docs/index.md

   1 Firefox policies can be specified using the [Group Policy templates on Windows](https://github.com/mozilla/policy-templates/tree/master/windows), [Intune on Windows](https://support.mozilla.org/kb/managing-firefox-intune), [configuration profiles on macOS](https://github.com/mozilla/policy-templates/tree/master/mac), or by creating a file called `policies.json`. On Windows, create a directory called `distribution` where the EXE is located and place the file there. On Mac, the file goes into `Firefox.app/Contents/Resources/distribution`.  On Linux, the file goes into `firefox/distribution`, where `firefox` is the installation directory for firefox, which varies by distribution or you can specify system-wide policy by placing the file in `/etc/firefox/policies`.
   2
   3 Unfortunately, JSON files do not support comments, but you can add extra entries to the JSON to use as comments. You will see an error in about:policies, but the policies will still work properly. For example:
   4 ```
   5 {
   6   "policies": {
   7     "Authentication": {
   8       "SPNEGO": ["mydomain.com", "https://myotherdomain.com"]
   9     }
  10     "Authentication_Comment": "These domains are required for us"
  11   }
  12 }
  13 ```
  14 Note: The `policies.json` must use the UTF-8 encoding.
  15
  16 | Policy Name | Description
  17 | --- | --- |
  18 | **[`3rdparty`](#3rdparty)** | Set policies that WebExtensions can access via chrome.storage.managed.
  19 | **[`AllowedDomainsForApps`](#alloweddomainsforapps)** | Define domains allowed to access Google Workspace.
  20 | **[`AllowFileSelectionDialogs`](#allowfileselectiondialogs)** | Allow file selection dialogs.
  21 | **[`AppAutoUpdate`](#appautoupdate)** | Enable or disable automatic application update.
  22 | **[`AppUpdatePin`](#appupdatepin)** | Prevent Firefox from being updated beyond the specified version.
  23 | **[`AppUpdateURL`](#appupdateurl)** | Change the URL for application update.
  24 | **[`Authentication`](#authentication)** | Configure sites that support integrated authentication.
  25 | **[`AutofillAddressEnabled`](#autofilladdressenabled)** | Enable autofill for addresses.
  26 | **[`AutofillCreditCardEnabled`](#autofillcreditcardenabled)** | Enable autofill for payment methods.
  27 | **[`AutoLaunchProtocolsFromOrigins`](#autolaunchprotocolsfromorigins)** | Define a list of external protocols that can be used from listed origins without prompting the user.
  28 | **[`BackgroundAppUpdate`](#backgroundappupdate)** | Enable or disable the background updater (Windows only).
  29 | **[`BlockAboutAddons`](#blockaboutaddons)** | Block access to the Add-ons Manager (about:addons).
  30 | **[`BlockAboutConfig`](#blockaboutconfig)** | Block access to about:config.
  31 | **[`BlockAboutProfiles`](#blockaboutprofiles)** | Block access to About Profiles (about:profiles).
  32 | **[`BlockAboutSupport`](#blockaboutsupport)** | Block access to Troubleshooting Information (about:support).
  33 | **[`Bookmarks`](#bookmarks)** | Add bookmarks in either the bookmarks toolbar or menu.
  34 | **[`CaptivePortal`](#captiveportal)** | Enable or disable the detection of captive portals.
  35 | **[`Certificates`](#certificates)** |
  36 | **[`Certificates -> ImportEnterpriseRoots`](#certificates--importenterpriseroots)** | Trust certificates that have been added to the operating system certificate store by a user or administrator.
  37 | **[`Certificates -> Install`](#certificates--install)** | Install certificates into the Firefox certificate store.
  38 | **[`Containers`](#containers)** | Set policies related to [containers](https://addons.mozilla.org/firefox/addon/multi-account-containers/).
  39 | **[`Cookies`](#cookies)** | Configure cookie preferences.
  40 | **[`DefaultDownloadDirectory`](#defaultdownloaddirectory)** | Set the default download directory.
  41 | **[`DisableAppUpdate`](#disableappupdate)** | Turn off application updates.
  42 | **[`DisableBuiltinPDFViewer`](#disablebuiltinpdfviewer)** | Disable the built in PDF viewer.
  43 | **[`DisabledCiphers`](#disabledciphers)** | Disable ciphers.
  44 | **[`DisableDefaultBrowserAgent`](#disabledefaultbrowseragent)** | Prevent the default browser agent from taking any actions (Windows only).
  45 | **[`DisableDeveloperTools`](#disabledevelopertools)** | Remove access to all developer tools.
  46 | **[`DisableEncryptedClientHello`](#disableencryptedclienthello)** | Disable the TLS Feature Encrypted Client Hello (ECH).
  47 | **[`DisableFeedbackCommands`](#disablefeedbackcommands)** | Disable the menus for reporting sites.
  48 | **[`DisableFirefoxAccounts`](#disablefirefoxaccounts)** | Disable Firefox Accounts integration (Sync).
  49 | **[`DisableFirefoxScreenshots`](#disablefirefoxscreenshots)** | Remove access to Firefox Screenshots.
  50 | **[`DisableFirefoxStudies`](#disablefirefoxstudies)** | Disable Firefox studies (Shield).
  51 | **[`DisableForgetButton`](#disableforgetbutton)** | Disable the "Forget" button.
  52 | **[`DisableFormHistory`](#disableformhistory)** | Turn off saving information on web forms and the search bar.
  53 | **[`DisableMasterPasswordCreation`](#disablemasterpasswordcreation)** | Remove the master password functionality.
  54 | **[`DisablePasswordReveal`](#disablepasswordreveal)** | Do not allow passwords to be revealed in saved logins.
  55 | **[`DisablePocket`](#disablepocket)** | Remove Pocket in the Firefox UI.
  56 | **[`DisablePrivateBrowsing`](#disableprivatebrowsing)** | Remove access to private browsing.
  57 | **[`DisableProfileImport`](#disableprofileimport)** | Disables the "Import data from another browser" option in the bookmarks window.
  58 | **[`DisableProfileRefresh`](#disableprofilerefresh)** | Disable the Refresh Firefox button on about:support and support.mozilla.org
  59 | **[`DisableSafeMode`](#disablesafemode)** | Disable safe mode within the browser.
  60 | **[`DisableSecurityBypass`](#disablesecuritybypass)** | Prevent the user from bypassing security in certain cases.
  61 | **[`DisableSetDesktopBackground`](#disablesetdesktopbackground)** | Remove the "Set As Desktop Background..." menuitem when right clicking on an image.
  62 | **[`DisableSystemAddonUpdate`](#disablesystemaddonupdate)** | Prevent system add-ons from being installed or updated.
  63 | **[`DisableTelemetry`](#disabletelemetry)** | DisableTelemetry
  64 | **[`DisableThirdPartyModuleBlocking`](#disablethirdpartymoduleblocking)** | Do not allow blocking third-party modules.
  65 | **[`DisplayBookmarksToolbar`](#displaybookmarkstoolbar)** | Set the initial state of the bookmarks toolbar.
  66 | **[`DisplayMenuBar`](#displaymenubar)** | Set the state of the menubar.
  67 | **[`DNSOverHTTPS`](#dnsoverhttps)** | Configure DNS over HTTPS.
  68 | **[`DontCheckDefaultBrowser`](#dontcheckdefaultbrowser)** | Don't check if Firefox is the default browser at startup.
  69 | **[`DownloadDirectory`](#downloaddirectory)** | Set and lock the download directory.
  70 | **[`EnableTrackingProtection`](#enabletrackingprotection)** | Configure tracking protection.
  71 | **[`EncryptedMediaExtensions`](#encryptedmediaextensions)** | Enable or disable Encrypted Media Extensions and optionally lock it.
  72 | **[`EnterprisePoliciesEnabled`](#enterprisepoliciesenabled)** | Enable policy support on macOS.
  73 | **[`ExemptDomainFileTypePairsFromFileTypeDownloadWarnings`](#exemptdomainfiletypepairsfromfiletypedownloadwarnings)** | Disable warnings based on file extension for specific file types on domains.
  74 | **[`Extensions`](#extensions)** | Control the installation, uninstallation and locking of extensions.
  75 | **[`ExtensionSettings`](#extensionsettings)** | Manage all aspects of extensions.
  76 | **[`ExtensionUpdate`](#extensionupdate)** | Control extension updates.
  77 | **[`FirefoxHome`](#firefoxhome)** | Customize the Firefox Home page.
  78 | **[`FirefoxSuggest`](#firefoxsuggest)** | Customize Firefox Suggest.
  79 | **[`GoToIntranetSiteForSingleWordEntryInAddressBar`](#gotointranetsiteforsinglewordentryinaddressbar)** | Force direct intranet site navigation instead of searching when typing single word entries in the address bar.
  80 | **[`Handlers`](#handlers)** | Configure default application handlers.
  81 | **[`HardwareAcceleration`](#hardwareacceleration)** | Control hardware acceleration.
  82 | **[`Homepage`](#homepage)** | Configure the default homepage and how Firefox starts.
  83 | **[`HttpAllowlist`](#httpallowlist)** | Configure origins that will not be upgraded to HTTPS.
  84 | **[`HttpsOnlyMode`](#httpsonlymode)** | Configure HTTPS-Only Mode.
  85 | **[`InstallAddonsPermission`](#installaddonspermission)** | Configure the default extension install policy as well as origins for extension installs are allowed.
  86 | **[`LegacyProfiles`](#legacyprofiles)** | Disable the feature enforcing a separate profile for each installation.
  87 | **[`LegacySameSiteCookieBehaviorEnabled`](#legacysamesitecookiebehaviorenabled)** | Enable default legacy SameSite cookie behavior setting.
  88 | **[`LegacySameSiteCookieBehaviorEnabledForDomainList`](#legacysamesitecookiebehaviorenabledfordomainlist)** | Revert to legacy SameSite behavior for cookies on specified sites.
  89 | **[`LocalFileLinks`](#localfilelinks)** | Enable linking to local files by origin.
  90 | **[`ManagedBookmarks`](#managedbookmarks)** | Configures a list of bookmarks managed by an administrator that cannot be changed by the user.
  91 | **[`ManualAppUpdateOnly`](#manualappupdateonly)** | Allow manual updates only and do not notify the user about updates.
  92 | **[`NetworkPrediction`](#networkprediction)** | Enable or disable network prediction (DNS prefetching).
  93 | **[`NewTabPage`](#newtabpage)** | Enable or disable the New Tab page.
  94 | **[`NoDefaultBookmarks`](#nodefaultbookmarks)** | Disable the creation of default bookmarks.
  95 | **[`OfferToSaveLogins`](#offertosavelogins)** | Control whether or not Firefox offers to save passwords.
  96 | **[`OfferToSaveLoginsDefault`](#offertosaveloginsdefault)** | Set the default value for whether or not Firefox offers to save passwords.
  97 | **[`OverrideFirstRunPage`](#overridefirstrunpage)** | Override the first run page.
  98 | **[`OverridePostUpdatePage`](#overridepostupdatepage)** | Override the upgrade page.
  99 | **[`PasswordManagerEnabled`](#passwordmanagerenabled)** | Remove (some) access to the password manager.
 100 | **[`PasswordManagerExceptions`](#passwordmanagerexceptions)** | Prevent Firefox from saving passwords for specific sites.
 101 | **[`PDFjs`](#pdfjs)** | Disable or configure PDF.js, the built-in PDF viewer.
 102 | **[`Permissions`](#permissions)** | Set permissions associated with camera, microphone, location, and notifications.
 103 | **[`PictureInPicture`](#pictureinpicture)** | Enable or disable Picture-in-Picture.
 104 | **[`PopupBlocking`](#popupblocking)** | Configure the default pop-up window policy as well as origins for which pop-up windows are allowed.
 105 | **[`PostQuantumKeyAgreementEnabled`](#postquantumkeyagreementenabled)** | Enable post-quantum key agreement for TLS.
 106 | **[`Preferences`](#preferences)** | Set and lock preferences.
 107 | **[`PrimaryPassword`](#primarypassword)** | Require or prevent using a primary (formerly master) password.
 108 | **[`PrintingEnabled`](#printingenabled)** | Enable or disable printing.
 109 | **[`PromptForDownloadLocation`](#promptfordownloadlocation)** | Ask where to save each file before downloading.
 110 | **[`Proxy`](#proxy)** | Configure proxy settings.
 111 | **[`RequestedLocales`](#requestedlocales)** | Set the the list of requested locales for the application in order of preference.
 112 | **[`SanitizeOnShutdown` (All)](#sanitizeonshutdown-all)** | Clear all data on shutdown.
 113 | **[`SanitizeOnShutdown` (Selective)](#sanitizeonshutdown-selective)** | Clear data on shutdown.
 114 | **[`SearchBar`](#searchbar)** | Set whether or not search bar is displayed.
 115 | **[`SearchEngines`](#searchengines-this-policy-is-only-available-on-the-esr)** |
 116 | **[`SearchEngines -> Add`](#searchengines--add)** | Add new search engines.
 117 | **[`SearchEngines -> Default`](#searchengines--default)** | Set the default search engine.
 118 | **[`SearchEngines -> PreventInstalls`](#searchengines--preventinstalls)** | Prevent installing search engines from webpages.
 119 | **[`SearchEngines -> Remove`](#searchengines--remove)** | Hide built-in search engines.
 120 | **[`SearchSuggestEnabled`](#searchsuggestenabled)** | Enable search suggestions.
 121 | **[`SecurityDevices`](#securitydevices)** | Install PKCS #11 modules.
 122 | **[`ShowHomeButton`](#showhomebutton)** | Show the home button on the toolbar.
 123 | **[`SSLVersionMax`](#sslversionmax)** | Set and lock the maximum version of TLS.
 124 | **[`SSLVersionMin`](#sslversionmin)** | Set and lock the minimum version of TLS.
 125 | **[`StartDownloadsInTempDirectory`](#startdownloadsintempdirectory)** | Force downloads to start off in a local, temporary location rather than the default download directory.
 126 | **[`SupportMenu`](#supportmenu)** | Add a menuitem to the help menu for specifying support information.
 127 | **[`TranslateEnabled`](#translateenabled)** | Enable or disable webpage translation.
 128 | **[`UserMessaging`](#usermessaging)** | Don't show certain messages to the user.
 129 | **[`UseSystemPrintDialog`](#usesystemprintdialog)** | Print using the system print dialog instead of print preview.
 130 | **[`WebsiteFilter`](#websitefilter)** | Block websites from being visited.
 131 | **[`WindowsSSO`](#windowssso)** | Allow Windows single sign-on for Microsoft, work, and school accounts.
 132
 133 ### 3rdparty
 134
 135 Allow WebExtensions to configure policy. For more information, see [Adding policy support to your extension](https://extensionworkshop.com/documentation/enterprise/enterprise-development/#how-to-add-policy).
 136
 137 For GPO and Intune, the extension developer should provide an ADMX file.
 138
 139 **Compatibility:** Firefox 68\
 140 **CCK2 Equivalent:** N/A\
 141 **Preferences Affected:** N/A
 142
 143 #### macOS
 144 ```
 145 <dict>
 146   <key>3rdparty</key>
 147   <dict>
 148     <key>Extensions</key>
 149     <dict>
 150       <key>uBlock0@raymondhill.net</key>
 151       <dict>
 152         <key>adminSettings</key>
 153         <dict>
 154           <key>selectedFilterLists</key>
 155           <array>
 156             <string>ublock-privacy</string>
 157             <string>ublock-badware</string>
 158             <string>ublock-filters</string>
 159             <string>user-filters</string>
 160           </array>
 161         </dict>
 162       </dict>
 163     </dict>
 164   </dict>
 165 </dict>
 166 ```
 167 #### policies.json
 168 ```
 169 {
 170   "policies": {
 171     "3rdparty": {
 172       "Extensions": {
 173         "uBlock0@raymondhill.net": {
 174           "adminSettings": {
 175             "selectedFilterLists": [
 176               "ublock-privacy",
 177               "ublock-badware",
 178               "ublock-filters",
 179               "user-filters"
 180             ]
 181           }
 182         }
 183       }
 184     }
 185   }
 186 }
 187 ```
 188
 189 ### AllowedDomainsForApps
 190
 191 Define domains allowed to access Google Workspace.
 192
 193 This policy is based on the [Chrome policy](https://chromeenterprise.google/policies/#AllowedDomainsForApps) of the same name.
 194
 195 If this policy is enabled, users can only access Google Workspace using accounts from the specified domains. If you want to allow Gmail, you can add ```consumer_accounts``` to the list.
