README.md

   1 **These policies are in active development and so might contain changes that do not work with current versions of Firefox.**
   2
   3 **You should use the [officially released versions](https://github.com/mozilla/policy-templates/releases) if you are deploying changes.**
   4
   5 Official policy documentation has been moved to https://mozilla.github.io/policy-templates/.
   6
   7 I'm maintaining things in the README.md until we can update links in Firefox.
   8
   9 Firefox policies can be specified using the [Group Policy templates on Windows](https://github.com/mozilla/policy-templates/tree/master/windows), [Intune on Windows](https://support.mozilla.org/kb/managing-firefox-intune), [configuration profiles on macOS](https://github.com/mozilla/policy-templates/tree/master/mac), or by creating a file called `policies.json`. On Windows, create a directory called `distribution` where the EXE is located and place the file there. On Mac, the file goes into `Firefox.app/Contents/Resources/distribution`.  On Linux, the file goes into `firefox/distribution`, where `firefox` is the installation directory for firefox, which varies by distribution or you can specify system-wide policy by placing the file in `/etc/firefox/policies`.
  10
  11 Unfortunately, JSON files do not support comments, but you can add extra entries to the JSON to use as comments. You will see an error in about:policies, but the policies will still work properly. For example:
  12
  13 ```
  14 {
  15   "policies": {
  16     "Authentication": {
  17       "SPNEGO": ["mydomain.com", "https://myotherdomain.com"]
  18     }
  19     "Authentication_Comment": "These domains are required for us"
  20   }
  21 }
  22 ```
  23
  24 | Policy Name | Description
  25 | --- | --- |
  26 | **[`3rdparty`](#3rdparty)** | Set policies that WebExtensions can access via chrome.storage.managed.
  27 | **[`AllowedDomainsForApps`](#alloweddomainsforapps)** | Define domains allowed to access Google Workspace.
  28 | **[`AppAutoUpdate`](#appautoupdate)** | Enable or disable automatic application update.
  29 | **[`AppUpdatePin`](#appupdatepin)** | Prevent Firefox from being updated beyond the specified version.
  30 | **[`AppUpdateURL`](#appupdateurl)** | Change the URL for application update.
  31 | **[`Authentication`](#authentication)** | Configure sites that support integrated authentication.
  32 | **[`AutoLaunchProtocolsFromOrigins`](#autolaunchprotocolsfromorigins)** | Define a list of external protocols that can be used from listed origins without prompting the user.
  33 | **[`BackgroundAppUpdate`](#backgroundappupdate)** | Enable or disable the background updater (Windows only).
  34 | **[`BlockAboutAddons`](#blockaboutaddons)** | Block access to the Add-ons Manager (about:addons).
  35 | **[`BlockAboutConfig`](#blockaboutconfig)** | Block access to about:config.
  36 | **[`BlockAboutProfiles`](#blockaboutprofiles)** | Block access to About Profiles (about:profiles).
  37 | **[`BlockAboutSupport`](#blockaboutsupport)** | Block access to Troubleshooting Information (about:support).
  38 | **[`Bookmarks`](#bookmarks)** | Add bookmarks in either the bookmarks toolbar or menu.
  39 | **[`CaptivePortal`](#captiveportal)** | Enable or disable the detection of captive portals.
  40 | **[`Certificates`](#certificates)** |
  41 | **[`Certificates -> ImportEnterpriseRoots`](#certificates--importenterpriseroots)** | Trust certificates that have been added to the operating system certificate store by a user or administrator.
  42 | **[`Certificates -> Install`](#certificates--install)** | Install certificates into the Firefox certificate store.
  43 | **[`Containers`](#containers)** | Set policies related to [containers](https://addons.mozilla.org/firefox/addon/multi-account-containers/).
  44 | **[`Cookies`](#cookies)** | Configure cookie preferences.
  45 | **[`DefaultDownloadDirectory`](#defaultdownloaddirectory)** | Set the default download directory.
  46 | **[`DisableAppUpdate`](#disableappupdate)** | Turn off application updates.
  47 | **[`DisableBuiltinPDFViewer`](#disablebuiltinpdfviewer)** | Disable the built in PDF viewer.
  48 | **[`DisabledCiphers`](#disabledciphers)** | Disable ciphers.
  49 | **[`DisableDefaultBrowserAgent`](#disabledefaultbrowseragent)** | Prevent the default browser agent from taking any actions (Windows only).
  50 | **[`DisableDeveloperTools`](#disabledevelopertools)** | Remove access to all developer tools.
  51 | **[`DisableFeedbackCommands`](#disablefeedbackcommands)** | Disable the menus for reporting sites.
  52 | **[`DisableFirefoxAccounts`](#disablefirefoxaccounts)** | Disable Firefox Accounts integration (Sync).
  53 | **[`DisableFirefoxScreenshots`](#disablefirefoxscreenshots)** | Remove access to Firefox Screenshots.
  54 | **[`DisableFirefoxStudies`](#disablefirefoxstudies)** | Disable Firefox studies (Shield).
  55 | **[`DisableForgetButton`](#disableforgetbutton)** | Disable the "Forget" button.
  56 | **[`DisableFormHistory`](#disableformhistory)** | Turn off saving information on web forms and the search bar.
  57 | **[`DisableMasterPasswordCreation`](#disablemasterpasswordcreation)** | Remove the master password functionality.
  58 | **[`DisablePasswordReveal`](#disablepasswordreveal)** | Do not allow passwords to be revealed in saved logins.
  59 | **[`DisablePocket`](#disablepocket)** | Remove Pocket in the Firefox UI.
  60 | **[`DisablePrivateBrowsing`](#disableprivatebrowsing)** | Remove access to private browsing.
  61 | **[`DisableProfileImport`](#disableprofileimport)** | Disables the "Import data from another browser" option in the bookmarks window.
  62 | **[`DisableProfileRefresh`](#disableprofilerefresh)** | Disable the Refresh Firefox button on about:support and support.mozilla.org
  63 | **[`DisableSafeMode`](#disablesafemode)** | Disable safe mode within the browser.
  64 | **[`DisableSecurityBypass`](#disablesecuritybypass)** | Prevent the user from bypassing security in certain cases.
  65 | **[`DisableSetDesktopBackground`](#disablesetdesktopbackground)** | Remove the "Set As Desktop Background..." menuitem when right clicking on an image.
  66 | **[`DisableSystemAddonUpdate`](#disablesystemaddonupdate)** | Prevent system add-ons from being installed or updated.
  67 | **[`DisableTelemetry`](#disabletelemetry)** | DisableTelemetry
  68 | **[`DisableThirdPartyModuleBlocking`](#disablethirdpartymoduleblocking)** | Do not allow blocking third-party modules.
  69 | **[`DisplayBookmarksToolbar`](#displaybookmarkstoolbar)** | Set the initial state of the bookmarks toolbar.
  70 | **[`DisplayMenuBar`](#displaymenubar)** | Set the state of the menubar.
  71 | **[`DNSOverHTTPS`](#dnsoverhttps)** | Configure DNS over HTTPS.
  72 | **[`DontCheckDefaultBrowser`](#dontcheckdefaultbrowser)** | Don't check if Firefox is the default browser at startup.
  73 | **[`DownloadDirectory`](#downloaddirectory)** | Set and lock the download directory.
  74 | **[`EnableTrackingProtection`](#enabletrackingprotection)** | Configure tracking protection.
  75 | **[`EncryptedMediaExtensions`](#encryptedmediaextensions)** | Enable or disable Encrypted Media Extensions and optionally lock it.
  76 | **[`EnterprisePoliciesEnabled`](#enterprisepoliciesenabled)** | Enable policy support on macOS.
  77 | **[`ExemptDomainFileTypePairsFromFileTypeDownloadWarnings`](#exemptdomainfiletypepairsfromfiletypedownloadwarnings)** | Disable warnings based on file extension for specific file types on domains.
  78 | **[`Extensions`](#extensions)** | Control the installation, uninstallation and locking of extensions.
  79 | **[`ExtensionSettings`](#extensionsettings)** | Manage all aspects of extensions.
  80 | **[`ExtensionUpdate`](#extensionupdate)** | Control extension updates.
  81 | **[`FirefoxHome`](#firefoxhome)** | Customize the Firefox Home page.
  82 | **[`GoToIntranetSiteForSingleWordEntryInAddressBar`](#gotointranetsiteforsinglewordentryinaddressbar)** | Force direct intranet site navigation instead of searching when typing single word entries in the address bar.
  83 | **[`Handlers`](#handlers)** | Configure default application handlers.
  84 | **[`HardwareAcceleration`](#hardwareacceleration)** | Control hardware acceleration.
  85 | **[`Homepage`](#homepage)** | Configure the default homepage and how Firefox starts.
  86 | **[`InstallAddonsPermission`](#installaddonspermission)** | Configure the default extension install policy as well as origins for extension installs are allowed.
  87 | **[`LegacyProfiles`](#legacyprofiles)** | Disable the feature enforcing a separate profile for each installation.
  88 | **[`LegacySameSiteCookieBehaviorEnabled`](#legacysamesitecookiebehaviorenabled)** | Enable default legacy SameSite cookie behavior setting.
  89 | **[`LegacySameSiteCookieBehaviorEnabledForDomainList`](#legacysamesitecookiebehaviorenabledfordomainlist)** | Revert to legacy SameSite behavior for cookies on specified sites.
  90 | **[`LocalFileLinks`](#localfilelinks)** | Enable linking to local files by origin.
  91 | **[`ManagedBookmarks`](#managedbookmarks)** | Configures a list of bookmarks managed by an administrator that cannot be changed by the user.
  92 | **[`ManualAppUpdateOnly`](#manualappupdateonly)** | Allow manual updates only and do not notify the user about updates.
  93 | **[`NetworkPrediction`](#networkprediction)** | Enable or disable network prediction (DNS prefetching).
  94 | **[`NewTabPage`](#newtabpage)** | Enable or disable the New Tab page.
  95 | **[`NoDefaultBookmarks`](#nodefaultbookmarks)** | Disable the creation of default bookmarks.
  96 | **[`OfferToSaveLogins`](#offertosavelogins)** | Control whether or not Firefox offers to save passwords.
  97 | **[`OfferToSaveLoginsDefault`](#offertosaveloginsdefault)** | Set the default value for whether or not Firefox offers to save passwords.
  98 | **[`OverrideFirstRunPage`](#overridefirstrunpage)** | Override the first run page.
  99 | **[`OverridePostUpdatePage`](#overridepostupdatepage)** | Override the upgrade page.
 100 | **[`PasswordManagerEnabled`](#passwordmanagerenabled)** | Remove (some) access to the password manager.
 101 | **[`PasswordManagerExceptions`](#passwordmanagerexceptions)** | Prevent Firefox from saving passwords for specific sites.
 102 | **[`PDFjs`](#pdfjs)** | Disable or configure PDF.js, the built-in PDF viewer.
 103 | **[`Permissions`](#permissions)** | Set permissions associated with camera, microphone, location, and notifications.
 104 | **[`PictureInPicture`](#pictureinpicture)** | Enable or disable Picture-in-Picture.
 105 | **[`PopupBlocking`](#popupblocking)** | Configure the default pop-up window policy as well as origins for which pop-up windows are allowed.
 106 | **[`Preferences`](#preferences)** | Set and lock preferences.
 107 | **[`PrimaryPassword`](#primarypassword)** | Require or prevent using a primary (formerly master) password.
 108 | **[`PromptForDownloadLocation`](#promptfordownloadlocation)** | Ask where to save each file before downloading.
 109 | **[`Proxy`](#proxy)** | Configure proxy settings.
 110 | **[`RequestedLocales`](#requestedlocales)** | Set the the list of requested locales for the application in order of preference.
 111 | **[`SanitizeOnShutdown` (All)](#sanitizeonshutdown-all)** | Clear all data on shutdown.
 112 | **[`SanitizeOnShutdown` (Selective)](#sanitizeonshutdown-selective)** | Clear data on shutdown.
 113 | **[`SearchBar`](#searchbar)** | Set whether or not search bar is displayed.
 114 | **[`SearchEngines`](#searchengines-this-policy-is-only-available-on-the-esr)** |
 115 | **[`SearchEngines -> Add`](#searchengines--add)** | Add new search engines.
 116 | **[`SearchEngines -> Default`](#searchengines--default)** | Set the default search engine.
 117 | **[`SearchEngines -> PreventInstalls`](#searchengines--preventinstalls)** | Prevent installing search engines from webpages.
 118 | **[`SearchEngines -> Remove`](#searchengines--remove)** | Hide built-in search engines.
 119 | **[`SearchSuggestEnabled`](#searchsuggestenabled)** | Enable search suggestions.
 120 | **[`SecurityDevices`](#securitydevices)** | Install PKCS #11 modules.
 121 | **[`ShowHomeButton`](#showhomebutton)** | Show the home button on the toolbar.
 122 | **[`SSLVersionMax`](#sslversionmax)** | Set and lock the maximum version of TLS.
 123 | **[`SSLVersionMin`](#sslversionmin)** | Set and lock the minimum version of TLS.
 124 | **[`StartDownloadsInTempDirectory`](#startdownloadsintempdirectory)** | Force downloads to start off in a local, temporary location rather than the default download directory.
 125 | **[`SupportMenu`](#supportmenu)** | Add a menuitem to the help menu for specifying support information.
 126 | **[`UserMessaging`](#usermessaging)** | Don't show certain messages to the user.
 127 | **[`UseSystemPrintDialog`](#usesystemprintdialog)** | Print using the system print dialog instead of print preview.
 128 | **[`WebsiteFilter`](#websitefilter)** | Block websites from being visited.
 129 | **[`WindowsSSO`](#windowssso)** | Allow Windows single sign-on for Microsoft, work, and school accounts.
 130
 131 ### 3rdparty
 132
 133 Allow WebExtensions to configure policy. For more information, see [Adding policy support to your extension](https://extensionworkshop.com/documentation/enterprise/adding-policy-support-to-your-extension/).
 134
 135 For GPO and Intune, the extension developer should provide an ADMX file.
 136
 137 **Compatibility:** Firefox 68\
 138 **CCK2 Equivalent:** N/A\
 139 **Preferences Affected:** N/A
 140
 141 #### macOS
 142 ```
 143 <dict>
 144   <key>3rdparty</key>
 145   <dict>
 146     <key>Extensions</key>
 147     <dict>
 148       <key>uBlock0@raymondhill.net</key>
 149       <dict>
 150         <key>adminSettings</key>
 151         <dict>
 152           <key>selectedFilterLists</key>
 153           <array>
 154             <string>ublock-privacy</string>
 155             <string>ublock-badware</string>
 156             <string>ublock-filters</string>
 157             <string>user-filters</string>
 158           </array>
 159         </dict>
 160       </dict>
 161     </dict>
 162   </dict>
 163 </dict>
 164 ```
 165 #### policies.json
 166 ```
 167 {
 168   "policies": {
 169     "3rdparty": {
 170       "Extensions": {
 171         "uBlock0@raymondhill.net": {
 172           "adminSettings": {
 173             "selectedFilterLists": [
 174               "ublock-privacy",
 175               "ublock-badware",
 176               "ublock-filters",
 177               "user-filters"
 178             ]
 179           }
 180         }
 181       }
 182     }
 183   }
 184 }
 185 ```
 186
 187 ### AllowedDomainsForApps
 188
 189 Define domains allowed to access Google Workspace.
 190
 191 This policy is based on the [Chrome policy](https://chromeenterprise.google/policies/#AllowedDomainsForApps) of the same name.
 192
 193 If this policy is enabled, users can only access Google Workspace using accounts from the specified domains. If you want to allow Gmail, you can add ```consumer_accounts``` to the list.
 194
 195 **Compatibility:** Firefox 89, Firefox ESR 78.11\
 196 **CCK2 Equivalent:** N/A\
 197 **Preferences Affected:** N/A
 198
 199 #### Windows (GPO)
 200 ```
 201 Software\Policies\Mozilla\Firefox\AllowedDomainsForApps = "managedfirefox.com,example.com"
 202 ```
 203 #### Windows (Intune)
 204 OMA-URI:
 205 ```
 206 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox/AllowedDomainsForApps
 207 ```
 208 Value (string):
 209 ```
 210 <enabled/>
 211 <data id="AllowedDomainsForApps" value="managedfirefox.com,example.com"/>
 212 ```
 213 #### macOS
 214 ```
 215 <dict>
 216   <key>AllowedDomainsForApps</key>
 217   <string>managedfirefox.com,example.com</string>
 218 </dict>
 219 ```
 220 #### policies.json
 221 ```
 222 {
 223   "policies": {
 224     "AllowedDomainsForApps": "managedfirefox.com,example.com"
 225   }
 226 }
 227 ```
 228 ### AppAutoUpdate
 229
 230 Enable or disable **automatic** application update.
 231
 232 If set to true, application updates are installed without user approval within Firefox. The operating system might still require approval.
 233
 234 If set to false, application updates are downloaded but the user can choose when to install the update.
 235
 236 If you have disabled updates via `DisableAppUpdate`, this policy has no effect.
 237
 238 **Compatibility:** Firefox 75, Firefox ESR 68.7\
 239 **CCK2 Equivalent:** N/A\
 240 **Preferences Affected:** `app.update.auto`
 241
 242 #### Windows (GPO)
 243 ```
 244 Software\Policies\Mozilla\Firefox\AppAutoUpdate = 0x1 | 0x0
 245 ```
 246 #### Windows (Intune)
 247 OMA-URI:
 248 ```
 249 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox/AppAutoUpdate
 250 ```
 251 Value (string):
 252 ```
 253 <enabled/> or <disabled/>
 254 ```
 255 #### macOS
 256 ```
 257 <dict>
 258   <key>AppAutoUpdate</key>
 259   <true/> | <false/>
 260 </dict>
 261 ```
 262 #### policies.json
 263 ```
 264 {
 265   "policies": {
 266     "AppAutoUpdate": true | false
 267   }
 268 }
 269 ```
 270 ### AppUpdatePin
 271
 272 Prevent Firefox from being updated beyond the specified version.
 273
 274 You can specify the any version as ```xx.``` and Firefox will be updated with all minor versions, but will not be updated beyond the major version.
 275
 276 You can also specify the version as ```xx.xx``` and Firefox will be updated with all patch versions, but will not be updated beyond the minor version.
 277
 278 You should specify a version that exists or is guaranteed to exist. If you specify a version that doesn't end up existing, Firefox will update beyond that version.
 279
 280 **Compatibility:** Firefox 102,\
 281 **CCK2 Equivalent:** N/A\
 282 **Preferences Affected:** N/A
 283
 284 #### Windows (GPO)
 285 ```
 286 Software\Policies\Mozilla\Firefox\AppUpdatePin = "106."
 287 ```
 288 #### Windows (Intune)
 289 OMA-URI:
 290 ```
 291 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox/AppUpdatePin
 292 ```
 293 Value (string):
 294 ```
 295 <enabled/>
 296 <data id="AppUpdatePin" value="106."/>
 297 ```
 298 #### macOS
 299 ```
 300 <dict>
 301   <key>AppUpdatePin</key>
 302   <string>106.</string>
 303 </dict>
 304 ```
 305 #### policies.json
 306 ```
 307 {
 308   "policies": {
 309     "AppUpdatePin": "106."
 310   }
 311 }
 312 ```
 313 ### AppUpdateURL
 314
 315 Change the URL for application update if you are providing Firefox updates from a custom update server.
 316
 317 **Compatibility:** Firefox 62, Firefox ESR 60.2\
 318 **CCK2 Equivalent:** N/A\
 319 **Preferences Affected:** `app.update.url`
 320
 321 #### Windows (GPO)
 322 ```
 323 Software\Policies\Mozilla\Firefox\AppUpdateURL = "https://yoursite.com"
 324 ```
 325 #### Windows (Intune)
 326 OMA-URI:
 327 ```
 328 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox/AppUpdateURL
 329 ```
 330 Value (string):
 331 ```
 332 <enabled/>
 333 <data id="AppUpdateURL" value="https://yoursite.com"/>
 334 ```
 335 #### macOS
 336 ```
 337 <dict>
 338   <key>AppUpdateURL</key>
 339   <string>https://yoursite.com</string>
 340 </dict>
 341 ```
 342 #### policies.json
 343 ```
 344 {
 345   "policies": {
 346     "AppUpdateURL": "https://yoursite.com"
 347   }
 348 }
 349 ```
 350 ### Authentication
 351
 352 Configure sites that support integrated authentication.
 353
 354 See [Integrated authentication](https://htmlpreview.github.io/?https://github.com/mdn/archived-content/blob/main/files/en-us/mozilla/integrated_authentication/raw.html) for more information.
 355
 356 `PrivateBrowsing` enables integrated authentication in private browsing.
 357
 358 **Compatibility:** Firefox 60, Firefox ESR 60 (AllowNonFQDN added in 62/60.2, AllowProxies added in 70/68.2, Locked added in 71/68.3, PrivateBrowsing added in 77/68.9)\
 359 **CCK2 Equivalent:** N/A\
 360 **Preferences Affected:** `network.negotiate-auth.trusted-uris`,`network.negotiate-auth.delegation-uris`,`network.automatic-ntlm-auth.trusted-uris`,`network.automatic-ntlm-auth.allow-non-fqdn`,`network.negotiate-auth.allow-non-fqdn`,`network.automatic-ntlm-auth.allow-proxies`,`network.negotiate-auth.allow-proxies`,`network.auth.private-browsing-sso`
 361
 362 #### Windows (GPO)
 363 ```
 364 Software\Policies\Mozilla\Firefox\Authentication\SPNEGO\1 = "mydomain.com"
 365 Software\Policies\Mozilla\Firefox\Authentication\SPNEGO\2 = "https://myotherdomain.com"
 366 Software\Policies\Mozilla\Firefox\Authentication\Delegated\1 = "mydomain.com"
 367 Software\Policies\Mozilla\Firefox\Authentication\Delegated\2 = "https://myotherdomain.com"
 368 Software\Policies\Mozilla\Firefox\Authentication\NTLM\1 = "mydomain.com"
 369 Software\Policies\Mozilla\Firefox\Authentication\NTLM\2 = "https://myotherdomain.com"
 370 Software\Policies\Mozilla\Firefox\Authentication\AllowNonFQDN\SPNEGO = 0x1 | 0x0
 371 Software\Policies\Mozilla\Firefox\Authentication\AllowNonFQDN\NTLM = 0x1 | 0x0
 372 Software\Policies\Mozilla\Firefox\Authentication\AllowProxies\SPNEGO = 0x1 | 0x0
 373 Software\Policies\Mozilla\Firefox\Authentication\AllowProxies\NTLM = 0x1 | 0x0
 374 Software\Policies\Mozilla\Firefox\Authentication\Locked = 0x1 | 0x0
 375 Software\Policies\Mozilla\Firefox\Authentication\PrivateBrowsing = 0x1 | 0x0
 376 ```
 377 #### Windows (Intune)
 378 OMA-URI:
 379 ```
 380 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~Authentication/Authentication_SPNEGO
 381 ```
 382 Value (string):
 383 ```
 384 <enabled/>
 385 <data id="Authentication" value="1&#xF000;mydomain&#xF000;2&#xF000;https://myotherdomain.com"/>
 386 ```
 387 OMA-URI:
 388 ```
 389 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~Authentication/Authentication_Delegated
 390 ```
 391 Value (string):
 392 ```
 393 <enabled/>
 394 <data id="Authentication" value="1&#xF000;mydomain&#xF000;2&#xF000;https://myotherdomain.com"/>
 395 ```
 396 OMA-URI:
 397 ```
 398 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~Authentication/Authentication_NTLM
 399 ```
 400 Value (string):
 401 ```
 402 <enabled/>
 403 <data id="Authentication" value="1&#xF000;mydomain&#xF000;2&#xF000;https://myotherdomain.com"/>
 404 ```
 405 OMA-URI:
 406 ```
 407 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~Authentication/Authentication_AllowNonFQDN
 408 ```
 409 Value (string):
 410 ```
 411 <enabled/>
 412 <data id="Authentication_AllowNonFQDN_NTLM" value="true | false"/>
 413 <data id="Authentication_AllowNonFQDN_SPNEGO" value="true | false"/>
 414 ```
 415 OMA-URI:
 416 ```
 417 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~Authentication/Authentication_Locked
 418 ```
 419 Value (string):
 420 ```
 421 <enabled/> or <disabled/>
 422 ```
 423 OMA-URI:
 424 ```
 425 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~Authentication/Authentication_PrivateBrowsing
 426 ```
 427 Value (string):
 428 ```
 429 <enabled/> or <disabled/>
 430 ```
 431 #### macOS
 432 ```
 433 <dict>
 434   <key>Authentication</key>
 435   <dict>
 436     <key>SPNEGO</key>
 437     <array>
 438       <string>mydomain.com</string>
 439       <string>https://myotherdomain.com</string>
 440     </array>
 441     <key>Delegated</key>
 442     <array>
 443       <string>mydomain.com</string>
 444       <string>https://myotherdomain.com</string>
 445     </array>
 446     <key>NTLM</key>
 447     <array>
 448       <string>mydomain.com</string>
 449       <string>https://myotherdomain.com</string>
 450     </array>
 451     <key>AllowNonFQDN</key>
 452       <dict>
 453       <key>SPNEGO</key>
 454       <true/> | <false/>
 455       <key>NTLM</key>
 456       <true/> | <false/>
 457     </dict>
 458     <key>AllowProxies</key>
 459       <dict>
 460       <key>SPNEGO</key>
 461       <true/> | <false/>
 462       <key>NTLM</key>
 463       <true/> | <false/>
 464     </dict>
 465     <key>Locked</key>
 466     <true/> | <false/>
 467     <key>PrivateBrowsing</key>
 468     <true/> | <false/>
 469   </dict>
 470 </dict>
 471 ```
 472 #### policies.json
 473 ```
 474 {
 475   "policies": {
 476     "Authentication": {
 477       "SPNEGO": ["mydomain.com", "https://myotherdomain.com"],
 478       "Delegated": ["mydomain.com", "https://myotherdomain.com"],
 479       "NTLM": ["mydomain.com", "https://myotherdomain.com"],
 480       "AllowNonFQDN": {
 481         "SPNEGO": true | false,
 482         "NTLM": true | false
 483       },
 484       "AllowProxies": {
 485         "SPNEGO": true | false,
 486         "NTLM": true | false
 487       },
 488       "Locked": true | false,
 489       "PrivateBrowsing": true | false
 490     }
 491   }
 492 }
 493 ```
 494 ### AutoLaunchProtocolsFromOrigins
 495 Define a list of external protocols that can be used from listed origins without prompting the user. The origin is the scheme plus the hostname.
 496
 497 The syntax of this policy is exactly the same as the [Chrome AutoLaunchProtocolsFromOrigins policy](https://cloud.google.com/docs/chrome-enterprise/policies/?policy=AutoLaunchProtocolsFromOrigins) except that you can only use valid origins (not just hostnames). This also means that you cannot specify an asterisk for all origins.
