Preferences Affected:** N/A
5739
5740 #### Windows (GPO)
5741 ```
5742 Software\Policies\Mozilla\Firefox\SupportMenu\Title = "Support Menu"
5743 Software\Policies\Mozilla\Firefox\SupportMenu\URL = "http://example.com/support"
5744 Software\Policies\Mozilla\Firefox\SupportMenu\AccessKey = "S"
5745 ```
5746 #### Windows (Intune)
5747 OMA-URI:
5748 ```
5749 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox/SupportMenu
5750 ```
5751 Value (string):
5752 ```
5753 <enabled/>
5754 <data id="SupportMenuTitle" value="Support Menu"/>
5755 <data id="SupportMenuURL" value="http://example.com/support"/>
5756 <data id="SupportMenuAccessKey" value="S"/>
5757 ```
5758 #### macOS
5759 ```
5760 <dict>
5761   <key>SupportMenu</key>
5762   <dict>
5763     <key>Title</key>
5764     <string>SupportMenu</string>
5765     <key>URL</key>
5766     <string>http://example.com/support</string>
5767     <key>AccessKey</key>
5768     <string>S</string>
5769   </dict>
5770 </dict>
5771 ```
5772 #### policies.json
5773 ```
5774 {
5775   "policies": {
5776     "SupportMenu": {
5777       "Title": "Support Menu",
5778       "URL": "http://example.com/support",
5779       "AccessKey": "S"
5780     }
5781   }
5782 }
5783 ```
5784 ### StartDownloadsInTempDirectory
5785 Force downloads to start off in a local, temporary location rather than the default download directory.
5786
5787 **Compatibility:** Firefox 102\
5788 **CCK2 Equivalent:** N/A\
5789 **Preferences Affected:** `browser.download.start_downloads_in_tmp_dir`
5790
5791 #### Windows (GPO)
5792 ```
5793 Software\Policies\Mozilla\Firefox\StartDownloadsInTempDirectory = 0x1 | 0x0
5794 ```
5795 #### Windows (Intune)
5796 OMA-URI:
5797 ```
5798 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox/StartDownloadsInTempDirectory
5799 ```
5800 Value (string):
5801 ```
5802 <enabled/> or <disabled/>
5803 ```
5804 #### macOS
5805 ```
5806 <dict>
5807   <key>StartDownloadsInTempDirectory</key>
5808   <true/> | <false/>
5809 </dict>
5810 ```
5811 #### policies.json
5812 ```
5813 {
5814   "policies": {
5815     "StartDownloadsInTempDirectory": true | false
5816 }
5817 ```
5818 ### UserMessaging
5819
5820 Prevent Firefox from messaging the user in certain situations.
5821
5822 `WhatsNew` Remove the "What's New" icon and menuitem.
5823
5824 `ExtensionRecommendations` If false, don't recommend extensions while the user is visiting web pages.
5825
5826 `FeatureRecommendations` If false, don't recommend browser features.
5827
5828 `UrlbarInterventions` If false, Don't offer Firefox specific suggestions in the URL bar.
5829
5830 `SkipOnboarding` If true, don't show onboarding messages on the new tab page.
5831
5832 `MoreFromMozilla` If false, don't show the "More from Mozilla" section in Preferences. (Firefox 98)
5833
5834 `Locked` prevents the user from changing user messaging preferences.
5835
5836 **Compatibility:** Firefox 75, Firefox ESR 68.7\
5837 **CCK2 Equivalent:** N/A\
5838 **Preferences Affected:** `browser.messaging-system.whatsNewPanel.enabled`, `browser.newtabpage.activity-stream.asrouter.userprefs.cfr.addons`, `browser.newtabpage.activity-stream.asrouter.userprefs.cfr.features`, `browser.aboutwelcome.enabled`, `browser.preferences.moreFromMozilla`
5839
5840 #### Windows (GPO)
5841 ```
5842 Software\Policies\Mozilla\Firefox\UserMessaging\WhatsNew = 0x1 | 0x0
5843 Software\Policies\Mozilla\Firefox\UserMessaging\ExtensionRecommendations = 0x1 | 0x0
5844 Software\Policies\Mozilla\Firefox\UserMessaging\FeatureRecommendations = 0x1 | 0x0
5845 Software\Policies\Mozilla\Firefox\UserMessaging\UrlbarInterventions = 0x1 | 0x0
5846 Software\Policies\Mozilla\Firefox\UserMessaging\SkipOnboarding = 0x1 | 0x0
5847 Software\Policies\Mozilla\Firefox\UserMessaging\MoreFromMozilla = 0x1 | 0x0
5848 Software\Policies\Mozilla\Firefox\UserMessaging\Locked = 0x1 | 0x0
5849 ```
5850 #### Windows (Intune)
5851 OMA-URI:
5852 ```
5853 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~UserMessaging/UserMessaging_WhatsNew
5854 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~UserMessaging/UserMessaging_ExtensionRecommendations
5855 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~UserMessaging/UserMessaging_FeatureRecommendations
5856 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~UserMessaging/UserMessaging_UrlbarInterventions
5857 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~UserMessaging/UserMessaging_SkipOnboarding
5858 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~UserMessaging/UserMessaging_MoreFromMozilla
5859 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~UserMessaging/UserMessaging_Locked