 196
 197 **Compatibility:** Firefox 89, Firefox ESR 78.11\
 198 **CCK2 Equivalent:** N/A\
 199 **Preferences Affected:** N/A
 200
 201 #### Windows (GPO)
 202 ```
 203 Software\Policies\Mozilla\Firefox\AllowedDomainsForApps = "managedfirefox.com,example.com"
 204 ```
 205 #### Windows (Intune)
 206 OMA-URI:
 207 ```
 208 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox/AllowedDomainsForApps
 209 ```
 210 Value (string):
 211 ```
 212 <enabled/>
 213 <data id="AllowedDomainsForApps" value="managedfirefox.com,example.com"/>
 214 ```
 215 #### macOS
 216 ```
 217 <dict>
 218   <key>AllowedDomainsForApps</key>
 219   <string>managedfirefox.com,example.com</string>
 220 </dict>
 221 ```
 222 #### policies.json
 223 ```
 224 {
 225   "policies": {
 226     "AllowedDomainsForApps": "managedfirefox.com,example.com"
 227   }
 228 }
 229 ```
 230 ### AllowFileSelectionDialogs
 231
 232 Enable or disable file selection dialogs.
 233
 234 **Compatibility:** Firefox 124\
 235 **CCK2 Equivalent:** N/A\
 236 **Preferences Affected:** `widget.disable_file_pickers`
 237
 238 #### Windows (GPO)
 239 ```
 240 Software\Policies\Mozilla\Firefox\AllowFileSelectionDialogs = 0x1 | 0x0
 241 ```
 242 #### Windows (Intune)
 243 OMA-URI:
 244 ```
 245 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox/AppAutoAllowFileSelectionDialogsUpdate
 246 ```
 247 Value (string):
 248 ```
 249 <enabled/> or <disabled/>
 250 ```
 251 #### macOS
 252 ```
 253 <dict>
 254   <key>AllowFileSelectionDialogs</key>
 255   <true/> | <false/>
 256 </dict>
 257 ```
 258 #### policies.json
 259 ```
 260 {
 261   "policies": {
 262     "AllowFileSelectionDialogs": true | false
 263   }
 264 }
 265 ```
 266 ### AppAutoUpdate
 267
 268 Enable or disable **automatic** application update.
 269
 270 If set to true, application updates are installed without user approval within Firefox. The operating system might still require approval.
 271
 272 If set to false, application updates are downloaded but the user can choose when to install the update.
 273
 274 If you have disabled updates via `DisableAppUpdate`, this policy has no effect.
 275
 276 **Compatibility:** Firefox 75, Firefox ESR 68.7\
 277 **CCK2 Equivalent:** N/A\
 278 **Preferences Affected:** `app.update.auto`
 279
 280 #### Windows (GPO)
 281 ```
 282 Software\Policies\Mozilla\Firefox\AppAutoUpdate = 0x1 | 0x0
 283 ```
 284 #### Windows (Intune)
 285 OMA-URI:
 286 ```
 287 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox/AppAutoUpdate
 288 ```
 289 Value (string):
 290 ```
 291 <enabled/> or <disabled/>
 292 ```
 293 #### macOS
 294 ```
 295 <dict>
 296   <key>AppAutoUpdate</key>
 297   <true/> | <false/>
 298 </dict>
 299 ```
 300 #### policies.json
 301 ```
 302 {
 303   "policies": {
 304     "AppAutoUpdate": true | false
 305   }
 306 }
 307 ```
 308 ### AppUpdatePin
 309
 310 Prevent Firefox from being updated beyond the specified version.
 311
 312 You can specify the any version as ```xx.``` and Firefox will be updated with all minor versions, but will not be updated beyond the major version.
 313
 314 You can also specify the version as ```xx.xx``` and Firefox will be updated with all patch versions, but will not be updated beyond the minor version.
 315
 316 You should specify a version that exists or is guaranteed to exist. If you specify a version that doesn't end up existing, Firefox will update beyond that version.
 317
 318 **Compatibility:** Firefox 102,\
 319 **CCK2 Equivalent:** N/A\
 320 **Preferences Affected:** N/A
 321
 322 #### Windows (GPO)
 323 ```
 324 Software\Policies\Mozilla\Firefox\AppUpdatePin = "106."
 325 ```
 326 #### Windows (Intune)
 327 OMA-URI:
 328 ```
 329 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox/AppUpdatePin
 330 ```
 331 Value (string):
 332 ```
 333 <enabled/>
 334 <data id="AppUpdatePin" value="106."/>
 335 ```
 336 #### macOS
 337 ```
 338 <dict>
 339   <key>AppUpdatePin</key>
 340   <string>106.</string>
 341 </dict>
 342 ```
 343 #### policies.json
 344 ```
 345 {
 346   "policies": {
 347     "AppUpdatePin": "106."
 348   }
 349 }
 350 ```
 351 ### AppUpdateURL
 352
 353 Change the URL for application update if you are providing Firefox updates from a custom update server.
 354
 355 **Compatibility:** Firefox 62, Firefox ESR 60.2\
 356 **CCK2 Equivalent:** N/A\
 357 **Preferences Affected:** `app.update.url`
 358
 359 #### Windows (GPO)
 360 ```
 361 Software\Policies\Mozilla\Firefox\AppUpdateURL = "https://yoursite.com"
 362 ```
 363 #### Windows (Intune)
 364 OMA-URI:
 365 ```
 366 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox/AppUpdateURL
 367 ```
 368 Value (string):
 369 ```
 370 <enabled/>
 371 <data id="AppUpdateURL" value="https://yoursite.com"/>
 372 ```
 373 #### macOS
 374 ```
 375 <dict>
 376   <key>AppUpdateURL</key>
 377   <string>https://yoursite.com</string>
 378 </dict>
 379 ```
 380 #### policies.json
 381 ```
 382 {
 383   "policies": {
 384     "AppUpdateURL": "https://yoursite.com"
 385   }
 386 }
 387 ```
 388 ### Authentication
 389
 390 Configure sites that support integrated authentication.
 391
 392 See [Integrated authentication](https://htmlpreview.github.io/?https://github.com/mdn/archived-content/blob/main/files/en-us/mozilla/integrated_authentication/raw.html) for more information.
 393
 394 `PrivateBrowsing` enables integrated authentication in private browsing.
 395
 396 **Compatibility:** Firefox 60, Firefox ESR 60 (AllowNonFQDN added in 62/60.2, AllowProxies added in 70/68.2, Locked added in 71/68.3, PrivateBrowsing added in 77/68.9)\
 397 **CCK2 Equivalent:** N/A\
 398 **Preferences Affected:** `network.negotiate-auth.trusted-uris`,`network.negotiate-auth.delegation-uris`,`network.automatic-ntlm-auth.trusted-uris`,`network.automatic-ntlm-auth.allow-non-fqdn`,`network.negotiate-auth.allow-non-fqdn`,`network.automatic-ntlm-auth.allow-proxies`,`network.negotiate-auth.allow-proxies`,`network.auth.private-browsing-sso`
 399
 400 #### Windows (GPO)
 401 ```
 402 Software\Policies\Mozilla\Firefox\Authentication\SPNEGO\1 = "mydomain.com"
 403 Software\Policies\Mozilla\Firefox\Authentication\SPNEGO\2 = "https://myotherdomain.com"
 404 Software\Policies\Mozilla\Firefox\Authentication\Delegated\1 = "mydomain.com"
 405 Software\Policies\Mozilla\Firefox\Authentication\Delegated\2 = "https://myotherdomain.com"
 406 Software\Policies\Mozilla\Firefox\Authentication\NTLM\1 = "mydomain.com"
 407 Software\Policies\Mozilla\Firefox\Authentication\NTLM\2 = "https://myotherdomain.com"
 408 Software\Policies\Mozilla\Firefox\Authentication\AllowNonFQDN\SPNEGO = 0x1 | 0x0
 409 Software\Policies\Mozilla\Firefox\Authentication\AllowNonFQDN\NTLM = 0x1 | 0x0
 410 Software\Policies\Mozilla\Firefox\Authentication\AllowProxies\SPNEGO = 0x1 | 0x0
 411 Software\Policies\Mozilla\Firefox\Authentication\AllowProxies\NTLM = 0x1 | 0x0
 412 Software\Policies\Mozilla\Firefox\Authentication\Locked = 0x1 | 0x0
 413 Software\Policies\Mozilla\Firefox\Authentication\PrivateBrowsing = 0x1 | 0x0
 414 ```
 415 #### Windows (Intune)
 416 OMA-URI:
 417 ```
 418 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~Authentication/Authentication_SPNEGO
 419 ```
 420 Value (string):
 421 ```
 422 <enabled/>
 423 <data id="Authentication" value="1&#xF000;mydomain&#xF000;2&#xF000;https://myotherdomain.com"/>
 424 ```
 425 OMA-URI:
 426 ```
 427 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~Authentication/Authentication_Delegated
 428 ```
 429 Value (string):
 430 ```
 431 <enabled/>
 432 <data id="Authentication" value="1&#xF000;mydomain&#xF000;2&#xF000;https://myotherdomain.com"/>
 433 ```
 434 OMA-URI:
 435 ```
 436 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~Authentication/Authentication_NTLM
 437 ```
 438 Value (string):
 439 ```
 440 <enabled/>
 441 <data id="Authentication" value="1&#xF000;mydomain&#xF000;2&#xF000;https://myotherdomain.com"/>
 442 ```
 443 OMA-URI:
 444 ```
 445 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~Authentication/Authentication_AllowNonFQDN
 446 ```
 447 Value (string):
 448 ```
 449 <enabled/>
 450 <data id="Authentication_AllowNonFQDN_NTLM" value="true | false"/>
 451 <data id="Authentication_AllowNonFQDN_SPNEGO" value="true | false"/>
 452 ```
 453 OMA-URI:
 454 ```
 455 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~Authentication/Authentication_Locked
 456 ```
 457 Value (string):
 458 ```
 459 <enabled/> or <disabled/>
 460 ```
 461 OMA-URI:
 462 ```
 463 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~Authentication/Authentication_PrivateBrowsing
 464 ```
 465 Value (string):
 466 ```
 467 <enabled/> or <disabled/>
 468 ```
 469 #### macOS
 470 ```
 471 <dict>
 472   <key>Authentication</key>
 473   <dict>
 474     <key>SPNEGO</key>
 475     <array>
 476       <string>mydomain.com</string>
 477       <string>https://myotherdomain.com</string>
 478     </array>
 479     <key>Delegated</key>
 480     <array>
 481       <string>mydomain.com</string>
 482       <string>https://myotherdomain.com</string>
 483     </array>
 484     <key>NTLM</key>
 485     <array>
 486       <string>mydomain.com</string>
 487       <string>https://myotherdomain.com</string>
 488     </array>
 489     <key>AllowNonFQDN</key>
 490       <dict>
 491       <key>SPNEGO</key>
 492       <true/> | <false/>
 493       <key>NTLM</key>
 494       <true/> | <false/>
 495     </dict>
 496     <key>AllowProxies</key>
 497       <dict>
 498       <key>SPNEGO</key>
 499       <true/> | <false/>
 500       <key>NTLM</key>
 501       <true/> | <false/>
 502     </dict>
 503     <key>Locked</key>
 504     <true/> | <false/>
 505     <key>PrivateBrowsing</key>
 506     <true/> | <false/>
 507   </dict>
 508 </dict>
 509 ```
 510 #### policies.json
 511 ```
 512 {
 513   "policies": {
 514     "Authentication": {
 515       "SPNEGO": ["mydomain.com", "https://myotherdomain.com"],
 516       "Delegated": ["mydomain.com", "https://myotherdomain.com"],
 517       "NTLM": ["mydomain.com", "https://myotherdomain.com"],
 518       "AllowNonFQDN": {
 519         "SPNEGO": true | false,
 520         "NTLM": true | false
 521       },
 522       "AllowProxies": {
 523         "SPNEGO": true | false,
 524         "NTLM": true | false
 525       },
 526       "Locked": true | false,
 527       "PrivateBrowsing": true | false
 528     }
 529   }
 530 }
 531 ```
 532 ### AutofillAddressEnabled
 533
 534 Enables or disables autofill for addresses.
 535
 536 This only applies when address autofill is enabled for a particular Firefox version or region. See [this page](https://support.mozilla.org/kb/automatically-fill-your-address-web-forms) for more information.
 537
 538 **Compatibility:** Firefox 125, Firefox ESR 115.10\
 539 **CCK2 Equivalent:** N/A\
 540 **Preferences Affected:** `extensions.formautofill.addresses.enabled`
 541
 542 #### Windows (GPO)
 543 ```
 544 Software\Policies\Mozilla\Firefox\AutofillAddressEnabled = 0x1 | 0x0
 545 ```
 546 #### Windows (Intune)
 547 OMA-URI:
 548 ```
 549 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox/AutofillAddressEnabled
 550 ```
 551 Value (string):
 552 ```
 553 <enabled/> or <disabled/>
 554 ```
 555 #### macOS
 556 ```
 557 <dict>
 558   <key>AutofillAddressEnabled</key>
 559   <true/> | <false/>
 560 </dict>
 561 ```
 562 #### policies.json
 563 ```
 564 {
 565   "policies": {
 566     "AutofillAddressEnabled": true | false
 567   }
 568 }
 569 ```
 570 ### AutofillCreditCardEnabled
 571
 572 Enables or disables autofill for payment methods.
 573
 574 This only applies when payment method autofill is enabled for a particular Firefox version or region. See [this page](https://support.mozilla.org/kb/credit-card-autofill) for more information.
 575
 576 **Compatibility:** Firefox 125, Firefox ESR 115.10\
 577 **CCK2 Equivalent:** N/A\
 578 **Preferences Affected:** `extensions.formautofill.creditCards.enabled`
 579
 580 #### Windows (GPO)
 581 ```
 582 Software\Policies\Mozilla\Firefox\AutofillCreditCardEnabled = 0x1 | 0x0
 583 ```
 584 #### Windows (Intune)
 585 OMA-URI:
 586 ```
 587 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox/AutofillCreditCardEnabled
 588 ```
 589 Value (string):
 590 ```
 591 <enabled/> or <disabled/>
 592 ```
 593 #### macOS
 594 ```
 595 <dict>
 596   <key>AutofillCreditCardEnabled</key>
 597   <true/> | <false/>
 598 </dict>
 599 ```
 600 #### policies.json
 601 ```
 602 {
 603   "policies": {
 604     "AutofillCreditCardEnabled": true | false
 605   }
 606 }
 607 ```
 608 ### AutoLaunchProtocolsFromOrigins
 609 Define a list of external protocols that can be used from listed origins without prompting the user. The origin is the scheme plus the hostname.
 610
 611 The syntax of this policy is exactly the same as the [Chrome AutoLaunchProtocolsFromOrigins policy](https://cloud.google.com/docs/chrome-enterprise/policies/?policy=AutoLaunchProtocolsFromOrigins) except that you can only use valid origins (not just hostnames). This also means that you cannot specify an asterisk for all origins.
 612
 613 The schema is:
 614 ```
 615 {
 616  "items": {
 617   "properties": {
 618    "allowed_origins": {
 619     "items": {
 620      "type": "string"
 621     },
 622     "type": "array"
 623    },
 624    "protocol": {
 625     "type": "string"
 626    }
 627   },
 628   "required": [
 629    "protocol",
 630    "allowed_origins"
 631   ],
 632   "type": "object"
 633  },
 634  "type": "array"
 635 }
 636 ```
 637 **Compatibility:** Firefox 90, Firefox ESR 78.12\
 638 **CCK2 Equivalent:** N/A\
 639 **Preferences Affected:** N/A
 640
 641 #### Windows (GPO)
 642 Software\Policies\Mozilla\Firefox\AutoLaunchProtocolsFromOrigins (REG_MULTI_SZ) =
 643 ```
 644 [
 645   {
 646     "protocol": "zoommtg",
 647     "allowed_origins": [
 648       "https://somesite.zoom.us"
 649     ]
 650   }
 651 ]
 652 ```
 653 #### Windows (Intune)
 654 OMA-URI:
 655 ```
 656 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox/AutoLaunchProtocolsFromOrigins
 657 ```
 658 Value (string):
 659 ```
 660 <enabled/>
 661 <data id="JSON" value='
 662 [
 663   {
 664     "protocol": "zoommtg",
 665     "allowed_origins": [
 666       "https://somesite.zoom.us"
 667     ]
 668   }
 669 ]'/>
 670 ```
 671 If you are using custom ADMX and ADML administrative templates in Intune, you can use this OMA-URI instead
 672 to workaround the limit on the length of strings. Put all of your JSON on one line.