 498
 499 The schema is:
 500 ```
 501 {
 502  "items": {
 503   "properties": {
 504    "allowed_origins": {
 505     "items": {
 506      "type": "string"
 507     },
 508     "type": "array"
 509    },
 510    "protocol": {
 511     "type": "string"
 512    }
 513   },
 514   "required": [
 515    "protocol",
 516    "allowed_origins"
 517   ],
 518   "type": "object"
 519  },
 520  "type": "array"
 521 }
 522 ```
 523 **Compatibility:** Firefox 90, Firefox ESR 78.12\
 524 **CCK2 Equivalent:** N/A\
 525 **Preferences Affected:** N/A
 526
 527 #### Windows (GPO)
 528 Software\Policies\Mozilla\Firefox\AutoLaunchProtocolsFromOrigins (REG_MULTI_SZ) =
 529 ```
 530 [
 531   {
 532     "protocol": "zoommtg",
 533     "allowed_origins": [
 534       "https://somesite.zoom.us"
 535     ]
 536   }
 537 ]
 538 ```
 539 #### Windows (Intune)
 540 OMA-URI:
 541 ```
 542 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox/AutoLaunchProtocolsFromOrigins
 543 ```
 544 Value (string):
 545 ```
 546 <enabled/>
 547 <data id="JSON" value='
 548 [
 549   {
 550     "protocol": "zoommtg",
 551     "allowed_origins": [
 552       "https://somesite.zoom.us"
 553     ]
 554   }
 555 ]'/>
 556 ```
 557 #### macOS
 558 ```
 559 <dict>
 560   <key>AutoLaunchProtocolsFromOrigins</key>
 561   <array>
 562     <dict>
 563       <key>protocol</key>
 564       <string>zoommtg</string>
 565       <key>allowed_origins</key>
 566       <array>
 567         <string>https://somesite.zoom.us</string>
 568       </array>
 569     </dict>
 570   </array>
 571 </dict>
 572 ```
 573 #### policies.json
 574 ```
 575 {
 576   "policies": {
 577     "AutoLaunchProtocolsFromOrigins": [{
 578       "protocol": "zoommtg",
 579       "allowed_origins": [
 580         "https://somesite.zoom.us"
 581       ]
 582     }]
 583   }
 584 }
 585 ```
 586 ### BackgroundAppUpdate
 587
 588 Enable or disable **automatic** application update **in the background**, when the application is not running.
 589
 590 If set to true, application updates may be installed (without user approval) in the background, even when the application is not running. The operating system might still require approval.
 591
 592 If set to false, the application will not try to install updates when the application is not running.
 593
 594 If you have disabled updates via `DisableAppUpdate` or disabled automatic updates via `AppAutoUpdate`, this policy has no effect.
 595
 596 **Compatibility:** Firefox 90 (Windows only)\
 597 **CCK2 Equivalent:** N/A\
 598 **Preferences Affected:** `app.update.background.enabled`
 599
 600 #### Windows (GPO)
 601 ```
 602 Software\Policies\Mozilla\Firefox\BackgroundAppUpdate = 0x1 | 0x0
 603 ```
 604 #### Windows (Intune)
 605 OMA-URI:
 606 ```
 607 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox/BackgroundAppUpdate
 608 ```
 609 Value (string):
 610 ```
 611 <enabled/> or <disabled/>
 612 ```
 613 #### macOS
 614 ```
 615 <dict>
 616   <key>BackgroundAppUpdate</key>
 617   <true/> | <false/>
 618 </dict>
 619 ```
 620 #### policies.json
 621 ```
 622 {
 623   "policies": {
 624     "BackgroundAppUpdate": true | false
 625   }
 626 }
 627 ```
 628 ### BlockAboutAddons
 629
 630 Block access to the Add-ons Manager (about:addons).
 631
 632 **Compatibility:** Firefox 60, Firefox ESR 60\
 633 **CCK2 Equivalent:** `disableAddonsManager`\
 634 **Preferences Affected:** N/A
 635
 636 #### Windows (GPO)
 637 ```
 638 Software\Policies\Mozilla\Firefox\BlockAboutAddons = 0x1 | 0x0
 639 ```
 640 #### Windows (Intune)
 641 OMA-URI:
 642 ```
 643 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox/BlockAboutAddons
 644 ```
 645 Value (string):
 646 ```
 647 <enabled/> or <disabled/>
 648 ```
 649 #### macOS
 650 ```
 651 <dict>
 652   <key>BlockAboutAddons</key>
 653   <true/> | <false/>
 654 </dict>
 655 ```
 656 #### policies.json
 657 ```
 658 {
 659   "policies": {
 660     "BlockAboutAddons": true | false
 661   }
 662 }
 663 ```
 664 ### BlockAboutConfig
 665
 666 Block access to about:config.
 667
 668 **Compatibility:** Firefox 60, Firefox ESR 60\
 669 **CCK2 Equivalent:** `disableAboutConfig`\
 670 **Preferences Affected:** N/A
 671
 672 #### Windows (GPO)
 673 ```
 674 Software\Policies\Mozilla\Firefox\BlockAboutConfig = 0x1 | 0x0
 675 ```
 676 #### Windows (Intune)
 677 OMA-URI:
 678 ```
 679 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox/BlockAboutConfig
 680 ```
 681 Value (string):
 682 ```
 683 <enabled/> or <disabled/>
 684 ```
 685 #### macOS
 686 ```
 687 <dict>
 688   <key>BlockAboutConfig</key>
 689   <true/> | <false/>
 690 </dict>
 691 ```
 692 #### policies.json
 693 ```
 694 {
 695   "policies": {
 696     "BlockAboutConfig": true | false
 697   }
 698 }
 699 ```
 700 ### BlockAboutProfiles
 701
 702 Block access to About Profiles (about:profiles).
 703
 704 **Compatibility:** Firefox 60, Firefox ESR 60\
 705 **CCK2 Equivalent:** `disableAboutProfiles`\
 706 **Preferences Affected:** N/A
 707
 708 #### Windows (GPO)
 709 ```
 710 Software\Policies\Mozilla\Firefox\BlockAboutProfiles = 0x1 | 0x0
 711 ```
 712 #### Windows (Intune)
 713 OMA-URI:
 714 ```
 715 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox/BlockAboutProfiles
 716 ```
 717 Value (string):
 718 ```
 719 <enabled/> or <disabled/>
 720 ```
 721 #### macOS
 722 ```
 723 <dict>
 724   <key>BlockAboutProfiles</key>
 725   <true/> | <false/>
 726 </dict>
 727 ```
 728 #### policies.json
 729 ```
 730 {
 731   "policies": {
 732     "BlockAboutProfiles": true | false
 733   }
 734 }
 735 ```
 736 ### BlockAboutSupport
 737
 738 Block access to Troubleshooting Information (about:support).
 739
 740 **Compatibility:** Firefox 60, Firefox ESR 60\
 741 **CCK2 Equivalent:** `disableAboutSupport`\
 742 **Preferences Affected:** N/A
 743
 744 #### Windows (GPO)
 745 ```
 746 Software\Policies\Mozilla\Firefox\BlockAboutSupport = 0x1 | 0x0
 747 ```
 748 #### Windows (Intune)
 749 OMA-URI:
 750 ```
 751 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox/BlockAboutSupport
 752 ```
 753 Value (string):
 754 ```
 755 <enabled/> or <disabled/>
 756 ```
 757 #### macOS
 758 ```
 759 <dict>
 760   <key>BlockAboutSupport</key>
 761   <true/> | <false/>
 762 </dict>
 763 ```
 764 #### policies.json
 765 ```
 766 {
 767   "policies": {
 768     "BlockAboutSupport": true | false
 769   }
 770 }
 771 ```
 772 ### Bookmarks
 773
 774 Note: [`ManagedBookmarks`](#managedbookmarks) is the new recommended way to add bookmarks. This policy will continue to be supported.
 775
 776 Add bookmarks in either the bookmarks toolbar or menu. Only `Title` and `URL` are required. If `Placement` is not specified, the bookmark will be placed on the toolbar. If `Folder` is specified, it is automatically created and bookmarks with the same folder name are grouped together.
 777
 778 If you want to clear all bookmarks set with this policy, you can set the value to an empty array (```[]```). This can be on Windows via the new Bookmarks (JSON) policy available with GPO and Intune.
 779
 780 **Compatibility:** Firefox 60, Firefox ESR 60\
 781 **CCK2 Equivalent:** `bookmarks.toolbar`,`bookmarks.menu`\
 782 **Preferences Affected:** N/A
 783
 784 #### Windows (GPO)
 785 ```
 786 Software\Policies\Mozilla\Firefox\Bookmarks\1\Title = "Example"
 787 Software\Policies\Mozilla\Firefox\Bookmarks\1\URL = "https://example.com"
 788 Software\Policies\Mozilla\Firefox\Bookmarks\1\Favicon = "https://example.com/favicon.ico"
 789 Software\Policies\Mozilla\Firefox\Bookmarks\1\Placement = "toolbar" | "menu"
 790 Software\Policies\Mozilla\Firefox\Bookmarks\1\Folder = "FolderName"
 791
 792 Software\Policies\Mozilla\Firefox\Bookmarks (REG_MULTI_SZ) =
 793 ```
 794 []
 795 ```
 796
 797 ```
 798 #### Windows (Intune)
 799 OMA-URI:
 800 ```
 801 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~Bookmarks/Bookmark01
 802 ```
 803 Value (string):
 804 ```
 805 <enabled/>
 806 <data id="BookmarkTitle" value="Example"/>
 807 <data id="BookmarkURL" value="https://example.com"/>
 808 <data id="BookmarkFavicon" value="https://example.com/favicon.ico"/>
 809 <data id="BookmarkPlacement" value="toolbar | menu"/>
 810 <data id="BookmarkFolder" value="FolderName"/>
 811 ```
 812 OMA-URI:
 813 ```
 814 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox/Bookmarks
 815 ```
 816 Value (string):
 817 ```
 818 <enabled/>
 819 <data id="JSON" value='[]'/>
 820 ```
 821 #### macOS
 822 ```
 823 <dict>
 824   <key>Bookmarks</key>
 825   <array>
 826     <dict>
 827       <key>Title</key>
 828       <string>Example</string>
 829       <key>URL</key>
 830       <string>https://example.com</string>
 831       <key>Favicon</key>
 832       <string>https://example.com/favicon.ico</string>
 833       <key>Placement</key>
 834       <string>toolbar | menu</string>
 835       <key>Folder</key>
 836       <string>FolderName</string>
 837     </dict>
 838   </array>
 839 </dict>
 840 ```
 841 #### policies.json
 842 ```
 843 {
 844   "policies": {
 845     "Bookmarks": [
 846       {
 847         "Title": "Example",
 848         "URL": "https://example.com",
 849         "Favicon": "https://example.com/favicon.ico",
 850         "Placement": "toolbar" | "menu",
 851         "Folder": "FolderName"
 852       }
 853     ]
 854   }
 855 }
 856 ```
 857 ### CaptivePortal
 858 Enable or disable the detection of captive portals.
 859
 860 **Compatibility:** Firefox 67, Firefox ESR 60.7\
 861 **CCK2 Equivalent:** N/A\
 862 **Preferences Affected:** `network.captive-portal-service.enabled`
 863
 864 #### Windows (GPO)
 865 ```
 866 Software\Policies\Mozilla\Firefox\CaptivePortal = 0x1 | 0x0
 867 ```
 868 #### Windows (Intune)
 869 OMA-URI:
 870 ```
 871 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox/CaptivePortal
 872 ```
 873 Value (string):
 874 ```
 875 <enabled/> or <disabled/>
 876 ```
 877 #### macOS
 878 ```
 879 <dict>
 880   <key>CaptivePortal</key>
 881   <true/> | <false/>
 882 </dict>
 883 ```
 884 #### policies.json
 885 ```
 886 {
 887   "policies": {
 888     "CaptivePortal": true | false
 889   }
 890 }
 891 ```
 892 ### Certificates
 893
 894 ### Certificates | ImportEnterpriseRoots
 895
 896 Trust certificates that have been added to the operating system certificate store by a user or administrator.
 897
 898 Note: This policy only works on Windows and macOS. For Linux discussion, see [bug 1600509](https://bugzilla.mozilla.org/show_bug.cgi?id=1600509).
 899
 900 See https://support.mozilla.org/kb/setting-certificate-authorities-firefox for more detail.
 901
 902 **Compatibility:** Firefox 60, Firefox ESR 60 (macOS support in Firefox 63, Firefox ESR 68)\
 903 **CCK2 Equivalent:** N/A\
 904 **Preferences Affected:** `security.enterprise_roots.enabled`
 905
 906 #### Windows (GPO)
 907 ```
 908 Software\Policies\Mozilla\Firefox\Certificates\ImportEnterpriseRoots = 0x1 | 0x0
 909 ```
 910 #### Windows (Intune)
 911 OMA-URI:
 912 ```
 913 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~Certificates/Certificates_ImportEnterpriseRoots
 914 ```
 915 Value (string):
 916 ```
 917 <enabled/> or <disabled/>
 918 ```
 919 #### macOS
 920 ```
 921 <dict>
 922   <key>Certificates</key>
 923   <dict>
 924     <key>ImportEnterpriseRoots</key>
 925     <true/> | <false/>
 926   </dict>
 927 </dict>
 928 ```
 929 #### policies.json
 930 ```
 931 {
 932   "policies": {
 933     "Certificates": {
 934       "ImportEnterpriseRoots": true | false
 935     }
 936   }
 937 }
 938 ```
 939 ### Certificates | Install
 940
 941 Install certificates into the Firefox certificate store. If only a filename is specified, Firefox searches for the file in the following locations:
 942
 943 - Windows
 944   - %USERPROFILE%\AppData\Local\Mozilla\Certificates
 945   - %USERPROFILE%\AppData\Roaming\Mozilla\Certificates
 946 - macOS
 947   - /Library/Application Support/Mozilla/Certificates
 948   - ~/Library/Application Support/Mozilla/Certificates
 949 - Linux
 950   - /usr/lib/mozilla/certificates
 951   - /usr/lib64/mozilla/certificates
 952   - ~/.mozilla/certificates
 953
 954 Starting with Firefox 65, Firefox 60.5 ESR, a fully qualified path can be used, including UNC paths. You should use the native path style for your operating system. We do not support using %USERPROFILE% or other environment variables on Windows.
 955
 956 If you are specifying the path in the policies.json file on Windows, you need to escape your backslashes (`\\`) which means that for UNC paths, you need to escape both (`\\\\`). If you use group policy, you only need one backslash.
 957
 958 Certificates are installed using the trust string `CT,CT,`.
 959
 960 Binary (DER) and ASCII (PEM) certificates are both supported.
 961
 962 **Compatibility:** Firefox 64, Firefox ESR 64\
 963 **CCK2 Equivalent:** `certs.ca`\
 964 **Preferences Affected:** N/A
 965
 966 #### Windows (GPO)
 967 ```
 968 Software\Policies\Mozilla\Firefox\Certificates\Install\1 = "cert1.der"
 969 Software\Policies\Mozilla\Firefox\Certificates\Install\2 = "C:\Users\username\cert2.pem"
 970 ```
 971 #### Windows (Intune)
 972 OMA-URI:
 973 ```
 974 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~Certificates/Certificates_Install
 975 ```
 976 Value (string):
 977 ```
 978 <enabled/>
 979 <data id="Certificates_Install" value="1&#xF000;cert1.der&#xF000;2&#xF000;C:\Users\username\cert2.pem"/>
 980 ```
 981 #### macOS
 982 ```
 983 <dict>
 984   <key>Certificates</key>
 985   <dict>
 986     <key>Install</key>
 987     <array>
 988       <string>cert1.der</string>
 989       <string>/Users/username/cert2.pem</string>
 990     </array>
 991   </dict>
 992 </dict>
 993 ```
 994 #### policies.json
 995 ```
 996 {
 997   "policies": {
 998     "Certificates": {
 999       "Install": ["cert1.der", "/home/username/cert2.pem"]
1000     }
1001   }
1002 }
1003 ```
1004 ### Containers
1005 Set policies related to [containers](https://addons.mozilla.org/firefox/addon/multi-account-containers/).
1006
1007 Currently you can set the initial set of containers.
1008
1009 For each container, you can specify the name, icon, and color.
1010
1011 | Name | Description |
1012 | --- | --- |
1013 | `name`| Name of container
1014 | `icon` | Can be `fingerprint`, `briefcase`, `dollar`, `cart`, `vacation`, `gift`, `food`, `fruit`, `pet`, `tree`, `chill`, `circle`, `fence`
1015 | `color` | Can be `blue`, `turquoise`, `green`, `yellow`, `orange`, `red`, `pink`, `purple`, `toolbar`
1016
1017 **Compatibility:** Firefox 113\
1018 **CCK2 Equivalent:** N/A\
1019 **Preferences Affected:** N/A
1020
1021 #### Windows (GPO)
1022 Software\Policies\Mozilla\Firefox\Containers (REG_MULTI_SZ) =
1023 ```
1024 {
1025   "Default": [
1026     {
1027       "name": "My container",
1028       "icon": "pet",
1029       "color": "turquoise"
1030     }
1031   ]
1032 }
1033 ```
1034 #### Windows (Intune)
1035 OMA-URI:
1036 ```
1037 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox/Containers
1038 ```
1039 Value (string):
1040 ```
1041 <enabled/>
1042 <data id="JSON" value='
1043 {
1044   "Default": [
1045     {
1046       "name": "My container",
1047       "icon": "pet",
1048       "color": "turquoise"
1049     }
1050   ]
1051 }
1052 '/>
1053 ```
1054 #### macOS
1055 ```
1056 <dict>
1057   <key>Default</key>
1058   <dict>
1059     <key>Containers</key>
1060     <array>
1061       <dict>
1062         <key>name</key>
1063         <string>My container</string>
1064         <key>icon</key>
1065         <string>pet</string>
1066         <key>color</key>
1067         <string>turquoise</string>
1068       </dict>
1069     </array>
1070   </dict>
1071 </dict>
1072 ```
1073 #### policies.json
1074 ```
1075 {
1076   "policies": {
1077     "Containers": {
1078       "Default": [
1079         {
1080           "name": "My container",
1081           "icon": "pet",
1082           "color": "turquoise"
1083         }
1084       ]
1085     }
1086   }
1087 }
1088 ```
1089 ### Cookies
1090 Configure cookie preferences.
1091
1092 `Allow` is a list of origins (not domains) where cookies are always allowed. You must include http or https.
1093
1094 `AllowSession` is a list of origins (not domains) where cookies are only allowed for the current session. You must include http or https.
1095
1096 `Block` is a list of origins (not domains) where cookies are always blocked. You must include http or https.
1097
1098 `Behavior` sets the default behavior for cookies based on the values below.
1099
1100 `BehaviorPrivateBrowsing` sets the default behavior for cookies in private browsing based on the values below.
1101
1102 | Value | Description
1103 | --- | --- |
1104 | accept | Accept all cookies
1105 | reject-foreign | Reject third party cookies
1106 | reject | Reject all cookies
1107 | limit-foreign | Reject third party cookies for sites you haven't visited
1108 | reject-tracker | Reject cookies for known trackers (default)
1109 | reject-tracker-and-partition-foreign | Reject cookies for known trackers and partition third-party cookies (Total Cookie Protection) (default for private browsing)
1110
1111 `ExpireAtSessionEnd` determines when cookies expire.
1112
1113 `Locked` prevents the user from changing cookie preferences.
1114
1115 **Compatibility:** Firefox 60, Firefox ESR 60 (RejectTracker added in Firefox 63, AllowSession added in Firefox 79/78.1, Behavior added in Firefox 95/91.4)\
1116 **CCK2 Equivalent:** N/A\
1117 **Preferences Affected:** `network.cookie.cookieBehavior`, `network.cookie.cookieBehavior.pbmode`, `network.cookie.lifetimePolicy`
1118
1119 #### Windows (GPO)
1120 ```
1121 Software\Policies\Mozilla\Firefox\Cookies\Allow\1 = "https://example.com"
1122 Software\Policies\Mozilla\Firefox\Cookies\AllowSession\1 = "https://example.edu"
1123 Software\Policies\Mozilla\Firefox\Cookies\Block\1 = "https://example.org"
1124 Software\Policies\Mozilla\Firefox\Cookies\Default = 0x1 | 0x0
1125 Software\Policies\Mozilla\Firefox\Cookies\AcceptThirdParty = "always" | "never" | "from-visited"
1126 Software\Policies\Mozilla\Firefox\Cookies\ExpireAtSessionEnd = 0x1 | 0x0
1127 Software\Policies\Mozilla\Firefox\Cookies\RejectTracker = 0x1 | 0x0
1128 Software\Policies\Mozilla\Firefox\Cookies\Behavior = "accept" | "reject-foreign" | "reject" | "limit-foreign" | "reject-tracker" | "reject-tracker-and-partition-foreign"
1129 Software\Policies\Mozilla\Firefox\Cookies\BehaviorPrivateBrowsing = "accept" | "reject-foreign" | "reject" | "limit-foreign" | "reject-tracker" | "reject-tracker-and-partition-foreign"
1130 Software\Policies\Mozilla\Firefox\Cookies\Locked = 0x1 | 0x0
1131 ```
1132 #### Windows (Intune)
1133 OMA-URI:
1134 ```
1135 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~Cookies/Cookies_Allow
1136 ```
1137 Value (string):
1138 ```
1139 <enabled/>
1140 <data id="Permissions" value="1&#xF000;https://example.com"/>
1141 ```
1142 OMA-URI:
1143 ```
1144 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~Cookies/Cookies_AllowSession
1145 ```
1146 Value (string):
1147 ```
1148 <enabled/>
1149 <data id="Permissions" value="1&#xF000;https://example.edu"/>
1150 ```
1151 OMA-URI:
1152 ```
1153 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~Cookies/Cookies_Block
1154 ```
1155 Value (string):
1156 ```
1157 <enabled/>
1158 <data id="Permissions" value="1&#xF000;https://example.org"/>
1159 ```
1160 OMA-URI:
1161 ```
1162 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~Cookies/Cookies_Default
1163 ```
1164 Value (string):
1165 ```
1166 <enabled/> or <disabled/>
1167 ```
1168 OMA-URI:
1169 ```
1170 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~Cookies/Cookies_AcceptThirdParty
1171 ```
1172 Value (string):
1173 ```
1174 <enabled/>
1175 <data id="Cookies_AcceptThirdParty" value="always | never | from-visited"/>
1176 ```
1177 OMA-URI:
1178 ```
1179 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~Cookies/Cookies_ExpireAtSessionEnd
1180 ```
1181 Value (string):
1182 ```
1183 <enabled/> or <disabled/>
1184 ```
1185 OMA-URI:
1186 ```
1187 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~Cookies/Cookies_RejectTracker
1188 ```
1189 Value (string):
1190 ```
1191 <enabled/> or <disabled/>
1192 ```
1193 OMA-URI:
1194 ```
1195 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~Cookies/Cookies_Locked
1196 ```
1197 Value (string):
1198 ```
1199 <enabled/> or <disabled/>
1200 ```
1201 OMA-URI:
1202 ```
1203 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~Cookies/Cookies_Behavior
1204 ```
1205 Value (string):
1206 ```
1207 <enabled/>
1208 <data id="Cookies_Behavior" value="accept | reject-foreign | reject | limit-foreign | reject-tracker | reject-tracker-and-partition-foreign"/>
1209 ```
1210 OMA-URI:
1211 ```
1212 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~Cookies/Cookies_BehaviorPrivateBrowsing
1213 ```
1214 Value (string):
1215 ```
1216 <enabled/>
1217 <data id="Cookies_BehaviorPrivateBrowsing" value="accept | reject-foreign | reject | limit-foreign | reject-tracker | reject-tracker-and-partition-foreign"/>
1218 ```
1219 #### macOS
1220 ```
1221 <dict>
1222   <key>Cookies</key>
1223   <dict>
1224     <key>Allow</key>
1225     <array>
1226       <string>http://example.com</string>
1227     </array>
1228     <key>AllowSession</key>
1229     <array>
1230       <string>http://example.edu</string>
1231     </array>
1232     <key>Block</key>
1233     <array>
1234       <string>http://example.org</string>
1235     </array>
1236     <key>Default</key>
1237     <true/> | <false/>
1238     <key>AcceptThirdParty</key>
1239     <string>always | never | from-visited</string>
1240     <key>ExpireAtSessionEnd</key>
1241     <true/> | <false/>
1242     <key>RejectTracker</key>
1243     <true/> | <false/>
1244     <key>Locked</key>
1245     <true/> | <false/>
1246     <key>Behavior</key>
1247     <string>accept | reject-foreign | reject | limit-foreign | reject-tracker | reject-tracker-and-partition-foreign</string>
1248     <key>BehaviorPrivateBrowsing</key>
1249     <string>accept | reject-foreign | reject | limit-foreign | reject-tracker | reject-tracker-and-partition-foreign</string>
1250   </dict>
1251 </dict>
1252 ```
1253 #### policies.json
1254 ```
1255 {
1256   "policies": {
1257     "Cookies": {
1258       "Allow": ["http://example.org/"],
1259       "AllowSession": ["http://example.edu/"],
1260       "Block": ["http://example.edu/"],
1261       "Default": true | false,
1262       "AcceptThirdParty": "always" | "never" | "from-visited",
1263       "ExpireAtSessionEnd": true | false,
1264       "RejectTracker": true | false,
1265       "Locked": true | false,
1266       "Behavior": "accept" | "reject-foreign" | "reject" | "limit-foreign" | "reject-tracker" | "reject-tracker-and-partition-foreign",
1267       "BehaviorPrivateBrowsing": "accept" | "reject-foreign" | "reject" | "limit-foreign" | "reject-tracker" | "reject-tracker-and-partition-foreign",
1268     }
1269   }
1270 }
1271 ```
1272 ### DefaultDownloadDirectory
1273 Set the default download directory.
1274
1275 You can use ${home} for the native home directory.
1276
1277 **Compatibility:** Firefox 68, Firefox ESR 68\
1278 **CCK2 Equivalent:** N/A\
1279 **Preferences Affected:** `browser.download.dir`, `browser.download.folderList`
1280
1281 #### Windows (GPO)
1282 ```
1283 Software\Policies\Mozilla\Firefox\DefaultDownloadDirectory = "${home}\Downloads"
1284 ```
1285 #### Windows (Intune)
1286 OMA-URI:
1287 ```
1288 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox/DefaultDownloadDirectory
1289 ```
1290 Value (string):
1291 ```
1292 <enabled/>
1293 <data id="Preferences_String" value="${home}\Downloads"/>
1294 ```
1295 #### macOS
1296 ```
1297 <dict>
1298   <key>DefaultDownloadDirectory</key>
1299   <string>${home}/Downloads</string>
1300 </dict>
1301 ```
1302 #### policies.json (macOS and Linux)
1303 ```
1304 {
1305   "policies": {
1306     "DefaultDownloadDirectory": "${home}/Downloads"
1307   }
1308 }
1309 ```
1310 #### policies.json (Windows)
1311 ```
1312 {
1313   "policies": {
1314     "DefaultDownloadDirectory": "${home}\\Downloads"
1315   }
1316 }
1317 ```
1318 ### DisableAppUpdate
1319 Turn off application updates within Firefox.
1320
1321 **Compatibility:** Firefox 60, Firefox ESR 60\
1322 **CCK2 Equivalent:** `disableFirefoxUpdates`\
1323 **Preferences Affected:** N/A
1324
1325 #### Windows (GPO)
1326 ```
1327 Software\Policies\Mozilla\Firefox\DisableAppUpdate = 0x1 | 0x0
1328 ```
1329 #### Windows (Intune)
1330 OMA-URI:
1331 ```
1332 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox/DisableAppUpdate
1333 ```
1334 Value (string):
1335 ```
1336 <enabled/> or <disabled/>
1337 ```
1338 #### macOS
1339 ```
1340 <dict>
1341   <key>DisableAppUpdate</key>
1342   <true/> | <false/>
1343 </dict>
1344 ```
1345 #### policies.json
1346 ```
1347 {
1348   "policies": {
1349     "DisableAppUpdate": true | false
1350   }
1351 }
1352 ```
1353 ### DisableBuiltinPDFViewer
1354 Disable the built in PDF viewer. PDF files are downloaded and sent externally.
1355
1356 **Compatibility:** Firefox 60, Firefox ESR 60\
1357 **CCK2 Equivalent:** `disablePDFjs`\
1358 **Preferences Affected:** `pdfjs.disabled`
1359
1360 #### Windows (GPO)
1361 ```
1362 Software\Policies\Mozilla\Firefox\DisableBuiltinPDFViewer = 0x1 | 0x0
1363 ```
1364 #### Windows (Intune)
1365 OMA-URI:
1366 ```
1367 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox/DisableBuiltinPDFViewer
1368 ```
1369 Value (string):
1370 ```
1371 <enabled/> or <disabled/>
1372 ```
1373 #### macOS
1374 ```
1375 <dict>
1376   <key>DisableBuiltinPDFViewer</key>
1377   <true/> | <false/>
1378 </dict>
1379 ```
1380 #### policies.json
1381 ```
1382 {
1383   "policies": {
1384     "DisableBuiltinPDFViewer": true | false
1385   }
1386 }
1387 ```
1388 ### DisabledCiphers
1389 Disable specific cryptographic ciphers, listed below.
1390
1391 ```
1392 TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256
1393 TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256
1394 TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256
1395 TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256
1396 TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384
1397 TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384
1398 TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA
1399 TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA
1400 TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA
1401 TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA
1402 TLS_DHE_RSA_WITH_AES_128_CBC_SHA
1403 TLS_DHE_RSA_WITH_AES_256_CBC_SHA
1404 TLS_RSA_WITH_AES_128_GCM_SHA256
1405 TLS_RSA_WITH_AES_256_GCM_SHA384
1406 TLS_RSA_WITH_AES_128_CBC_SHA
1407 TLS_RSA_WITH_AES_256_CBC_SHA
1408 TLS_RSA_WITH_3DES_EDE_CBC_SHA
1409 ```
1410
1411 **Preferences Affected:** `security.ssl3.ecdhe_rsa_aes_128_gcm_sha256`, `security.ssl3.ecdhe_ecdsa_aes_128_gcm_sha256`, `security.ssl3.ecdhe_ecdsa_chacha20_poly1305_sha256`, `security.ssl3.ecdhe_rsa_chacha20_poly1305_sha256`, `security.ssl3.ecdhe_ecdsa_aes_256_gcm_sha384`, `security.ssl3.ecdhe_rsa_aes_256_gcm_sha384`, `security.ssl3.ecdhe_rsa_aes_128_sha`, `security.ssl3.ecdhe_ecdsa_aes_128_sha`, `security.ssl3.ecdhe_rsa_aes_256_sha`, `security.ssl3.ecdhe_ecdsa_aes_256_sha`, `security.ssl3.dhe_rsa_aes_128_sha`, `security.ssl3.dhe_rsa_aes_256_sha`, `security.ssl3.rsa_aes_128_gcm_sha256`, `security.ssl3.rsa_aes_256_gcm_sha384`, `security.ssl3.rsa_aes_128_sha`, `security.ssl3.rsa_aes_256_sha`, `security.ssl3.deprecated.rsa_des_ede3_sha`
1412
1413 ---
1414 **Note:**
1415
1416 This policy was updated in Firefox 78 to allow enabling ciphers as well. Setting the value to true disables the cipher, setting the value to false enables the cipher. Previously setting the value to true or false disabled the cipher.