5860 ```
5861 Value (string):
5862 ```
5863 <enabled/> or <disabled/>
5864 ```
5865 #### macOS
5866 ```
5867 <dict>
5868   <key>UserMessaging</key>
5869   <dict>
5870     <key>WhatsNew</key>
5871     <true/> | <false/>
5872     <key>ExtensionRecommendations</key>
5873     <true/> | <false/>
5874     <key>FeatureRecommendations</key>
5875     <true/> | <false/>
5876     <key>UrlbarInterventions</key>
5877     <true/> | <false/>
5878     <key>SkipOnboarding</key>
5879     <true/> | <false/>
5880     <key>MoreFromMozilla</key>
5881     <true/> | <false/>
5882     <key>Locked</key>
5883     <true/> | <false/>
5884   </dict>
5885 </dict>
5886 ```
5887 #### policies.json
5888 ```
5889 {
5890   "policies": {
5891     "UserMessaging": {
5892       "WhatsNew": true | false,
5893       "ExtensionRecommendations": true | false,
5894       "FeatureRecommendations": true | false,
5895       "UrlbarInterventions": true | false,
5896       "SkipOnboarding": true | false,
5897       "MoreFromMozilla": true | false,
5898       "Locked": true | false
5899     }
5900   }
5901 }
5902 ```
5903 ### UseSystemPrintDialog
5904 Use the system print dialog instead of the print preview window.
5905
5906 **Compatibility:** Firefox 102\
5907 **CCK2 Equivalent:** N/A\
5908 **Preferences Affected:** `print.prefer_system_dialog`
5909
5910 #### Windows (GPO)
5911 ```
5912 Software\Policies\Mozilla\Firefox\UseSystemPrintDialog = 0x1 | 0x0
5913 ```
5914 #### Windows (Intune)
5915 OMA-URI:
5916 ```
5917 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox/UseSystemPrintDialog
5918 ```
5919 Value (string):
5920 ```
5921 <enabled/> or <disabled/>
5922 ```
5923 #### macOS
5924 ```
5925 <dict>
5926   <key>UseSystemPrintDialog</key>
5927   <true/> | <false/>
5928 </dict>
5929 ```
5930 #### policies.json
5931 ```
5932 {
5933   "policies": {
5934     "UseSystemPrintDialog": true | false
5935   }
5936 }
5937 ```
5938 ### WebsiteFilter
5939 Block websites from being visited. The parameters take an array of Match Patterns, as documented in https://developer.mozilla.org/en-US/Add-ons/WebExtensions/Match_patterns.
5940 The arrays are limited to 1000 entries each.
5941
5942 If you want to block all URLs, you can use `<all_urls>` or `*://*/*`. You can't have just a `*` on the right side.
5943
5944 For specific protocols, use `https://*/*` or `http://*/*`.
5945
5946 As of Firefox 83 and Firefox ESR 78.5, file URLs are supported.
5947
5948 **Compatibility:** Firefox 60, Firefox ESR 60\
5949 **CCK2 Equivalent:** N/A\
5950 **Preferences Affected:** N/A
5951
5952 #### Windows (GPO)
5953 ```
5954 Software\Policies\Mozilla\Firefox\WebsiteFilter\Block\1 = "<all_urls>"
5955 Software\Policies\Mozilla\Firefox\WebsiteFilter\Exceptions\1 = "http://example.org/*"
5956 ```
5957 #### Windows (Intune)
5958 OMA-URI:
5959 ```
5960 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox/B_WebsiteFilter_Block
5961 ```
5962 Value (string):
5963 ```
5964 <enabled/> <data id="WebsiteFilter" value="1&#xF000;&#60;all_urls&#62;"/>
5965 ```
5966 OMA-URI:
5967 ```
5968 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox/B_WebsiteFilter_Exceptions
5969 ```
5970 Value (string):
5971 ```
5972 <enabled/>
5973 <data id="WebsiteFilter" value="1&#xF000;http://example.org/*"/>
5974 ```
5975 #### macOS
5976 ```
5977 <dict>
5978   <key>WebsiteFilter</key>
5979   <dict>
5980     <key>Block</key>
5981     <array>
5982       <string><all_urls></string>
5983     </array>
5984     <key>Exceptions</key>
5985     <array>
5986       <string>http://example.org/*</string>
5987     </array>
5988   </dict>
5989
5990 </dict>
5991 ```
5992 #### policies.json
5993 ```
5994 {
5995   "policies": {
5996     "WebsiteFilter": {
5997       "Block": ["<all_urls>"],
5998       "Exceptions": ["http://example.org/*"]
5999     }
6000   }
6001 }
6002 ```
6003 ### WindowsSSO
6004 Allow Windows single sign-on for Microsoft, work, and school accounts.
6005
6006 If this policy is set to true, Firefox will use credentials stored in Windows to sign in to Microsoft, work, and school accounts.
6007
6008 **Compatibility:** Firefox 91\
6009 **CCK2 Equivalent:** N/A\
6010 **Preferences Affected:** `network.http.windows-sso.enabled`
6011
6012 #### Windows (GPO)
6013 ```
6014 Software\Policies\Mozilla\Firefox\WindowsSSO = 0x1 | 0x0
6015 ```
6016 #### Windows (Intune)
6017 OMA-URI:
6018 ```
6019 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox/WindowsSSO
6020 ```
6021 Value (string):
6022 ```
6023 <enabled/> or <disabled/>
6024 ```
6025 #### policies.json
6026 ```
6027 {
6028   "policies": {
6029     "WindowsSSO": true | false
6030   }
6031 }
6032 ```
6033