 673
 674 OMA-URI:
 675 ```
 676 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~Extensions/AutoLaunchProtocolsFromOriginsOneLine
 677 ```
 678 Value (string):
 679 ```
 680 <enabled/>
 681 <data id="JSONOneLine" value='[]'/>
 682 ```
 683 #### macOS
 684 ```
 685 <dict>
 686   <key>AutoLaunchProtocolsFromOrigins</key>
 687   <array>
 688     <dict>
 689       <key>protocol</key>
 690       <string>zoommtg</string>
 691       <key>allowed_origins</key>
 692       <array>
 693         <string>https://somesite.zoom.us</string>
 694       </array>
 695     </dict>
 696   </array>
 697 </dict>
 698 ```
 699 #### policies.json
 700 ```
 701 {
 702   "policies": {
 703     "AutoLaunchProtocolsFromOrigins": [{
 704       "protocol": "zoommtg",
 705       "allowed_origins": [
 706         "https://somesite.zoom.us"
 707       ]
 708     }]
 709   }
 710 }
 711 ```
 712 ### BackgroundAppUpdate
 713
 714 Enable or disable **automatic** application update **in the background**, when the application is not running.
 715
 716 If set to true, application updates may be installed (without user approval) in the background, even when the application is not running. The operating system might still require approval.
 717
 718 If set to false, the application will not try to install updates when the application is not running.
 719
 720 If you have disabled updates via `DisableAppUpdate` or disabled automatic updates via `AppAutoUpdate`, this policy has no effect.
 721
 722 If you are having trouble getting the background task to run, verify your configuration with the ["Requirements to run" section in this support document](https://support.mozilla.org/en-US/kb/enable-background-updates-firefox-windows).
 723
 724 **Compatibility:** Firefox 90 (Windows only)\
 725 **CCK2 Equivalent:** N/A\
 726 **Preferences Affected:** `app.update.background.enabled`
 727
 728 #### Windows (GPO)
 729 ```
 730 Software\Policies\Mozilla\Firefox\BackgroundAppUpdate = 0x1 | 0x0
 731 ```
 732 #### Windows (Intune)
 733 OMA-URI:
 734 ```
 735 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox/BackgroundAppUpdate
 736 ```
 737 Value (string):
 738 ```
 739 <enabled/> or <disabled/>
 740 ```
 741 #### macOS
 742 ```
 743 <dict>
 744   <key>BackgroundAppUpdate</key>
 745   <true/> | <false/>
 746 </dict>
 747 ```
 748 #### policies.json
 749 ```
 750 {
 751   "policies": {
 752     "BackgroundAppUpdate": true | false
 753   }
 754 }
 755 ```
 756 ### BlockAboutAddons
 757
 758 Block access to the Add-ons Manager (about:addons).
 759
 760 **Compatibility:** Firefox 60, Firefox ESR 60\
 761 **CCK2 Equivalent:** `disableAddonsManager`\
 762 **Preferences Affected:** N/A
 763
 764 #### Windows (GPO)
 765 ```
 766 Software\Policies\Mozilla\Firefox\BlockAboutAddons = 0x1 | 0x0
 767 ```
 768 #### Windows (Intune)
 769 OMA-URI:
 770 ```
 771 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox/BlockAboutAddons
 772 ```
 773 Value (string):
 774 ```
 775 <enabled/> or <disabled/>
 776 ```
 777 #### macOS
 778 ```
 779 <dict>
 780   <key>BlockAboutAddons</key>
 781   <true/> | <false/>
 782 </dict>
 783 ```
 784 #### policies.json
 785 ```
 786 {
 787   "policies": {
 788     "BlockAboutAddons": true | false
 789   }
 790 }
 791 ```
 792 ### BlockAboutConfig
 793
 794 Block access to about:config.
 795
 796 **Compatibility:** Firefox 60, Firefox ESR 60\
 797 **CCK2 Equivalent:** `disableAboutConfig`\
 798 **Preferences Affected:** N/A
 799
 800 #### Windows (GPO)
 801 ```
 802 Software\Policies\Mozilla\Firefox\BlockAboutConfig = 0x1 | 0x0
 803 ```
 804 #### Windows (Intune)
 805 OMA-URI:
 806 ```
 807 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox/BlockAboutConfig
 808 ```
 809 Value (string):
 810 ```
 811 <enabled/> or <disabled/>
 812 ```
 813 #### macOS
 814 ```
 815 <dict>
 816   <key>BlockAboutConfig</key>
 817   <true/> | <false/>
 818 </dict>
 819 ```
 820 #### policies.json
 821 ```
 822 {
 823   "policies": {
 824     "BlockAboutConfig": true | false
 825   }
 826 }
 827 ```
 828 ### BlockAboutProfiles
 829
 830 Block access to About Profiles (about:profiles).
 831
 832 **Compatibility:** Firefox 60, Firefox ESR 60\
 833 **CCK2 Equivalent:** `disableAboutProfiles`\
 834 **Preferences Affected:** N/A
 835
 836 #### Windows (GPO)
 837 ```
 838 Software\Policies\Mozilla\Firefox\BlockAboutProfiles = 0x1 | 0x0
 839 ```
 840 #### Windows (Intune)
 841 OMA-URI:
 842 ```
 843 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox/BlockAboutProfiles
 844 ```
 845 Value (string):
 846 ```
 847 <enabled/> or <disabled/>
 848 ```
 849 #### macOS
 850 ```
 851 <dict>
 852   <key>BlockAboutProfiles</key>
 853   <true/> | <false/>
 854 </dict>
 855 ```
 856 #### policies.json
 857 ```
 858 {
 859   "policies": {
 860     "BlockAboutProfiles": true | false
 861   }
 862 }
 863 ```
 864 ### BlockAboutSupport
 865
 866 Block access to Troubleshooting Information (about:support).
 867
 868 **Compatibility:** Firefox 60, Firefox ESR 60\
 869 **CCK2 Equivalent:** `disableAboutSupport`\
 870 **Preferences Affected:** N/A
 871
 872 #### Windows (GPO)
 873 ```
 874 Software\Policies\Mozilla\Firefox\BlockAboutSupport = 0x1 | 0x0
 875 ```
 876 #### Windows (Intune)
 877 OMA-URI:
 878 ```
 879 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox/BlockAboutSupport
 880 ```
 881 Value (string):
 882 ```
 883 <enabled/> or <disabled/>
 884 ```
 885 #### macOS
 886 ```
 887 <dict>
 888   <key>BlockAboutSupport</key>
 889   <true/> | <false/>
 890 </dict>
 891 ```
 892 #### policies.json
 893 ```
 894 {
 895   "policies": {
 896     "BlockAboutSupport": true | false
 897   }
 898 }
 899 ```
 900 ### Bookmarks
 901
 902 Note: [`ManagedBookmarks`](#managedbookmarks) is the new recommended way to add bookmarks. This policy will continue to be supported.
 903
 904 Add bookmarks in either the bookmarks toolbar or menu. Only `Title` and `URL` are required. If `Placement` is not specified, the bookmark will be placed on the toolbar. If `Folder` is specified, it is automatically created and bookmarks with the same folder name are grouped together.
 905
 906 If you want to clear all bookmarks set with this policy, you can set the value to an empty array (```[]```). This can be on Windows via the new Bookmarks (JSON) policy available with GPO and Intune.
 907
 908 **Compatibility:** Firefox 60, Firefox ESR 60\
 909 **CCK2 Equivalent:** `bookmarks.toolbar`,`bookmarks.menu`\
 910 **Preferences Affected:** N/A
 911
 912 #### Windows (GPO)
 913 ```
 914 Software\Policies\Mozilla\Firefox\Bookmarks\1\Title = "Example"
 915 Software\Policies\Mozilla\Firefox\Bookmarks\1\URL = "https://example.com"
 916 Software\Policies\Mozilla\Firefox\Bookmarks\1\Favicon = "https://example.com/favicon.ico"
 917 Software\Policies\Mozilla\Firefox\Bookmarks\1\Placement = "toolbar" | "menu"
 918 Software\Policies\Mozilla\Firefox\Bookmarks\1\Folder = "FolderName"
 919
 920 Software\Policies\Mozilla\Firefox\Bookmarks (REG_MULTI_SZ) =
 921 ```
 922 []
 923 ```
 924
 925 ```
 926 #### Windows (Intune)
 927 OMA-URI:
 928 ```
 929 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~Bookmarks/Bookmark01
 930 ```
 931 Value (string):
 932 ```
 933 <enabled/>
 934 <data id="BookmarkTitle" value="Example"/>
 935 <data id="BookmarkURL" value="https://example.com"/>
 936 <data id="BookmarkFavicon" value="https://example.com/favicon.ico"/>
 937 <data id="BookmarkPlacement" value="toolbar | menu"/>
 938 <data id="BookmarkFolder" value="FolderName"/>
 939 ```
 940 OMA-URI:
 941 ```
 942 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox/Bookmarks
 943 ```
 944 Value (string):
 945 ```
 946 <enabled/>
 947 <data id="JSON" value='[]'/>
 948 ```
 949 If you are using custom ADMX and ADML administrative templates in Intune, you can use this OMA-URI instead
 950 to workaround the limit on the length of strings. Put all of your JSON on one line.
 951
 952 OMA-URI:
 953 ```
 954 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~Extensions/BookmarksOneLine
 955 ```
 956 Value (string):
 957 ```
 958 <enabled/>
 959 <data id="JSONOneLine" value='[]'/>
 960 ```
 961 #### macOS
 962 ```
 963 <dict>
 964   <key>Bookmarks</key>
 965   <array>
 966     <dict>
 967       <key>Title</key>
 968       <string>Example</string>
 969       <key>URL</key>
 970       <string>https://example.com</string>
 971       <key>Favicon</key>
 972       <string>https://example.com/favicon.ico</string>
 973       <key>Placement</key>
 974       <string>toolbar | menu</string>
 975       <key>Folder</key>
 976       <string>FolderName</string>
 977     </dict>
 978   </array>
 979 </dict>
 980 ```
 981 #### policies.json
 982 ```
 983 {
 984   "policies": {
 985     "Bookmarks": [
 986       {
 987         "Title": "Example",
 988         "URL": "https://example.com",
 989         "Favicon": "https://example.com/favicon.ico",
 990         "Placement": "toolbar" | "menu",
 991         "Folder": "FolderName"
 992       }
 993     ]
 994   }
 995 }
 996 ```
 997 ### CaptivePortal
 998 Enable or disable the detection of captive portals.
 999
1000 **Compatibility:** Firefox 67, Firefox ESR 60.7\
1001 **CCK2 Equivalent:** N/A\
1002 **Preferences Affected:** `network.captive-portal-service.enabled`
1003
1004 #### Windows (GPO)
1005 ```
1006 Software\Policies\Mozilla\Firefox\CaptivePortal = 0x1 | 0x0
1007 ```
1008 #### Windows (Intune)
1009 OMA-URI:
1010 ```
1011 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox/CaptivePortal
1012 ```
1013 Value (string):
1014 ```
1015 <enabled/> or <disabled/>
1016 ```
1017 #### macOS
1018 ```
1019 <dict>
1020   <key>CaptivePortal</key>
1021   <true/> | <false/>
1022 </dict>
1023 ```
1024 #### policies.json
1025 ```
1026 {
1027   "policies": {
1028     "CaptivePortal": true | false
1029   }
1030 }
1031 ```
1032 ### Certificates
1033
1034 ### Certificates | ImportEnterpriseRoots
1035
1036 Trust certificates that have been added to the operating system certificate store by a user or administrator.
1037
1038 Note: This policy only works on Windows and macOS. For Linux discussion, see [bug 1600509](https://bugzilla.mozilla.org/show_bug.cgi?id=1600509).
1039
1040 See https://support.mozilla.org/kb/setting-certificate-authorities-firefox for more detail.
1041
1042 **Compatibility:** Firefox 60, Firefox ESR 60 (macOS support in Firefox 63, Firefox ESR 68)\
1043 **CCK2 Equivalent:** N/A\
1044 **Preferences Affected:** `security.enterprise_roots.enabled`
1045
1046 #### Windows (GPO)
1047 ```
1048 Software\Policies\Mozilla\Firefox\Certificates\ImportEnterpriseRoots = 0x1 | 0x0
1049 ```
1050 #### Windows (Intune)
1051 OMA-URI:
1052 ```
1053 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~Certificates/Certificates_ImportEnterpriseRoots
1054 ```
1055 Value (string):
1056 ```
1057 <enabled/> or <disabled/>
1058 ```
1059 #### macOS
1060 ```
1061 <dict>
1062   <key>Certificates</key>
1063   <dict>
1064     <key>ImportEnterpriseRoots</key>
1065     <true/> | <false/>
1066   </dict>
1067 </dict>
1068 ```
1069 #### policies.json
1070 ```
1071 {
1072   "policies": {
1073     "Certificates": {
1074       "ImportEnterpriseRoots": true | false
1075     }
1076   }
1077 }
1078 ```
1079 ### Certificates | Install
1080
1081 Install certificates into the Firefox certificate store. If only a filename is specified, Firefox searches for the file in the following locations:
1082
1083 - Windows
1084   - %USERPROFILE%\AppData\Local\Mozilla\Certificates
1085   - %USERPROFILE%\AppData\Roaming\Mozilla\Certificates
1086 - macOS
1087   - /Library/Application Support/Mozilla/Certificates
1088   - ~/Library/Application Support/Mozilla/Certificates
1089 - Linux
1090   - /usr/lib/mozilla/certificates
1091   - /usr/lib64/mozilla/certificates
1092   - ~/.mozilla/certificates
1093
1094 Starting with Firefox 65, Firefox 60.5 ESR, a fully qualified path can be used, including UNC paths. You should use the native path style for your operating system. We do not support using %USERPROFILE% or other environment variables on Windows.
1095
1096 If you are specifying the path in the policies.json file on Windows, you need to escape your backslashes (`\\`) which means that for UNC paths, you need to escape both (`\\\\`). If you use group policy, you only need one backslash.
1097
1098 Certificates are installed using the trust string `CT,CT,`.
1099
1100 Binary (DER) and ASCII (PEM) certificates are both supported.
1101
1102 **Compatibility:** Firefox 64, Firefox ESR 64\
1103 **CCK2 Equivalent:** `certs.ca`\
1104 **Preferences Affected:** N/A
1105
1106 #### Windows (GPO)
1107 ```
1108 Software\Policies\Mozilla\Firefox\Certificates\Install\1 = "cert1.der"
1109 Software\Policies\Mozilla\Firefox\Certificates\Install\2 = "C:\Users\username\cert2.pem"
1110 ```
1111 #### Windows (Intune)
1112 OMA-URI:
1113 ```
1114 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~Certificates/Certificates_Install
1115 ```
1116 Value (string):
1117 ```
1118 <enabled/>
1119 <data id="Certificates_Install" value="1&#xF000;cert1.der&#xF000;2&#xF000;C:\Users\username\cert2.pem"/>
1120 ```
1121 #### macOS
1122 ```
1123 <dict>
1124   <key>Certificates</key>
1125   <dict>
1126     <key>Install</key>
1127     <array>
1128       <string>cert1.der</string>
1129       <string>/Users/username/cert2.pem</string>
1130     </array>
1131   </dict>
1132 </dict>
1133 ```
1134 #### policies.json
1135 ```
1136 {
1137   "policies": {
1138     "Certificates": {
1139       "Install": ["cert1.der", "/home/username/cert2.pem"]
1140     }
1141   }
1142 }
1143 ```
1144 ### Containers
1145 Set policies related to [containers](https://addons.mozilla.org/firefox/addon/multi-account-containers/).
1146
1147 Currently you can set the initial set of containers.
1148
1149 For each container, you can specify the name, icon, and color.
1150
1151 | Name | Description |
1152 | --- | --- |
1153 | `name`| Name of container
1154 | `icon` | Can be `fingerprint`, `briefcase`, `dollar`, `cart`, `vacation`, `gift`, `food`, `fruit`, `pet`, `tree`, `chill`, `circle`, `fence`
1155 | `color` | Can be `blue`, `turquoise`, `green`, `yellow`, `orange`, `red`, `pink`, `purple`, `toolbar`
1156
1157 **Compatibility:** Firefox 113\
1158 **CCK2 Equivalent:** N/A\
1159 **Preferences Affected:** N/A
1160
1161 #### Windows (GPO)
1162 Software\Policies\Mozilla\Firefox\Containers (REG_MULTI_SZ) =
1163 ```
1164 {
1165   "Default": [
1166     {
1167       "name": "My container",
1168       "icon": "pet",
1169       "color": "turquoise"
1170     }
1171   ]
1172 }
1173 ```
1174 #### Windows (Intune)
1175 OMA-URI:
1176 ```
1177 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox/Containers
1178 ```
1179 Value (string):
1180 ```
1181 <enabled/>
1182 <data id="JSON" value='
1183 {
1184   "Default": [
1185     {
1186       "name": "My container",
1187       "icon": "pet",
1188       "color": "turquoise"
1189     }
1190   ]
1191 }
1192 '/>
1193 ```
1194 If you are using custom ADMX and ADML administrative templates in Intune, you can use this OMA-URI instead
1195 to workaround the limit on the length of strings. Put all of your JSON on one line.