1417
1418 ---
1419 **Compatibility:** Firefox 76, Firefox ESR 68.8 (TLS_RSA_WITH_AES_128_GCM_SHA256 and TLS_RSA_WITH_AES_256_GCM_SHA384 were added in Firefox 78, TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA, TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA, TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA38, TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256, TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384, and TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256 were added in Firefox 97 and Firefox 91.6)\
1420 **CCK2 Equivalent:** N/A\
1421 **Preferences Affected:** N/A
1422
1423 #### Windows (GPO)
1424 ```
1425 Software\Policies\Mozilla\Firefox\DisabledCiphers\CIPHER_NAME = 0x1 | 0x0
1426 ```
1427 #### Windows (Intune)
1428 OMA-URI:
1429 ```
1430 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~DisabledCiphers/DisabledCiphers_CIPHER_NAME
1431
1432 ```
1433 Value (string):
1434 ```
1435 <enabled/> or <disabled/>
1436 ```
1437 #### macOS
1438 ```
1439 <dict>
1440   <key>DisabledCiphers</key>
1441     <dict>
1442       <key>CIPHER_NAME</key>
1443       <true/> | <false/>
1444     </dict>
1445 </dict>
1446 ```
1447 #### policies.json
1448 ```
1449 {
1450   "policies": {
1451     "DisabledCiphers": {
1452       "CIPHER_NAME": true | false,
1453     }
1454   }
1455 }
1456 ```
1457 ### DisableDefaultBrowserAgent
1458 Prevent the default browser agent from taking any actions. Only applicable to Windows; other platforms don’t have the agent.
1459
1460 The browser agent is a Windows-only scheduled task which runs in the background to collect and submit data about the browser that the user has set as their OS default. More information is available [here](https://firefox-source-docs.mozilla.org/toolkit/mozapps/defaultagent/default-browser-agent/index.html).
1461
1462 **Compatibility:** Firefox 75, Firefox ESR 68.7 (Windows only)\
1463 **CCK2 Equivalent:** N/A\
1464 **Preferences Affected:** N/A
1465
1466 #### Windows (GPO)
1467 ```
1468 Software\Policies\Mozilla\Firefox\DisableDefaultBrowserAgent = 0x1 | 0x0
1469 ```
1470 #### Windows (Intune)
1471 OMA-URI:
1472 ```
1473 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox/DisableDefaultBrowserAgent
1474 ```
1475 Value (string):
1476 ```
1477 <enabled/> or <disabled/>
1478 ```
1479 #### policies.json
1480 ```
1481 {
1482   "policies": {
1483     "DisableDefaultBrowserAgent": true | false
1484   }
1485 }
1486 ```
1487 ### DisableDeveloperTools
1488 Remove access to all developer tools.
1489
1490 **Compatibility:** Firefox 60, Firefox ESR 60\
1491 **CCK2 Equivalent:** `removeDeveloperTools`\
1492 **Preferences Affected:** `devtools.policy.disabled`
1493
1494 #### Windows (GPO)
1495 ```
1496 Software\Policies\Mozilla\Firefox\DisableDeveloperTools = 0x1 | 0x0`
1497 ```
1498 #### Windows (Intune)
1499 OMA-URI:
1500 ```
1501 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox/DisableDeveloperTools
1502 ```
1503 Value (string):
1504 ```
1505 <enabled/> or <disabled/>
1506 ```
1507 #### macOS
1508 ```
1509 <dict>
1510   <key>DisableDeveloperTools</key>
1511   <true/> | <false/>
1512 </dict>
1513 ```
1514 #### policies.json
1515 ```
1516 {
1517   "policies": {
1518     "DisableDeveloperTools": true | false
1519   }
1520 }
1521 ```
1522 ### DisableFeedbackCommands
1523 Disable the menus for reporting sites (Submit Feedback, Report Deceptive Site).
1524
1525 **Compatibility:** Firefox 60, Firefox ESR 60\
1526 **CCK2 Equivalent:** N/A\
1527 **Preferences Affected:** N/A
1528
1529 #### Windows (GPO)
1530 ```
1531 Software\Policies\Mozilla\Firefox\DisableFeedbackCommands = 0x1 | 0x0
1532 ```
1533 #### Windows (Intune)
1534 OMA-URI:
1535 ```
1536 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox/DisableFeedbackCommands
1537 ```
1538 Value (string):
1539 ```
1540 <enabled/> or <disabled/>
1541 ```
1542 #### macOS
1543 ```
1544 <dict>
1545   <key>DisableFeedbackCommands</key>
1546   <true/> | <false/>
1547 </dict>
1548 ```
1549 #### policies.json
1550 ```
1551 {
1552   "policies": {
1553     "DisableFeedbackCommands": true | false
1554   }
1555 }
1556 ```
1557 ### DisableFirefoxAccounts
1558 Disable Firefox Accounts integration (Sync).
1559
1560 **Compatibility:** Firefox 60, Firefox ESR 60\
1561 **CCK2 Equivalent:** `disableSync`\
1562 **Preferences Affected:** `identity.fxaccounts.enabled`
1563
1564 #### Windows (GPO)
1565 ```
1566 Software\Policies\Mozilla\Firefox\DisableFirefoxAccounts = 0x1 | 0x0
1567 ```
1568 #### Windows (Intune)
1569 OMA-URI:
1570 ```
1571 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox/DisableFirefoxAccounts
1572 ```
1573 Value (string):
1574 ```
1575 <enabled/> or <disabled/>
1576 ```
1577 #### macOS
1578 ```
1579 <dict>
1580   <key>DisableFirefoxAccounts</key>
1581   <true/> | <false/>
1582 </dict>
1583 ```
1584 #### policies.json
1585 ```
1586 {
1587   "policies": {
1588     "DisableFirefoxAccounts": true | false
1589   }
1590 }
1591 ```
1592 ### DisableFirefoxScreenshots
1593 Remove access to Firefox Screenshots.
1594
1595 **Compatibility:** Firefox 60, Firefox ESR 60\
1596 **CCK2 Equivalent:** N/A\
1597 **Preferences Affected:** `extensions.screenshots.disabled`
1598
1599 #### Windows (GPO)
1600 ```
1601 Software\Policies\Mozilla\Firefox\DisableFirefoxScreenshots = 0x1 | 0x0
1602 ```
1603 #### Windows (Intune)
1604 OMA-URI:
1605 ```
1606 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox/DisableFirefoxScreenshots
1607 ```
1608 Value (string):
1609 ```
1610 <enabled/> or <disabled/>
1611 ```
1612 #### macOS
1613 ```
1614 <dict>
1615   <key>DisableFirefoxScreenshots</key>
1616   <true/> | <false/>
1617 </dict>
1618 ```
1619 #### policies.json
1620 ```
1621 {
1622   "policies": {
1623     "DisableFirefoxScreenshots": true | false
1624   }
1625 }
1626 ```
1627 ### DisableFirefoxStudies
1628 Disable Firefox studies (Shield).
1629
1630 **Compatibility:** Firefox 60, Firefox ESR 60\
1631 **CCK2 Equivalent:** N/A\
1632 **Preferences Affected:** N/A
1633
1634 #### Windows (GPO)
1635 ```
1636 Software\Policies\Mozilla\Firefox\DisableFirefoxStudies = 0x1 | 0x0
1637 ```
1638 #### Windows (Intune)
1639 OMA-URI:
1640 ```
1641 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox/DisableFirefoxStudies
1642 ```
1643 Value (string):
1644 ```
1645 <enabled/> or <disabled/>
1646 ```
1647 #### macOS
1648 ```
1649 <dict>
1650   <key>DisableFirefoxStudies</key>
1651   <true/> | <false/>
1652 </dict>
1653 ```
1654 #### policies.json
1655 ```
1656 {
1657   "policies": {
1658     "DisableFirefoxStudies": true | false
1659   }
1660 }
1661 ```
1662 ### DisableForgetButton
1663 Disable the "Forget" button.
1664
1665 **Compatibility:** Firefox 60, Firefox ESR 60\
1666 **CCK2 Equivalent:** `disableForget`\
1667 **Preferences Affected:** N/A
1668
1669 #### Windows (GPO)
1670 ```
1671 Software\Policies\Mozilla\Firefox\DisableForgetButton = 0x1 | 0x0
1672 ```
1673 #### Windows (Intune)
1674 OMA-URI:
1675 ```
1676 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox/DisableForgetButton
1677 ```
1678 Value (string):
1679 ```
1680 <enabled/> or <disabled/>
1681 ```
1682 #### macOS
1683 ```
1684 <dict>
1685   <key>DisableForgetButton</key>
1686   <true/> | <false/>
1687 </dict>
1688 ```
1689 #### policies.json
1690 ```
1691 {
1692   "policies": {
1693     "DisableForgetButton": true | false
1694   }
1695 }
1696 ```
1697 ### DisableFormHistory
1698 Turn off saving information on web forms and the search bar.
1699
1700 **Compatibility:** Firefox 60, Firefox ESR 60\
1701 **CCK2 Equivalent:** `disableFormFill`\
1702 **Preferences Affected:** `browser.formfill.enable`
1703
1704 #### Windows (GPO)
1705 ```
1706 Software\Policies\Mozilla\Firefox\DisableFormHistory = 0x1 | 0x0
1707 ```
1708 #### Windows (Intune)
1709 OMA-URI:
1710 ```
1711 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox/DisableFormHistory
1712 ```
1713 Value (string):
1714 ```
1715 <enabled/> or <disabled/>
1716 ```
1717 #### macOS
1718 ```
1719 <dict>
1720   <key>DisableFormHistory</key>
1721   <true/> | <false/>
1722 </dict>
1723 ```
1724 #### policies.json
1725 ```
1726 {
1727   "policies": {
1728     "DisableFormHistory": true | false
1729   }
1730 }
1731 ```
1732 ### DisableMasterPasswordCreation
1733 Remove the master password functionality.
1734
1735 If this value is true, it works the same as setting [`PrimaryPassword`](#primarypassword) to false and removes the primary password functionality.
1736
1737 If both `DisableMasterPasswordCreation` and `PrimaryPassword` are used, `DisableMasterPasswordCreation` takes precedent.
1738
1739 **Compatibility:** Firefox 60, Firefox ESR 60\
1740 **CCK2 Equivalent:** `noMasterPassword`\
1741 **Preferences Affected:** N/A
1742
1743 #### Windows (GPO)
1744 ```
1745 Software\Policies\Mozilla\Firefox\DisableMasterPasswordCreation = 0x1 | 0x0
1746 ```
1747 #### Windows (Intune)
1748 OMA-URI:
1749 ```
1750 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox/DisableMasterPasswordCreation
1751 ```
1752 Value (string):
1753 ```
1754 <enabled/> or <disabled/>
1755 ```
1756 #### macOS
1757 ```
1758 <dict>
1759   <key>DisableMasterPasswordCreation</key>
1760   <true/> | <false/>
1761 </dict>
1762 ```
1763 #### policies.json
1764 ```
1765 {
1766   "policies": {
1767     "DisableMasterPasswordCreation": true | false
1768   }
1769 }
1770 ```
1771 ### DisablePasswordReveal
1772 Do not allow passwords to be shown in saved logins
1773
1774 **Compatibility:** Firefox 71, Firefox ESR 68.3\
1775 **CCK2 Equivalent:** N/A
1776 **Preferences Affected:** N/A
1777
1778 #### Windows (GPO)
1779 ```
1780 Software\Policies\Mozilla\Firefox\DisablePasswordReveal = 0x1 | 0x0
1781 ```
1782 #### Windows (Intune)
1783 OMA-URI:
1784 ```
1785 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox/DisablePasswordReveal
1786 ```
1787 Value (string):
1788 ```
1789 <enabled/> or <disabled/>
1790 ```
1791 #### macOS
1792 ```
1793 <dict>
1794   <key>DisablePasswordReveal</key>
1795   <true/> | <false/>
1796 </dict>
1797 ```
1798 #### policies.json
1799 ```
1800 {
1801   "policies": {
1802     "DisablePasswordReveal": true | false
1803   }
1804 }
1805 ```
1806 ### DisablePocket
1807 Remove Pocket in the Firefox UI. It does not remove it from the new tab page.
1808
1809 **Compatibility:** Firefox 60, Firefox ESR 60\
1810 **CCK2 Equivalent:** `disablePocket`\
1811 **Preferences Affected:** `extensions.pocket.enabled`
1812
1813 #### Windows (GPO)
1814 ```
1815 Software\Policies\Mozilla\Firefox\DisablePocket = 0x1 | 0x0
1816 ```
1817 #### Windows (Intune)
1818 OMA-URI:
1819 ```
1820 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox/DisablePocket
1821 ```
1822 Value (string):
1823 ```
1824 <enabled/> or <disabled/>
1825 ```
1826 #### macOS
1827 ```
1828 <dict>
1829   <key>DisablePocket</key>
1830   <true/> | <false/>
1831 </dict>
1832 ```
1833 #### policies.json
1834 ```
1835 {
1836   "policies": {
1837     "DisablePocket": true | false
1838   }
1839 }
1840 ```
1841 ### DisablePrivateBrowsing
1842 Remove access to private browsing.
1843
1844 **Compatibility:** Firefox 60, Firefox ESR 60\
1845 **CCK2 Equivalent:** `disablePrivateBrowsing`\
1846 **Preferences Affected:** N/A
1847
1848 #### Windows (GPO)
1849 ```
1850 Software\Policies\Mozilla\Firefox\DisablePrivateBrowsing = 0x1 | 0x0
1851 ```
1852 #### Windows (Intune)
1853 OMA-URI:
1854 ```
1855 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox/DisablePrivateBrowsing
1856 ```
1857 Value (string):
1858 ```
1859 <enabled/> or <disabled/>
1860 ```
1861 #### macOS
1862 ```
1863 <dict>
1864   <key>DisablePrivateBrowsing</key>
1865   <true/> | <false/>
1866 </dict>
1867 ```
1868 #### policies.json
1869 ```
1870 {
1871   "policies": {
1872     "DisablePrivateBrowsing": true | false
1873   }
1874 }
1875 ```
1876 ### DisableProfileImport
1877 Disables the "Import data from another browser" option in the bookmarks window.
1878
1879 **Compatibility:** Firefox 60, Firefox ESR 60\
1880 **CCK2 Equivalent:** N/A\
1881 **Preferences Affected:** N/A
1882
1883 #### Windows (GPO)
1884 ```
1885 Software\Policies\Mozilla\Firefox\DisableProfileImport = 0x1 | 0x0
1886 ```
1887 #### Windows (Intune)
1888 OMA-URI:
1889 ```
1890 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox/DisableProfileImport
1891 ```
1892 Value (string):
1893 ```
1894 <enabled/> or <disabled/>
1895 ```
1896 #### macOS
1897 ```
1898 <dict>
1899   <key>DisableProfileImport</key>
1900   <true/> | <false/>
1901 </dict>
1902 ```
1903 #### policies.json
1904 ```
1905 {
1906   "policies": {
1907     "DisableProfileImport": true | false
1908   }
1909 }
1910 ```
1911 ### DisableProfileRefresh
1912 Disable the Refresh Firefox button on about:support and support.mozilla.org, as well as the prompt that displays offering to refresh Firefox when you haven't used it in a while.
1913
1914 **Compatibility:** Firefox 60, Firefox ESR 60\
1915 **CCK2 Equivalent:** `disableResetFirefox`\
1916 **Preferences Affected:** `browser.disableResetPrompt`
1917
1918 #### Windows (GPO)
1919 ```
1920 Software\Policies\Mozilla\Firefox\DisableProfileRefresh = 0x1 | 0x0
1921 ```
1922 #### Windows (Intune)
1923 OMA-URI:
1924 ```
1925 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox/DisableProfileRefresh
1926 ```
1927 Value (string):
1928 ```
1929 <enabled/> or <disabled/>
1930 ```
1931 #### macOS
1932 ```
1933 <dict>
1934   <key>DisableProfileRefresh</key>
1935   <true/> | <false/>
1936 </dict>
1937 ```
1938 #### policies.json
1939 ```
1940 {
1941   "policies": {
1942     "DisableProfileRefresh": true | false
1943   }
1944 }
1945 ```
1946 ### DisableSafeMode
1947 Disable safe mode within the browser.
1948
1949 On Windows, this disables safe mode via the command line as well.
1950
1951 **Compatibility:** Firefox 60, Firefox ESR 60 (Windows, macOS)\
1952 **CCK2 Equivalent:** `disableSafeMode`\
1953 **Preferences Affected:** N/A
1954
1955 #### Windows (GPO)
1956 ```
1957 Software\Policies\Mozilla\Firefox\DisableSafeMode = 0x1 | 0x0
1958 ```
1959 #### Windows (Intune)
1960 OMA-URI:
1961 ```
1962 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox/DisableSafeMode
1963 ```
1964 Value (string):
1965 ```
1966 <enabled/> or <disabled/>
1967 ```
1968 #### macOS
1969 ```
1970 <dict>
1971   <key>DisableSafeMode</key>
1972   <true/> | <false/>
1973 </dict>
1974 ```
1975 #### policies.json
1976 ```
1977 {
1978   "policies": {
1979     "DisableSafeMode": true | false
1980   }
1981 }
1982 ```
1983 ### DisableSecurityBypass
1984 Prevent the user from bypassing security in certain cases.
1985
1986 `InvalidCertificate` prevents adding an exception when an invalid certificate is shown.
1987
1988 `SafeBrowsing` prevents selecting "ignore the risk" and visiting a harmful site anyway.
1989
1990 **Compatibility:** Firefox 60, Firefox ESR 60\
1991 **CCK2 Equivalent:** N/A\
1992 **Preferences Affected:** `security.certerror.hideAddException`, `browser.safebrowsing.allowOverride`
1993
1994 #### Windows (GPO)
1995 ```
1996 Software\Policies\Mozilla\Firefox\DisableSecurityBypass\InvalidCertificate = 0x1 | 0x0
1997 Software\Policies\Mozilla\Firefox\DisableSecurityBypass\SafeBrowsing = 0x1 | 0x0
1998 ```
1999 #### Windows (Intune)
2000 OMA-URI:
2001 ```
2002 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox/P_DisableSecurityBypass_InvalidCertificate
2003 ```
2004 Value (string):
2005 ```
2006 <enabled/> or <disabled/>
2007 ```
2008 OMA-URI:
2009 ```
2010 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox/P_DisableSecurityBypass_SafeBrowsing
2011 ```
2012 Value (string):
2013 ```
2014 <enabled/> or <disabled/>
2015 ```
2016
2017 #### macOS
2018 ```
2019 <dict>
2020   <key>DisableSecurityBypass</key>
2021   <dict>
2022     <key>InvalidCertificate</key>
2023     <true/> | <false/>
2024     <key>SafeBrowsing</key>
2025     <true/> | <false/>
2026   </dict>
2027 </dict>
2028 ```
2029 #### policies.json
2030 ```
2031 {
2032   "policies": {
2033     "DisableSecurityBypass": {
2034       "InvalidCertificate": true | false,
2035       "SafeBrowsing": true | false
2036     }
2037   }
2038 }
2039 ```
2040 ### DisableSetDesktopBackground
2041 Remove the "Set As Desktop Background..." menuitem when right clicking on an image.
2042
2043 **Compatibility:** Firefox 60, Firefox ESR 60\
2044 **CCK2 Equivalent:** `removeSetDesktopBackground`\
2045 **Preferences Affected:** N/A
2046
2047 #### Windows (GPO)
2048 ```
2049 Software\Policies\Mozilla\Firefox\DisableSetDesktopBackground = 0x1 | 0x0
2050 ```
2051 #### Windows (Intune)
2052 OMA-URI:
2053 ```
2054 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox/DisableSetDesktopBackground
2055 ```
2056 Value (string):
2057 ```
2058 <enabled/> or <disabled/>
2059 ```
2060 #### macOS
2061 ```
2062 <dict>
2063   <key>DisableSetDesktopBackground</key>
2064   <true/> | <false/>
2065 </dict>
2066 ```
2067 #### policies.json
2068 ```
2069 {
2070   "policies": {
2071     "DisableSetDesktopBackground": true | false
2072   }
2073 }
2074 ```
2075 ### DisableSystemAddonUpdate
2076 Prevent system add-ons from being installed or updated.
2077
2078 **Compatibility:** Firefox 60, Firefox ESR 60\
2079 **CCK2 Equivalent:** N/A\
2080 **Preferences Affected:** N/A
2081
2082 #### Windows (GPO)
2083 ```
2084 Software\Policies\Mozilla\Firefox\DisableSystemAddonUpdate = 0x1 | 0x0
2085 ```
2086 #### Windows (Intune)
2087 OMA-URI:
2088 ```
2089 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox/DisableSystemAddonUpdate
2090 ```
2091 Value (string):
2092 ```
2093 <enabled/> or <disabled/>
2094 ```
2095 #### macOS
2096 ```
2097 <dict>
2098   <key>DisableSystemAddonUpdate</key>
2099   <true/> | <false/>
2100 </dict>
2101 ```
2102 #### policies.json
2103 ```
2104 {
2105   "policies": {
2106     "DisableSystemAddonUpdate": true | false
2107   }
2108 }
2109 ```
2110 ### DisableTelemetry
2111 Prevent the upload of telemetry data.
2112
2113 As of Firefox 83 and Firefox ESR 78.5, local storage of telemetry data is disabled as well.
2114
2115 Mozilla recommends that you do not disable telemetry. Information collected through telemetry helps us build a better product for businesses like yours.
2116
2117 **Compatibility:** Firefox 60, Firefox ESR 60\
2118 **CCK2 Equivalent:** `disableTelemetry`\
2119 **Preferences Affected:** `datareporting.healthreport.uploadEnabled`, `datareporting.policy.dataSubmissionEnabled`, `toolkit.telemetry.archive.enabled`
2120
2121 #### Windows (GPO)
2122 ```
2123 Software\Policies\Mozilla\Firefox\DisableTelemetry = 0x1 | 0x0
2124 ```
2125 #### Windows (Intune)
2126 OMA-URI:
2127 ```
2128 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox/DisableTelemetry
2129 ```
2130 Value (string):
2131 ```
2132 <enabled/> or <disabled/>
2133 ```
2134 #### macOS
2135 ```
2136 <dict>
2137   <key>DisableTelemetry</key>
2138   <true/> | <false/>
2139 </dict>
2140 ```
2141 #### policies.json
2142 ```
2143 {
2144   "policies": {
2145     "DisableTelemetry": true | false
2146   }
2147 }
2148 ```
2149 ### DisableThirdPartyModuleBlocking
2150 Do not allow blocking third-party modules from the `about:third-party` page.
2151
2152 This policy only works on Windows through GPO (not policies.json).
2153
2154 **Compatibility:** Firefox 110 (Windows only, GPO only)\
2155 **CCK2 Equivalent:** N/A\
2156 **Preferences Affected:** N/A
2157
2158 #### Windows (GPO)
2159 ```
2160 Software\Policies\Mozilla\Firefox\DisableThirdPartyModuleBlocking = = 0x1 | 0x0
2161 ```
2162 #### Windows (Intune)
2163 OMA-URI:
2164 ```
2165 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox/DisableThirdPartyModuleBlocking
2166 ```
2167 Value (string):
2168 ```
2169 <enabled/> or <disabled/>
2170 ```
2171 ### DisplayBookmarksToolbar
2172 Set the initial state of the bookmarks toolbar. A user can still change how it is displayed.
2173
2174 `always` means the bookmarks toolbar is always shown.
2175
2176 `never` means the bookmarks toolbar is not shown.
2177
2178 `newtab` means the bookmarks toolbar is only shown on the new tab page.
2179
2180 **Compatibility:** Firefox 109, Firefox ESR 102.7\
2181 **CCK2 Equivalent:** N/A\
2182 **Preferences Affected:** N/A
2183
2184 #### Windows (GPO)
2185 ```
2186 Software\Policies\Mozilla\Firefox\DisplayBookmarksToolbar = "always", "never", "newtab"
2187 ```
2188 #### Windows (Intune)
2189 OMA-URI:
2190 ```
2191 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox/DisplayBookmarksToolbar_Enum
2192 ```
2193 Value (string):
2194 ```
2195 <enabled/>
2196 <data id="DisplayBookmarksToolbar" value="always | never | newtab"/>
2197 ```
2198 #### macOS
2199 ```
2200 <dict>
2201   <key>DisplayBookmarksToolbar</key>
2202   <string>always | never | newtab</string>
2203 </dict>
2204 ```
2205 #### policies.json
2206 ```
2207 {
2208   "policies": {
2209     "DisplayBookmarksToolbar": "always" | "never" | "newtab"
2210   }
2211 }
2212 ```
2213 ### DisplayMenuBar
2214 Set the state of the menubar.
2215
2216 `always` means the menubar is shown and cannot be hidden.