1196
1197 OMA-URI:
1198 ```
1199 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~Extensions/ContainersOneLine
1200 ```
1201 Value (string):
1202 ```
1203 <enabled/>
1204 <data id="JSONOneLine" value='{}'/>
1205 ```
1206 #### macOS
1207 ```
1208 <dict>
1209   <key>Default</key>
1210   <dict>
1211     <key>Containers</key>
1212     <array>
1213       <dict>
1214         <key>name</key>
1215         <string>My container</string>
1216         <key>icon</key>
1217         <string>pet</string>
1218         <key>color</key>
1219         <string>turquoise</string>
1220       </dict>
1221     </array>
1222   </dict>
1223 </dict>
1224 ```
1225 #### policies.json
1226 ```
1227 {
1228   "policies": {
1229     "Containers": {
1230       "Default": [
1231         {
1232           "name": "My container",
1233           "icon": "pet",
1234           "color": "turquoise"
1235         }
1236       ]
1237     }
1238   }
1239 }
1240 ```
1241 ### Cookies
1242 Configure cookie preferences.
1243
1244 `Allow` is a list of origins (not domains) where cookies are always allowed. You must include http or https.
1245
1246 `AllowSession` is a list of origins (not domains) where cookies are only allowed for the current session. You must include http or https.
1247
1248 `Block` is a list of origins (not domains) where cookies are always blocked. You must include http or https.
1249
1250 `Behavior` sets the default behavior for cookies based on the values below.
1251
1252 `BehaviorPrivateBrowsing` sets the default behavior for cookies in private browsing based on the values below.
1253
1254 | Value | Description
1255 | --- | --- |
1256 | accept | Accept all cookies
1257 | reject-foreign | Reject third party cookies
1258 | reject | Reject all cookies
1259 | limit-foreign | Reject third party cookies for sites you haven't visited
1260 | reject-tracker | Reject cookies for known trackers (default)
1261 | reject-tracker-and-partition-foreign | Reject cookies for known trackers and partition third-party cookies (Total Cookie Protection) (default for private browsing)
1262
1263 `Locked` prevents the user from changing cookie preferences.
1264
1265 `Default` determines whether cookies are accepted at all. (*Deprecated*. Use `Behavior` instead)
1266
1267 `AcceptThirdParty` determines how third-party cookies are handled. (*Deprecated*. Use `Behavior` instead)
1268
1269 `RejectTracker` only rejects cookies for trackers. (*Deprecated*. Use `Behavior` instead)
1270
1271 `ExpireAtSessionEnd` determines when cookies expire. (*Deprecated*. Use [`SanitizeOnShutdown`](#sanitizeonshutdown-selective) instead)
1272
1273 **Compatibility:** Firefox 60, Firefox ESR 60 (RejectTracker added in Firefox 63, AllowSession added in Firefox 79/78.1, Behavior added in Firefox 95/91.4)\
1274 **CCK2 Equivalent:** N/A\
1275 **Preferences Affected:** `network.cookie.cookieBehavior`, `network.cookie.cookieBehavior.pbmode`, `network.cookie.lifetimePolicy`
1276
1277 #### Windows (GPO)
1278 ```
1279 Software\Policies\Mozilla\Firefox\Cookies\Allow\1 = "https://example.com"
1280 Software\Policies\Mozilla\Firefox\Cookies\AllowSession\1 = "https://example.edu"
1281 Software\Policies\Mozilla\Firefox\Cookies\Block\1 = "https://example.org"
1282 Software\Policies\Mozilla\Firefox\Cookies\Behavior = "accept" | "reject-foreign" | "reject" | "limit-foreign" | "reject-tracker" | "reject-tracker-and-partition-foreign"
1283 Software\Policies\Mozilla\Firefox\Cookies\BehaviorPrivateBrowsing = "accept" | "reject-foreign" | "reject" | "limit-foreign" | "reject-tracker" | "reject-tracker-and-partition-foreign"
1284 Software\Policies\Mozilla\Firefox\Cookies\Locked = 0x1 | 0x0
1285 ```
1286 #### Windows (Intune)
1287 OMA-URI:
1288 ```
1289 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~Cookies/Cookies_Allow
1290 ```
1291 Value (string):
1292 ```
1293 <enabled/>
1294 <data id="Permissions" value="1&#xF000;https://example.com"/>
1295 ```
1296 OMA-URI:
1297 ```
1298 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~Cookies/Cookies_AllowSession
1299 ```
1300 Value (string):
1301 ```
1302 <enabled/>
1303 <data id="Permissions" value="1&#xF000;https://example.edu"/>
1304 ```
1305 OMA-URI:
1306 ```
1307 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~Cookies/Cookies_Block
1308 ```
1309 Value (string):
1310 ```
1311 <enabled/>
1312 <data id="Permissions" value="1&#xF000;https://example.org"/>
1313 ```
1314 OMA-URI:
1315 ```
1316 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~Cookies/Cookies_Locked
1317 ```
1318 Value (string):
1319 ```
1320 <enabled/> or <disabled/>
1321 ```
1322 OMA-URI:
1323 ```
1324 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~Cookies/Cookies_Behavior
1325 ```
1326 Value (string):
1327 ```
1328 <enabled/>
1329 <data id="Cookies_Behavior" value="accept | reject-foreign | reject | limit-foreign | reject-tracker | reject-tracker-and-partition-foreign"/>
1330 ```
1331 OMA-URI:
1332 ```
1333 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~Cookies/Cookies_BehaviorPrivateBrowsing
1334 ```
1335 Value (string):
1336 ```
1337 <enabled/>
1338 <data id="Cookies_BehaviorPrivateBrowsing" value="accept | reject-foreign | reject | limit-foreign | reject-tracker | reject-tracker-and-partition-foreign"/>
1339 ```
1340 #### macOS
1341 ```
1342 <dict>
1343   <key>Cookies</key>
1344   <dict>
1345     <key>Allow</key>
1346     <array>
1347       <string>http://example.com</string>
1348     </array>
1349     <key>AllowSession</key>
1350     <array>
1351       <string>http://example.edu</string>
1352     </array>
1353     <key>Block</key>
1354     <array>
1355       <string>http://example.org</string>
1356     </array>
1357     <key>Locked</key>
1358     <true/> | <false/>
1359     <key>Behavior</key>
1360     <string>accept | reject-foreign | reject | limit-foreign | reject-tracker | reject-tracker-and-partition-foreign</string>
1361     <key>BehaviorPrivateBrowsing</key>
1362     <string>accept | reject-foreign | reject | limit-foreign | reject-tracker | reject-tracker-and-partition-foreign</string>
1363   </dict>
1364 </dict>
1365 ```
1366 #### policies.json
1367 ```
1368 {
1369   "policies": {
1370     "Cookies": {
1371       "Allow": ["http://example.org/"],
1372       "AllowSession": ["http://example.edu/"],
1373       "Block": ["http://example.edu/"],
1374       "Locked": true | false,
1375       "Behavior": "accept" | "reject-foreign" | "reject" | "limit-foreign" | "reject-tracker" | "reject-tracker-and-partition-foreign",
1376       "BehaviorPrivateBrowsing": "accept" | "reject-foreign" | "reject" | "limit-foreign" | "reject-tracker" | "reject-tracker-and-partition-foreign",
1377     }
1378   }
1379 }
1380 ```
1381 ### DefaultDownloadDirectory
1382 Set the default download directory.
1383
1384 You can use ${home} for the native home directory.
1385
1386 **Compatibility:** Firefox 68, Firefox ESR 68\
1387 **CCK2 Equivalent:** N/A\
1388 **Preferences Affected:** `browser.download.dir`, `browser.download.folderList`
1389
1390 #### Windows (GPO)
1391 ```
1392 Software\Policies\Mozilla\Firefox\DefaultDownloadDirectory = "${home}\Downloads"
1393 ```
1394 #### Windows (Intune)
1395 OMA-URI:
1396 ```
1397 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox/DefaultDownloadDirectory
1398 ```
1399 Value (string):
1400 ```
1401 <enabled/>
1402 <data id="Preferences_String" value="${home}\Downloads"/>
1403 ```
1404 #### macOS
1405 ```
1406 <dict>
1407   <key>DefaultDownloadDirectory</key>
1408   <string>${home}/Downloads</string>
1409 </dict>
1410 ```
1411 #### policies.json (macOS and Linux)
1412 ```
1413 {
1414   "policies": {
1415     "DefaultDownloadDirectory": "${home}/Downloads"
1416   }
1417 }
1418 ```
1419 #### policies.json (Windows)
1420 ```
1421 {
1422   "policies": {
1423     "DefaultDownloadDirectory": "${home}\\Downloads"
1424   }
1425 }
1426 ```
1427 ### DisableAppUpdate
1428 Turn off application updates within Firefox.
1429
1430 **Compatibility:** Firefox 60, Firefox ESR 60\
1431 **CCK2 Equivalent:** `disableFirefoxUpdates`\
1432 **Preferences Affected:** N/A
1433
1434 #### Windows (GPO)
1435 ```
1436 Software\Policies\Mozilla\Firefox\DisableAppUpdate = 0x1 | 0x0
1437 ```
1438 #### Windows (Intune)
1439 OMA-URI:
1440 ```
1441 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox/DisableAppUpdate
1442 ```
1443 Value (string):
1444 ```
1445 <enabled/> or <disabled/>
1446 ```
1447 #### macOS
1448 ```
1449 <dict>
1450   <key>DisableAppUpdate</key>
1451   <true/> | <false/>
1452 </dict>
1453 ```
1454 #### policies.json
1455 ```
1456 {
1457   "policies": {
1458     "DisableAppUpdate": true | false
1459   }
1460 }
1461 ```
1462 ### DisableBuiltinPDFViewer
1463 Disable the built in PDF viewer. PDF files are downloaded and sent externally.
1464
1465 **Compatibility:** Firefox 60, Firefox ESR 60\
1466 **CCK2 Equivalent:** `disablePDFjs`\
1467 **Preferences Affected:** `pdfjs.disabled`
1468
1469 #### Windows (GPO)
1470 ```
1471 Software\Policies\Mozilla\Firefox\DisableBuiltinPDFViewer = 0x1 | 0x0
1472 ```
1473 #### Windows (Intune)
1474 OMA-URI:
1475 ```
1476 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox/DisableBuiltinPDFViewer
1477 ```
1478 Value (string):
1479 ```
1480 <enabled/> or <disabled/>
1481 ```
1482 #### macOS
1483 ```
1484 <dict>
1485   <key>DisableBuiltinPDFViewer</key>
1486   <true/> | <false/>
1487 </dict>
1488 ```
1489 #### policies.json
1490 ```
1491 {
1492   "policies": {
1493     "DisableBuiltinPDFViewer": true | false
1494   }
1495 }
1496 ```
1497 ### DisabledCiphers
1498 Disable specific cryptographic ciphers, listed below.
1499
1500 ```
1501 TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256
1502 TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256
1503 TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256
1504 TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256
1505 TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384
1506 TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384
1507 TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA
1508 TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA
1509 TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA
1510 TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA
1511 TLS_DHE_RSA_WITH_AES_128_CBC_SHA
1512 TLS_DHE_RSA_WITH_AES_256_CBC_SHA
1513 TLS_RSA_WITH_AES_128_GCM_SHA256
1514 TLS_RSA_WITH_AES_256_GCM_SHA384
1515 TLS_RSA_WITH_AES_128_CBC_SHA
1516 TLS_RSA_WITH_AES_256_CBC_SHA
1517 TLS_RSA_WITH_3DES_EDE_CBC_SHA
1518 ```
1519
1520 **Preferences Affected:** `security.ssl3.ecdhe_rsa_aes_128_gcm_sha256`, `security.ssl3.ecdhe_ecdsa_aes_128_gcm_sha256`, `security.ssl3.ecdhe_ecdsa_chacha20_poly1305_sha256`, `security.ssl3.ecdhe_rsa_chacha20_poly1305_sha256`, `security.ssl3.ecdhe_ecdsa_aes_256_gcm_sha384`, `security.ssl3.ecdhe_rsa_aes_256_gcm_sha384`, `security.ssl3.ecdhe_rsa_aes_128_sha`, `security.ssl3.ecdhe_ecdsa_aes_128_sha`, `security.ssl3.ecdhe_rsa_aes_256_sha`, `security.ssl3.ecdhe_ecdsa_aes_256_sha`, `security.ssl3.dhe_rsa_aes_128_sha`, `security.ssl3.dhe_rsa_aes_256_sha`, `security.ssl3.rsa_aes_128_gcm_sha256`, `security.ssl3.rsa_aes_256_gcm_sha384`, `security.ssl3.rsa_aes_128_sha`, `security.ssl3.rsa_aes_256_sha`, `security.ssl3.deprecated.rsa_des_ede3_sha`
1521
1522 ---
1523 **Note:**
1524
1525 This policy was updated in Firefox 78 to allow enabling ciphers as well. Setting the value to true disables the cipher, setting the value to false enables the cipher. Previously setting the value to true or false disabled the cipher.
1526
1527 ---
1528 **Compatibility:** Firefox 76, Firefox ESR 68.8 (TLS_RSA_WITH_AES_128_GCM_SHA256 and TLS_RSA_WITH_AES_256_GCM_SHA384 were added in Firefox 78, TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA, TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA, TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA38, TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256, TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384, and TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256 were added in Firefox 97 and Firefox 91.6)\
1529 **CCK2 Equivalent:** N/A\
1530 **Preferences Affected:** N/A
1531
1532 #### Windows (GPO)
1533 ```
1534 Software\Policies\Mozilla\Firefox\DisabledCiphers\CIPHER_NAME = 0x1 | 0x0
1535 ```
1536 #### Windows (Intune)
1537 OMA-URI:
1538 ```
1539 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~DisabledCiphers/DisabledCiphers_CIPHER_NAME
1540
1541 ```
1542 Value (string):
1543 ```
1544 <enabled/> or <disabled/>
1545 ```
1546 #### macOS
1547 ```
1548 <dict>
1549   <key>DisabledCiphers</key>
1550     <dict>
1551       <key>CIPHER_NAME</key>
1552       <true/> | <false/>
1553     </dict>
1554 </dict>
1555 ```
1556 #### policies.json
1557 ```
1558 {
1559   "policies": {
1560     "DisabledCiphers": {
1561       "CIPHER_NAME": true | false,
1562     }
1563   }
1564 }
1565 ```
1566 ### DisableDefaultBrowserAgent
1567 Prevent the default browser agent from taking any actions. Only applicable to Windows; other platforms don’t have the agent.
1568
1569 The browser agent is a Windows-only scheduled task which runs in the background to collect and submit data about the browser that the user has set as their OS default. More information is available [here](https://firefox-source-docs.mozilla.org/toolkit/mozapps/defaultagent/default-browser-agent/index.html).
1570
1571 **Compatibility:** Firefox 75, Firefox ESR 68.7 (Windows only)\
1572 **CCK2 Equivalent:** N/A\
1573 **Preferences Affected:** N/A
1574
1575 #### Windows (GPO)
1576 ```
1577 Software\Policies\Mozilla\Firefox\DisableDefaultBrowserAgent = 0x1 | 0x0
1578 ```
1579 #### Windows (Intune)
1580 OMA-URI:
1581 ```
1582 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox/DisableDefaultBrowserAgent
1583 ```
1584 Value (string):
1585 ```
1586 <enabled/> or <disabled/>
1587 ```
1588 #### policies.json
1589 ```
1590 {
1591   "policies": {
1592     "DisableDefaultBrowserAgent": true | false
1593   }
1594 }
1595 ```
1596 ### DisableDeveloperTools
1597 Remove access to all developer tools.
1598
1599 **Compatibility:** Firefox 60, Firefox ESR 60\
1600 **CCK2 Equivalent:** `removeDeveloperTools`\
1601 **Preferences Affected:** `devtools.policy.disabled`
1602
1603 #### Windows (GPO)
1604 ```
1605 Software\Policies\Mozilla\Firefox\DisableDeveloperTools = 0x1 | 0x0`
1606 ```
1607 #### Windows (Intune)
1608 OMA-URI:
1609 ```
1610 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox/DisableDeveloperTools
1611 ```
1612 Value (string):
1613 ```
1614 <enabled/> or <disabled/>
1615 ```
1616 #### macOS
1617 ```
1618 <dict>
1619   <key>DisableDeveloperTools</key>
1620   <true/> | <false/>
1621 </dict>
1622 ```
1623 #### policies.json
1624 ```
1625 {
1626   "policies": {
1627     "DisableDeveloperTools": true | false
1628   }
1629 }
1630 ```
1631 ### DisableFeedbackCommands
1632 Disable the menus for reporting sites (Submit Feedback, Report Deceptive Site).
1633
1634 **Compatibility:** Firefox 60, Firefox ESR 60\
1635 **CCK2 Equivalent:** N/A\
1636 **Preferences Affected:** N/A
1637
1638 #### Windows (GPO)
1639 ```
1640 Software\Policies\Mozilla\Firefox\DisableFeedbackCommands = 0x1 | 0x0
1641 ```
1642 #### Windows (Intune)
1643 OMA-URI:
1644 ```
1645 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox/DisableFeedbackCommands
1646 ```
1647 Value (string):
1648 ```
1649 <enabled/> or <disabled/>
1650 ```
1651 #### macOS
1652 ```
1653 <dict>
1654   <key>DisableFeedbackCommands</key>
1655   <true/> | <false/>
1656 </dict>
1657 ```
1658 #### policies.json
1659 ```
1660 {
1661   "policies": {
1662     "DisableFeedbackCommands": true | false
1663   }
1664 }
1665 ```
1666 ### DisableEncryptedClientHello
1667 Disable the TLS Feature for Encrypted Client Hello. Note that TLS Client Hellos will still contain an ECH extension, but this extension will not be used by Firefox during the TLS handshake.