2217
2218 `never` means the menubar is hidden and cannot be shown.
2219
2220 `default-on` means the menubar is on by default but can be hidden.
2221
2222 `default-off` means the menubar is off by default but can be shown.
2223
2224 **Compatibility:** Firefox 73, Firefox ESR 68.5 (Windows, some Linux)\
2225 **CCK2 Equivalent:** `displayMenuBar`\
2226 **Preferences Affected:** N/A
2227
2228 #### Windows (GPO)
2229 ```
2230 Software\Policies\Mozilla\Firefox\DisplayMenuBar = "always", "never", "default-on", "default-off"
2231 ```
2232 #### Windows (Intune)
2233 OMA-URI:
2234 ```
2235 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox/DisplayMenuBar_Enum
2236 ```
2237 Value (string):
2238 ```
2239 <enabled/>
2240 <data id="DisplayMenuBar" value="always | never | default-on | default-off"/>
2241 ```
2242 #### macOS
2243 ```
2244 <dict>
2245   <key>DisplayMenuBar</key>
2246   <string>always | never | default-on | default-off</string>
2247 </dict>
2248 ```
2249 #### policies.json
2250 ```
2251 {
2252   "policies": {
2253     "DisplayMenuBar": "always", "never", "default-on", "default-off"
2254   }
2255 }
2256 ```
2257 ### DNSOverHTTPS
2258 Configure DNS over HTTPS.
2259
2260 `Enabled` determines whether DNS over HTTPS is enabled
2261
2262 `ProviderURL` is a URL to another provider.
2263
2264 `Locked` prevents the user from changing DNS over HTTPS preferences.
2265
2266 `ExcludedDomains` excludes domains from DNS over HTTPS.
2267
2268 **Compatibility:** Firefox 63, Firefox ESR 68 (ExcludedDomains added in 75/68.7)\
2269 **CCK2 Equivalent:** N/A\
2270 **Preferences Affected:** `network.trr.mode`, `network.trr.uri`
2271
2272 #### Windows (GPO)
2273 ```
2274 Software\Policies\Mozilla\Firefox\DNSOverHTTPS\Enabled = 0x1 | 0x0
2275 Software\Policies\Mozilla\Firefox\DNSOverHTTPS\ProviderURL = "URL_TO_ALTERNATE_PROVIDER"
2276 Software\Policies\Mozilla\Firefox\DNSOverHTTPS\Locked = 0x1 | 0x0
2277 Software\Policies\Mozilla\Firefox\DNSOverHTTPS\ExcludedDomains\1 = "example.com"
2278 ```
2279 #### Windows (Intune)
2280 OMA-URI:
2281 ```
2282 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~DNSOverHTTPS/DNSOverHTTPS_Enabled
2283 ```
2284 Value (string):
2285 ```
2286 <enabled/> or <disabled/>
2287 ```
2288 OMA-URI:
2289 ```
2290 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~DNSOverHTTPS/DNSOverHTTPS_ProviderURL
2291 ```
2292 Value (string):
2293 ```
2294 <enabled/>
2295 <data id="String" value="URL_TO_ALTERNATE_PROVIDER"/>
2296 ```
2297 OMA-URI:
2298 ```
2299 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~DNSOverHTTPS/DNSOverHTTPS_Locked
2300 ```
2301 Value (string):
2302 ```
2303 <enabled/> or <disabled/>
2304 ```
2305 OMA-URI:
2306 ```
2307 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~DNSOverHTTPS/DNSOverHTTPS_ExcludedDomains
2308 ```
2309 Value (string):
2310 ```
2311 <enabled/>
2312 <data id="List" value="1&#xF000;example.com"/>
2313 ```
2314 #### macOS
2315 ```
2316 <dict>
2317   <key>DNSOverHTTPS</key>
2318   <dict>
2319     <key>Enabled</key>
2320     <true/> | <false/>
2321     <key>ProviderURL</key>
2322     <string>URL_TO_ALTERNATE_PROVIDER</string>
2323     <key>Locked</key>
2324     <true/> | <false/>
2325     <key>ExcludedDomains</key>
2326     <array>
2327       <string>example.com</string>
2328     </array>
2329   </dict>
2330 </dict>
2331 ```
2332 #### policies.json
2333 ```
2334 {
2335   "policies": {
2336     "DNSOverHTTPS": {
2337       "Enabled":  true | false,
2338       "ProviderURL": "URL_TO_ALTERNATE_PROVIDER",
2339       "Locked": true | false,
2340       "ExcludedDomains": ["example.com"]
2341     }
2342   }
2343 }
2344 ```
2345 ### DontCheckDefaultBrowser
2346 Don't check if Firefox is the default browser at startup.
2347
2348 **Compatibility:** Firefox 60, Firefox ESR 60\
2349 **CCK2 Equivalent:** `dontCheckDefaultBrowser`\
2350 **Preferences Affected:** `browser.shell.checkDefaultBrowser`
2351
2352 #### Windows (GPO)
2353 ```
2354 Software\Policies\Mozilla\Firefox\DontCheckDefaultBrowser = 0x1 | 0x0
2355 ```
2356 #### Windows (Intune)
2357 OMA-URI:
2358 ```
2359 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox/DontCheckDefaultBrowser
2360 ```
2361 Value (string):
2362 ```
2363 <enabled/> or <disabled/>
2364 ```
2365 #### macOS
2366 ```
2367 <dict>
2368   <key>DontCheckDefaultBrowser</key>
2369   <true/> | <false/>
2370 </dict>
2371 ```
2372 #### policies.json
2373 ```
2374 {
2375   "policies": {
2376     "DontCheckDefaultBrowser": true | false
2377   }
2378 }
2379 ```
2380 ### DownloadDirectory
2381 Set and lock the download directory.
2382
2383 You can use ${home} for the native home directory.
2384
2385 **Compatibility:** Firefox 68, Firefox ESR 68\
2386 **CCK2 Equivalent:** N/A\
2387 **Preferences Affected:** `browser.download.dir`, `browser.download.folderList`, `browser.download.useDownloadDir`
2388
2389 #### Windows (GPO)
2390 ```
2391 Software\Policies\Mozilla\Firefox\DownloadDirectory = "${home}\Downloads"
2392 ```
2393 #### Windows (Intune)
2394 OMA-URI:
2395 ```
2396 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox/DownloadDirectory
2397 ```
2398 Value (string):
2399 ```
2400 <enabled/>
2401 <data id="Preferences_String" value="${home}\Downloads"/>
2402 ```
2403 #### macOS
2404 ```
2405 <dict>
2406   <key>DownloadDirectory</key>
2407   <string>${home}/Downloads</string>
2408 </dict>
2409 ```
2410 #### policies.json (macOS and Linux)
2411 ```
2412 {
2413   "policies": {
2414     "DownloadDirectory": "${home}/Downloads"
2415 }
2416 ```
2417 #### policies.json (Windows)
2418 ```
2419 {
2420   "policies": {
2421     "DownloadDirectory": "${home}\\Downloads"
2422 }
2423 ```
2424 ### EnableTrackingProtection
2425 Configure tracking protection.
2426
2427 If this policy is not configured, tracking protection is not enabled by default in the browser, but it is enabled by default in private browsing and the user can change it.
2428
2429 If `Value` is set to false, tracking protection is disabled and locked in both the regular browser and private browsing.
2430
2431 If `Value` is set to true, tracking protection is enabled by default in both the regular browser and private browsing and the `Locked` value determines whether or not a user can change it.
2432
2433 If `Cryptomining` is set to true, cryptomining scripts on websites are blocked.
2434
2435 If `Fingerprinting` is set to true, fingerprinting scripts on websites are blocked.
2436
2437 If `EmailTracking` is set to true, hidden email tracking pixels and scripts on websites are blocked. (Firefox 112)
2438
2439 `Exceptions` are origins for which tracking protection is not enabled.
2440
2441 **Compatibility:** Firefox 60, Firefox ESR 60 (Cryptomining and Fingerprinting added in 70/68.2, Exceptions added in 73/68.5)\
2442 **CCK2 Equivalent:** N/A\
2443 **Preferences Affected:** `privacy.trackingprotection.enabled`, `privacy.trackingprotection.pbmode.enabled`, `privacy.trackingprotection.cryptomining.enabled`, `privacy.trackingprotection.fingerprinting.enabled`
2444
2445 #### Windows (GPO)
2446 ```
2447 Software\Policies\Mozilla\Firefox\EnableTrackingProtection\Value = 0x1 | 0x0
2448 Software\Policies\Mozilla\Firefox\EnableTrackingProtection\Locked = 0x1 | 0x0
2449 Software\Policies\Mozilla\Firefox\EnableTrackingProtection\Cryptomining = 0x1 | 0x0
2450 Software\Policies\Mozilla\Firefox\EnableTrackingProtection\Fingerprinting = 0x1 | 0x0
2451 Software\Policies\Mozilla\Firefox\EnableTrackingProtection\Exceptions\1 = "https://example.com"
2452 ```
2453 #### Windows (Intune)
2454 OMA-URI:
2455 ```
2456 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~TrackingProtection/A_TrackingProtection_Value
2457 ```
2458 Value (string):
2459 ```
2460 <enabled/> or <disabled/>
2461 ```
2462 OMA-URI:
2463 ```
2464 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~TrackingProtection/B_TrackingProtection_Cryptomining
2465 ```
2466 Value (string):
2467 ```
2468 <enabled/> or <disabled/>
2469 ```
2470 OMA-URI:
2471 ```
2472 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~TrackingProtection/C_TrackingProtection_Fingerprinting
2473 ```
2474 Value (string):
2475 ```
2476 <enabled/> or <disabled/>
2477 ```
2478 OMA-URI:
2479 ```
2480 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~TrackingProtection/D_TrackingProtection_Exceptions
2481 ```
2482 Value (string):
2483 ```
2484 <enabled/>
2485 <data id="TrackingProtection_Exceptions" value="1&#xF000;https://example.com"/>
2486 ```
2487 OMA-URI:
2488 ```
2489 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~TrackingProtection/E_TrackingProtection_Locked
2490 ```
2491 Value (string):
2492 ```
2493 <enabled/> or <disabled/>
2494 ```
2495 #### macOS
2496 ```
2497 <dict>
2498   <key>EnableTrackingProtection</key>
2499   <dict>
2500     <key>Value</key>
2501     <true/> | <false/>
2502     <key>Locked</key>
2503     <true/> | <false/>
2504     <key>Cryptomining</key>
2505     <true/> | <false/>
2506     <key>Fingerprinting</key>
2507     <true/> | <false/>
2508     <key>Exceptions</key>
2509     <array>
2510       <string>https://example.com</string>
2511     </array>
2512   </dict>
2513 </dict>
2514 ```
2515 #### policies.json
2516 ```
2517 {
2518   "policies": {
2519     "EnableTrackingProtection": {
2520       "Value": true | false,
2521       "Locked": true | false,
2522       "Cryptomining": true | false,
2523       "Fingerprinting": true | false,
2524       "Exceptions": ["https://example.com"]
2525     }
2526   }
2527 }
2528 ```
2529 ### EncryptedMediaExtensions
2530 Enable or disable Encrypted Media Extensions and optionally lock it.
2531
2532 If `Enabled` is set to false, encrypted media extensions (like Widevine) are not downloaded by Firefox unless the user consents to installing them.
2533
2534 If `Locked` is set to true and `Enabled` is set to false, Firefox will not download encrypted media extensions (like Widevine) or ask the user to install them.
2535
2536 **Compatibility:** Firefox 77, Firefox ESR 68.9\
2537 **CCK2 Equivalent:** N/A\
2538 **Preferences Affected:** `media.eme.enabled`
2539
2540 #### Windows (GPO)
2541 ```
2542 Software\Policies\Mozilla\Firefox\EncryptedMediaExtensions\Enabled = 0x1 | 0x0
2543 Software\Policies\Mozilla\Firefox\EncryptedMediaExtensions\Locked = 0x1 | 0x0
2544 ```
2545 #### Windows (Intune)
2546 OMA-URI:
2547 ```
2548 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~EncryptedMediaExtensions/EncryptedMediaExtensions_Enabled
2549 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~EncryptedMediaExtensions/EncryptedMediaExtensions_Locked
2550 ```
2551 Value (string):
2552 ```
2553 <enabled/>or <disabled/>
2554 ```
2555 #### macOS
2556 ```
2557 <dict>
2558   <key>EncryptedMediaExtensions</key>
2559   <dict>
2560     <key>Enabled</key>
2561     <true/> | <false/>
2562     <key>Locked</key>
2563     <true/> | <false/>
2564   </dict>
2565 </dict>
2566 ```
2567 #### policies.json
2568 ```
2569 {
2570   "policies": {
2571     "EncryptedMediaExtensions": {
2572       "Enabled": true | false,
2573       "Locked": true | false
2574     }
2575   }
2576 }
2577 ```
2578 ### EnterprisePoliciesEnabled
2579 Enable policy support on macOS.
2580
2581 **Compatibility:** Firefox 63, Firefox ESR 60.3 (macOS only)\
2582 **CCK2 Equivalent:** N/A\
2583 **Preferences Affected:** N/A
2584
2585 #### macOS
2586 ```
2587 <dict>
2588   <key>EnterprisePoliciesEnabled</key>
2589   <true/>
2590 </dict>
2591 ```
2592 ### ExemptDomainFileTypePairsFromFileTypeDownloadWarnings
2593
2594 Disable warnings based on file extension for specific file types on domains.
2595
2596 This policy is based on the [Chrome policy](https://chromeenterprise.google/policies/#ExemptDomainFileTypePairsFromFileTypeDownloadWarnings) of the same name.
2597
2598 Important: The documentation for the policy for both Edge and Chrome is incorrect. The ```domains``` value must be a domain, not a URL pattern. Also, we do not support using ```*``` to mean all domains.
2599
2600 **Compatibility:** Firefox 102\
2601 **CCK2 Equivalent:** N/A\
2602 **Preferences Affected:** N/A
2603
2604 #### Windows (GPO)
2605 Software\Policies\Mozilla\Firefox\ExemptDomainFileTypePairsFromFileTypeDownloadWarnings (REG_MULTI_SZ) =
2606 ```
2607 [
2608   {
2609      "file_extension": "jnlp",
2610      "domains": ["example.com"]
2611   }
2612 ]
2613 ```
2614 #### Windows (Intune)
2615 OMA-URI:
2616 ```
2617 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox/ExemptDomainFileTypePairsFromFileTypeDownloadWarnings
2618 ```
2619 Value (string):
2620 ```
2621 <enabled/>
2622 <data id="JSON" value='
2623 [
2624   {
2625      "file_extension": "jnlp",
2626      "domains": ["example.com"]
2627   }
2628 ]
2629 '/>
2630 ```
2631 #### macOS
2632 ```
2633 <dict>
2634   <key>ExemptDomainFileTypePairsFromFileTypeDownloadWarnings</key>
2635   <array>
2636     <dict>
2637       <key>file_extension</key>
2638       <string>jnlp</string>
2639       <key>domains</key>
2640       <array>
2641         <string>example.com</string>
2642       </array>
2643     </dict>
2644   </array>
2645 </dict>
2646 ```
2647 #### policies.json
2648 ```
2649 {
2650   "policies": {
2651     "ExemptDomainFileTypePairsFromFileTypeDownloadWarnings": [{
2652       "file_extension": "jnlp",
2653       "domains": ["example.com"]
2654     }]
2655   }
2656 }
2657 ```
2658 ### Extensions
2659 Control the installation, uninstallation and locking of extensions.
2660
2661 While this policy is not technically deprecated, it is recommended that you use the **[`ExtensionSettings`](#extensionsettings)** policy. It has the same functionality and adds more. It does not support native paths, though, so you'll have to use file:/// URLs.
2662
2663 `Install` is a list of URLs or native paths for extensions to be installed.
2664
2665 `Uninstall` is a list of extension IDs that should be uninstalled if found.
2666
2667 `Locked` is a list of extension IDs that the user cannot disable or uninstall.
2668
2669 **Compatibility:** Firefox 60, Firefox ESR 60\
2670 **CCK2 Equivalent:** `addons`\
2671 **Preferences Affected:** N/A
2672
2673 #### Windows (GPO)
2674 ```
2675 Software\Policies\Mozilla\Firefox\Extensions\Install\1 = "https://addons.mozilla.org/firefox/downloads/somefile.xpi"
2676 Software\Policies\Mozilla\Firefox\Extensions\Install\2 = "//path/to/xpi"
2677 Software\Policies\Mozilla\Firefox\Extensions\Uninstall\1 = "bad_addon_id@mozilla.org"
2678 Software\Policies\Mozilla\Firefox\Extensions\Locked\1 = "addon_id@mozilla.org"
2679 ```
2680 #### Windows (Intune)
2681 OMA-URI:
2682 ```
2683 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~Extensions/Extensions_Install
2684 ```
2685 Value (string):
2686 ```
2687 <enabled/>
2688 <data id="Extensions" value="1&#xF000;https://addons.mozilla.org/firefox/downloads/somefile.xpi&#xF000;2&#xF000;//path/to/xpi"/>
2689 ```
2690 OMA-URI:
2691 ```
2692 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~Extensions/Extensions_Uninstall
2693 ```
2694 Value (string):
2695 ```
2696 <enabled/>
2697 <data id="Extensions" value="1&#xF000;bad_addon_id@mozilla.org"/>
2698 ```
2699 OMA-URI:
2700 ```
2701 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~Extensions/Extensions_Locked
2702 ```
2703 Value (string):
2704 ```
2705 <enabled/>
2706 <data id="Extensions" value="1&#xF000;addon_id@mozilla.org"/>
2707 ```
2708 #### macOS
2709 ```
2710 <dict>
2711   <key>Extensions</key>
2712   <dict>
2713     <key>Install</key>
2714     <array>
2715       <string>https://addons.mozilla.org/firefox/downloads/somefile.xpi</string>
2716       <string>//path/to/xpi</string>
2717     </array>
2718     <key>Uninstall</key>
2719     <array>
2720       <string>bad_addon_id@mozilla.org</string>
2721     </array>
2722     <key>Locked</key>
2723     <array>
2724       <string>addon_id@mozilla.org</string>
2725     </array>
2726   </dict>
2727 </dict>
2728 ```
2729 #### policies.json
2730 ```
2731 {
2732   "policies": {
2733     "Extensions": {
2734       "Install": ["https://addons.mozilla.org/firefox/downloads/somefile.xpi", "//path/to/xpi"],
2735       "Uninstall": ["bad_addon_id@mozilla.org"],
2736       "Locked":  ["addon_id@mozilla.org"]
2737     }
2738   }
2739 }
2740 ```
2741 ### ExtensionSettings
2742 Manage all aspects of extensions. This policy is based heavily on the [Chrome policy](https://dev.chromium.org/administrators/policy-list-3/extension-settings-full) of the same name.
2743
2744 This policy maps an extension ID to its configuration. With an extension ID, the configuration will be applied to the specified extension only. A default configuration can be set for the special ID "*", which will apply to all extensions that don't have a custom configuration set in this policy.
2745
2746 To obtain an extension ID, install the extension and go to about:support. You will see the ID in the Extensions section. I've also created an extension that makes it easy to find the ID of extensions on AMO. You can download it [here](https://github.com/mkaply/queryamoid/releases/tag/v0.1).
2747
2748 The configuration for each extension is another dictionary that can contain the fields documented below.
2749
2750 | Name | Description |
2751 | --- | --- |
2752 | `installation_mode` | Maps to a string indicating the installation mode for the extension. The valid strings are `allowed`,`blocked`,`force_installed`, and `normal_installed`.
2753 | &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;`allowed` | Allows the extension to be installed by the user. This is the default behavior. There is no need for an install_url; it will automatically be allowed based on the ID.
2754 | &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;`blocked`| Blocks installation of the extension and removes it from the device if already installed.
2755 | &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;`force_installed`| The extension is automatically installed and can't be removed by the user. This option is not valid for the default configuration and requires an install_url.
2756 | &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;`normal_installed`| The extension is automatically installed but can be disabled by the user. This option is not valid for the default configuration and requires an install_url.
2757 | `install_url`| Maps to a URL indicating where Firefox can download a force_installed or normal_installed extension.  If installing from the local file system, use a [```file:///``` URL](https://en.wikipedia.org/wiki/File_URI_scheme). If installing from the addons.mozilla.org, use the following URL (substituting SHORT_NAME from the URL on AMO), https://addons.mozilla.org/firefox/downloads/latest/SHORT_NAME/latest.xpi. Languages packs are available from https://releases.mozilla.org/pub/firefox/releases/VERSION/PLATFORM/xpi/LANGUAGE.xpi. If you need to update the extension, you can change the name of the extension and it will be automatically updated. Extensions installed from file URLs will additional be updated when their internal version changes.
2758 | `install_sources` | A list of sources from which installing extensions is allowed using URL match patterns. **This is unnecessary if you are only allowing the installation of certain extensions by ID.** Each item in this list is an extension-style match pattern. Users will be able to easily install items from any URL that matches an item in this list. Both the location of the *.xpi file and the page where the download is started from (i.e.  the referrer) must be allowed by these patterns. This setting can be used only for the default configuration.
2759 | `allowed_types` | This setting whitelists the allowed types of extension/apps that can be installed in Firefox. The value is a list of strings, each of which should be one of the following: "extension", "theme", "dictionary", "locale" This setting can be used only for the default configuration.
2760 | `blocked_install_message` | This maps to a string specifying the error message to display to users if they're blocked from installing an extension. This setting allows you to append text to the generic error message displayed when the extension is blocked. This could be be used to direct users to your help desk, explain why a particular extension is blocked, or something else. This setting can be used only for the default configuration.
2761 | `restricted_domains` | An array of domains on which content scripts can't be run. This setting can be used only for the default configuration.
2762 | `updates_disabled` | (Firefox 89, Firefox ESR 78.11) Boolean that indicates whether or not to disable automatic updates for an individual extension.
2763 | `default_area` | (Firefox 113) String that indicates where to place the extension icon by default. Possible values are `navbar` and `menupanel`.
2764
2765 **Compatibility:** Firefox 69, Firefox ESR 68.1 (As of Firefox 85, Firefox ESR 78.7, installing a theme makes it the default.)\
2766 **CCK2 Equivalent:** N/A\
2767 **Preferences Affected:** N/A
2768
2769 #### Windows (GPO)
2770 Software\Policies\Mozilla\Firefox\ExtensionSettings (REG_MULTI_SZ) =
2771 ```
2772 {
2773   "*": {
2774     "blocked_install_message": "Custom error message.",
2775     "install_sources": ["https://yourwebsite.com/*"],
2776     "installation_mode": "blocked",
2777     "allowed_types": ["extension"]
2778   },
2779   "uBlock0@raymondhill.net": {
2780     "installation_mode": "force_installed",
2781     "install_url": "https://addons.mozilla.org/firefox/downloads/latest/ublock-origin/latest.xpi"
2782   },
2783   "https-everywhere@eff.org": {
2784     "installation_mode": "allowed"
2785   }
2786 }
2787 ```
2788 #### Windows (Intune)
2789 OMA-URI:
2790 ```
2791 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~Extensions/ExtensionSettings
2792 ```
2793 Value (string):
2794 ```
2795 <enabled/>
2796 <data id="ExtensionSettings" value='
2797 {
2798   "*": {
2799     "blocked_install_message": "Custom error message.",
2800     "install_sources": ["https://yourwebsite.com/*"],
2801     "installation_mode": "blocked",
2802     "allowed_types": ["extension"]
2803   },
2804   "uBlock0@raymondhill.net": {
2805     "installation_mode": "force_installed",
2806     "install_url": "https://addons.mozilla.org/firefox/downloads/latest/ublock-origin/latest.xpi"
2807   },
2808     "https-everywhere@eff.org": {
2809     "installation_mode": "allowed"
2810   }
2811 }'/>
2812 ```
2813 #### macOS
2814 ```
2815 <dict>
2816   <key>ExtensionSettings</key>
2817   <dict>
2818     <key>*</key>
2819     <dict>
2820       <key>blocked_install_message</key>
2821       <string>Custom error message.</string>
2822       <key>install_sources</key>
2823       <array>
2824         <string>"https://yourwebsite.com/*"</string>
2825       </array>
2826       <key>installation_mode</key>
2827       <string>blocked</string>
2828       <key>allowed_types</key>
2829       <array>
2830         <string>extension</string>
2831       </array>
2832     </dict>
2833     <key>uBlock0@raymondhill.net</key>
2834     <dict>
2835       <key>installation_mode</key>
2836        <string>force_installed</string>
2837       <key>install_url</key>
2838       <string>https://addons.mozilla.org/firefox/downloads/latest/ublock-origin/latest.xpi</string>
2839     </dict>
2840     <key>https-everywhere@eff.org</key>
2841     <dict>
2842       <key>installation_mode</key>
2843        <string>allowed</string>
2844     </dict>
2845   </dict>
2846 </dict>
2847 ```
2848 #### policies.json
2849 ```
2850 {
2851   "policies": {
2852     "ExtensionSettings": {
2853       "*": {
2854         "blocked_install_message": "Custom error message.",
2855         "install_sources": ["https://yourwebsite.com/*"],
2856         "installation_mode": "blocked",
2857         "allowed_types": ["extension"]
2858       },
2859       "uBlock0@raymondhill.net": {
2860         "installation_mode": "force_installed",
2861         "install_url": "https://addons.mozilla.org/firefox/downloads/latest/ublock-origin/latest.xpi"
2862       },
2863       "https-everywhere@eff.org": {
2864         "installation_mode": "allowed"
2865       }
2866     }
2867   }
2868 }
2869 ```
2870 ### ExtensionUpdate
2871 Control extension updates.
2872
2873 **Compatibility:** Firefox 67, Firefox ESR 60.7\
2874 **CCK2 Equivalent:** N/A\
2875 **Preferences Affected:** `extensions.update.enabled`
2876
2877 #### Windows (GPO)
2878 ```
2879 Software\Policies\Mozilla\Firefox\ExtensionUpdate = 0x1 | 0x0
2880 ```
2881 #### Windows (Intune)
2882 OMA-URI:
2883 ```
2884 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~Extensions/ExtensionUpdate
2885 ```
2886 Value (string):
2887 ```
2888 <enabled/> or <disabled/>
2889 ```
2890 #### macOS
2891 ```
2892 <dict>
2893   <key>ExtensionUpdate</key>
2894   <true/> | <false/>
2895 </dict>
2896 ```
2897 #### policies.json
2898 ```
2899 {
2900   "policies": {
2901     "ExtensionUpdate": true | false
2902   }
2903 }
2904 ```
2905 ### FirefoxHome
2906 Customize the Firefox Home page.
2907
2908 **Compatibility:** Firefox 68, Firefox ESR 68 (SponsoredTopSites and SponsoredPocket were added in Firefox 95, Firefox ESR 91.4)
2909 **CCK2 Equivalent:** N/A\
2910 **Preferences Affected:** `browser.newtabpage.activity-stream.showSearch`, `browser.newtabpage.activity-stream.feeds.topsites`, `browser.newtabpage.activity-stream.feeds.section.highlights`, `browser.newtabpage.activity-stream.feeds.section.topstories`, `browser.newtabpage.activity-stream.feeds.snippets`, `browser.newtabpage.activity-stream.showSponsoredTopSites`, `browser.newtabpage.activity-stream.showSponsored`
2911
2912 #### Windows (GPO)
2913 ```
2914 Software\Policies\Mozilla\Firefox\FirefoxHome\Search = 0x1 | 0x0
2915 Software\Policies\Mozilla\Firefox\FirefoxHome\TopSites = 0x1 | 0x0
2916 Software\Policies\Mozilla\Firefox\FirefoxHome\SponsoredTopSites = 0x1 | 0x0
2917 Software\Policies\Mozilla\Firefox\FirefoxHome\Highlights = 0x1 | 0x0
2918 Software\Policies\Mozilla\Firefox\FirefoxHome\Pocket = 0x1 | 0x0
2919 Software\Policies\Mozilla\Firefox\FirefoxHome\SponsoredPocket = 0x1 | 0x0
2920 Software\Policies\Mozilla\Firefox\FirefoxHome\Snippets = 0x1 | 0x0
2921 Software\Policies\Mozilla\Firefox\FirefoxHome\Locked = 0x1 | 0x0
2922 ```
2923 #### Windows (Intune)
2924 OMA-URI:
2925 ```
2926 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox/CustomizeFirefoxHome
2927 ```
2928 Value (string):
2929 ```
2930 <enabled/>
2931 <data id="FirefoxHome_Search"  value="true | false"/>
2932 <data id="FirefoxHome_TopSites"  value="true | false"/>
2933 <data id="FirefoxHome_SponsoredTopSites"  value="true | false"/>
2934 <data id="FirefoxHome_Highlights"  value="true | false"/>
2935 <data id="FirefoxHome_Pocket"  value="true | false"/>
2936 <data id="FirefoxHome_SponsoredPocket"  value="true | false"/>
2937 <data id="FirefoxHome_Snippets"  value="true | false"/>
2938 <data id="FirefoxHome_Locked"  value="true | false"/>
2939 ```
2940 #### macOS
2941 ```
2942 <dict>
2943   <key>FirefoxHome</key>
2944   <dict>
2945     <key>Search</key>
2946     <true/> | <false/>
2947     <key>TopSites</key>
2948     <true/> | <false/>
2949     <key>SponsoredTopSites</key>
2950     <true/> | <false/>
2951     <key>Highlights</key>
2952     <true/> | <false/>
2953     <key>Pocket</key>
2954     <true/> | <false/>
2955     <key>SponsoredPocket</key>
2956     <true/> | <false/>
2957     <key>Snippets</key>
2958     <true/> | <false/>
2959     <key>Locked</key>
2960     <true/> | <false/>
2961   </dict>
2962 </dict>
2963 ```
2964 #### policies.json
2965 ```
2966 {
2967   "policies": {
2968     "FirefoxHome": {
2969       "Search": true | false,
2970       "TopSites": true | false,
2971       "SponsoredTopSites": true | false,
2972       "Highlights": true | false,
2973       "Pocket": true | false,
2974       "SponsoredPocket": true | false,
2975       "Snippets": true | false,
2976       "Locked": true | false
2977     }
2978   }
2979 }
2980 ```
2981 ### GoToIntranetSiteForSingleWordEntryInAddressBar
2982 Whether to always go through the DNS server before sending a single word search string to a search engine.
2983
2984 If the site exists, it will navigate to the website. If the intranet responds with a 404, the page will show a 404. If the intranet does not respond, the browser will attempt a search.