1668
1669 **Compatibility:** Firefox 127, Firefox ESR 128\
1670 **CCK2 Equivalent:** N/A\
1671 **Preferences Affected:** `network.dns.echconfig.enabled`, `network.dns.http3_echconfig.enabled`
1672
1673 #### Windows (GPO)
1674 ```
1675 Software\Policies\Mozilla\Firefox\DisableEncryptedClientHello = 0x1 | 0x0
1676 ```
1677 #### Windows (Intune)
1678 OMA-URI:
1679 ```
1680 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox/DisableEncryptedClientHello
1681 ```
1682 Value (string):
1683 ```
1684 <enabled/> or <disabled/>
1685 ```
1686 #### macOS
1687 ```
1688 <dict>
1689   <key>DisableEncryptedClientHello</key>
1690   <true/> | <false/>
1691 </dict>
1692 ```
1693 #### policies.json
1694 ```
1695 {
1696   "policies": {
1697     "DisableEncryptedClientHello": true | false
1698   }
1699 }
1700 ```
1701 ### DisableFirefoxAccounts
1702 Disable Firefox Accounts integration (Sync).
1703
1704 **Compatibility:** Firefox 60, Firefox ESR 60\
1705 **CCK2 Equivalent:** `disableSync`\
1706 **Preferences Affected:** `identity.fxaccounts.enabled`
1707
1708 #### Windows (GPO)
1709 ```
1710 Software\Policies\Mozilla\Firefox\DisableFirefoxAccounts = 0x1 | 0x0
1711 ```
1712 #### Windows (Intune)
1713 OMA-URI:
1714 ```
1715 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox/DisableFirefoxAccounts
1716 ```
1717 Value (string):
1718 ```
1719 <enabled/> or <disabled/>
1720 ```
1721 #### macOS
1722 ```
1723 <dict>
1724   <key>DisableFirefoxAccounts</key>
1725   <true/> | <false/>
1726 </dict>
1727 ```
1728 #### policies.json
1729 ```
1730 {
1731   "policies": {
1732     "DisableFirefoxAccounts": true | false
1733   }
1734 }
1735 ```
1736 ### DisableFirefoxScreenshots
1737 Remove access to Firefox Screenshots.
1738
1739 **Compatibility:** Firefox 60, Firefox ESR 60\
1740 **CCK2 Equivalent:** N/A\
1741 **Preferences Affected:** `extensions.screenshots.disabled`
1742
1743 #### Windows (GPO)
1744 ```
1745 Software\Policies\Mozilla\Firefox\DisableFirefoxScreenshots = 0x1 | 0x0
1746 ```
1747 #### Windows (Intune)
1748 OMA-URI:
1749 ```
1750 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox/DisableFirefoxScreenshots
1751 ```
1752 Value (string):
1753 ```
1754 <enabled/> or <disabled/>
1755 ```
1756 #### macOS
1757 ```
1758 <dict>
1759   <key>DisableFirefoxScreenshots</key>
1760   <true/> | <false/>
1761 </dict>
1762 ```
1763 #### policies.json
1764 ```
1765 {
1766   "policies": {
1767     "DisableFirefoxScreenshots": true | false
1768   }
1769 }
1770 ```
1771 ### DisableFirefoxStudies
1772 Disable Firefox studies (Shield).
1773
1774 **Compatibility:** Firefox 60, Firefox ESR 60\
1775 **CCK2 Equivalent:** N/A\
1776 **Preferences Affected:** `browser.newtabpage.activity-stream.asrouter.userprefs.cfr.addons`, `browser.newtabpage.activity-stream.asrouter.userprefs.cfr.features`
1777
1778 #### Windows (GPO)
1779 ```
1780 Software\Policies\Mozilla\Firefox\DisableFirefoxStudies = 0x1 | 0x0
1781 ```
1782 #### Windows (Intune)
1783 OMA-URI:
1784 ```
1785 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox/DisableFirefoxStudies
1786 ```
1787 Value (string):
1788 ```
1789 <enabled/> or <disabled/>
1790 ```
1791 #### macOS
1792 ```
1793 <dict>
1794   <key>DisableFirefoxStudies</key>
1795   <true/> | <false/>
1796 </dict>
1797 ```
1798 #### policies.json
1799 ```
1800 {
1801   "policies": {
1802     "DisableFirefoxStudies": true | false
1803   }
1804 }
1805 ```
1806 ### DisableForgetButton
1807 Disable the "Forget" button.
1808
1809 **Compatibility:** Firefox 60, Firefox ESR 60\
1810 **CCK2 Equivalent:** `disableForget`\
1811 **Preferences Affected:** N/A
1812
1813 #### Windows (GPO)
1814 ```
1815 Software\Policies\Mozilla\Firefox\DisableForgetButton = 0x1 | 0x0
1816 ```
1817 #### Windows (Intune)
1818 OMA-URI:
1819 ```
1820 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox/DisableForgetButton
1821 ```
1822 Value (string):
1823 ```
1824 <enabled/> or <disabled/>
1825 ```
1826 #### macOS
1827 ```
1828 <dict>
1829   <key>DisableForgetButton</key>
1830   <true/> | <false/>
1831 </dict>
1832 ```
1833 #### policies.json
1834 ```
1835 {
1836   "policies": {
1837     "DisableForgetButton": true | false
1838   }
1839 }
1840 ```
1841 ### DisableFormHistory
1842 Turn off saving information on web forms and the search bar.
1843
1844 **Compatibility:** Firefox 60, Firefox ESR 60\
1845 **CCK2 Equivalent:** `disableFormFill`\
1846 **Preferences Affected:** `browser.formfill.enable`
1847
1848 #### Windows (GPO)
1849 ```
1850 Software\Policies\Mozilla\Firefox\DisableFormHistory = 0x1 | 0x0
1851 ```
1852 #### Windows (Intune)
1853 OMA-URI:
1854 ```
1855 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox/DisableFormHistory
1856 ```
1857 Value (string):
1858 ```
1859 <enabled/> or <disabled/>
1860 ```
1861 #### macOS
1862 ```
1863 <dict>
1864   <key>DisableFormHistory</key>
1865   <true/> | <false/>
1866 </dict>
1867 ```
1868 #### policies.json
1869 ```
1870 {
1871   "policies": {
1872     "DisableFormHistory": true | false
1873   }
1874 }
1875 ```
1876 ### DisableMasterPasswordCreation
1877 Remove the master password functionality.
1878
1879 If this value is true, it works the same as setting [`PrimaryPassword`](#primarypassword) to false and removes the primary password functionality.
1880
1881 If both `DisableMasterPasswordCreation` and `PrimaryPassword` are used, `DisableMasterPasswordCreation` takes precedent.
1882
1883 **Compatibility:** Firefox 60, Firefox ESR 60\
1884 **CCK2 Equivalent:** `noMasterPassword`\
1885 **Preferences Affected:** N/A
1886
1887 #### Windows (GPO)
1888 ```
1889 Software\Policies\Mozilla\Firefox\DisableMasterPasswordCreation = 0x1 | 0x0
1890 ```
1891 #### Windows (Intune)
1892 OMA-URI:
1893 ```
1894 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox/DisableMasterPasswordCreation
1895 ```
1896 Value (string):
1897 ```
1898 <enabled/> or <disabled/>
1899 ```
1900 #### macOS
1901 ```
1902 <dict>
1903   <key>DisableMasterPasswordCreation</key>
1904   <true/> | <false/>
1905 </dict>
1906 ```
1907 #### policies.json
1908 ```
1909 {
1910   "policies": {
1911     "DisableMasterPasswordCreation": true | false
1912   }
1913 }
1914 ```
1915 ### DisablePasswordReveal
1916 Do not allow passwords to be shown in saved logins
1917
1918 **Compatibility:** Firefox 71, Firefox ESR 68.3\
1919 **CCK2 Equivalent:** N/A
1920 **Preferences Affected:** N/A
1921
1922 #### Windows (GPO)
1923 ```
1924 Software\Policies\Mozilla\Firefox\DisablePasswordReveal = 0x1 | 0x0
1925 ```
1926 #### Windows (Intune)
1927 OMA-URI:
1928 ```
1929 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox/DisablePasswordReveal
1930 ```
1931 Value (string):
1932 ```
1933 <enabled/> or <disabled/>
1934 ```
1935 #### macOS
1936 ```
1937 <dict>
1938   <key>DisablePasswordReveal</key>
1939   <true/> | <false/>
1940 </dict>
1941 ```
1942 #### policies.json
1943 ```
1944 {
1945   "policies": {
1946     "DisablePasswordReveal": true | false
1947   }
1948 }
1949 ```
1950 ### DisablePocket
1951 Remove Pocket in the Firefox UI. It does not remove it from the new tab page.
1952
1953 **Compatibility:** Firefox 60, Firefox ESR 60\
1954 **CCK2 Equivalent:** `disablePocket`\
1955 **Preferences Affected:** `extensions.pocket.enabled`
1956
1957 #### Windows (GPO)
1958 ```
1959 Software\Policies\Mozilla\Firefox\DisablePocket = 0x1 | 0x0
1960 ```
1961 #### Windows (Intune)
1962 OMA-URI:
1963 ```
1964 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox/DisablePocket
1965 ```
1966 Value (string):
1967 ```
1968 <enabled/> or <disabled/>
1969 ```
1970 #### macOS
1971 ```
1972 <dict>
1973   <key>DisablePocket</key>
1974   <true/> | <false/>
1975 </dict>
1976 ```
1977 #### policies.json
1978 ```
1979 {
1980   "policies": {
1981     "DisablePocket": true | false
1982   }
1983 }
1984 ```
1985 ### DisablePrivateBrowsing
1986 Remove access to private browsing.
1987
1988 **Compatibility:** Firefox 60, Firefox ESR 60\
1989 **CCK2 Equivalent:** `disablePrivateBrowsing`\
1990 **Preferences Affected:** N/A
1991
1992 #### Windows (GPO)
1993 ```
1994 Software\Policies\Mozilla\Firefox\DisablePrivateBrowsing = 0x1 | 0x0
1995 ```
1996 #### Windows (Intune)
1997 OMA-URI:
1998 ```
1999 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox/DisablePrivateBrowsing
2000 ```
2001 Value (string):
2002 ```
2003 <enabled/> or <disabled/>
2004 ```
2005 #### macOS
2006 ```
2007 <dict>
2008   <key>DisablePrivateBrowsing</key>
2009   <true/> | <false/>
2010 </dict>
2011 ```
2012 #### policies.json
2013 ```
2014 {
2015   "policies": {
2016     "DisablePrivateBrowsing": true | false
2017   }
2018 }
2019 ```
2020 ### DisableProfileImport
2021 Disables the "Import data from another browser" option in the bookmarks window.
2022
2023 **Compatibility:** Firefox 60, Firefox ESR 60\
2024 **CCK2 Equivalent:** N/A\
2025 **Preferences Affected:** N/A
2026
2027 #### Windows (GPO)
2028 ```
2029 Software\Policies\Mozilla\Firefox\DisableProfileImport = 0x1 | 0x0
2030 ```
2031 #### Windows (Intune)
2032 OMA-URI:
2033 ```
2034 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox/DisableProfileImport
2035 ```
2036 Value (string):
2037 ```
2038 <enabled/> or <disabled/>
2039 ```
2040 #### macOS
2041 ```
2042 <dict>
2043   <key>DisableProfileImport</key>
2044   <true/> | <false/>
2045 </dict>
2046 ```
2047 #### policies.json
2048 ```
2049 {
2050   "policies": {
2051     "DisableProfileImport": true | false
2052   }
2053 }
2054 ```
2055 ### DisableProfileRefresh
2056 Disable the Refresh Firefox button on about:support and support.mozilla.org, as well as the prompt that displays offering to refresh Firefox when you haven't used it in a while.
2057
2058 **Compatibility:** Firefox 60, Firefox ESR 60\
2059 **CCK2 Equivalent:** `disableResetFirefox`\
2060 **Preferences Affected:** `browser.disableResetPrompt`
2061
2062 #### Windows (GPO)
2063 ```
2064 Software\Policies\Mozilla\Firefox\DisableProfileRefresh = 0x1 | 0x0
2065 ```
2066 #### Windows (Intune)
2067 OMA-URI:
2068 ```
2069 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox/DisableProfileRefresh
2070 ```
2071 Value (string):
2072 ```
2073 <enabled/> or <disabled/>
2074 ```
2075 #### macOS
2076 ```
2077 <dict>
2078   <key>DisableProfileRefresh</key>
2079   <true/> | <false/>
2080 </dict>
2081 ```
2082 #### policies.json
2083 ```
2084 {
2085   "policies": {
2086     "DisableProfileRefresh": true | false
2087   }
2088 }
2089 ```
2090 ### DisableSafeMode
2091 Disable safe mode within the browser.
2092
2093 On Windows, this disables safe mode via the command line as well.
2094
2095 **Compatibility:** Firefox 60, Firefox ESR 60 (Windows, macOS)\
2096 **CCK2 Equivalent:** `disableSafeMode`\
2097 **Preferences Affected:** N/A
2098
2099 #### Windows (GPO)
2100 ```
2101 Software\Policies\Mozilla\Firefox\DisableSafeMode = 0x1 | 0x0
2102 ```
2103 #### Windows (Intune)
2104 OMA-URI:
2105 ```
2106 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox/DisableSafeMode
2107 ```
2108 Value (string):
2109 ```
2110 <enabled/> or <disabled/>
2111 ```
2112 #### macOS
2113 ```
2114 <dict>
2115   <key>DisableSafeMode</key>
2116   <true/> | <false/>
2117 </dict>
2118 ```
2119 #### policies.json
2120 ```
2121 {
2122   "policies": {
2123     "DisableSafeMode": true | false
2124   }
2125 }
2126 ```
2127 ### DisableSecurityBypass
2128 Prevent the user from bypassing security in certain cases.
2129
2130 `InvalidCertificate` prevents adding an exception when an invalid certificate is shown.
2131
2132 `SafeBrowsing` prevents selecting "ignore the risk" and visiting a harmful site anyway.
2133
2134 These policies only affect what happens when an error is shown, they do not affect any settings in preferences.
2135
2136 **Compatibility:** Firefox 60, Firefox ESR 60\
2137 **CCK2 Equivalent:** N/A\
2138 **Preferences Affected:** `security.certerror.hideAddException`, `browser.safebrowsing.allowOverride`
2139
2140 #### Windows (GPO)
2141 ```
2142 Software\Policies\Mozilla\Firefox\DisableSecurityBypass\InvalidCertificate = 0x1 | 0x0
2143 Software\Policies\Mozilla\Firefox\DisableSecurityBypass\SafeBrowsing = 0x1 | 0x0
2144 ```
2145 #### Windows (Intune)
2146 OMA-URI:
2147 ```
2148 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox/P_DisableSecurityBypass_InvalidCertificate
2149 ```
2150 Value (string):
2151 ```
2152 <enabled/> or <disabled/>
2153 ```
2154 OMA-URI:
2155 ```
2156 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox/P_DisableSecurityBypass_SafeBrowsing
2157 ```
2158 Value (string):
2159 ```
2160 <enabled/> or <disabled/>
2161 ```
2162
2163 #### macOS
2164 ```
2165 <dict>
2166   <key>DisableSecurityBypass</key>
2167   <dict>
2168     <key>InvalidCertificate</key>
2169     <true/> | <false/>
2170     <key>SafeBrowsing</key>
2171     <true/> | <false/>
2172   </dict>
2173 </dict>
2174 ```
2175 #### policies.json
2176 ```
2177 {
2178   "policies": {
2179     "DisableSecurityBypass": {
2180       "InvalidCertificate": true | false,
2181       "SafeBrowsing": true | false
2182     }
2183   }
2184 }
2185 ```
2186 ### DisableSetDesktopBackground
2187 Remove the "Set As Desktop Background..." menuitem when right clicking on an image.
2188
2189 **Compatibility:** Firefox 60, Firefox ESR 60\
2190 **CCK2 Equivalent:** `removeSetDesktopBackground`\
2191 **Preferences Affected:** N/A
2192
2193 #### Windows (GPO)
2194 ```
2195 Software\Policies\Mozilla\Firefox\DisableSetDesktopBackground = 0x1 | 0x0
2196 ```
2197 #### Windows (Intune)
2198 OMA-URI:
2199 ```
2200 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox/DisableSetDesktopBackground
2201 ```
2202 Value (string):
2203 ```
2204 <enabled/> or <disabled/>
2205 ```
2206 #### macOS
2207 ```
2208 <dict>
2209   <key>DisableSetDesktopBackground</key>
2210   <true/> | <false/>
2211 </dict>
2212 ```
2213 #### policies.json
2214 ```
2215 {
2216   "policies": {
2217     "DisableSetDesktopBackground": true | false
2218   }
2219 }
2220 ```
2221 ### DisableSystemAddonUpdate
2222 Prevent system add-ons from being installed or updated.
2223
2224 **Compatibility:** Firefox 60, Firefox ESR 60\
2225 **CCK2 Equivalent:** N/A\
2226 **Preferences Affected:** N/A
2227
2228 #### Windows (GPO)
2229 ```
2230 Software\Policies\Mozilla\Firefox\DisableSystemAddonUpdate = 0x1 | 0x0
2231 ```
2232 #### Windows (Intune)
2233 OMA-URI:
2234 ```
2235 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox/DisableSystemAddonUpdate
2236 ```
2237 Value (string):
2238 ```
2239 <enabled/> or <disabled/>
2240 ```
2241 #### macOS
2242 ```
2243 <dict>
2244   <key>DisableSystemAddonUpdate</key>
2245   <true/> | <false/>
2246 </dict>
2247 ```
2248 #### policies.json
2249 ```
2250 {
2251   "policies": {
2252     "DisableSystemAddonUpdate": true | false
2253   }
2254 }
2255 ```
2256 ### DisableTelemetry
2257 Prevent the upload of telemetry data.
2258
2259 As of Firefox 83 and Firefox ESR 78.5, local storage of telemetry data is disabled as well.
2260
2261 Mozilla recommends that you do not disable telemetry. Information collected through telemetry helps us build a better product for businesses like yours.
2262
2263 **Compatibility:** Firefox 60, Firefox ESR 60\
2264 **CCK2 Equivalent:** `disableTelemetry`\
2265 **Preferences Affected:** `datareporting.healthreport.uploadEnabled`, `datareporting.policy.dataSubmissionEnabled`, `toolkit.telemetry.archive.enabled`
2266
2267 #### Windows (GPO)
2268 ```
2269 Software\Policies\Mozilla\Firefox\DisableTelemetry = 0x1 | 0x0
2270 ```
2271 #### Windows (Intune)
2272 OMA-URI:
2273 ```
2274 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox/DisableTelemetry
2275 ```
2276 Value (string):
2277 ```
2278 <enabled/> or <disabled/>
2279 ```
2280 #### macOS
2281 ```
2282 <dict>
2283   <key>DisableTelemetry</key>
2284   <true/> | <false/>
2285 </dict>
2286 ```
2287 #### policies.json
2288 ```
2289 {
2290   "policies": {
2291     "DisableTelemetry": true | false
2292   }
2293 }
2294 ```
2295 ### DisableThirdPartyModuleBlocking
2296 Do not allow blocking third-party modules from the `about:third-party` page.
2297
2298 This policy only works on Windows through GPO (not policies.json).
2299
2300 **Compatibility:** Firefox 110 (Windows only, GPO only)\
2301 **CCK2 Equivalent:** N/A\
2302 **Preferences Affected:** N/A
2303
2304 #### Windows (GPO)
2305 ```
2306 Software\Policies\Mozilla\Firefox\DisableThirdPartyModuleBlocking = = 0x1 | 0x0
2307 ```
2308 #### Windows (Intune)
2309 OMA-URI:
2310 ```
2311 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox/DisableThirdPartyModuleBlocking
2312 ```
2313 Value (string):
2314 ```
2315 <enabled/> or <disabled/>
2316 ```
2317 ### DisplayBookmarksToolbar
2318 Set the initial state of the bookmarks toolbar. A user can still change how it is displayed.
2319
2320 `always` means the bookmarks toolbar is always shown.
2321
2322 `never` means the bookmarks toolbar is not shown.
2323
2324 `newtab` means the bookmarks toolbar is only shown on the new tab page.
2325
2326 **Compatibility:** Firefox 109, Firefox ESR 102.7\
2327 **CCK2 Equivalent:** N/A\
2328 **Preferences Affected:** N/A
2329
2330 #### Windows (GPO)
2331 ```
2332 Software\Policies\Mozilla\Firefox\DisplayBookmarksToolbar = "always", "never", "newtab"
2333 ```
2334 #### Windows (Intune)
2335 OMA-URI:
2336 ```
2337 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox/DisplayBookmarksToolbar_Enum
2338 ```
2339 Value (string):
2340 ```
2341 <enabled/>
2342 <data id="DisplayBookmarksToolbar" value="always | never | newtab"/>
2343 ```
2344 #### macOS
2345 ```
2346 <dict>
2347   <key>DisplayBookmarksToolbar</key>
2348   <string>always | never | newtab</string>
2349 </dict>
2350 ```
2351 #### policies.json
2352 ```
2353 {
2354   "policies": {
2355     "DisplayBookmarksToolbar": "always" | "never" | "newtab"
2356   }
2357 }
2358 ```
2359 ### DisplayMenuBar
2360 Set the state of the menubar.
2361
2362 `always` means the menubar is shown and cannot be hidden.
2363
2364 `never` means the menubar is hidden and cannot be shown.
2365
2366 `default-on` means the menubar is on by default but can be hidden.
2367
2368 `default-off` means the menubar is off by default but can be shown.
2369
2370 **Compatibility:** Firefox 73, Firefox ESR 68.5 (Windows, some Linux)\
2371 **CCK2 Equivalent:** `displayMenuBar`\
2372 **Preferences Affected:** N/A
2373
2374 #### Windows (GPO)
2375 ```
2376 Software\Policies\Mozilla\Firefox\DisplayMenuBar = "always", "never", "default-on", "default-off"
2377 ```
2378 #### Windows (Intune)
2379 OMA-URI:
2380 ```
2381 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox/DisplayMenuBar_Enum
2382 ```
2383 Value (string):
2384 ```
2385 <enabled/>
2386 <data id="DisplayMenuBar" value="always | never | default-on | default-off"/>
2387 ```
2388 #### macOS
2389 ```
2390 <dict>
2391   <key>DisplayMenuBar</key>
2392   <string>always | never | default-on | default-off</string>
2393 </dict>
2394 ```
2395 #### policies.json
2396 ```
2397 {
2398   "policies": {
2399     "DisplayMenuBar": "always", "never", "default-on", "default-off"
2400   }
2401 }
2402 ```
2403 ### DNSOverHTTPS
2404 Configure DNS over HTTPS.
2405
2406 `Enabled` determines whether DNS over HTTPS is enabled
2407
2408 `ProviderURL` is a URL to another provider.
2409
2410 `Locked` prevents the user from changing DNS over HTTPS preferences.
2411
2412 `ExcludedDomains` excludes domains from DNS over HTTPS.
2413
2414 `Fallback` determines whether or not Firefox will use your default DNS resolver if there is a problem with the secure DNS provider.
2415
2416 **Compatibility:** Firefox 63, Firefox ESR 68 (ExcludedDomains added in 75/68.7) (Fallback added in 124)\
2417 **CCK2 Equivalent:** N/A\
2418 **Preferences Affected:** `network.trr.mode`, `network.trr.uri`
2419
2420 #### Windows (GPO)
2421 ```
2422 Software\Policies\Mozilla\Firefox\DNSOverHTTPS\Enabled = 0x1 | 0x0
2423 Software\Policies\Mozilla\Firefox\DNSOverHTTPS\ProviderURL = "URL_TO_ALTERNATE_PROVIDER"
2424 Software\Policies\Mozilla\Firefox\DNSOverHTTPS\Locked = 0x1 | 0x0
2425 Software\Policies\Mozilla\Firefox\DNSOverHTTPS\ExcludedDomains\1 = "example.com"
2426 Software\Policies\Mozilla\Firefox\DNSOverHTTPS\Fallback = 0x1 | 0x0
2427 ```
2428 #### Windows (Intune)
2429 OMA-URI:
2430 ```
2431 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~DNSOverHTTPS/DNSOverHTTPS_Enabled
2432 ```
2433 Value (string):
2434 ```
2435 <enabled/> or <disabled/>
2436 ```
2437 OMA-URI:
2438 ```
2439 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~DNSOverHTTPS/DNSOverHTTPS_ProviderURL
2440 ```
2441 Value (string):
2442 ```
2443 <enabled/>
2444 <data id="String" value="URL_TO_ALTERNATE_PROVIDER"/>
2445 ```
2446 OMA-URI:
2447 ```
2448 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~DNSOverHTTPS/DNSOverHTTPS_Locked
2449 ```
2450 Value (string):
2451 ```
2452 <enabled/> or <disabled/>
2453 ```
2454 OMA-URI:
2455 ```
2456 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~DNSOverHTTPS/DNSOverHTTPS_ExcludedDomains
2457 ```
2458 Value (string):
2459 ```
2460 <enabled/>
2461 <data id="List" value="1&#xF000;example.com"/>
2462 ```
2463 OMA-URI:
2464 ```
2465 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~DNSOverHTTPS/DNSOverHTTPS_Fallback
2466 ```
2467 Value (string):
2468 ```
2469 <enabled/> or <disabled/>
2470 ```
2471 #### macOS
2472 ```
2473 <dict>
2474   <key>DNSOverHTTPS</key>
2475   <dict>
2476     <key>Enabled</key>
2477     <true/> | <false/>
2478     <key>ProviderURL</key>
2479     <string>URL_TO_ALTERNATE_PROVIDER</string>
2480     <key>Locked</key>
2481     <true/> | <false/>
2482     <key>ExcludedDomains</key>
2483     <array>
2484       <string>example.com</string>
2485     </array>
2486     <key>Fallback</key>
2487     <true/> | <false/>
2488   </dict>
2489 </dict>
2490 ```
2491 #### policies.json
2492 ```
2493 {
2494   "policies": {
2495     "DNSOverHTTPS": {
2496       "Enabled":  true | false,
2497       "ProviderURL": "URL_TO_ALTERNATE_PROVIDER",
2498       "Locked": true | false,
2499       "ExcludedDomains": ["example.com"],
2500       "Fallback": true | false,
2501     }
2502   }
2503 }
2504 ```
2505 ### DontCheckDefaultBrowser
2506 Don't check if Firefox is the default browser at startup.
2507
2508 **Compatibility:** Firefox 60, Firefox ESR 60\
2509 **CCK2 Equivalent:** `dontCheckDefaultBrowser`\
2510 **Preferences Affected:** `browser.shell.checkDefaultBrowser`
2511
2512 #### Windows (GPO)
2513 ```
2514 Software\Policies\Mozilla\Firefox\DontCheckDefaultBrowser = 0x1 | 0x0
2515 ```
2516 #### Windows (Intune)
2517 OMA-URI:
2518 ```
2519 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox/DontCheckDefaultBrowser
2520 ```
2521 Value (string):
2522 ```
2523 <enabled/> or <disabled/>
2524 ```
2525 #### macOS
2526 ```
2527 <dict>
2528   <key>DontCheckDefaultBrowser</key>
2529   <true/> | <false/>
2530 </dict>
2531 ```
2532 #### policies.json
2533 ```
2534 {
2535   "policies": {
2536     "DontCheckDefaultBrowser": true | false
2537   }
2538 }
2539 ```
2540 ### DownloadDirectory
2541 Set and lock the download directory.
2542
2543 You can use ${home} for the native home directory.
2544
2545 **Compatibility:** Firefox 68, Firefox ESR 68\
2546 **CCK2 Equivalent:** N/A\
2547 **Preferences Affected:** `browser.download.dir`, `browser.download.folderList`, `browser.download.useDownloadDir`
2548
2549 #### Windows (GPO)
2550 ```
2551 Software\Policies\Mozilla\Firefox\DownloadDirectory = "${home}\Downloads"
2552 ```
2553 #### Windows (Intune)
2554 OMA-URI:
2555 ```
2556 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox/DownloadDirectory
2557 ```
2558 Value (string):
2559 ```
2560 <enabled/>
2561 <data id="Preferences_String" value="${home}\Downloads"/>
2562 ```
2563 #### macOS
2564 ```
2565 <dict>
2566   <key>DownloadDirectory</key>
2567   <string>${home}/Downloads</string>
2568 </dict>
2569 ```
2570 #### policies.json (macOS and Linux)
2571 ```
2572 {
2573   "policies": {
2574     "DownloadDirectory": "${home}/Downloads"
2575 }
2576 ```
2577 #### policies.json (Windows)
2578 ```
2579 {
2580   "policies": {
2581     "DownloadDirectory": "${home}\\Downloads"
2582 }
2583 ```
2584 ### EnableTrackingProtection
2585 Configure tracking protection.
2586
2587 If this policy is not configured, tracking protection is not enabled by default in the browser, but it is enabled by default in private browsing and the user can change it.
2588
2589 If `Value` is set to false, tracking protection is disabled and locked in both the regular browser and private browsing.
2590
2591 If `Value` is set to true, tracking protection is enabled by default in both the regular browser and private browsing and the `Locked` value determines whether or not a user can change it.
2592
2593 If `Cryptomining` is set to true, cryptomining scripts on websites are blocked.
2594
2595 If `Fingerprinting` is set to true, fingerprinting scripts on websites are blocked.
2596
2597 If `EmailTracking` is set to true, hidden email tracking pixels and scripts on websites are blocked. (Firefox 112)
2598
2599 `Exceptions` are origins for which tracking protection is not enabled.
2600
2601 **Compatibility:** Firefox 60, Firefox ESR 60 (Cryptomining and Fingerprinting added in 70/68.2, Exceptions added in 73/68.5)\
2602 **CCK2 Equivalent:** N/A\
2603 **Preferences Affected:** `privacy.trackingprotection.enabled`, `privacy.trackingprotection.pbmode.enabled`, `privacy.trackingprotection.cryptomining.enabled`, `privacy.trackingprotection.fingerprinting.enabled`
2604
2605 #### Windows (GPO)
2606 ```
2607 Software\Policies\Mozilla\Firefox\EnableTrackingProtection\Value = 0x1 | 0x0
2608 Software\Policies\Mozilla\Firefox\EnableTrackingProtection\Locked = 0x1 | 0x0
2609 Software\Policies\Mozilla\Firefox\EnableTrackingProtection\Cryptomining = 0x1 | 0x0
2610 Software\Policies\Mozilla\Firefox\EnableTrackingProtection\Fingerprinting = 0x1 | 0x0
2611 Software\Policies\Mozilla\Firefox\EnableTrackingProtection\Exceptions\1 = "https://example.com"
2612 ```
2613 #### Windows (Intune)
2614 OMA-URI:
2615 ```
2616 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~TrackingProtection/A_TrackingProtection_Value
2617 ```
2618 Value (string):
2619 ```
2620 <enabled/> or <disabled/>
2621 ```
2622 OMA-URI:
2623 ```
2624 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~TrackingProtection/B_TrackingProtection_Cryptomining
2625 ```
2626 Value (string):
2627 ```
2628 <enabled/> or <disabled/>
2629 ```
2630 OMA-URI:
2631 ```
2632 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~TrackingProtection/C_TrackingProtection_Fingerprinting
2633 ```
2634 Value (string):
2635 ```
2636 <enabled/> or <disabled/>
2637 ```
2638 OMA-URI:
2639 ```
2640 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~TrackingProtection/D_TrackingProtection_Exceptions
2641 ```
2642 Value (string):
2643 ```
2644 <enabled/>
2645 <data id="TrackingProtection_Exceptions" value="1&#xF000;https://example.com"/>
2646 ```
2647 OMA-URI:
2648 ```
2649 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~TrackingProtection/E_TrackingProtection_Locked
2650 ```
2651 Value (string):
2652 ```
2653 <enabled/> or <disabled/>
2654 ```
2655 #### macOS
2656 ```
2657 <dict>
2658   <key>EnableTrackingProtection</key>
2659   <dict>
2660     <key>Value</key>
2661     <true/> | <false/>
2662     <key>Locked</key>
2663     <true/> | <false/>
2664     <key>Cryptomining</key>
2665     <true/> | <false/>
2666     <key>Fingerprinting</key>
2667     <true/> | <false/>
2668     <key>Exceptions</key>
2669     <array>
2670       <string>https://example.com</string>
2671     </array>
2672   </dict>
2673 </dict>
2674 ```
2675 #### policies.json
2676 ```
2677 {
2678   "policies": {
2679     "EnableTrackingProtection": {
2680       "Value": true | false,
2681       "Locked": true | false,
2682       "Cryptomining": true | false,
2683       "Fingerprinting": true | false,
2684       "Exceptions": ["https://example.com"]
2685     }
2686   }
2687 }
2688 ```
2689 ### EncryptedMediaExtensions
2690 Enable or disable Encrypted Media Extensions and optionally lock it.
2691
2692 If `Enabled` is set to false, encrypted media extensions (like Widevine) are not downloaded by Firefox unless the user consents to installing them.