2985
2986 The second result in the URL bar will be a search result to allow users to conduct a web search exactly as it was entered.
2987
2988 If instead you would like to enable the ability to have your domain appear as a valid URL and to disallow the browser from ever searching that term using the first result that matches it, add the pref `browser.fixup.domainwhitelist.YOUR_DOMAIN` (where `YOUR_DOMAIN` is the name of the domain you'd like to add), and set the pref to `true`. The URL bar will then suggest `YOUR_DOMAIN` when the user fully types `YOUR_DOMAIN`. If the user attempts to load that domain and it fails to load, it will show an "Unable to connect" error page.
2989
2990 You can also whitelist a domain suffix that is not part of the [Public Suffix List](https://publicsuffix.org/) by adding the pref `browser.fixup.domainsuffixwhitelist.YOUR_DOMAIN_SUFFIX` with a value of `true`.
2991
2992 Additionally, if you want users to see a "Did you mean to go to 'YOUR_DOMAIN'" prompt below the URL bar if they land on a search results page instead of an intranet domain that provides a response, set the pref `browser.urlbar.dnsResolveSingleWordsAfterSearch` to `1`. Enabling this will cause the browser to commit a DNS check after every single word search. If the browser receives a response from the intranet, a prompt will ask the user if they'd like to instead navigate to `YOUR_DOMAIN`. If the user presses the **yes** button, `browser.fixup.domainwhitelist.YOUR_DOMAIN` will be set to `true`.
2993
2994 **Compatibility:** Firefox 104, Firefox ESR 102.2\
2995 **CCK2 Equivalent:** `N/A`\
2996 **Preferences Affected:** `browser.fixup.dns_first_for_single_words`
2997
2998 #### Windows (GPO)
2999 ```
3000 Software\Policies\Mozilla\Firefox\GoToIntranetSiteForSingleWordEntryInAddressBar = 0x1 | 0x0
3001 ```
3002 #### Windows (Intune)
3003 OMA-URI:
3004 ```
3005 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox/GoToIntranetSiteForSingleWordEntryInAddressBar
3006 ```
3007 Value (string):
3008 ```
3009 <enabled/> or <disabled/>
3010 ```
3011 #### macOS
3012 ```
3013 <dict>
3014   <key>GoToIntranetSiteForSingleWordEntryInAddressBar</key>
3015   <true/> | <false/>
3016 </dict>
3017 ```
3018 #### policies.json
3019 ```
3020 {
3021   "policies": {
3022     "GoToIntranetSiteForSingleWordEntryInAddressBar": true | false
3023   }
3024 }
3025 ```
3026 ### Handlers
3027 Configure default application handlers. This policy is based on the internal format of `handlers.json`.
3028
3029 You can configure handlers based on a mime type (`mimeTypes`), a file's extension (`extensions`), or a protocol (`schemes`).
3030
3031 Within each handler type, you specify the given mimeType/extension/scheme as a key and use the following subkeys to describe how it is handled.
3032
3033 | Name | Description |
3034 | --- | --- |
3035 | `action`| Can be either `saveToDisk`, `useHelperApp`, `useSystemDefault`.
3036 | `ask` | If `true`, the user is asked if what they want to do with the file. If `false`, the action is taken without user intervention.
3037 | `handlers` | An array of handlers with the first one being the default. If you don't want to have a default handler, use an empty object for the first handler. Choose between path or uriTemplate.
3038 | &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;`name` | The display name of the handler (might not be used).
3039 | &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;`path`| The native path to the executable to be used.
3040 | &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;`uriTemplate`| A url to a web based application handler. The URL must be https and contain a %s to be used for substitution.
3041
3042 **Compatibility:** Firefox 78, Firefox ESR 78\
3043 **CCK2 Equivalent:** N/A\
3044 **Preferences Affected:** N/A
3045
3046 #### Windows (GPO)
3047 Software\Policies\Mozilla\Firefox\Handlers (REG_MULTI_SZ) =
3048 ```
3049 {
3050   "mimeTypes": {
3051     "application/msword": {
3052       "action": "useSystemDefault",
3053       "ask": true | false
3054     }
3055   },
3056   "schemes": {
3057     "mailto": {
3058       "action": "useHelperApp",
3059       "ask": true | false,
3060       "handlers": [{
3061         "name": "Gmail",
3062         "uriTemplate": "https://mail.google.com/mail/?extsrc=mailto&url=%s"
3063       }]
3064     }
3065   },
3066   "extensions": {
3067     "pdf": {
3068       "action": "useHelperApp",
3069       "ask": true | false,
3070       "handlers": [{
3071         "name": "Adobe Acrobat",
3072         "path": "C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\AcroRd32.exe"
3073       }]
3074     }
3075   }
3076 }
3077 ```
3078 #### Windows (Intune)
3079 OMA-URI:
3080 ```
3081 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox/Handlers
3082 ```
3083 Value (string):
3084 ```
3085 <enabled/>
3086 <data id="Handlers" value='
3087 {
3088   "mimeTypes": {
3089     "application/msword": {
3090       "action": "useSystemDefault",
3091       "ask": true | false
3092     }
3093   },
3094   "schemes": {
3095     "mailto": {
3096       "action": "useHelperApp",
3097       "ask": true | false,
3098       "handlers": [{
3099         "name": "Gmail",
3100         "uriTemplate": "https://mail.google.com/mail/?extsrc=mailto&amp;url=%s"
3101       }]
3102     }
3103   },
3104   "extensions": {
3105     "pdf": {
3106       "action": "useHelperApp",
3107       "ask": true | false,
3108       "handlers": [{
3109         "name": "Adobe Acrobat",
3110         "path": "C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\AcroRd32.exe"
3111       }]
3112     }
3113   }
3114 }
3115 '/>
3116 ```
3117 #### macOS
3118 ```
3119 <dict>
3120   <key>Handlers</key>
3121   <dict>
3122     <key>mimeTypes</key>
3123     <dict>
3124       <key>application/msword</key>
3125       <dict>
3126         <key>action</key>
3127         <string>useSystemDefault</string>
3128         <key>ask</key>
3129         <true/> | <false/>
3130       </dict>
3131     </dict>
3132     <key>schemes</key>
3133     <dict>
3134       <key>mailto</key>
3135       <dict>
3136         <key>action</key>
3137         <string>useHelperApp</string>
3138         <key>ask</key>
3139         <true/> | <false/>
3140         <key>handlers</key>
3141         <array>
3142           <dict>
3143             <key>name</key>
3144             <string>Gmail</string>
3145             <key>uriTemplate</key>
3146             <string>https://mail.google.com/mail/?extsrc=mailto&url=%s</string>
3147           </dict>
3148         </array>
3149       </dict>
3150     </dict>
3151     <key>extensions</key>
3152     <dict>
3153       <key>pdf</key>
3154       <dict>
3155         <key>action</key>
3156         <string>useHelperApp</string>
3157         <key>ask</key>
3158         <true/> | <false/>
3159         <key>handlers</key>
3160         <array>
3161           <dict>
3162             <key>name</key>
3163             <string>Adobe Acrobat</string>
3164             <key>path</key>
3165             <string>/System/Applications/Preview.app</string>
3166           </dict>
3167         </array>
3168       </dict>
3169     </dict>
3170   </dict>
3171 </dict>
3172 ```
3173 #### policies.json
3174 ```
3175 {
3176   "policies": {
3177     "Handlers": {
3178       "mimeTypes": {
3179         "application/msword": {
3180           "action": "useSystemDefault",
3181           "ask": false
3182         }
3183       },
3184       "schemes": {
3185         "mailto": {
3186           "action": "useHelperApp",
3187           "ask": true | false,
3188           "handlers": [{
3189             "name": "Gmail",
3190             "uriTemplate": "https://mail.google.com/mail/?extsrc=mailto&url=%s"
3191           }]
3192         }
3193       },
3194       "extensions": {
3195         "pdf": {
3196           "action": "useHelperApp",
3197           "ask": true | false,
3198           "handlers": [{
3199             "name": "Adobe Acrobat",
3200             "path": "/usr/bin/acroread"
3201           }]
3202         }
3203       }
3204     }
3205   }
3206 }
3207 ```
3208 ### HardwareAcceleration
3209 Control hardware acceleration.
3210
3211 **Compatibility:** Firefox 60, Firefox ESR 60\
3212 **CCK2 Equivalent:** N/A\
3213 **Preferences Affected:** `layers.acceleration.disabled`
3214
3215 #### Windows (GPO)
3216 ```
3217 Software\Policies\Mozilla\Firefox\HardwareAcceleration = 0x1 | 0x0
3218 ```
3219 #### Windows (Intune)
3220 OMA-URI:
3221 ```
3222 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox/HardwareAcceleration
3223 ```
3224 Value (string):
3225 ```
3226 <enabled/> or <disabled/>
3227 ```
3228 #### macOS
3229 ```
3230 <dict>
3231   <key>HardwareAcceleration</key>
3232   <true/> | <false/>
3233 </dict>
3234 ```
3235 #### policies.json
3236 ```
3237 {
3238   "policies": {
3239     "HardwareAcceleration": true | false
3240   }
3241 }
3242 ```
3243 ### Homepage
3244 Configure the default homepage and how Firefox starts.
3245
3246 `URL` is the default homepage.
3247
3248 `Locked` prevents the user from changing homepage preferences.
3249
3250 `Additional` allows for more than one homepage.
3251
3252 `StartPage` is how Firefox starts. The choices are no homepage, the default homepage or the previous session.
3253
3254 With Firefox 78, an additional option as added for `Startpage`, `homepage-locked`. If this is value is set for the Startpage, the user will always get the homepage at startup and cannot choose to restore their session.
3255
3256 **Compatibility:** Firefox 60, Firefox ESR 60 (StartPage was added in Firefox 60, Firefox ESR 60.4, homepage-locked added in Firefox 78)\
3257 **CCK2 Equivalent:** `homePage`,`lockHomePage`\
3258 **Preferences Affected:** `browser.startup.homepage`, `browser.startup.page`
3259
3260 #### Windows (GPO)
3261 ```
3262 Software\Policies\Mozilla\Firefox\Homepage\URL = "https://example.com"
3263 Software\Policies\Mozilla\Firefox\Homepage\Locked = 0x1 | 0x0
3264 Software\Policies\Mozilla\Firefox\Homepage\Additional\1 = "https://example.org"
3265 Software\Policies\Mozilla\Firefox\Homepage\Additional\2 = "https://example.edu"
3266 Software\Policies\Mozilla\Firefox\Homepage\StartPage = "none" | "homepage" | "previous-session" | "homepage-locked"
3267 ```
3268 #### Windows (Intune)
3269 OMA-URI:
3270 ```
3271 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~Homepage/HomepageURL
3272 ```
3273 Value (string):
3274 ```
3275 <enabled/>
3276
3277 <data id="HomepageURL" value="https://example.com"/>
3278 <data id="HomepageLocked" value="true | false"/>
3279 ```
3280 OMA-URI:
3281 ```
3282 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~Homepage/HomepageAdditional
3283 ```
3284 Value (string):
3285 ```
3286 <enabled/>
3287
3288 <data id="HomepageAdditional" value="1&#xF000;http://example.org&#xF000;2&#xF000;http://example.edu"/>
3289 ```
3290 OMA-URI:
3291 ```
3292 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~Homepage/HomepageStartPage
3293 ```
3294 Value (string):
3295 ```
3296 <enabled/>
3297
3298 <data id="StartPage" value="none | homepage | previous-session"/>
3299 ```
3300 #### macOS
3301 ```
3302 <dict>
3303   <key>Homepage</key>
3304   <dict>
3305     <key>URL</key>
3306     <string>http://example.com</string>
3307     <key>Locked</key>
3308     <true/> | <false/>
3309     <key>Additional</key>
3310     <array>
3311       <string>http://example.org</string>
3312       <string>http://example.edu</string>
3313     </array>
3314     <key>StartPage</key>
3315     <string>none | homepage | previous-session | homepage-locked</string>
3316   </dict>
3317 </dict>
3318 ```
3319 #### policies.json
3320 ```
3321 {
3322   "policies": {
3323     "Homepage": {
3324       "URL": "http://example.com/",
3325       "Locked": true | false,
3326       "Additional": ["http://example.org/",
3327                      "http://example.edu/"],
3328       "StartPage": "none" | "homepage" | "previous-session" | "homepage-locked"
3329     }
3330   }
3331 }
3332 ```
3333 ### InstallAddonsPermission
3334 Configure the default extension install policy as well as origins for extension installs are allowed. This policy does not override turning off all extension installs.
3335
3336 `Allow` is a list of origins where extension installs are allowed.
3337
3338 `Default` determines whether or not extension installs are allowed by default.
3339
3340 **Compatibility:** Firefox 60, Firefox ESR 60\
3341 **CCK2 Equivalent:** `permissions.install`\
3342 **Preferences Affected:** `xpinstall.enabled`
3343
3344 #### Windows (GPO)
3345 ```
3346 Software\Policies\Mozilla\Firefox\InstallAddonsPermission\Allow\1 = "https://example.org"
3347 Software\Policies\Mozilla\Firefox\InstallAddonsPermission\Allow\2 = "https://example.edu"
3348 Software\Policies\Mozilla\Firefox\InstallAddonsPermission\Default = 0x1 | 0x0
3349 ```
3350 #### Windows (Intune)
3351 OMA-URI:
3352 ```
3353 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~Addons/InstallAddonsPermission_Allow
3354 ```
3355 Value (string):
3356 ```
3357 <enabled/>
3358 <data id="Permissions" value="1&#xF000;https://example.org&#xF000;2&#xF000;https://example.edu"/>
3359 ```
3360 OMA-URI:
3361 ```
3362 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~Addons/InstallAddonsPermission_Default
3363 ```
3364 Value (string):
3365 ```
3366 <enabled/>
3367 ```
3368 #### macOS
3369 ```
3370 <dict>
3371   <key>InstallAddonsPermission</key>
3372   <dict>
3373     <key>Allow</key>
3374     <array>
3375       <string>http://example.org</string>
3376       <string>http://example.edu</string>
3377     </array>
3378     <key>Default</key>
3379     <true/> | <false/>
3380   </dict>
3381 </dict>
3382 ```
3383 #### policies.json
3384 ```
3385 {
3386   "policies": {
3387     "InstallAddonsPermission": {
3388       "Allow": ["http://example.org/",
3389                 "http://example.edu/"],
3390       "Default": true | false
3391     }
3392   }
3393 }
3394 ```
3395 ### LegacyProfiles
3396 Disable the feature enforcing a separate profile for each installation.
3397
3398 If this policy set to true, Firefox will not try to create different profiles for installations of Firefox in different directories. This is the equivalent of the MOZ_LEGACY_PROFILES environment variable.
3399
3400 If this policy set to false, Firefox will create a new profile for each unique installation of Firefox.
3401
3402 This policy only work on Windows via GPO (not policies.json).
3403
3404 **Compatibility:** Firefox 70, Firefox ESR 68.2 (Windows only, GPO only)\
3405 **CCK2 Equivalent:** N/A\
3406 **Preferences Affected:** N/A
3407
3408 #### Windows (GPO)
3409 ```
3410 Software\Policies\Mozilla\Firefox\LegacyProfiles = = 0x1 | 0x0
3411 ```
3412 #### Windows (Intune)
3413 OMA-URI:
3414 ```
3415 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox/LegacyProfiles
3416 ```
3417 Value (string):
3418 ```
3419 <enabled/> or <disabled/>
3420 ```
3421 ### LegacySameSiteCookieBehaviorEnabled
3422 Enable default legacy SameSite cookie behavior setting.
3423
3424 If this policy is set to true, it reverts all cookies to legacy SameSite behavior which means that cookies that don't explicitly specify a ```SameSite``` attribute are treated as if they were ```SameSite=None```.
3425
3426 **Compatibility:** Firefox 96\
3427 **CCK2 Equivalent:** N/A\
3428 **Preferences Affected:** `network.cookie.sameSite.laxByDefault`
3429
3430 #### Windows (GPO)
3431 ```
3432 Software\Policies\Mozilla\Firefox\LegacySameSiteCookieBehaviorEnabled = = 0x1 | 0x0
3433 ```
3434 #### Windows (Intune)
3435 OMA-URI:
3436 ```
3437 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox/LegacySameSiteCookieBehaviorEnabled
3438 ```
3439 Value (string):
3440 ```
3441 <enabled/> or <disabled/>
3442 ```
3443 #### macOS
3444 ```
3445 <dict>
3446   <key>LegacySameSiteCookieBehaviorEnabled</key>
3447   <true/> | <false/>
3448 </dict>
3449 ```
3450 #### policies.json
3451 ```
3452 {
3453   "policies": {
3454     "LegacySameSiteCookieBehaviorEnabled": true | false
3455 }
3456 ```
3457 ### LegacySameSiteCookieBehaviorEnabledForDomainList
3458 Revert to legacy SameSite behavior for cookies on specified sites.
3459
3460 If this policy is set to true, cookies set for domains in this list will revert to legacy SameSite behavior which means that cookies that don't explicitly specify a ```SameSite``` attribute are treated as if they were ```SameSite=None```.
3461
3462 **Compatibility:** Firefox 96\
3463 **CCK2 Equivalent:** N/A\
3464 **Preferences Affected:** `network.cookie.sameSite.laxByDefault.disabledHosts`
3465
3466 #### Windows (GPO)
3467 ```
3468 Software\Policies\Mozilla\Firefox\LegacySameSiteCookieBehaviorEnabledForDomainList\1 = "example.org"
3469 Software\Policies\Mozilla\Firefox\LegacySameSiteCookieBehaviorEnabledForDomainList\2 = "example.edu"
3470 ```
3471 #### Windows (Intune)
3472 OMA-URI:
3473 ```
3474 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox/LegacySameSiteCookieBehaviorEnabledForDomainList
3475 ```
3476 Value (string):
3477 ```
3478 <enabled/>
3479 <data id="LegacySameSiteCookieBehaviorEnabledForDomainList" value="1&#xF000;example.org&#xF000;2&#xF000;example.edu"/>
3480 ```
3481 #### macOS
3482 ```
3483 <dict>
3484   <key>LegacySameSiteCookieBehaviorEnabledForDomainList</key>
3485   <array>
3486     <string>example.org</string>
3487     <string>example.edu</string>
3488   </array>
3489 </dict>
3490 ```
3491 #### policies.json
3492 ```
3493 {
3494   "policies": {
3495     "LegacySameSiteCookieBehaviorEnabledForDomainList": ["example.org",
3496                                                          "example.edu"]
3497   }
3498 }
3499 ```
3500 ### LocalFileLinks
3501 Enable linking to local files by origin.
3502
3503 **Compatibility:** Firefox 68, Firefox ESR 68\
3504 **CCK2 Equivalent:** N/A\
3505 **Preferences Affected:** `capability.policy.localfilelinks.*`
3506
3507 #### Windows (GPO)
3508 ```
3509 Software\Policies\Mozilla\Firefox\LocalFileLinks\1 = "https://example.org"
3510 Software\Policies\Mozilla\Firefox\LocalFileLinks\2 = "https://example.edu"
3511 ```
3512 #### Windows (Intune)
3513 OMA-URI:
3514 ```
3515 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox/LocalFileLinks
3516 ```
3517 Value (string):
3518 ```
3519 <enabled/>
3520 <data id="LocalFileLinks" value="1&#xF000;https://example.org&#xF000;2&#xF000;https://example.edu"/>
3521 ```
3522 #### macOS
3523 ```
3524 <dict>
3525   <key>LocalFileLinks</key>
3526   <array>
3527     <string>http://example.org</string>
3528     <string>http://example.edu</string>
3529   </array>
3530 </dict>
3531 ```
3532 #### policies.json
3533 ```
3534 {
3535   "policies": {
3536     "LocalFileLinks": ["http://example.org/",
3537                        "http://example.edu/"]
3538   }
3539 }
3540 ```
3541 ### ManagedBookmarks
3542 Configures a list of bookmarks managed by an administrator that cannot be changed by the user.
3543
3544 The bookmarks are only added as a button on the personal toolbar. They are not in the bookmarks folder.
3545
3546 The syntax of this policy is exactly the same as the [Chrome ManagedBookmarks policy](https://cloud.google.com/docs/chrome-enterprise/policies/?policy=ManagedBookmarks). The schema is:
3547 ```
3548 {
3549  "items": {
3550   "id": "BookmarkType",
3551   "properties": {
3552    "children": {
3553     "items": {
3554      "$ref": "BookmarkType"
3555     },
3556     "type": "array"
3557    },
3558    "name": {
3559     "type": "string"
3560    },
3561    "toplevel_name": {
3562     "type": "string"
3563    },
3564    "url": {
3565     "type": "string"
3566    }
3567   },
3568   "type": "object"
3569  },
3570  "type": "array"
3571 }
3572 ```
3573 **Compatibility:** Firefox 83, Firefox ESR 78.5\
3574 **CCK2 Equivalent:** N/A\
3575 **Preferences Affected:** N/A
3576
3577 #### Windows (GPO)
3578 Software\Policies\Mozilla\Firefox\ManagedBookmarks (REG_MULTI_SZ) =
3579 ```
3580 [
3581   {
3582     "toplevel_name": "My managed bookmarks folder"
3583   },
3584   {
3585     "url": "example.com",
3586     "name": "Example"
3587   },
3588   {
3589     "name": "Mozilla links",
3590     "children": [
3591       {
3592         "url": "https://mozilla.org",
3593         "name": "Mozilla.org"
3594       },
3595       {
3596         "url": "https://support.mozilla.org/",
3597         "name": "SUMO"
3598       }
3599     ]
3600   }
3601 ]
3602 ```
3603 #### Windows (Intune)
3604 OMA-URI:
3605 ```
3606 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox/ManagedBookmarks
3607 ```
3608 Value (string):
3609 ```
3610 <enabled/>
3611 <data id="JSON" value='
3612 [
3613   {
3614     "toplevel_name": "My managed bookmarks folder"
3615   },
3616   {
3617     "url": "example.com",
3618     "name": "Example"
3619   },
3620   {
3621     "name": "Mozilla links",
3622     "children": [
3623       {
3624         "url": "https://mozilla.org",
3625         "name": "Mozilla.org"
3626       },
3627       {
3628         "url": "https://support.mozilla.org/",
3629         "name": "SUMO"
3630       }
3631     ]
3632   }
3633 ]'/>
3634 ```
3635 #### macOS
3636 ```
3637 <dict>
3638   <key>ManagedBookmarks</key>
3639   <array>
3640     <dict>
3641       <key>toplevel_name</key>
3642       <string>My managed bookmarks folder</string>
3643       <dict>
3644         <key>url</key>
3645         <string>example.com</string>
3646         <key>name</key>
3647         <string>Example</string>
3648       </dict>
3649       <dict>
3650       <key>name</key>
3651       <string>Mozilla links</string>
3652       <key>children</key>
3653       <array>
3654         <dict>
3655           <key>url</key>
3656           <string>https://mozilla.org</string>
3657           <key>name</key>
3658           <string>Mozilla</string>
3659         </dict>
3660         <dict>
3661           <key>url</key>
3662           <string>https://support.mozilla.org/</string>
3663           <key>name</key>
3664           <string>SUMO</string>
3665         </dict>
3666       </array>
3667     </dict>
3668   </array>
3669 </dict>
3670 ```
3671 #### policies.json
3672 ```
3673 {
3674   "policies": {
3675     "ManagedBookmarks": [
3676       {
3677         "toplevel_name": "My managed bookmarks folder"
3678       },
3679       {
3680         "url": "example.com",
3681         "name": "Example"
3682       },
3683       {
3684         "name": "Mozilla links",
3685         "children": [
3686           {
3687             "url": "https://mozilla.org",
3688             "name": "Mozilla.org"
3689           },
3690           {
3691             "url": "https://support.mozilla.org/",
3692             "name": "SUMO"
3693           }
3694         ]
3695       }
3696     ]
3697   }
3698 }
3699 ```
3700 ### ManualAppUpdateOnly
3701
3702 Switch to manual updates only.
3703
3704 If this policy is enabled:
3705  1. The user will never be prompted to install updates
3706  2. Firefox will not check for updates in the background, though it will check automatically when an update UI is displayed (such as the one in the About dialog). This check will be used to show "Update to version X" in the UI, but will not automatically download the update or prompt the user to update in any other way.
3707  3. The update UI will work as expected, unlike when using DisableAppUpdate.
3708
3709 This policy is primarily intended for advanced end users, not for enterprises.
3710
3711 **Compatibility:** Firefox 87\
3712 **CCK2 Equivalent:** N/A\
3713 **Preferences Affected:** N/A
3714
3715 #### policies.json
3716 ```
3717 {
3718   "policies": {
3719     "ManualAppUpdateOnly": true | false
3720   }
3721 }
3722 ```
3723 ### NetworkPrediction
3724 Enable or disable network prediction (DNS prefetching).
3725
3726 **Compatibility:** Firefox 67, Firefox ESR 60.7\
3727 **CCK2 Equivalent:** N/A\
3728 **Preferences Affected:** `network.dns.disablePrefetch`, `network.dns.disablePrefetchFromHTTPS`
3729
3730 #### Windows (GPO)
3731 ```
3732 Software\Policies\Mozilla\Firefox\NetworkPrediction = 0x1 | 0x0
3733 ```
3734 #### Windows (Intune)
3735 OMA-URI:
3736 ```
3737 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox/NetworkPrediction
3738 ```
3739 Value (string):
3740 ```
3741 <enabled/> or <disabled/>
3742 ```
3743 #### macOS
3744 ```
3745 <dict>
3746   <key>NetworkPrediction</key>
3747   <true/> | <false/>
3748 </dict>
3749 ```
3750 #### policies.json
3751 ```
3752 {
3753   "policies": {
3754     "NetworkPrediction": true | false
3755 }
3756 ```
3757 ### NewTabPage
3758 Enable or disable the New Tab page.
3759
3760 **Compatibility:** Firefox 68, Firefox ESR 68\
3761 **CCK2 Equivalent:** N/A\
3762 **Preferences Affected:** `browser.newtabpage.enabled`
3763
3764 #### Windows (GPO)
3765 ```
3766 Software\Policies\Mozilla\Firefox\NewTabPage = 0x1 | 0x0
3767 ```
3768 #### Windows (Intune)
3769 OMA-URI:
3770 ```
3771 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox/NewTabPage
3772 ```
3773 Value (string):
3774 ```
3775 <enabled/> or <disabled/>
3776 ```
3777 #### macOS
3778 ```
3779 <dict>
3780   <key>NewTabPage</key>
3781   <true/> | <false/>
3782 </dict>
3783 ```
3784 #### policies.json
3785 ```
3786 {
3787   "policies": {
3788     "NewTabPage": true | false
3789 }
3790 ```
3791 ### NoDefaultBookmarks
3792 Disable the creation of default bookmarks.
3793
3794 This policy is only effective if the user profile has not been created yet.
3795
3796 **Compatibility:** Firefox 60, Firefox ESR 60\
3797 **CCK2 Equivalent:** `removeDefaultBookmarks`\
3798 **Preferences Affected:** N/A
3799
3800 #### Windows (GPO)
3801 ```
3802 Software\Policies\Mozilla\Firefox\NoDefaultBookmarks = 0x1 | 0x0
3803 ```
3804 #### Windows (Intune)
3805 OMA-URI:
3806 ```
3807 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox/NoDefaultBookmarks
3808 ```
3809 Value (string):
3810 ```
3811 <enabled/> or <disabled/>
3812 ```
3813 #### macOS
3814 ```
3815 <dict>
3816   <key>NoDefaultBookmarks</key>
3817   <true/> | <false/>
3818 </dict>
3819 ```
3820 #### policies.json
3821 ```
3822 {
3823   "policies": {
3824     "NoDefaultBookmarks": true | false
3825   }
3826 }
3827 ```
3828 ### OfferToSaveLogins
3829 Control whether or not Firefox offers to save passwords.
3830
3831 **Compatibility:** Firefox 60, Firefox ESR 60\
3832 **CCK2 Equivalent:** `dontRememberPasswords`\
3833 **Preferences Affected:** `signon.rememberSignons`
3834
3835 #### Windows (GPO)
3836 ```
3837 Software\Policies\Mozilla\Firefox\OfferToSaveLogins = 0x1 | 0x0
3838 ```
3839 #### Windows (Intune)
3840 OMA-URI:
3841 ```
3842 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox/OfferToSaveLogins
3843 ```
3844 Value (string):
3845 ```
3846 <enabled/> or <disabled/>
3847 ```
3848 #### macOS
3849 ```
3850 <dict>
3851   <key>OfferToSaveLogins</key>
3852   <true/> | <false/>
3853 </dict>
3854 ```
3855 #### policies.json
3856 ```
3857 {
3858   "policies": {
3859     "OfferToSaveLogins": true | false
3860   }
3861 }
3862 ```
3863 ### OfferToSaveLoginsDefault
3864 Sets the default value of signon.rememberSignons without locking it.
3865
3866 **Compatibility:** Firefox 70, Firefox ESR 60.2\
3867 **CCK2 Equivalent:** `dontRememberPasswords`\
3868 **Preferences Affected:** `signon.rememberSignons`
3869
3870 #### Windows (GPO)
3871 ```
3872 Software\Policies\Mozilla\Firefox\OfferToSaveLoginsDefault = 0x1 | 0x0
3873 ```
3874 #### Windows (Intune)
3875 OMA-URI:
3876 ```
3877 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox/OfferToSaveLoginsDefault
3878 ```
3879 Value (string):
3880 ```
3881 <enabled/> or <disabled/>
3882 ```
3883 #### macOS
3884 ```
3885 <dict>
3886   <key>OfferToSaveLoginsDefault</key>
3887   <true/> | <false/>
3888 </dict>
3889 ```
3890 #### policies.json
3891 ```
3892 {
3893   "policies": {
3894     "OfferToSaveLoginsDefault": true | false
3895   }
3896 }
3897 ```
3898 ### OverrideFirstRunPage
3899 Override the first run page. If the value is an empty string (""), the first run page is not displayed.
3900
3901 Starting with Firefox 83, Firefox ESR 78.5, you can also specify multiple URLS separated by a vertical bar (|).
3902
3903 **Compatibility:** Firefox 60, Firefox ESR 60\
3904 **CCK2 Equivalent:** `welcomePage`,`noWelcomePage`\
3905 **Preferences Affected:** `startup.homepage_welcome_url`
3906
3907 #### Windows (GPO)
3908 ```
3909 Software\Policies\Mozilla\Firefox\OverrideFirstRunPage = "http://example.org"
3910 ```
3911 #### Windows (Intune)
3912 OMA-URI:
3913 ```
3914 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox/OverrideFirstRunPage
3915 ```
3916 Value (string):
3917 ```
3918 <enabled/>
3919 <data id="OverridePage" value="https://example.com"/>
3920 ```
3921 #### macOS
3922 ```
3923 <dict>
3924   <key>OverrideFirstRunPage</key>
3925   <string>http://example.org</string>
3926 </dict>
3927 ```
3928 #### policies.json
3929 ```
3930 {
3931   "policies": {
3932     "OverrideFirstRunPage": "http://example.org"
3933   }
3934 }
3935 ```
3936 ### OverridePostUpdatePage
3937 Override the upgrade page. If the value is an empty string (""), no extra pages are displayed when Firefox is upgraded.
3938
3939 **Compatibility:** Firefox 60, Firefox ESR 60\
3940 **CCK2 Equivalent:** `upgradePage`,`noUpgradePage`\
3941 **Preferences Affected:** `startup.homepage_override_url`
3942
3943 #### Windows (GPO)
3944 ```
3945 Software\Policies\Mozilla\Firefox\OverridePostUpdatePage = "http://example.org"
3946 ```
3947 #### Windows (Intune)
3948 OMA-URI:
3949 ```
3950 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox/OverridePostUpdatePage
3951 ```
3952 Value (string):
3953 ```
3954 <enabled/>
3955 <data id="OverridePage" value="https://example.com"/>
3956 ```
3957 #### macOS
3958 ```
3959 <dict>
3960   <key>OverridePostUpdatePage</key>
3961   <string>http://example.org</string>
3962 </dict>
3963 ```
3964 #### policies.json
3965 ```
3966 {
3967   "policies": {
3968     "OverridePostUpdatePage": "http://example.org"
3969   }
3970 }
3971 ```
3972 ### PasswordManagerEnabled
3973 Remove access to the password manager via preferences and blocks about:logins on Firefox 70.
3974
3975 **Compatibility:** Firefox 70, Firefox ESR 60.2\
3976 **CCK2 Equivalent:** N/A\
3977 **Preferences Affected:** `pref.privacy.disable_button.view_passwords`
3978
3979 #### Windows (GPO)
3980 ```
3981 Software\Policies\Mozilla\Firefox\PasswordManagerEnabled = 0x1 | 0x0
3982 ```
3983 #### Windows (Intune)
3984 OMA-URI:
3985 ```
3986 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox/PasswordManagerEnabled
3987 ```
3988 Value (string):
3989 ```
3990 <enabled/> or <disabled/>
3991 ```
3992 #### macOS
3993 ```
3994 <dict>
3995   <key>PasswordManagerEnabled</key>
3996   <true/> | <false/>
3997 </dict>
3998 ```
3999 #### policies.json
4000 ```
4001 {
4002   "policies": {
4003     "PasswordManagerEnabled": true | false
4004   }
4005 }
4006 ```
4007 ### PasswordManagerExceptions
4008 Prevent Firefox from saving passwords for specific sites.
4009
4010 The sites are specified as a list of origins.
4011
4012 **Compatibility:** Firefox 101\
4013 **CCK2 Equivalent:** N/A\
4014 **Preferences Affected:** N/A
4015
4016 #### Windows (GPO)
4017 ```
4018 Software\Policies\Mozilla\Firefox\PasswordManagerExceptions\1 = "https://example.org"
4019 Software\Policies\Mozilla\Firefox\PasswordManagerExceptions\2 = "https://example.edu"
4020 ```
4021 #### Windows (Intune)
4022 OMA-URI:
4023 ```
4024 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox/PasswordManagerExceptions
4025 ```
4026 Value (string):
4027 ```
4028 <enabled/>
4029 <data id="List" value="1&#xF000;https://example.org&#xF000;2&#xF000;https://example.edu"/>
4030 ```
4031 #### macOS
4032 ```
4033 <dict>
4034   <key>PasswordManagerExceptions</key>
4035   <array>
4036     <string>https://example.org</string>
4037     <string>https://example.edu</string>
4038   </array>
4039 </dict>
4040 ```
4041 #### policies.json
4042 ```
4043 {
4044   "policies": {
4045     "PasswordManagerExceptions": ["https://example.org",
4046                                   "https://example.edu"]
4047   }
4048 }
4049 ```
4050
4051 ### PDFjs
4052 Disable or configure PDF.js, the built-in PDF viewer.
4053
4054 If `Enabled` is set to false, the built-in PDF viewer is disabled.
4055
4056 If `EnablePermissions` is set to true, the built-in PDF viewer will honor document permissions like preventing the copying of text.
4057
4058 Note: DisableBuiltinPDFViewer has not been deprecated. You can either continue to use it, or switch to using PDFjs->Enabled to disable the built-in PDF viewer. This new permission was added because we needed a place for PDFjs->EnabledPermissions.
4059
4060 **Compatibility:** Firefox 77, Firefox ESR 68.9\
4061 **CCK2 Equivalent:** N/A\
4062 **Preferences Affected:** `pdfjs.diabled`, `pdfjs.enablePermissions`
4063
4064 #### Windows (GPO)
4065 ```
4066 Software\Policies\Mozilla\Firefox\PDFjs\Enabled = 0x1 | 0x0
4067 Software\Policies\Mozilla\Firefox\PDFjs\EnablePermissions = 0x1 | 0x0
4068 ```
4069 #### Windows (Intune)
4070 OMA-URI:
4071 ```
4072 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~PDFjs/PDFjs_Enabled
4073 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~PDFjs/PDFjs_EnablePermissions
4074 ```
4075 Value (string):
4076 ```
4077 <enabled/>or <disabled/>
4078 ```
4079 #### macOS
4080 ```
4081 <dict>
4082   <key>PDFjs</key>
4083   <dict>
4084     <key>Enabled</key>
4085     <true/> | <false/>
4086     <key>EnablePermissions</key>
4087     <true/> | <false/>
4088   </dict>
4089 </dict>
4090 ```
4091 #### policies.json
4092 ```
4093 {
4094   "policies": {
4095     "PDFjs": {
4096       "Enabled": true | false,
4097       "EnablePermissions": true | false
4098     }
4099   }
4100 }
4101 ```
4102 ### Permissions
4103 Set permissions associated with camera, microphone, location, notifications, autoplay, and virtual reality. Because these are origins, not domains, entries with unique ports must be specified separately. This explicitly means that it is not possible to add wildcards. See examples below.
4104
4105 `Allow` is a list of origins where the feature is allowed.
4106
4107 `Block` is a list of origins where the feature is not allowed.
4108
4109 `BlockNewRequests` determines whether or not new requests can be made for the feature.
4110
4111 `Locked` prevents the user from changing preferences for the feature.
4112
4113 `Default` specifies the default value for Autoplay. block-audio-video is not supported on Firefox ESR 68.
4114
4115 **Compatibility:** Firefox 62, Firefox ESR 60.2 (Autoplay added in Firefox 74, Firefox ESR 68.6, Autoplay Default/Locked added in Firefox 76, Firefox ESR 68.8, VirtualReality added in Firefox 80, Firefox ESR 78.2)\
4116 **CCK2 Equivalent:** N/A\
4117 **Preferences Affected:** `permissions.default.camera`, `permissions.default.microphone`, `permissions.default.geo`, `permissions.default.desktop-notification`, `media.autoplay.default`, `permissions.default.xr`
4118
4119 #### Windows (GPO)
4120 ```
4121 Software\Policies\Mozilla\Firefox\Permissions\Camera\Allow\1 = "https://example.org"
4122 Software\Policies\Mozilla\Firefox\Permissions\Camera\Allow\2 = "https://example.org:1234"
4123 Software\Policies\Mozilla\Firefox\Permissions\Camera\Block\1 = "https://example.edu"
4124 Software\Policies\Mozilla\Firefox\Permissions\Camera\BlockNewRequests = 0x1 | 0x0
4125 Software\Policies\Mozilla\Firefox\Permissions\Camera\Locked = 0x1 | 0x0
4126 Software\Policies\Mozilla\Firefox\Permissions\Microphone\Allow\1 = "https://example.org"
4127 Software\Policies\Mozilla\Firefox\Permissions\Microphone\Block\1 = "https://example.edu"
4128 Software\Policies\Mozilla\Firefox\Permissions\Microphone\BlockNewRequests = 0x1 | 0x0
4129 Software\Policies\Mozilla\Firefox\Permissions\Microphone\Locked = 0x1 | 0x0
4130 Software\Policies\Mozilla\Firefox\Permissions\Location\Allow\1 = "https://example.org"
4131 Software\Policies\Mozilla\Firefox\Permissions\Location\Block\1 = "https://example.edu"
4132 Software\Policies\Mozilla\Firefox\Permissions\Location\BlockNewRequests = 0x1 | 0x0
4133 Software\Policies\Mozilla\Firefox\Permissions\Location\Locked = 0x1 | 0x0
4134 Software\Policies\Mozilla\Firefox\Permissions\Notifications\Allow\1 = "https://example.org"
4135 Software\Policies\Mozilla\Firefox\Permissions\Notifications\Block\1 = "https://example.edu"
4136 Software\Policies\Mozilla\Firefox\Permissions\Notifications\BlockNewRequests = 0x1 | 0x0
4137 Software\Policies\Mozilla\Firefox\Permissions\Notifications\Locked = 0x1 | 0x0
4138 Software\Policies\Mozilla\Firefox\Permissions\Autoplay\Allow\1 = "https://example.org"
4139 Software\Policies\Mozilla\Firefox\Permissions\Autoplay\Block\1 = "https://example.edu"
4140 Software\Policies\Mozilla\Firefox\Permissions\Autoplay\Default = "allow-audio-video" | "block-audio" | "block-audio-video"
4141 Software\Policies\Mozilla\Firefox\Permissions\Autoplay\Locked = 0x1 | 0x0
4142 Software\Policies\Mozilla\Firefox\Permissions\VirtualReality\Allow\1 = "https://example.org"
4143 Software\Policies\Mozilla\Firefox\Permissions\VirtualReality\Block\1 = "https://example.edu"
4144 Software\Policies\Mozilla\Firefox\Permissions\VirtualReality\BlockNewRequests = 0x1 | 0x0
4145 Software\Policies\Mozilla\Firefox\Permissions\VirtualReality\Locked = 0x1 | 0x0
4146 ```
4147 #### Windows (Intune)
4148 OMA-URI:
4149 ```
4150 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~Permissions~Location/Location_BlockNewRequests
4151 ```
4152 Value (string):
4153 ```
4154 <enabled/> or <disabled/>
4155 ```
4156 OMA-URI:
4157 ```
4158 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~Permissions~Location/Location_Locked
4159 ```
4160 Value (string):
4161 ```
4162 <enabled/> or <disabled/>
4163 ```
4164 OMA-URI:
4165 ```
4166 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~Permissions~Notifications/Notifications_Allow
4167 ```
4168 Value (string):
4169 ```
4170 <enabled/>
4171 <data id="Permissions" value="1&#xF000;https://example.org"/>
4172 ```
4173 OMA-URI:
4174 ```
4175 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~Permissions~Notifications/Notifications_BlockNewRequests
4176 ```
4177 Value (string):
4178 ```
4179 <enabled/> or <disabled/>
4180 ```
4181 OMA-URI:
4182 ```
4183 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~Permissions~Notifications/Notifications_Locked
4184 ```
4185 Value (string):
4186 ```
4187 <enabled/> or <disabled/>
4188 ```
4189 OMA-URI:
4190 ```
4191 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~Permissions~Autoplay/Autoplay_Allow
4192 ```
4193 Value (string):
4194 ```
4195 <enabled/>
4196 <data id="Permissions" value="1&#xF000;https://example.org"/>
4197 ```
4198 OMA-URI:
4199 ```
4200 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~Permissions~Autoplay/Autoplay_Block
4201 ```
4202 Value (string):
4203 ```
4204 <enabled/>
4205 <data id="Permissions" value="1&#xF000;https://example.edu"/>
4206 ```
4207 OMA-URI:
4208 ```
4209 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~Permissions~Autoplay/Autoplay_Default
4210 ```
4211 Value (string):
4212 ```
4213 <enabled/>
4214 <data id="Autoplay_Default" value="allow-audio-video | block-audio | block-audio-video"/>
4215 ```
4216 OMA-URI:
4217 ```
4218 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~Permissions~Autoplay/Autoplay_Locked
4219 ```
4220 Value (string):
4221 ```
4222 <enabled/> or <disabled/>
4223 ```
4224 OMA-URI:
4225 ```
4226 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~Permissions~Notifications/VirtualReality_Allow
4227 ```
4228 Value (string):
4229 ```
4230 <enabled/>
4231 <data id="Permissions" value="1&#xF000;https://example.org"/>
4232 ```
4233 OMA-URI:
4234 ```
4235 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~Permissions~Notifications/VirtualReality_Block
4236 ```
4237 Value (string):
4238 ```
4239 <enabled/>
4240 <data id="Permissions" value="1&#xF000;https://example.edu"/>
4241 ```
4242 OMA-URI:
4243 ```
4244 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~Permissions~Notifications/VirtualReality_BlockNewRequests
4245 ```
4246 Value (string):
4247 ```
4248 <enabled/> or <disabled/>
4249 ```
4250 OMA-URI:
4251 ```
4252 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~Permissions~Notifications/VirtualReality_Locked
4253 ```
4254 Value (string):
4255 ```
4256 <enabled/> or <disabled/>
4257 ```
4258 #### macOS
4259 ```
4260 <dict>
4261   <key>Permissions</key>
4262   <dict>
4263     <key>Camera</key>
4264     <dict>
4265       <key>Allow</key>
4266       <array>
4267         <string>https://example.org</string>
4268         <string>https://example.org:1234</string>
4269       </array>
4270       <key>Block</key>
4271       <array>
4272         <string>https://example.edu</string>
4273       </array>
4274       <key>BlockNewRequests</key>
4275       <true/> | <false/>
4276       <key>Locked</key>
4277       <true/> | <false/>
4278     </dict>
4279     <key>Microphone</key>
4280     <dict>
4281       <key>Allow</key>
4282       <array>
4283         <string>https://example.org</string>
4284       </array>
4285       <key>Block</key>
4286       <array>
4287         <string>https://example.edu</string>
4288       </array>
4289       <key>BlockNewRequests</key>
4290       <true/> | <false/>
4291       <key>Locked</key>
4292       <true/> | <false/>
4293     </dict>
4294     <key>Location</key>
4295     <dict>
4296       <key>Allow</key>
4297       <array>
4298         <string>https://example.org</string>
4299       </array>
4300       <key>Block</key>
4301       <array>
4302         <string>https://example.edu</string>
4303       </array>
4304       <key>BlockNewRequests</key>
4305       <true/> | <false/>
4306       <key>Locked</key>
4307       <true/> | <false/>
4308     </dict>
4309     <key>Notifications</key>
4310     <dict>
4311       <key>Allow</key>
4312       <array>
4313         <string>https://example.org</string>
4314       </array>
4315       <key>Block</key>
4316       <array>
4317         <string>https://example.edu</string>
4318       </array>
4319       <key>BlockNewRequests</key>
4320       <true/>
4321       <key>Locked</key>
4322       <true/>
4323     </dict>
4324     <key>Autoplay</key>
4325     <dict>
4326       <key>Allow</key>
4327       <array>
4328         <string>https://example.org</string>
4329       </array>
4330       <key>Block</key>
4331       <array>
4332         <string>https://example.edu</string>
4333       </array>
4334       <key>Default</key>
4335       <string>allow-audio-video | block-audio | block-audio-video</string>
4336       <key>Locked</key>
4337       <true/> | <false/>
4338     </dict>
4339   </dict>
4340 </dict>
4341 ```
4342 #### policies.json
4343 ```
4344 {
4345   "policies": {
4346     "Permissions": {
4347       "Camera": {
4348         "Allow": ["https://example.org","https://example.org:1234"],
4349         "Block": ["https://example.edu"],
4350         "BlockNewRequests": true | false,
4351         "Locked": true | false
4352       },
4353       "Microphone": {
4354         "Allow": ["https://example.org"],
4355         "Block": ["https://example.edu"],
4356         "BlockNewRequests": true | false,
4357         "Locked": true | false
4358       },
4359       "Location": {
4360         "Allow": ["https://example.org"],
4361         "Block": ["https://example.edu"],
4362         "BlockNewRequests": true | false,
4363         "Locked": true | false
4364       },
4365       "Notifications": {
4366         "Allow": ["https://example.org"],
4367         "Block": ["https://example.edu"],
4368         "BlockNewRequests": true | false,
4369         "Locked": true | false
4370       },
4371       "Autoplay": {
4372         "Allow": ["https://example.org"],
4373         "Block": ["https://example.edu"],
4374         "Default": "allow-audio-video" | "block-audio" | "block-audio-video",
4375         "Locked": true | false
4376       }
4377     }
4378   }
4379 }
4380 ```
4381 ### PictureInPicture
4382
4383 Enable or disable Picture-in-Picture as well as prevent the user from enabling or disabling it (Locked).
4384
4385 **Compatibility:** Firefox 78, Firefox ESR 78\
4386 **CCK2 Equivalent:** N/A\
4387 **Preferences Affected:** `media.videocontrols.picture-in-picture.video-toggle.enabled`
4388
4389 #### Windows (GPO)
4390 ```
4391 Software\Policies\Mozilla\Firefox\PictureInPicture\Enabled = 0x1 | 0x0
4392 Software\Policies\Mozilla\Firefox\PictureInPicture\Locked = 0x1 | 0x0
4393
4394 ```
4395 #### Windows (Intune)
4396 OMA-URI:
4397 ```
4398 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~PictureInPicture/PictureInPicture_Enabled
4399 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~PictureInPicture/PictureInPicture_Locked
4400 ```
4401 Value (string):
4402 ```
4403 <enabled/> or <disabled/>
4404 ```
4405 #### macOS
4406 ```
4407 <dict>
4408   <key>PictureInPicture</key>
4409   <dict>
4410     <key>Enabled</key>
4411     <true/> | <false/>
4412     <key>Locked</key>
4413     <true/> | <false/>
4414   </dict>
4415 </dict>
4416 ```
4417 #### policies.json
4418 ```
4419 {
4420   "policies": {
4421     "PictureInPicture": {
4422       "Enabled": true | false,
4423       "Locked": true | false
4424     }
4425   }
4426 }
4427 ```
4428 ### PopupBlocking
4429 Configure the default pop-up window policy as well as origins for which pop-up windows are allowed.
4430
4431 `Allow` is a list of origins where popup-windows are allowed.
4432
4433 `Default` determines whether or not pop-up windows are allowed by default.
4434
4435 `Locked` prevents the user from changing pop-up preferences.
4436
4437 **Compatibility:** Firefox 60, Firefox ESR 60\
4438 **CCK2 Equivalent:** `permissions.popup`\
4439 **Preferences Affected:** `dom.disable_open_during_load`
4440
4441 #### Windows (GPO)
4442 ```
4443 Software\Policies\Mozilla\Firefox\PopupBlocking\Allow\1 = "https://example.org"
4444 Software\Policies\Mozilla\Firefox\PopupBlocking\Allow\2 = "https://example.edu"
4445 Software\Policies\Mozilla\Firefox\PopupBlocking\Default = 0x1 | 0x0
4446 Software\Policies\Mozilla\Firefox\PopupBlocking\Locked = 0x1 | 0x0
4447 ```
4448 #### Windows (Intune)
4449 OMA-URI:
4450 ```
4451 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~Popups/PopupBlocking_Allow
4452 ```
4453 Value (string):
4454 ```
4455 <enabled/>
4456 <data id="Permissions" value="1&#xF000;https://example.org&#xF000;2&#xF000;https://example.edu"/>
4457 ```
4458 OMA-URI:
4459 ```
4460 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~Popups/PopupBlocking_Default
4461 ```
4462 Value (string):
4463 ```
4464 <enabled/> or <disabled/>
4465 ```
4466 OMA-URI:
4467 ```
4468 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~Popups/PopupBlocking_Locked
4469 ```
4470 Value (string):
4471 ```
4472 <enabled/> or <disabled/>
4473 ```
4474 #### macOS
4475 ```
4476 <dict>
4477   <key>PopupBlocking</key>
4478   <dict>
4479     <key>Allow</key>
4480     <array>
4481       <string>http://example.org</string>
4482       <string>http://example.edu</string>
4483     </array>
4484     <key>Default</key>
4485     <true/> | <false/>
4486     <key>Locked</key>
4487     <true/> | <false/>
4488   </dict>
4489 </dict>
4490 ```
4491 #### policies.json
4492 ```
4493 {
4494   "policies": {
4495     "PopupBlocking": {
4496       "Allow": ["http://example.org/",
4497                 "http://example.edu/"],
4498       "Default": true | false,
4499       "Locked": true | false
4500     }
4501   }
4502 }
4503 ```
4504 ### Preferences
4505 Set and lock preferences.
4506
4507 **NOTE** On Windows, in order to use this policy, you must clear all settings in the old **Preferences (Deprecated)** section in group policy.
4508
4509 Previously you could only set and lock a subset of preferences. Starting with Firefox 81 and Firefox ESR 78.3 you can set many more preferences. You can also set default preferences, user preferences and you can clear preferences.
4510
4511 Preferences that start with the following prefixes are supported:
4512 ```
4513 accessibility.
4514 app.update.* (Firefox 86, Firefox 78.8)
4515 browser.
4516 datareporting.policy.
4517 dom.
4518 extensions.
4519 general.autoScroll (Firefox 83, Firefox ESR 78.5)
4520 general.smoothScroll (Firefox 83, Firefox ESR 78.5)
4521 geo.
4522 gfx.
4523 intl.
4524 keyword.enabled (Firefox 95, Firefox ESR 91.4)
4525 layers.
4526 layout.
4527 media.
4528 network.
4529 pdfjs. (Firefox 84, Firefox ESR 78.6)
4530 places.
4531 print.
4532 signon. (Firefox 83, Firefox ESR 78.5)
4533 spellchecker. (Firefox 84, Firefox ESR 78.6)
4534 toolkit.legacyUserProfileCustomizations.stylesheets (Firefox 95, Firefox ESR 91.4)
4535 ui.
4536 widget.