2693
2694 If `Locked` is set to true and `Enabled` is set to false, Firefox will not download encrypted media extensions (like Widevine) or ask the user to install them.
2695
2696 **Compatibility:** Firefox 77, Firefox ESR 68.9\
2697 **CCK2 Equivalent:** N/A\
2698 **Preferences Affected:** `media.eme.enabled`
2699
2700 #### Windows (GPO)
2701 ```
2702 Software\Policies\Mozilla\Firefox\EncryptedMediaExtensions\Enabled = 0x1 | 0x0
2703 Software\Policies\Mozilla\Firefox\EncryptedMediaExtensions\Locked = 0x1 | 0x0
2704 ```
2705 #### Windows (Intune)
2706 OMA-URI:
2707 ```
2708 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~EncryptedMediaExtensions/EncryptedMediaExtensions_Enabled
2709 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~EncryptedMediaExtensions/EncryptedMediaExtensions_Locked
2710 ```
2711 Value (string):
2712 ```
2713 <enabled/>or <disabled/>
2714 ```
2715 #### macOS
2716 ```
2717 <dict>
2718   <key>EncryptedMediaExtensions</key>
2719   <dict>
2720     <key>Enabled</key>
2721     <true/> | <false/>
2722     <key>Locked</key>
2723     <true/> | <false/>
2724   </dict>
2725 </dict>
2726 ```
2727 #### policies.json
2728 ```
2729 {
2730   "policies": {
2731     "EncryptedMediaExtensions": {
2732       "Enabled": true | false,
2733       "Locked": true | false
2734     }
2735   }
2736 }
2737 ```
2738 ### EnterprisePoliciesEnabled
2739 Enable policy support on macOS.
2740
2741 **Compatibility:** Firefox 63, Firefox ESR 60.3 (macOS only)\
2742 **CCK2 Equivalent:** N/A\
2743 **Preferences Affected:** N/A
2744
2745 #### macOS
2746 ```
2747 <dict>
2748   <key>EnterprisePoliciesEnabled</key>
2749   <true/>
2750 </dict>
2751 ```
2752 ### ExemptDomainFileTypePairsFromFileTypeDownloadWarnings
2753
2754 Disable warnings based on file extension for specific file types on domains.
2755
2756 This policy is based on the [Chrome policy](https://chromeenterprise.google/policies/#ExemptDomainFileTypePairsFromFileTypeDownloadWarnings) of the same name.
2757
2758 Important: The documentation for the policy for both Edge and Chrome is incorrect. The ```domains``` value must be a domain, not a URL pattern. Also, we do not support using ```*``` to mean all domains.
2759
2760 **Compatibility:** Firefox 102\
2761 **CCK2 Equivalent:** N/A\
2762 **Preferences Affected:** N/A
2763
2764 #### Windows (GPO)
2765 Software\Policies\Mozilla\Firefox\ExemptDomainFileTypePairsFromFileTypeDownloadWarnings (REG_MULTI_SZ) =
2766 ```
2767 [
2768   {
2769      "file_extension": "jnlp",
2770      "domains": ["example.com"]
2771   }
2772 ]
2773 ```
2774 #### Windows (Intune)
2775 OMA-URI:
2776 ```
2777 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox/ExemptDomainFileTypePairsFromFileTypeDownloadWarnings
2778 ```
2779 Value (string):
2780 ```
2781 <enabled/>
2782 <data id="JSON" value='
2783 [
2784   {
2785      "file_extension": "jnlp",
2786      "domains": ["example.com"]
2787   }
2788 ]
2789 '/>
2790 ```
2791 If you are using custom ADMX and ADML administrative templates in Intune, you can use this OMA-URI instead
2792 to workaround the limit on the length of strings. Put all of your JSON on one line.
2793
2794 OMA-URI:
2795 ```
2796 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~Extensions/ExemptDomainFileTypePairsFromFileTypeDownloadWarningsOneLine
2797 ```
2798 Value (string):
2799 ```
2800 <enabled/>
2801 <data id="JSONOneLine" value='[]'/>
2802 ```
2803 #### macOS
2804 ```
2805 <dict>
2806   <key>ExemptDomainFileTypePairsFromFileTypeDownloadWarnings</key>
2807   <array>
2808     <dict>
2809       <key>file_extension</key>
2810       <string>jnlp</string>
2811       <key>domains</key>
2812       <array>
2813         <string>example.com</string>
2814       </array>
2815     </dict>
2816   </array>
2817 </dict>
2818 ```
2819 #### policies.json
2820 ```
2821 {
2822   "policies": {
2823     "ExemptDomainFileTypePairsFromFileTypeDownloadWarnings": [{
2824       "file_extension": "jnlp",
2825       "domains": ["example.com"]
2826     }]
2827   }
2828 }
2829 ```
2830 ### Extensions
2831 Control the installation, uninstallation and locking of extensions.
2832
2833 We strongly recommend that you use the **[`ExtensionSettings`](#extensionsettings)** policy. It has the same functionality and adds more. It does not support native paths, though, so you'll have to use file:/// URLs.
2834
2835 This method will be deprecated in the near future.
2836
2837 `Install` is a list of URLs or native paths for extensions to be installed.
2838
2839 `Uninstall` is a list of extension IDs that should be uninstalled if found.
2840
2841 `Locked` is a list of extension IDs that the user cannot disable or uninstall.
2842
2843 **Compatibility:** Firefox 60, Firefox ESR 60\
2844 **CCK2 Equivalent:** `addons`\
2845 **Preferences Affected:** N/A
2846
2847 #### Windows (GPO)
2848 ```
2849 Software\Policies\Mozilla\Firefox\Extensions\Install\1 = "https://addons.mozilla.org/firefox/downloads/somefile.xpi"
2850 Software\Policies\Mozilla\Firefox\Extensions\Install\2 = "//path/to/xpi"
2851 Software\Policies\Mozilla\Firefox\Extensions\Uninstall\1 = "bad_addon_id@mozilla.org"
2852 Software\Policies\Mozilla\Firefox\Extensions\Locked\1 = "addon_id@mozilla.org"
2853 ```
2854 #### Windows (Intune)
2855 OMA-URI:
2856 ```
2857 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~Extensions/Extensions_Install
2858 ```
2859 Value (string):
2860 ```
2861 <enabled/>
2862 <data id="Extensions" value="1&#xF000;https://addons.mozilla.org/firefox/downloads/somefile.xpi&#xF000;2&#xF000;//path/to/xpi"/>
2863 ```
2864 OMA-URI:
2865 ```
2866 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~Extensions/Extensions_Uninstall
2867 ```
2868 Value (string):
2869 ```
2870 <enabled/>
2871 <data id="Extensions" value="1&#xF000;bad_addon_id@mozilla.org"/>
2872 ```
2873 OMA-URI:
2874 ```
2875 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~Extensions/Extensions_Locked
2876 ```
2877 Value (string):
2878 ```
2879 <enabled/>
2880 <data id="Extensions" value="1&#xF000;addon_id@mozilla.org"/>
2881 ```
2882 #### macOS
2883 ```
2884 <dict>
2885   <key>Extensions</key>
2886   <dict>
2887     <key>Install</key>
2888     <array>
2889       <string>https://addons.mozilla.org/firefox/downloads/somefile.xpi</string>
2890       <string>//path/to/xpi</string>
2891     </array>
2892     <key>Uninstall</key>
2893     <array>
2894       <string>bad_addon_id@mozilla.org</string>
2895     </array>
2896     <key>Locked</key>
2897     <array>
2898       <string>addon_id@mozilla.org</string>
2899     </array>
2900   </dict>
2901 </dict>
2902 ```
2903 #### policies.json
2904 ```
2905 {
2906   "policies": {
2907     "Extensions": {
2908       "Install": ["https://addons.mozilla.org/firefox/downloads/somefile.xpi", "//path/to/xpi"],
2909       "Uninstall": ["bad_addon_id@mozilla.org"],
2910       "Locked":  ["addon_id@mozilla.org"]
2911     }
2912   }
2913 }
2914 ```
2915 ### ExtensionSettings
2916 Manage all aspects of extensions. This policy is based heavily on the [Chrome policy](https://dev.chromium.org/administrators/policy-list-3/extension-settings-full) of the same name.
2917
2918 This policy maps an extension ID to its configuration. With an extension ID, the configuration will be applied to the specified extension only. A default configuration can be set for the special ID "*", which will apply to all extensions that don't have a custom configuration set in this policy.
2919
2920 To obtain an extension ID, install the extension and go to about:support. You will see the ID in the Extensions section. I've also created an extension that makes it easy to find the ID of extensions on AMO. You can download it [here](https://github.com/mkaply/queryamoid/releases/tag/v0.1).
2921
2922 The configuration for each extension is another dictionary that can contain the fields documented below.
2923
2924 | Name | Description |
2925 | --- | --- |
2926 | `installation_mode` | Maps to a string indicating the installation mode for the extension. The valid strings are `allowed`,`blocked`,`force_installed`, and `normal_installed`.
2927 | &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;`allowed` | Allows the extension to be installed by the user. This is the default behavior. There is no need for an install_url; it will automatically be allowed based on the ID.
2928 | &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;`blocked`| Blocks installation of the extension and removes it from the device if already installed.
2929 | &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;`force_installed`| The extension is automatically installed and can't be removed by the user. This option is not valid for the default configuration and requires an install_url.
2930 | &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;`normal_installed`| The extension is automatically installed but can be disabled by the user. This option is not valid for the default configuration and requires an install_url.
2931 | `install_url`| Maps to a URL indicating where Firefox can download a force_installed or normal_installed extension.  If installing from the local file system, use a [```file:///``` URL](https://en.wikipedia.org/wiki/File_URI_scheme). If installing from the addons.mozilla.org, use the following URL (substituting SHORT_NAME from the URL on AMO), https://addons.mozilla.org/firefox/downloads/latest/SHORT_NAME/latest.xpi. Languages packs are available from https://releases.mozilla.org/pub/firefox/releases/VERSION/PLATFORM/xpi/LANGUAGE.xpi. If you need to update the extension, you can change the name of the extension and it will be automatically updated. Extensions installed from file URLs will additional be updated when their internal version changes.
2932 | `install_sources` | A list of sources from which installing extensions is allowed using URL match patterns. **This is unnecessary if you are only allowing the installation of certain extensions by ID.** Each item in this list is an extension-style match pattern. Users will be able to easily install items from any URL that matches an item in this list. Both the location of the *.xpi file and the page where the download is started from (i.e.  the referrer) must be allowed by these patterns. This setting can be used only for the default configuration.
2933 | `allowed_types` | This setting whitelists the allowed types of extension/apps that can be installed in Firefox. The value is a list of strings, each of which should be one of the following: "extension", "theme", "dictionary", "locale" This setting can be used only for the default configuration.
2934 | `blocked_install_message` | This maps to a string specifying the error message to display to users if they're blocked from installing an extension. This setting allows you to append text to the generic error message displayed when the extension is blocked. This could be be used to direct users to your help desk, explain why a particular extension is blocked, or something else. This setting can be used only for the default configuration.
2935 | `restricted_domains` | An array of domains on which content scripts can't be run. This setting can be used only for the default configuration.
2936 | `updates_disabled` | (Firefox 89, Firefox ESR 78.11) Boolean that indicates whether or not to disable automatic updates for an individual extension.
2937 | `default_area` | (Firefox 113) String that indicates where to place the extension icon by default. Possible values are `navbar` and `menupanel`.
2938 | `temporarily_allow_weak_signatures`| (Firefox 127) A boolean that indicates whether to allow installing extensions signed using deprecated signature algorithms.
2939
2940 **Compatibility:** Firefox 69, Firefox ESR 68.1 (As of Firefox 85, Firefox ESR 78.7, installing a theme makes it the default.)\
2941 **CCK2 Equivalent:** N/A\
2942 **Preferences Affected:** N/A
2943
2944 #### Windows (GPO)
2945 Software\Policies\Mozilla\Firefox\ExtensionSettings (REG_MULTI_SZ) =
2946 ```
2947 {
2948   "*": {
2949     "blocked_install_message": "Custom error message.",
2950     "install_sources": ["https://yourwebsite.com/*"],
2951     "installation_mode": "blocked",
2952     "allowed_types": ["extension"]
2953   },
2954   "uBlock0@raymondhill.net": {
2955     "installation_mode": "force_installed",
2956     "install_url": "https://addons.mozilla.org/firefox/downloads/latest/ublock-origin/latest.xpi"
2957   },
2958   "https-everywhere@eff.org": {
2959     "installation_mode": "allowed",
2960     "updates_disabled": false
2961   }
2962 }
2963 ```
2964 #### Windows (Intune)
2965 OMA-URI:
2966 ```
2967 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~Extensions/ExtensionSettings
2968 ```
2969 Value (string):
2970 ```
2971 <enabled/>
2972 <data id="ExtensionSettings" value='
2973 {
2974   "*": {
2975     "blocked_install_message": "Custom error message.",
2976     "install_sources": ["https://yourwebsite.com/*"],
2977     "installation_mode": "blocked",
2978     "allowed_types": ["extension"]
2979   },
2980   "uBlock0@raymondhill.net": {
2981     "installation_mode": "force_installed",
2982     "install_url": "https://addons.mozilla.org/firefox/downloads/latest/ublock-origin/latest.xpi"
2983   },
2984     "https-everywhere@eff.org": {
2985     "installation_mode": "allowed",
2986     "updates_disabled": false
2987   }
2988 }'/>
2989 ```
2990 If you are using custom ADMX and ADML administrative templates in Intune, you can use this OMA-URI instead
2991 to workaround the limit on the length of strings. Put all of your JSON on one line.