4537 xpinstall.signatures.required (Firefox ESR 102.10, Firefox ESR only)
4538 ```
4539 as well as the following security preferences:
4540
4541 | Preference | Type | Default
4542 | --- | --- | --- |
4543 | security.default_personal_cert | string | Ask Every Time
4544 | &nbsp;&nbsp;&nbsp;&nbsp;If set to Select Automatically, Firefox automatically chooses the default personal certificate.
4545 | security.insecure_connection_text.enabled | bool | false
4546 | &nbsp;&nbsp;&nbsp;&nbsp;If set to true, adds the words "Not Secure" for insecure sites.
4547 | security.insecure_connection_text.pbmode.enabled | bool | false
4548 | &nbsp;&nbsp;&nbsp;&nbsp;If set to true, adds the words "Not Secure" for insecure sites in private browsing.
4549 | security.mixed_content.block_active_content | boolean | true
4550 | &nbsp;&nbsp;&nbsp;&nbsp;If false, mixed active content (HTTP and HTTPS) is not blocked.
4551 | security.osclientcerts.autoload | boolean | false
4552 | &nbsp;&nbsp;&nbsp;&nbsp;If true, client certificates are loaded from the operating system certificate store.
4553 | security.OCSP.enabled | integer | 1
4554 | &nbsp;&nbsp;&nbsp;&nbsp;If 0, do not fetch OCSP. If 1, fetch OCSP for DV and EV certificates. If 2, fetch OCSP only for EV certificates
4555 | security.OCSP.require | boolean | false
4556 | &nbsp;&nbsp;&nbsp;&nbsp; If true, if an OCSP request times out, the connection fails.
4557 | security.osclientcerts.assume_rsa_pss_support | boolean | true
4558 | &nbsp;&nbsp;&nbsp;&nbsp; If false, we don't assume an RSA key can do RSA-PSS (Firefox 114, Firefox ESR 102.12).
4559 | security.ssl.enable_ocsp_stapling | boolean | true
4560 | &nbsp;&nbsp;&nbsp;&nbsp; If false, OCSP stapling is not enabled.
4561 | security.ssl.errorReporting.enabled | boolean | true
4562 | &nbsp;&nbsp;&nbsp;&nbsp;If false, SSL errors cannot be sent to Mozilla.
4563 | security.tls.enable_0rtt_data | boolean | true
4564 | &nbsp;&nbsp;&nbsp;&nbsp;If false, TLS early data is turned off (Firefox 93, Firefox 91.2, Firefox 78.15).
4565 | security.tls.hello_downgrade_check | boolean | true
4566 | &nbsp;&nbsp;&nbsp;&nbsp;If false, the TLS 1.3 downgrade check is disabled.
4567 | security.tls.version.enable-deprecated | boolean | false
4568 | &nbsp;&nbsp;&nbsp;&nbsp;If true, browser will accept TLS 1.0. and TLS 1.1 (Firefox 86, Firefox 78.8).
4569 | security.warn_submit_secure_to_insecure | boolean | true
4570 | &nbsp;&nbsp;&nbsp;&nbsp;If false, no warning is shown when submitting a form from https to http.
4571
4572 Using the preference as the key, set the `Value` to the corresponding preference value.
4573
4574 `Status` can be "default", "locked", "user" or "clear"
4575
4576 * `"default"`: Read/Write: Settings appear as default even if factory default differs.
4577 * `"locked"`: Read-Only: Settings appear as default even if factory default differs.
4578 * `"user"`: Read/Write: Settings appear as changed if it differs from factory default.
4579 * `"clear"`: Read/Write: `Value` has no effect. Resets to factory defaults on each startup.
4580
4581 `"user"` preferences persist across invocations of Firefox. It is the equivalent of a user setting the preference. They are most useful when a preference is needed very early in startup so it can't be set as default by policy. An example of this is ```toolkit.legacyUserProfileCustomizations.stylesheets```.
4582
4583 `"user"` preferences persist even if the policy is removed, so if you need to remove them, you should use the clear policy.
4584
4585 See the examples below for more detail.
4586
4587 IMPORTANT: Make sure you're only setting a particular preference using this mechanism and not some other way.
4588
4589 Status
4590 **Compatibility:** Firefox 81, Firefox ESR 78.3\
4591 **CCK2 Equivalent:** `preferences`\
4592 **Preferences Affected:** Many
4593
4594 #### Windows (GPO)
4595 Software\Policies\Mozilla\Firefox\Preferences (REG_MULTI_SZ) =
4596 ```
4597 {
4598   "accessibility.force_disabled": {
4599     "Value": 1,
4600     "Status": "default"
4601   },
4602   "browser.cache.disk.parent_directory": {
4603     "Value": "SOME_NATIVE_PATH",
4604     "Status": "user"
4605   },
4606   "browser.tabs.warnOnClose": {
4607     "Value": false,
4608     "Status": "locked"
4609   }
4610 }
4611 ```
4612 #### Windows (Intune)
4613 OMA-URI:
4614 ```
4615 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox/Preferences
4616 ```
4617 Value (string):
4618 ```
4619 <enabled/>
4620 <data id="JSON" value='
4621 {
4622   "accessibility.force_disabled": {
4623     "Value": 1,
4624     "Status": "default"
4625   },
4626   "browser.cache.disk.parent_directory": {
4627     "Value": "SOME_NATIVE_PATH",
4628     "Status": "user"
4629   },
4630   "browser.tabs.warnOnClose": {
4631     "Value": false,
4632     "Status": "locked"
4633   }
4634 }'/>
4635 ```
4636 #### macOS
4637 ```
4638 <dict>
4639   <key>Preferences</key>
4640   <dict>
4641     <key>accessibility.force_disabled</key>
4642     <dict>
4643       <key>Value</key>
4644       <integer>1</integer>
4645       <key>Status</key>
4646       <string>default</string>
4647     </dict>
4648     <key>browser.cache.disk.parent_directory</key>
4649     <dict>
4650       <key>Value</key>
4651       <string>SOME_NATIVE_PATH</string>
4652       <key>Status</key>
4653       <string>user</string>
4654     </dict>
4655     <key>browser.tabs.warnOnClose</key>
4656     <dict>
4657       <key>Value</key>
4658       <false/>
4659       <key>Status</key>
4660       <string>locked</string>
4661     </dict>
4662   </dict>
4663 </dict>
4664 ```
4665 #### policies.json
4666 ```
4667 {
4668   "policies": {
4669     "Preferences": {
4670       "accessibility.force_disabled": {
4671         "Value": 1,
4672         "Status": "default"
4673       },
4674       "browser.cache.disk.parent_directory": {
4675         "Value": "SOME_NATIVE_PATH",
4676         "Status": "user"
4677       },
4678       "browser.tabs.warnOnClose": {
4679         "Value": false,
4680         "Status": "locked"
4681       }
4682     }
4683   }
4684 }
4685 ```
4686 ### PrimaryPassword
4687 Require or prevent using a primary (formerly master) password.
4688
4689 If this value is true, a primary password is required. If this value is false, it works the same as if [`DisableMasterPasswordCreation`](#disablemasterpasswordcreation) was true and removes the primary password functionality.
4690
4691 If both DisableMasterPasswordCreation and PrimaryPassword are used, DisableMasterPasswordCreation takes precedent.
4692
4693 **Compatibility:** Firefox 79, Firefox ESR 78.1\
4694 **CCK2 Equivalent:** `noMasterPassword`\
4695 **Preferences Affected:** N/A
4696
4697 #### Windows (GPO)
4698 ```
4699 Software\Policies\Mozilla\Firefox\PrimaryPassword = 0x1 | 0x0
4700 ```
4701 #### Windows (Intune)
4702 OMA-URI:
4703 ```
4704 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox/PrimaryPassword
4705 ```
4706 Value (string):
4707 ```
4708 <enabled/> or <disabled/>
4709 ```
4710 #### macOS
4711 ```
4712 <dict>
4713   <key>PrimaryPassword</key>
4714   <true/> | <false/>
4715 </dict>
4716 ```
4717 #### policies.json
4718 ```
4719 {
4720   "policies": {
4721     "PrimaryPassword": true | false
4722   }
4723 }
4724 ```
4725 ### PromptForDownloadLocation
4726 Ask where to save each file before downloading.
4727
4728 **Compatibility:** Firefox 68, Firefox ESR 68\
4729 **CCK2 Equivalent:** N/A\
4730 **Preferences Affected:** `browser.download.useDownloadDir`
4731
4732 #### Windows (GPO)
4733 ```
4734 Software\Policies\Mozilla\Firefox\PromptForDownloadLocation = 0x1 | 0x0
4735 ```
4736 #### Windows (Intune)
4737 OMA-URI:
4738 ```
4739 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox/PromptForDownloadLocation
4740 ```
4741 Value (string):
4742 ```
4743 <enabled/> or <disabled/>
4744 ```
4745 #### macOS
4746 ```
4747 <dict>
4748   <key>PromptForDownloadLocation</key>
4749   <true/> | <false/>
4750 </dict>
4751 ```
4752 #### policies.json
4753 ```
4754 {
4755   "policies": {
4756     "PromptForDownloadLocation": true | false
4757   }
4758 }
4759 ```
4760 ### Proxy
4761 Configure proxy settings. These settings correspond to the connection settings in Firefox preferences.
4762 To specify ports, append them to the hostnames with a colon (:).
4763
4764 Unless you lock this policy, changes the user already has in place will take effect.
4765
4766 `Mode` is the proxy method being used.
4767
4768 `Locked` is whether or not proxy settings can be changed.
4769
4770 `HTTPProxy` is the HTTP proxy server.
4771
4772 `UseHTTPProxyForAllProtocols` is whether or not the HTTP proxy should be used for all other proxies.
4773
4774 `SSLProxy` is the SSL proxy server.
4775
4776 `FTPProxy` is the FTP proxy server.
4777
4778 `SOCKSProxy` is the SOCKS proxy server
4779
4780 `SOCKSVersion` is the SOCKS version (4 or 5)
4781
4782 `Passthrough` is list of hostnames or IP addresses that will not be proxied. Use `<local>` to bypass proxying for all hostnames which do not contain periods.
4783
4784 `AutoConfigURL` is a  URL for proxy configuration (only used if Mode is autoConfig).
4785
4786 `AutoLogin` means do not prompt for authentication if password is saved.
4787
4788 `UseProxyForDNS` to use proxy DNS when using SOCKS v5.
4789
4790 **Compatibility:** Firefox 60, Firefox ESR 60\
4791 **CCK2 Equivalent:** `networkProxy*`\
4792 **Preferences Affected:** `network.proxy.type`, `network.proxy.autoconfig_url`, `network.proxy.socks_remote_dns`, `signon.autologin.proxy`, `network.proxy.socks_version`, `network.proxy.no_proxies_on`, `network.proxy.share_proxy_settings`, `network.proxy.http`, `network.proxy.http_port`, `network.proxy.ftp`, `network.proxy.ftp_port`, `network.proxy.ssl`, `network.proxy.ssl_port`, `network.proxy.socks`, `network.proxy.socks_port`
4793
4794 #### Windows (GPO)
4795 ```
4796 Software\Policies\Mozilla\Firefox\Proxy\Mode = "none" | "system" | "manual" | "autoDetect" | "autoConfig"
4797 Software\Policies\Mozilla\Firefox\Proxy\Locked = 0x1 | 0x0
4798 Software\Policies\Mozilla\Firefox\=Proxy\HTTPProxy = https://httpproxy.example.com
4799 Software\Policies\Mozilla\Firefox\Proxy\UseHTTPProxyForAllProtocols = 0x1 | 0x0
4800 Software\Policies\Mozilla\Firefox\Proxy\SSLProxy = https://sslproxy.example.com
4801 Software\Policies\Mozilla\Firefox\Proxy\FTPProxy = https://ftpproxy.example.com
4802 Software\Policies\Mozilla\Firefox\Proxy\SOCKSProxy = https://socksproxy.example.com
4803 Software\Policies\Mozilla\Firefox\Proxy\SOCKSVersion = 0x4 | 0x5
4804 Software\Policies\Mozilla\Firefox\Proxy\Passthrough = <local>
4805 Software\Policies\Mozilla\Firefox\Proxy\AutoConfigURL = URL_TO_AUTOCONFIG
4806 Software\Policies\Mozilla\Firefox\Proxy\AutoLogin = 0x1 | 0x0
4807 Software\Policies\Mozilla\Firefox\Proxy\UseProxyForDNS = 0x1 | 0x0
4808 ```
4809 #### Windows (Intune)
4810 **Note**
4811 These setttings were moved to a category to make them easier to configure via Intune.
4812
4813 OMA-URI:
4814 ```
4815 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~ProxySettings/Proxy_Locked
4816 ```
4817 Value (string):
4818 ```
4819 <enabled/> or <disabled/>
4820 ```
4821 OMA-URI:
4822 ```
4823 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~ProxySettings/Proxy_ConnectionType
4824 ```
4825 Value (string):
4826 ```
4827 <enabled/>
4828 <data id="Proxy_ConnectionType" value="none | system | manual | autoDetect | autoConfig"/>
4829 ```
4830 OMA-URI:
4831 ```
4832 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~ProxySettings/Proxy_HTTPProxy
4833 ```
4834 Value (string):
4835 ```
4836 <enabled/>
4837 <data id="Proxy_HTTPProxy" value="httpproxy.example.com"/>
4838 ```
4839 OMA-URI:
4840 ```
4841 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~ProxySettings/Proxy_UseHTTPProxyForAllProtocols
4842 ```
4843 Value (string):
4844 ```
4845 <enabled/> or <disabled/>
4846 ```
4847 OMA-URI:
4848 ```
4849 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~ProxySettings/Proxy_SSLProxy
4850 ```
4851 Value (string):
4852 ```
4853 <enabled/>
4854 <data id="Proxy_SSLProxy" value="sslproxy.example.com"/>
4855 ```
4856 OMA-URI:
4857 ```
4858 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~ProxySettings/Proxy_SOCKSProxy
4859 ```
4860 Value (string):
4861 ```
4862 <enabled/>
4863 <data id="Proxy_SOCKSProxy" value="socksproxy.example.com"/>
4864 <data id="Proxy_SOCKSVersion" value="4 | 5"/>
4865 ```
4866 OMA-URI:
4867 ```
4868 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~ProxySettings/Proxy_AutoConfigURL
4869 ```
4870 Value (string):
4871 ```
4872 <enabled/>
4873 <data id="Proxy_AutoConfigURL" value="URL_TO_AUTOCONFIG"/>
4874 ```
4875 OMA-URI:
4876 ```
4877 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~ProxySettings/Proxy_Passthrough
4878 ```
4879 Value (string):
4880 ```
4881 <enabled/>
4882 <data id="Proxy_Passthrough" value="&lt;local&gt;"/>
4883 ```
4884 OMA-URI:
4885 ```
4886 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~ProxySettings/Proxy_AutoLogin
4887 ```
4888 Value (string):
4889 ```
4890 <enabled/> or <disabled/>
4891 ```
4892 OMA-URI:
4893 ```
4894 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~ProxySettings/Proxy_UseProxyForDNS
4895 ```
4896 Value (string):
4897 ```
4898 <enabled/> or <disabled/>
4899 ```
4900 OMA-URI (Old way):
4901 ```
4902 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox/Proxy
4903 ```
4904 Value (string):
4905 ```
4906 <enabled/>
4907 <data id="ProxyLocked" value="true | false"/>
4908 <data id="ConnectionType" value="none | system | manual | autoDetect | autoConfig"/>
4909 <data id="HTTPProxy" value="httpproxy.example.com"/>
4910 <data id="UseHTTPProxyForAllProtocols" value="true | false"/>
4911 <data id="SSLProxy" value="sslproxy.example.com"/>
4912 <data id="FTPProxy" value="ftpproxy.example.com"/>
4913 <data id="SOCKSProxy" value="socksproxy.example.com"/>
4914 <data id="SOCKSVersion" value="4 | 5"/>
4915 <data id="AutoConfigURL" value="URL_TO_AUTOCONFIG"/>
4916 <data id="Passthrough" value="<local>"/>
4917 <data id="AutoLogin" value="true | false"/>
4918 <data id="UseProxyForDNS" value="true | false"/>
4919 ```
4920 #### macOS
4921 ```
4922 <dict>
4923   <key>Proxy</key>
4924   <dict>
4925     <key>Mode</key>
4926     <string>none | system | manual | autoDetect | autoConfig</string>
4927     <key>Locked</key>
4928     <true> | </false>
4929     <key>HTTPProxy</key>
4930     <string>https://httpproxy.example.com</string>
4931     <key>UseHTTPProxyForAllProtocols</key>
4932     <true> | </false>
4933     <key>SSLProxy</key>
4934     <string>https://sslproxy.example.com</string>
4935     <key>FTPProxy</key>
4936     <string>https://ftpproxy.example.com</string>
4937     <key>SOCKSProxy</key>
4938     <string>https://socksproxy.example.com</string>
4939     <key>SOCKSVersion</key>
4940     <string>4 | 5</string>
4941     <key>Passthrough</key>
4942     <string>&lt;local>&gt;</string>
4943     <key>AutoConfigURL</key>
4944     <string>URL_TO_AUTOCONFIG</string>
4945     <key>AutoLogin</key>
4946     <true> | </false>
4947     <key>UseProxyForDNS</key>
4948     <true> | </false>
4949   </dict>
4950 </dict>
4951 ```
4952 #### policies.json
4953 ```
4954 {
4955   "policies": {
4956     "Proxy": {
4957       "Mode": "none" | "system" | "manual" | "autoDetect" | "autoConfig",
4958       "Locked": true | false,
4959       "HTTPProxy": "hostname",
4960       "UseHTTPProxyForAllProtocols": true | false,
4961       "SSLProxy": "hostname",
4962       "FTPProxy": "hostname",
4963       "SOCKSProxy": "hostname",
4964       "SOCKSVersion": 4 | 5,
4965       "Passthrough": "<local>",
4966       "AutoConfigURL": "URL_TO_AUTOCONFIG",
4967       "AutoLogin": true | false,
4968       "UseProxyForDNS": true | false
4969     }
4970   }
4971 }
4972 ```
4973 ### RequestedLocales
4974 Set the the list of requested locales for the application in order of preference. It will cause the corresponding language pack to become active.
4975
4976 Note: For Firefox 68, this can now be a string so that you can specify an empty value.
4977
4978 **Compatibility:** Firefox 64, Firefox ESR 60.4, Updated in Firefox 68, Firefox ESR 68\
4979 **CCK2 Equivalent:** N/A\
4980 **Preferences Affected:** N/A
4981 #### Windows (GPO)
4982 ```
4983 Software\Policies\Mozilla\Firefox\RequestedLocales\1 = "de"
4984 Software\Policies\Mozilla\Firefox\RequestedLocales\2 = "en-US"
4985
4986 or
4987
4988 Software\Policies\Mozilla\Firefox\RequestedLocales = "de,en-US"
4989 ```
4990 #### Windows (Intune)
4991 OMA-URI:
4992 ```
4993 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox/RequestedLocalesString
4994 ```
4995 Value (string):
4996 ```
4997 <enabled/>
4998 <data id="Preferences_String" value="de,en-US"/>
4999 ```
5000 #### macOS
5001 ```
5002 <dict>
5003   <key>RequestedLocales</key>
5004   <array>
5005     <string>de</string>
5006     <string>en-US</string>
5007   </array>
5008 </dict>
5009
5010 or
5011
5012 <dict>
5013   <key>RequestedLocales</key>
5014   <string>de,en-US</string>
5015 </dict>
5016
5017 ```
5018 #### policies.json
5019 ```
5020 {
5021   "policies": {
5022     "RequestedLocales": ["de", "en-US"]
5023   }
5024 }
5025
5026 or
5027
5028 {
5029   "policies": {
5030     "RequestedLocales": "de,en-US"
5031   }
5032 }
5033 ```
5034 <a name="SanitizeOnShutdown"></a>
5035
5036 ### SanitizeOnShutdown (Selective)
5037 Clear data on shutdown. Choose from Cache, Cookies, Download History, Form & Search History, Browsing History, Active Logins, Site Preferences and Offline Website Data.
5038
5039 Previously, these values were always locked. Starting with Firefox 74 and Firefox ESR 68.6, you can use the `Locked` option to either keep the values unlocked (set it to false), or lock only the values you set (set it to true). If you want the old behavior of locking everything, do not set `Locked` at all.
5040
5041 **Compatibility:** Firefox 68, Firefox ESR 68 (Locked added in 74/68.6)\
5042 **CCK2 Equivalent:** N/A\
5043 **Preferences Affected:** `privacy.sanitize.sanitizeOnShutdown`, `privacy.clearOnShutdown.cache`, `privacy.clearOnShutdown.cookies`, `privacy.clearOnShutdown.downloads`, `privacy.clearOnShutdown.formdata`, `privacy.clearOnShutdown.history`, `privacy.clearOnShutdown.sessions`, `privacy.clearOnShutdown.siteSettings`, `privacy.clearOnShutdown.offlineApps`
5044 #### Windows (GPO)
5045 ```
5046 Software\Policies\Mozilla\Firefox\SanitizeOnShutdown\Cache = 0x1 | 0x0
5047 Software\Policies\Mozilla\Firefox\SanitizeOnShutdown\Cookies = 0x1 | 0x0
5048 Software\Policies\Mozilla\Firefox\SanitizeOnShutdown\Downloads = 0x1 | 0x0
5049 Software\Policies\Mozilla\Firefox\SanitizeOnShutdown\FormData = 0x1 | 0x0
5050 Software\Policies\Mozilla\Firefox\SanitizeOnShutdown\History = 0x1 | 0x0
5051 Software\Policies\Mozilla\Firefox\SanitizeOnShutdown\Sessions = 0x1 | 0x0
5052 Software\Policies\Mozilla\Firefox\SanitizeOnShutdown\SiteSettings = 0x1 | 0x0
5053 Software\Policies\Mozilla\Firefox\SanitizeOnShutdown\OfflineApps = 0x1 | 0x0
5054 Software\Policies\Mozilla\Firefox\SanitizeOnShutdown\Locked = 0x1 | 0x0
5055 ```
5056 #### Windows (Intune)
5057 OMA-URI:
5058 ```
5059 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~SanitizeOnShutdown/A_SanitizeOnShutdown_Cache
5060 ```
5061 Value (string):
5062 ```
5063 <enabled/> or <disabled/>
5064 ```
5065 OMA-URI:
5066 ```
5067 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~SanitizeOnShutdown/B_SanitizeOnShutdown_Cookies
5068 ```
5069 Value (string):
5070 ```
5071 <enabled/> or <disabled/>
5072 ```
5073 OMA-URI:
5074 ```
5075 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~SanitizeOnShutdown/C_SanitizeOnShutdown_Downloads
5076 ```
5077 Value (string):
5078 ```
5079 <enabled/> or <disabled/>
5080 ```
5081 OMA-URI:
5082 ```
5083 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~SanitizeOnShutdown/D_SanitizeOnShutdown_FormData
5084 ```
5085 Value (string):
5086 ```
5087 <enabled/> or <disabled/>
5088 ```
5089 OMA-URI:
5090 ```
5091 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~SanitizeOnShutdown/E_SanitizeOnShutdown_History
5092 ```
5093 Value (string):
5094 ```
5095 <enabled/> or <disabled/>
5096 ```
5097 OMA-URI:
5098 ```
5099 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~SanitizeOnShutdown/F_SanitizeOnShutdown_Sessions
5100 ```
5101 Value (string):
5102 ```
5103 <enabled/> or <disabled/>
5104 ```
5105 OMA-URI:
5106 ```
5107 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~SanitizeOnShutdown/G_SanitizeOnShutdown_SiteSettings
5108 ```
5109 Value (string):
5110 ```
5111 <enabled/> or <disabled/>
5112 ```
5113 OMA-URI:
5114 ```
5115 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~SanitizeOnShutdown/H_SanitizeOnShutdown_OfflineApps
5116 ```
5117 Value (string):
5118 ```
5119 <enabled/> or <disabled/>
5120 ```
5121 OMA-URI:
5122 ```
5123 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~SanitizeOnShutdown/I_SanitizeOnShutdown_Locked
5124 ```
5125 Value (string):
5126 ```
5127 <enabled/> or <disabled/>
5128 ```
5129 #### macOS
5130 ```
5131 <dict>
5132   <key>SanitizeOnShutdown</key>
5133   <dict>
5134     <key>Cache</key>
5135     <true/> | <false/>
5136     <key>Cookies</key>
5137     <true/> | <false/>
5138     <key>Downloads</key>
5139     <true/> | <false/>
5140     <key>FormData</key>
5141     <true/> | <false/>
5142     <key>History</key>
5143     <true/> | <false/>
5144     <key>Sessions</key>
5145     <true/> | <false/>
5146     <key>SiteSettings</key>
5147     <true/> | <false/>
5148     <key>OfflineApps</key>
5149     <true/> | <false/>
5150     <key>Locked</key>
5151     <true/> | <false/>
5152   </dict>
5153 </dict>
5154 ```
5155 #### policies.json
5156 ```
5157 {
5158   "policies": {
5159     "SanitizeOnShutdown": {
5160       "Cache": true | false,
5161       "Cookies": true | false,
5162       "Downloads": true | false,
5163       "FormData": true | false,
5164       "History": true | false,
5165       "Sessions": true | false,
5166       "SiteSettings": true | false,
5167       "OfflineApps": true | false,
5168       "Locked": true | false
5169     }
5170   }
5171 }
5172 ```
5173 ### SanitizeOnShutdown (All)
5174 Clear all data on shutdown, including Browsing & Download History, Cookies, Active Logins, Cache, Form & Search History, Site Preferences and Offline Website Data.
5175
5176 **Compatibility:** Firefox 60, Firefox ESR 60\
5177 **CCK2 Equivalent:** N/A\
5178 **Preferences Affected:** `privacy.sanitize.sanitizeOnShutdown`, `privacy.clearOnShutdown.cache`, `privacy.clearOnShutdown.cookies`, `privacy.clearOnShutdown.downloads`, `privacy.clearOnShutdown.formdata`, `privacy.clearOnShutdown.history`, `privacy.clearOnShutdown.sessions`, `privacy.clearOnShutdown.siteSettings`, `privacy.clearOnShutdown.offlineApps`
5179 #### Windows (GPO)
5180 ```
5181 Software\Policies\Mozilla\Firefox\SanitizeOnShutdown = 0x1 | 0x0
5182 ```
5183 #### Windows (Intune)
5184 OMA-URI:
5185 ```
5186 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox/C_SanitizeOnShutdown
5187 ```
5188 Value (string):
5189 ```
5190 <enabled/> or <disabled/>
5191 ```
5192 #### macOS
5193 ```
5194 <dict>
5195   <key>SanitizeOnShutdown</key>
5196   <true/> | <false/>
5197 </dict>
5198 ```
5199 #### policies.json
5200 ```
5201 {
5202   "policies": {
5203     "SanitizeOnShutdown": true | false
5204   }
5205 }
5206 ```
5207 ### SearchBar
5208 Set whether or not search bar is displayed.
5209
5210 **Compatibility:** Firefox 60, Firefox ESR 60\
5211 **CCK2 Equivalent:** `showSearchBar`\
5212 **Preferences Affected:** N/A
5213
5214 #### Windows (GPO)
5215 ```
5216 Software\Policies\Mozilla\Firefox\SearchBar = "unified" | "separate"
5217 ```
5218
5219 #### Windows (Intune)
5220 OMA-URI:
5221 ```
5222 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox/SearchBar
5223 ```
5224 Value (string):
5225 ```
5226 <enabled/>
5227 <data id="SearchBar" value="unified | separate"/>
5228 ```
5229 #### macOS
5230 ```
5231 <dict>
5232   <key>SearchBar</key>
5233   <string>unified | separate</string>
5234 </dict>
5235 ```
5236 #### policies.json
5237 ```
5238 {
5239   "policies": {
5240     "SearchBar": "unified" | "separate"
5241   }
5242 }
5243 ```
5244 <a name="SearchEngines"></a>
5245
5246 ### SearchEngines (This policy is only available on the ESR.)
5247
5248 ### SearchEngines | Add
5249
5250 Add new search engines. Although there are only five engines available in the ADMX template, there is no limit. To add more in the ADMX template, you can duplicate the XML.
5251
5252 This policy is only available on the ESR. `Name` and `URLTemplate` are required.
5253
5254 `Name` is the name of the search engine.
5255
5256 `URLTemplate` is the search URL with {searchTerms} to substitute for the search term.
5257
5258 `Method` is either GET or POST
5259
5260 `IconURL` is a URL for the icon to use.
5261
5262 `Alias` is a keyword to use for the engine.
5263
5264 `Description` is a description of the search engine.
5265
5266 `PostData` is the POST data as name value pairs separated by &.
5267
5268 `SuggestURLTemplate` is a search suggestions URL with {searchTerms} to substitute for the search term.
5269
5270 `Encoding` is the query charset for the engine. It defaults to UTF-8.
5271
5272 **Compatibility:** Firefox ESR 60 (POST support in Firefox ESR 68, Encoding support in Firefox 91)\
5273 **CCK2 Equivalent:** `searchplugins`\
5274 **Preferences Affected:** N/A
5275
5276 #### Windows (GPO)
5277 ```
5278 Software\Policies\Mozilla\Firefox\SearchEngines\Add\1\Name = "Example1"
5279 Software\Policies\Mozilla\Firefox\SearchEngines\Add\1\URLTemplate = "https://www.example.org/q={searchTerms}"
5280 Software\Policies\Mozilla\Firefox\SearchEngines\Add\1\Method = "GET" | "POST"
5281 Software\Policies\Mozilla\Firefox\SearchEngines\Add\1\IconURL = "https://www.example.org/favicon.ico"
5282 Software\Policies\Mozilla\Firefox\SearchEngines\Add\1\Alias = "example"
5283 Software\Policies\Mozilla\Firefox\SearchEngines\Add\1\Description = "Example Description"
5284 Software\Policies\Mozilla\Firefox\SearchEngines\Add\1\SuggestURLTemplate = "https://www.example.org/suggestions/q={searchTerms}"
5285 Software\Policies\Mozilla\Firefox\SearchEngines\Add\1\PostData = "name=value&q={searchTerms}"
5286 ```
5287 #### Windows (Intune)
5288 OMA-URI:
5289 ```
5290 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~Search/SearchEngines_1
5291 ```
5292 Value (string):
5293 ```
5294 <enabled/>
5295 <data id="SearchEngine_Name" value="Example1"/>
5296 <data id="SearchEngine_URLTemplate" value="https://www.example.org/q={searchTerms"/>
5297 <data id="SearchEngine_Method" value="GET | POST"/>
5298 <data id="SearchEngine_IconURL" value="https://www.example.org/favicon.ico"/>
5299 <data id="SearchEngine_Alias" value="example"/>
5300 <data id="SearchEngine_Description" value="Example Description"/>
5301 <data id="SearchEngine_SuggestURLTemplate" value="https://www.example.org/suggestions/q={searchTerms}"/>
5302 <data id="SearchEngine_PostData" value="name=value&amp;q={searchTerms}"/>
5303 ```
5304 #### macOS
5305 ```
5306 <dict>
5307   <key>SearchEngines</key>
5308   <dict>
5309     <key>Add</key>
5310     <array>
5311       <dict>
5312         <key>Name</key>
5313         <string>Example1</string>
5314         <key>URLTemplate</key>
5315         <string>https://www.example.org/q={searchTerms}</string>
5316         <key>Method</key>
5317         <string>GET | POST </string>
5318         <key>IconURL</key>
5319         <string>https://www.example.org/favicon.ico</string>
5320         <key>Alias</key>
5321         <string>example</string>
5322         <key>Description</key>
5323         <string>Example Description</string>
5324         <key>SuggestURLTemplate</key>
5325         <string>https://www.example.org/suggestions/q={searchTerms}</string>
5326         <key>PostData</key>
5327         <string>name=value&q={searchTerms}</string>
5328       </dict>
5329     <array>
5330   </dict>
5331 </dict>
5332 ```
5333 #### policies.json
5334 ```
5335 {
5336   "policies": {
5337     "SearchEngines": {
5338       "Add": [
5339         {
5340           "Name": "Example1",
5341           "URLTemplate": "https://www.example.org/q={searchTerms}",
5342           "Method": "GET" | "POST",
5343           "IconURL": "https://www.example.org/favicon.ico",
5344           "Alias": "example",
5345           "Description": "Description",
5346           "PostData": "name=value&q={searchTerms}",
5347           "SuggestURLTemplate": "https://www.example.org/suggestions/q={searchTerms}"
5348         }
5349       ]
5350     }
5351   }
5352 }
5353 ```
5354 ### SearchEngines | Default
5355
5356 Set the default search engine. This policy is only available on the ESR.
5357
5358 **Compatibility:** Firefox ESR 60\
5359 **CCK2 Equivalent:** `defaultSearchEngine`\
5360 **Preferences Affected:** N/A
5361
5362 #### Windows (GPO)
5363 ```
5364 Software\Policies\Mozilla\Firefox\SearchEngines\Default = NAME_OF_SEARCH_ENGINE
5365 ```
5366 #### Windows (Intune)
5367 OMA-URI:
5368 ```
5369 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~Search/SearchEngines_Default
5370 ```
5371 Value (string):
5372 ```
5373 <enabled/>
5374 <data id="SearchEngines_Default" value="NAME_OF_SEARCH_ENGINE"/>
5375 ```
5376 #### macOS
5377 ```
5378 <dict>
5379   <key>SearchEngines</key>
5380   <dict>
5381     <key>Default</key>
5382     <string>NAME_OF_SEARCH_ENGINE</string>
5383   </dict>
5384 </dict>
5385 ```
5386 #### policies.json
5387 ```
5388 {
5389   "policies": {
5390     "SearchEngines": {
5391       "Default": "NAME_OF_SEARCH_ENGINE"
5392     }
5393   }
5394 }
5395 ```
5396 ### SearchEngines | PreventInstalls
5397
5398 Prevent installing search engines from webpages.
5399
5400 **Compatibility:** Firefox ESR 60\
5401 **CCK2 Equivalent:** `disableSearchEngineInstall`\
5402 **Preferences Affected:** N/A
5403
5404 #### Windows (GPO)
5405 ```
5406 Software\Policies\Mozilla\Firefox\SearchEngines\PreventInstalls = 0x1 | 0x0
5407 ```
5408 #### Windows (Intune)
5409 OMA-URI:
5410 ```
5411 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~Search/SearchEngines_PreventInstalls
5412 ```
5413 Value (string):
5414 ```
5415 <enabled/> or <disabled/>
5416 ```
5417 #### macOS
5418 ```
5419 <dict>
5420   <key>SearchEngines</key>
5421   <dict>
5422     <key>PreventInstalls</key>
5423     <true/> | <false/>
5424   </dict>
5425 </dict>
5426 ```
5427 #### policies.json
5428 ```
5429 {
5430   "policies": {
5431     "SearchEngines": {
5432       "PreventInstalls": true | false
5433     }
5434   }
5435 }
5436 ```
5437 ### SearchEngines | Remove
5438
5439 Hide built-in search engines. This policy is only available on the ESR.
5440
5441 **Compatibility:** Firefox ESR 60.2\
5442 **CCK2 Equivalent:** `removeDefaultSearchEngines` (removed all built-in engines)\
5443 **Preferences Affected:** N/A
5444
5445 #### Windows (GPO)
5446 ```
5447 Software\Policies\Mozilla\Firefox\SearchEngines\Remove\1 = NAME_OF_SEARCH_ENGINE
5448 ```
5449 #### Windows (Intune)
5450 OMA-URI:
5451 ```
5452 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~Search/SearchEngines_Remove
5453 ```
5454 Value (string):
5455 ```
5456 <enabled/>
5457 <data id="SearchEngines_Remove" value="1&#xF000;NAME_OF_SEARCH_ENGINE"/>
5458 ```
5459 #### macOS
5460 ```
5461 <dict>
5462   <key>SearchEngines</key>
5463   <dict>
5464     <key>Remove</key>
5465     <array>
5466       <string>NAME_OF_SEARCH_ENGINE</string>
5467     </array>
5468   </dict>
5469 </dict>
5470 ```
5471 #### policies.json
5472 ```
5473 {
5474   "policies": {
5475     "SearchEngines": {
5476       "Remove": ["NAME_OF_SEARCH_ENGINE"]
5477     }
5478   }
5479 }
5480 ```
5481 ### SearchSuggestEnabled
5482
5483 Enable search suggestions.
5484
5485 **Compatibility:** Firefox 68, Firefox ESR 68\
5486 **CCK2 Equivalent:** N/A\
5487 **Preferences Affected:** `browser.urlbar.suggest.searches`, `browser.search.suggest.enabled`
5488
5489 #### Windows (GPO)
5490 ```
5491 Software\Policies\Mozilla\Firefox\SearchSuggestEnabled = 0x1 | 0x0
5492 ```
5493 #### Windows (Intune)
5494 OMA-URI:
5495 ```
5496 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~Search/SearchSuggestEnabled
5497 ```
5498 Value (string):
5499 ```
5500 <enabled/> or <disabled/>
5501 ```
5502 #### macOS
5503 ```
5504 <dict>
5505   <key>SearchSuggestEnabled</key>
5506   <true/> | <false/>
5507 </dict>
5508 ```
5509 #### policies.json
5510 ```
5511 {
5512   "policies": {
5513     "SearchSuggestEnabled": true | false
5514   }
5515 }
5516 ```
5517 ### SecurityDevices
5518
5519 Add or delete PKCS #11 modules.
5520
5521 **Compatibility:** Firefox 114, Firefox ESR 112.12\
5522 **CCK2 Equivalent:** N/A\
5523 **Preferences Affected:** N/A
5524
5525 #### Windows (GPO)
5526 ```
5527 Software\Policies\Mozilla\Firefox\SecurityDevices\Add\NAME_OF_DEVICE_TO_ADD = PATH_TO_LIBRARY_FOR_DEVICE
5528 Software\Policies\Mozilla\Firefox\SecurityDevices\Remove\1 = NAME_OF_DEVICE_TO_REMOVE
5529 ```
5530 #### Windows (Intune)
5531 OMA-URI:
5532 ```
5533 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox/SecurityDevices/SecurityDevices_Add
5534 ```
5535 Value (string):
5536 ```
5537 <enabled/>
5538 <data id="SecurityDevices" value="NAME_OF_DEVICE_TO_ADD&#xF000;PATH_TO_LIBRARY_FOR_DEVICE"/>
5539 ```
5540 OMA-URI:
5541 ```
5542 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox/SecurityDevices/SecurityDevices_Delete
5543 ```
5544 Value (string):
5545 ```
5546 <enabled/>
5547 <data id="SecurityDevices" value="1&#xF000;NAME_OF_DEVICE_TO_REMOVE"/>
5548 ```
5549 #### macOS
5550 ```
5551 <dict>
5552   <key>SecurityDevices</key>
5553   <dict>
5554     <key>Add<key>
5555     <dict>
5556       <key>NAME_OF_DEVICE_TO_ADD</key>
5557       <string>PATH_TO_LIBRARY_FOR_DEVICE</string>
5558     </dict>
5559     <key>Delete</add>
5560     <array>
5561       <string>NAME_OF_DEVICE_TO_DELETE</string>
5562     </array>
5563   </dict>
5564 </dict>
5565 ```
5566 #### policies.json
5567 ```
5568 {
5569   "policies": {
5570     "SecurityDevices": {
5571       "Add": {
5572         "NAME_OF_DEVICE_TO_ADD": "PATH_TO_LIBRARY_FOR_DEVICE"
5573       },
5574       "Delete": ["NAME_OF_DEVICE_TO_DELETE"]
5575     }
5576   }
5577 }
5578 ```
5579 ### SecurityDevices (Deprecated)
5580
5581 Install PKCS #11 modules.
5582
5583 **Compatibility:** Firefox 64, Firefox ESR 60.4\
5584 **CCK2 Equivalent:** `certs.devices`\
5585 **Preferences Affected:** N/A
5586
5587 #### Windows (GPO)
5588 ```
5589 Software\Policies\Mozilla\Firefox\SecurityDevices\NAME_OF_DEVICE = PATH_TO_LIBRARY_FOR_DEVICE
5590 ```
5591 #### Windows (Intune)
5592 OMA-URI:
5593 ```
5594 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox/SecurityDevices
5595 ```
5596 Value (string):
5597 ```
5598 <enabled/>
5599 <data id="SecurityDevices" value="NAME_OF_DEVICE&#xF000;PATH_TO_LIBRARY_FOR_DEVICE"/>
5600 ```
5601 #### macOS
5602 ```
5603 <dict>
5604   <key>SecurityDevices</key>
5605   <dict>
5606     <key>NAME_OF_DEVICE</key>
5607     <string>PATH_TO_LIBRARY_FOR_DEVICE</string>
5608   </dict>
5609 </dict>
5610 ```
5611 #### policies.json
5612 ```
5613 {
5614   "policies": {
5615     "SecurityDevices": {
5616       "NAME_OF_DEVICE": "PATH_TO_LIBRARY_FOR_DEVICE"
5617     }
5618   }
5619 }
5620 ```
5621 ### ShowHomeButton
5622 Show the home button on the toolbar.
5623
5624 Future versions of Firefox will not show the home button by default.
5625
5626 **Compatibility:** Firefox 88, Firefox ESR 78.10\
5627 **CCK2 Equivalent:** N/A\
5628 **Preferences Affected:** N/A
5629
5630 #### Windows (GPO)
5631 ```
5632 Software\Policies\Mozilla\Firefox\ShowHomeButton = 0x1 | 0x0
5633 ```
5634 #### Windows (Intune)
5635 OMA-URI:
5636 ```
5637 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~Homepage/Homepage_ShowHomeButton
5638 ```
5639 Value (string):
5640 ```
5641 <enabled/> or <disabled/>
5642 ```
5643 #### macOS
5644 ```
5645 <dict>
5646   <key>ShowHomeButton</key>
5647   <true/> | <false/>
5648 </dict>
5649 ```
5650 #### policies.json
5651 ```
5652 {
5653   "policies": {
5654     "ShowHomeButton": true | false
5655   }
5656 }
5657 ```
5658 ### SSLVersionMax
5659
5660 Set and lock the maximum version of TLS.
5661
5662 **Compatibility:** Firefox 66, Firefox ESR 60.6\
5663 **CCK2 Equivalent:** N/A\
5664 **Preferences Affected:** `security.tls.version.max`
5665
5666 #### Windows (GPO)
5667 ```
5668 Software\Policies\Mozilla\Firefox\SSLVersionMax = "tls1" | "tls1.1" | "tls1.2" | "tls1.3"
5669 ```
5670 #### Windows (Intune)
5671 OMA-URI:
5672 ```
5673 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox/SSLVersionMax
5674 ```
5675 Value (string):
5676 ```
5677 <enabled/>
5678 <data id="SSLVersion" value="tls1 | tls1.2 | tls1.3"/>
5679 ```
5680 #### macOS
5681 ```
5682 <dict>
5683   <key>SSLVersionMax</key>
5684   <string>tls1 | tls1.1 | tls1.2 | tls1.3</string>
5685 </dict>
5686 ```
5687
5688 #### policies.json
5689 ```
5690 {
5691   "policies": {
5692     "SSLVersionMax": "tls1" | "tls1.1" | "tls1.2" | "tls1.3"
5693   }
5694 }
5695 ```
5696 ### SSLVersionMin
5697
5698 Set and lock the minimum version of TLS.
5699
5700 **Compatibility:** Firefox 66, Firefox ESR 60.6\
5701 **CCK2 Equivalent:** N/A\
5702 **Preferences Affected:** `security.tls.version.min`
5703
5704 #### Windows (GPO)
5705 ```
5706 Software\Policies\Mozilla\Firefox\SSLVersionMin = "tls1" | "tls1.1" | "tls1.2" | "tls1.3"
5707 ```
5708 #### Windows (Intune)
5709 OMA-URI:
5710 ```
5711 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox/SSLVersionMin
5712 ```
5713 Value (string):
5714 ```
5715 <enabled/>
5716 <data id="SSLVersion" value="tls1 | tls1.2 | tls1.3"/>
5717 ```
5718 #### macOS
5719 ```
5720 <dict>
5721   <key>SSLVersionMin</key>
5722   <string>tls1 | tls1.1 | tls1.2 | tls1.3</string>
5723 </dict>
5724 ```
5725
5726 #### policies.json
5727 ```
5728 {
5729   "policies": {
5730     "SSLVersionMin": "tls1" | "tls1.1" | "tls1.2" | "tls1.3"
5731   }
5732 }
5733 ```
5734 ### SupportMenu
5735 Add a menuitem to the help menu for specifying support information.
5736
5737 **Compatibility:** Firefox 68.0.1, Firefox ESR 68.0.1\
5738 **CCK2 Equivalent:** helpMenu\
5739 **Preferences Affected:** N/A
5740
5741 #### Windows (GPO)
5742 ```
5743 Software\Policies\Mozilla\Firefox\SupportMenu\Title = "Support Menu"
5744 Software\Policies\Mozilla\Firefox\SupportMenu\URL = "http://example.com/support"
5745 Software\Policies\Mozilla\Firefox\SupportMenu\AccessKey = "S"
5746 ```
5747 #### Windows (Intune)
5748 OMA-URI:
5749 ```
5750 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox/SupportMenu
5751 ```
5752 Value (string):
5753 ```
5754 <enabled/>
5755 <data id="SupportMenuTitle" value="Support Menu"/>
5756 <data id="SupportMenuURL" value="http://example.com/support"/>
5757 <data id="SupportMenuAccessKey" value="S"/>
5758 ```
5759 #### macOS
5760 ```
5761 <dict>
5762   <key>SupportMenu</key>
5763   <dict>
5764     <key>Title</key>
5765     <string>SupportMenu</string>
5766     <key>URL</key>
5767     <string>http://example.com/support</string>
5768     <key>AccessKey</key>
5769     <string>S</string>
5770   </dict>
5771 </dict>
5772 ```
5773 #### policies.json
5774 ```
5775 {
5776   "policies": {
5777     "SupportMenu": {
5778       "Title": "Support Menu",
5779       "URL": "http://example.com/support",
5780       "AccessKey": "S"
5781     }
5782   }
5783 }
5784 ```
5785 ### StartDownloadsInTempDirectory
5786 Force downloads to start off in a local, temporary location rather than the default download directory.
5787
5788 **Compatibility:** Firefox 102\
5789 **CCK2 Equivalent:** N/A\
5790 **Preferences Affected:** `browser.download.start_downloads_in_tmp_dir`
5791
5792 #### Windows (GPO)
5793 ```
5794 Software\Policies\Mozilla\Firefox\StartDownloadsInTempDirectory = 0x1 | 0x0
5795 ```
5796 #### Windows (Intune)
5797 OMA-URI:
5798 ```
5799 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox/StartDownloadsInTempDirectory
5800 ```
5801 Value (string):
5802 ```
5803 <enabled/> or <disabled/>
5804 ```
5805 #### macOS
5806 ```
5807 <dict>
5808   <key>StartDownloadsInTempDirectory</key>
5809   <true/> | <false/>
5810 </dict>
5811 ```
5812 #### policies.json
5813 ```
5814 {
5815   "policies": {
5816     "StartDownloadsInTempDirectory": true | false
5817 }
5818 ```
5819 ### UserMessaging
5820
5821 Prevent Firefox from messaging the user in certain situations.
5822
5823 `WhatsNew` Remove the "What's New" icon and menuitem.
5824
5825 `ExtensionRecommendations` If false, don't recommend extensions while the user is visiting web pages.
5826
5827 `FeatureRecommendations` If false, don't recommend browser features.
5828
5829 `UrlbarInterventions` If false, Don't offer Firefox specific suggestions in the URL bar.
5830
5831 `SkipOnboarding` If true, don't show onboarding messages on the new tab page.
5832
5833 `MoreFromMozilla` If false, don't show the "More from Mozilla" section in Preferences. (Firefox 98)
5834
5835 `Locked` prevents the user from changing user messaging preferences.
5836
5837 **Compatibility:** Firefox 75, Firefox ESR 68.7\
5838 **CCK2 Equivalent:** N/A\
5839 **Preferences Affected:** `browser.messaging-system.whatsNewPanel.enabled`, `browser.newtabpage.activity-stream.asrouter.userprefs.cfr.addons`, `browser.newtabpage.activity-stream.asrouter.userprefs.cfr.features`, `browser.aboutwelcome.enabled`, `browser.preferences.moreFromMozilla`
5840
5841 #### Windows (GPO)
5842 ```
5843 Software\Policies\Mozilla\Firefox\UserMessaging\WhatsNew = 0x1 | 0x0
5844 Software\Policies\Mozilla\Firefox\UserMessaging\ExtensionRecommendations = 0x1 | 0x0
5845 Software\Policies\Mozilla\Firefox\UserMessaging\FeatureRecommendations = 0x1 | 0x0
5846 Software\Policies\Mozilla\Firefox\UserMessaging\UrlbarInterventions = 0x1 | 0x0
5847 Software\Policies\Mozilla\Firefox\UserMessaging\SkipOnboarding = 0x1 | 0x0
5848 Software\Policies\Mozilla\Firefox\UserMessaging\MoreFromMozilla = 0x1 | 0x0
5849 Software\Policies\Mozilla\Firefox\UserMessaging\Locked = 0x1 | 0x0
5850 ```
5851 #### Windows (Intune)
5852 OMA-URI:
5853 ```
5854 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~UserMessaging/UserMessaging_WhatsNew
5855 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~UserMessaging/UserMessaging_ExtensionRecommendations
5856 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~UserMessaging/UserMessaging_FeatureRecommendations
5857 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~UserMessaging/UserMessaging_UrlbarInterventions
5858 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~UserMessaging/UserMessaging_SkipOnboarding
5859 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~UserMessaging/UserMessaging_MoreFromMozilla
5860 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~UserMessaging/UserMessaging_Locked
5861 ```
5862 Value (string):
5863 ```
5864 <enabled/> or <disabled/>
5865 ```
5866 #### macOS
5867 ```
5868 <dict>
5869   <key>UserMessaging</key>
5870   <dict>
5871     <key>WhatsNew</key>
5872     <true/> | <false/>
5873     <key>ExtensionRecommendations</key>
5874     <true/> | <false/>
5875     <key>FeatureRecommendations</key>
5876     <true/> | <false/>
5877     <key>UrlbarInterventions</key>
5878     <true/> | <false/>
5879     <key>SkipOnboarding</key>
5880     <true/> | <false/>
5881     <key>MoreFromMozilla</key>
5882     <true/> | <false/>
5883     <key>Locked</key>
5884     <true/> | <false/>
5885   </dict>
5886 </dict>
5887 ```
5888 #### policies.json
5889 ```
5890 {
5891   "policies": {
5892     "UserMessaging": {
5893       "WhatsNew": true | false,
5894       "ExtensionRecommendations": true | false,
5895       "FeatureRecommendations": true | false,
5896       "UrlbarInterventions": true | false,
5897       "SkipOnboarding": true | false,
5898       "MoreFromMozilla": true | false,
5899       "Locked": true | false
5900     }
5901   }
5902 }
5903 ```
5904 ### UseSystemPrintDialog
5905 Use the system print dialog instead of the print preview window.
5906
5907 **Compatibility:** Firefox 102\
5908 **CCK2 Equivalent:** N/A\
5909 **Preferences Affected:** `print.prefer_system_dialog`
5910
5911 #### Windows (GPO)
5912 ```
5913 Software\Policies\Mozilla\Firefox\UseSystemPrintDialog = 0x1 | 0x0
5914 ```
5915 #### Windows (Intune)
5916 OMA-URI:
5917 ```
5918 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox/UseSystemPrintDialog
5919 ```
5920 Value (string):
5921 ```
5922 <enabled/> or <disabled/>
5923 ```
5924 #### macOS
5925 ```
5926 <dict>
5927   <key>UseSystemPrintDialog</key>
5928   <true/> | <false/>
5929 </dict>
5930 ```
5931 #### policies.json
5932 ```
5933 {
5934   "policies": {
5935     "UseSystemPrintDialog": true | false
5936   }
5937 }
5938 ```
5939 ### WebsiteFilter
5940 Block websites from being visited. The parameters take an array of Match Patterns, as documented in https://developer.mozilla.org/en-US/Add-ons/WebExtensions/Match_patterns.
5941 The arrays are limited to 1000 entries each.
5942
5943 If you want to block all URLs, you can use `<all_urls>` or `*://*/*`. You can't have just a `*` on the right side.
5944
5945 For specific protocols, use `https://*/*` or `http://*/*`.
5946
5947 As of Firefox 83 and Firefox ESR 78.5, file URLs are supported.
5948
5949 **Compatibility:** Firefox 60, Firefox ESR 60\
5950 **CCK2 Equivalent:** N/A\
5951 **Preferences Affected:** N/A
5952
5953 #### Windows (GPO)
5954 ```
5955 Software\Policies\Mozilla\Firefox\WebsiteFilter\Block\1 = "<all_urls>"
5956 Software\Policies\Mozilla\Firefox\WebsiteFilter\Exceptions\1 = "http://example.org/*"
5957 ```
5958 #### Windows (Intune)
5959 OMA-URI:
5960 ```
5961 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox/B_WebsiteFilter_Block
5962 ```
5963 Value (string):
5964 ```
5965 <enabled/> <data id="WebsiteFilter" value="1&#xF000;&#60;all_urls&#62;"/>
5966 ```
5967 OMA-URI:
5968 ```
5969 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox/B_WebsiteFilter_Exceptions
5970 ```
5971 Value (string):
5972 ```
5973 <enabled/>
5974 <data id="WebsiteFilter" value="1&#xF000;http://example.org/*"/>
5975 ```
5976 #### macOS
5977 ```
5978 <dict>
5979   <key>WebsiteFilter</key>
5980   <dict>
5981     <key>Block</key>
5982     <array>
5983       <string><all_urls></string>
5984     </array>
5985     <key>Exceptions</key>
5986     <array>
5987       <string>http://example.org/*</string>
5988     </array>
5989   </dict>
5990
5991 </dict>
5992 ```
5993 #### policies.json
5994 ```
5995 {
5996   "policies": {
5997     "WebsiteFilter": {
5998       "Block": ["<all_urls>"],
5999       "Exceptions": ["http://example.org/*"]
6000     }
6001   }
6002 }
6003 ```
6004 ### WindowsSSO
6005 Allow Windows single sign-on for Microsoft, work, and school accounts.
6006
6007 If this policy is set to true, Firefox will use credentials stored in Windows to sign in to Microsoft, work, and school accounts.
6008
6009 **Compatibility:** Firefox 91\
6010 **CCK2 Equivalent:** N/A\
6011 **Preferences Affected:** `network.http.windows-sso.enabled`
6012
6013 #### Windows (GPO)
6014 ```
6015 Software\Policies\Mozilla\Firefox\WindowsSSO = 0x1 | 0x0
6016 ```
6017 #### Windows (Intune)
6018 OMA-URI:
6019 ```
6020 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox/WindowsSSO
6021 ```
6022 Value (string):
6023 ```
6024 <enabled/> or <disabled/>
6025 ```
6026 #### policies.json
6027 ```
6028 {
6029   "policies": {
6030     "WindowsSSO": true | false
6031   }
6032 }
6033 ```
6034