2992
2993 OMA-URI:
2994 ```
2995 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~Extensions/ExtensionSettingsOneLine
2996 ```
2997 Value (string):
2998 ```
2999 <enabled/>
3000 <data id="JSONOneLine" value='{}'/>
3001 ```
3002 #### macOS
3003 ```
3004 <dict>
3005   <key>ExtensionSettings</key>
3006   <dict>
3007     <key>*</key>
3008     <dict>
3009       <key>blocked_install_message</key>
3010       <string>Custom error message.</string>
3011       <key>install_sources</key>
3012       <array>
3013         <string>"https://yourwebsite.com/*"</string>
3014       </array>
3015       <key>installation_mode</key>
3016       <string>blocked</string>
3017       <key>allowed_types</key>
3018       <array>
3019         <string>extension</string>
3020       </array>
3021     </dict>
3022     <key>uBlock0@raymondhill.net</key>
3023     <dict>
3024       <key>installation_mode</key>
3025       <string>force_installed</string>
3026       <key>install_url</key>
3027       <string>https://addons.mozilla.org/firefox/downloads/latest/ublock-origin/latest.xpi</string>
3028     </dict>
3029     <key>https-everywhere@eff.org</key>
3030     <dict>
3031       <key>installation_mode</key>
3032       <string>allowed</string>
3033       <key>updates_disabled</key>
3034       <true/> | <false/>
3035     </dict>
3036   </dict>
3037 </dict>
3038 ```
3039 #### policies.json
3040 ```
3041 {
3042   "policies": {
3043     "ExtensionSettings": {
3044       "*": {
3045         "blocked_install_message": "Custom error message.",
3046         "install_sources": ["https://yourwebsite.com/*"],
3047         "installation_mode": "blocked",
3048         "allowed_types": ["extension"]
3049       },
3050       "uBlock0@raymondhill.net": {
3051         "installation_mode": "force_installed",
3052         "install_url": "https://addons.mozilla.org/firefox/downloads/latest/ublock-origin/latest.xpi"
3053       },
3054       "https-everywhere@eff.org": {
3055         "installation_mode": "allowed",
3056         "updates_disabled": false
3057       }
3058     }
3059   }
3060 }
3061 ```
3062 ### ExtensionUpdate
3063 Control extension updates.
3064
3065 **Compatibility:** Firefox 67, Firefox ESR 60.7\
3066 **CCK2 Equivalent:** N/A\
3067 **Preferences Affected:** `extensions.update.enabled`
3068
3069 #### Windows (GPO)
3070 ```
3071 Software\Policies\Mozilla\Firefox\ExtensionUpdate = 0x1 | 0x0
3072 ```
3073 #### Windows (Intune)
3074 OMA-URI:
3075 ```
3076 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~Extensions/ExtensionUpdate
3077 ```
3078 Value (string):
3079 ```
3080 <enabled/> or <disabled/>
3081 ```
3082 #### macOS
3083 ```
3084 <dict>
3085   <key>ExtensionUpdate</key>
3086   <true/> | <false/>
3087 </dict>
3088 ```
3089 #### policies.json
3090 ```
3091 {
3092   "policies": {
3093     "ExtensionUpdate": true | false
3094   }
3095 }
3096 ```
3097 ### FirefoxHome
3098 Customize the Firefox Home page.
3099
3100 **Compatibility:** Firefox 68, Firefox ESR 68 (SponsoredTopSites and SponsoredPocket were added in Firefox 95, Firefox ESR 91.4, Snippets was deprecated in Firefox 122)
3101 **CCK2 Equivalent:** N/A\
3102 **Preferences Affected:** `browser.newtabpage.activity-stream.showSearch`, `browser.newtabpage.activity-stream.feeds.topsites`, `browser.newtabpage.activity-stream.feeds.section.highlights`, `browser.newtabpage.activity-stream.feeds.section.topstories`, `browser.newtabpage.activity-stream.feeds.snippets`, `browser.newtabpage.activity-stream.showSponsoredTopSites`, `browser.newtabpage.activity-stream.showSponsored`
3103
3104 #### Windows (GPO)
3105 ```
3106 Software\Policies\Mozilla\Firefox\FirefoxHome\Search = 0x1 | 0x0
3107 Software\Policies\Mozilla\Firefox\FirefoxHome\TopSites = 0x1 | 0x0
3108 Software\Policies\Mozilla\Firefox\FirefoxHome\SponsoredTopSites = 0x1 | 0x0
3109 Software\Policies\Mozilla\Firefox\FirefoxHome\Highlights = 0x1 | 0x0
3110 Software\Policies\Mozilla\Firefox\FirefoxHome\Pocket = 0x1 | 0x0
3111 Software\Policies\Mozilla\Firefox\FirefoxHome\SponsoredPocket = 0x1 | 0x0
3112 Software\Policies\Mozilla\Firefox\FirefoxHome\Snippets = 0x1 | 0x0
3113 Software\Policies\Mozilla\Firefox\FirefoxHome\Locked = 0x1 | 0x0
3114 ```
3115 #### Windows (Intune)
3116 OMA-URI:
3117 ```
3118 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox/CustomizeFirefoxHome
3119 ```
3120 Value (string):
3121 ```
3122 <enabled/>
3123 <data id="FirefoxHome_Search"  value="true | false"/>
3124 <data id="FirefoxHome_TopSites"  value="true | false"/>
3125 <data id="FirefoxHome_SponsoredTopSites"  value="true | false"/>
3126 <data id="FirefoxHome_Highlights"  value="true | false"/>
3127 <data id="FirefoxHome_Pocket"  value="true | false"/>
3128 <data id="FirefoxHome_SponsoredPocket"  value="true | false"/>
3129 <data id="FirefoxHome_Snippets"  value="true | false"/>
3130 <data id="FirefoxHome_Locked"  value="true | false"/>
3131 ```
3132 #### macOS
3133 ```
3134 <dict>
3135   <key>FirefoxHome</key>
3136   <dict>
3137     <key>Search</key>
3138     <true/> | <false/>
3139     <key>TopSites</key>
3140     <true/> | <false/>
3141     <key>SponsoredTopSites</key>
3142     <true/> | <false/>
3143     <key>Highlights</key>
3144     <true/> | <false/>
3145     <key>Pocket</key>
3146     <true/> | <false/>
3147     <key>SponsoredPocket</key>
3148     <true/> | <false/>
3149     <key>Snippets</key>
3150     <true/> | <false/>
3151     <key>Locked</key>
3152     <true/> | <false/>
3153   </dict>
3154 </dict>
3155 ```
3156 #### policies.json
3157 ```
3158 {
3159   "policies": {
3160     "FirefoxHome": {
3161       "Search": true | false,
3162       "TopSites": true | false,
3163       "SponsoredTopSites": true | false,
3164       "Highlights": true | false,
3165       "Pocket": true | false,
3166       "SponsoredPocket": true | false,
3167       "Snippets": true | false,
3168       "Locked": true | false
3169     }
3170   }
3171 }
3172 ```
3173 ### FirefoxSuggest
3174 Customize Firefox Suggest (US only).
3175
3176 **Compatibility:** Firefox 118, Firefox ESR 115.3.
3177 **CCK2 Equivalent:** N/A\
3178 **Preferences Affected:** `browser.urlbar.suggest.quicksuggest.nonsponsored`, `browser.urlbar.suggest.quicksuggest.sponsored`, `browser.urlbar.quicksuggest.dataCollection.enabled`
3179
3180 #### Windows (GPO)
3181 ```
3182 Software\Policies\Mozilla\Firefox\FirefoxSuggest\WebSuggestions = 0x1 | 0x0
3183 Software\Policies\Mozilla\Firefox\FirefoxSuggest\SponsoredSuggestions = 0x1 | 0x0
3184 Software\Policies\Mozilla\Firefox\FirefoxSuggest\ImproveSuggest = 0x1 | 0x0
3185 Software\Policies\Mozilla\Firefox\FirefoxSuggest\Locked = 0x1 | 0x0
3186 ```
3187 #### Windows (Intune)
3188 OMA-URI:
3189 ```
3190 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~FirefoxSuggest/WebSuggestions
3191 ```
3192 Value (string):
3193 ```
3194 <enabled/> or <disabled/>
3195 ```
3196 OMA-URI:
3197 ```
3198 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~FirefoxSuggest/SponsoredSuggestions
3199 ```
3200 Value (string):
3201 ```
3202 <enabled/> or <disabled/>
3203 ```
3204 OMA-URI:
3205 ```
3206 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~FirefoxSuggest/ImproveSuggest
3207 ```
3208 Value (string):
3209 ```
3210 <enabled/> or <disabled/>
3211 ```
3212 OMA-URI:
3213 ```
3214 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~FirefoxSuggest/Locked
3215 ```
3216 Value (string):
3217 ```
3218 <enabled/> or <disabled/>
3219 ```
3220 #### macOS
3221 ```
3222 <dict>
3223   <key>FirefoxSuggest</key>
3224   <dict>
3225     <key>WebSuggestions</key>
3226     <true/> | <false/>
3227     <key>SponsoredSuggestions</key>
3228     <true/> | <false/>
3229     <key>ImproveSuggest</key>
3230     <true/> | <false/>
3231     <key>Locked</key>
3232     <true/> | <false/>
3233   </dict>
3234 </dict>
3235 ```
3236 #### policies.json
3237 ```
3238 {
3239   "policies": {
3240     "FirefoxSuggest": {
3241       "WebSuggestions": true | false,
3242       "SponsoredSuggestions": true | false,
3243       "ImproveSuggest": true | false,
3244       "Locked": true | false
3245     }
3246   }
3247 }
3248 ```
3249 ### GoToIntranetSiteForSingleWordEntryInAddressBar
3250 Whether to always go through the DNS server before sending a single word search string to a search engine.
3251
3252 If the site exists, it will navigate to the website. If the intranet responds with a 404, the page will show a 404. If the intranet does not respond, the browser will attempt a search.
3253
3254 The second result in the URL bar will be a search result to allow users to conduct a web search exactly as it was entered.
3255
3256 If instead you would like to enable the ability to have your domain appear as a valid URL and to disallow the browser from ever searching that term using the first result that matches it, add the pref `browser.fixup.domainwhitelist.YOUR_DOMAIN` (where `YOUR_DOMAIN` is the name of the domain you'd like to add), and set the pref to `true`. The URL bar will then suggest `YOUR_DOMAIN` when the user fully types `YOUR_DOMAIN`. If the user attempts to load that domain and it fails to load, it will show an "Unable to connect" error page.
3257
3258 You can also whitelist a domain suffix that is not part of the [Public Suffix List](https://publicsuffix.org/) by adding the pref `browser.fixup.domainsuffixwhitelist.YOUR_DOMAIN_SUFFIX` with a value of `true`.
3259
3260 Additionally, if you want users to see a "Did you mean to go to 'YOUR_DOMAIN'" prompt below the URL bar if they land on a search results page instead of an intranet domain that provides a response, set the pref `browser.urlbar.dnsResolveSingleWordsAfterSearch` to `1`. Enabling this will cause the browser to commit a DNS check after every single word search. If the browser receives a response from the intranet, a prompt will ask the user if they'd like to instead navigate to `YOUR_DOMAIN`. If the user presses the **yes** button, `browser.fixup.domainwhitelist.YOUR_DOMAIN` will be set to `true`.
3261
3262 **Compatibility:** Firefox 104, Firefox ESR 102.2\
3263 **CCK2 Equivalent:** `N/A`\
3264 **Preferences Affected:** `browser.fixup.dns_first_for_single_words`
3265
3266 #### Windows (GPO)
3267 ```
3268 Software\Policies\Mozilla\Firefox\GoToIntranetSiteForSingleWordEntryInAddressBar = 0x1 | 0x0
3269 ```
3270 #### Windows (Intune)
3271 OMA-URI:
3272 ```
3273 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox/GoToIntranetSiteForSingleWordEntryInAddressBar
3274 ```
3275 Value (string):
3276 ```
3277 <enabled/> or <disabled/>
3278 ```
3279 #### macOS
3280 ```
3281 <dict>
3282   <key>GoToIntranetSiteForSingleWordEntryInAddressBar</key>
3283   <true/> | <false/>
3284 </dict>
3285 ```
3286 #### policies.json
3287 ```
3288 {
3289   "policies": {
3290     "GoToIntranetSiteForSingleWordEntryInAddressBar": true | false
3291   }
3292 }
3293 ```
3294 ### Handlers
3295 Configure default application handlers. This policy is based on the internal format of `handlers.json`.
3296
3297 You can configure handlers based on a mime type (`mimeTypes`), a file's extension (`extensions`), or a protocol (`schemes`).
3298
3299 Within each handler type, you specify the given mimeType/extension/scheme as a key and use the following subkeys to describe how it is handled.
3300
3301 | Name | Description |
3302 | --- | --- |
3303 | `action`| Can be either `saveToDisk`, `useHelperApp`, `useSystemDefault`.
3304 | `ask` | If `true`, the user is asked if what they want to do with the file. If `false`, the action is taken without user intervention.
3305 | `handlers` | An array of handlers with the first one being the default. If you don't want to have a default handler, use an empty object for the first handler. Choose between path or uriTemplate.
3306 | &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;`name` | The display name of the handler (might not be used).
3307 | &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;`path`| The native path to the executable to be used.
3308 | &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;`uriTemplate`| A url to a web based application handler. The URL must be https and contain a %s to be used for substitution.
3309
3310 **Compatibility:** Firefox 78, Firefox ESR 78\
3311 **CCK2 Equivalent:** N/A\
3312 **Preferences Affected:** N/A
3313
3314 #### Windows (GPO)
3315 Software\Policies\Mozilla\Firefox\Handlers (REG_MULTI_SZ) =
3316 ```
3317 {
3318   "mimeTypes": {
3319     "application/msword": {
3320       "action": "useSystemDefault",
3321       "ask": true | false
3322     }
3323   },
3324   "schemes": {
3325     "mailto": {
3326       "action": "useHelperApp",
3327       "ask": true | false,
3328       "handlers": [{
3329         "name": "Gmail",
3330         "uriTemplate": "https://mail.google.com/mail/?extsrc=mailto&url=%s"
3331       }]
3332     }
3333   },
3334   "extensions": {
3335     "pdf": {
3336       "action": "useHelperApp",
3337       "ask": true | false,
3338       "handlers": [{
3339         "name": "Adobe Acrobat",
3340         "path": "C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\AcroRd32.exe"
3341       }]
3342     }
3343   }
3344 }
3345 ```
3346 #### Windows (Intune)
3347 OMA-URI:
3348 ```
3349 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox/Handlers
3350 ```
3351 Value (string):
3352 ```
3353 <enabled/>
3354 <data id="Handlers" value='
3355 {
3356   "mimeTypes": {
3357     "application/msword": {
3358       "action": "useSystemDefault",
3359       "ask": true | false
3360     }
3361   },
3362   "schemes": {
3363     "mailto": {
3364       "action": "useHelperApp",
3365       "ask": true | false,
3366       "handlers": [{
3367         "name": "Gmail",
3368         "uriTemplate": "https://mail.google.com/mail/?extsrc=mailto&amp;url=%s"
3369       }]
3370     }
3371   },
3372   "extensions": {
3373     "pdf": {
3374       "action": "useHelperApp",
3375       "ask": true | false,
3376       "handlers": [{
3377         "name": "Adobe Acrobat",
3378         "path": "C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\AcroRd32.exe"
3379       }]
3380     }
3381   }
3382 }
3383 '/>
3384 ```
3385 If you are using custom ADMX and ADML administrative templates in Intune, you can use this OMA-URI instead
3386 to workaround the limit on the length of strings. Put all of your JSON on one line.
3387
3388 OMA-URI:
3389 ```
3390 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~Extensions/HandlersOneLine
3391 ```
3392 Value (string):
3393 ```
3394 <enabled/>
3395 <data id="JSONOneLine" value='{}'/>
3396 ```
3397 #### macOS
3398 ```
3399 <dict>
3400   <key>Handlers</key>
3401   <dict>
3402     <key>mimeTypes</key>
3403     <dict>
3404       <key>application/msword</key>
3405       <dict>
3406         <key>action</key>
3407         <string>useSystemDefault</string>
3408         <key>ask</key>
3409         <true/> | <false/>
3410       </dict>
3411     </dict>
3412     <key>schemes</key>
3413     <dict>
3414       <key>mailto</key>
3415       <dict>
3416         <key>action</key>
3417         <string>useHelperApp</string>
3418         <key>ask</key>
3419         <true/> | <false/>
3420         <key>handlers</key>
3421         <array>
3422           <dict>
3423             <key>name</key>
3424             <string>Gmail</string>
3425             <key>uriTemplate</key>
3426             <string>https://mail.google.com/mail/?extsrc=mailto&url=%s</string>
3427           </dict>
3428         </array>
3429       </dict>
3430     </dict>
3431     <key>extensions</key>
3432     <dict>
3433       <key>pdf</key>
3434       <dict>
3435         <key>action</key>
3436         <string>useHelperApp</string>
3437         <key>ask</key>
3438         <true/> | <false/>
3439         <key>handlers</key>
3440         <array>
3441           <dict>
3442             <key>name</key>
3443             <string>Adobe Acrobat</string>
3444             <key>path</key>
3445             <string>/System/Applications/Preview.app</string>
3446           </dict>
3447         </array>
3448       </dict>
3449     </dict>
3450   </dict>
3451 </dict>
3452 ```
3453 #### policies.json
3454 ```
3455 {
3456   "policies": {
3457     "Handlers": {
3458       "mimeTypes": {
3459         "application/msword": {
3460           "action": "useSystemDefault",
3461           "ask": false
3462         }
3463       },
3464       "schemes": {
3465         "mailto": {
3466           "action": "useHelperApp",
3467           "ask": true | false,
3468           "handlers": [{
3469             "name": "Gmail",
3470             "uriTemplate": "https://mail.google.com/mail/?extsrc=mailto&url=%s"
3471           }]
3472         }
3473       },
3474       "extensions": {
3475         "pdf": {
3476           "action": "useHelperApp",
3477           "ask": true | false,
3478           "handlers": [{
3479             "name": "Adobe Acrobat",
3480             "path": "/usr/bin/acroread"
3481           }]
3482         }
3483       }
3484     }
3485   }
3486 }
3487 ```
3488 ### HardwareAcceleration
3489 Control hardware acceleration.
3490
3491 **Compatibility:** Firefox 60, Firefox ESR 60\
3492 **CCK2 Equivalent:** N/A\
3493 **Preferences Affected:** `layers.acceleration.disabled`
3494
3495 #### Windows (GPO)
3496 ```
3497 Software\Policies\Mozilla\Firefox\HardwareAcceleration = 0x1 | 0x0
3498 ```
3499 #### Windows (Intune)
3500 OMA-URI:
3501 ```
3502 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox/HardwareAcceleration
3503 ```
3504 Value (string):
3505 ```
3506 <enabled/> or <disabled/>
3507 ```
3508 #### macOS
3509 ```
3510 <dict>
3511   <key>HardwareAcceleration</key>
3512   <true/> | <false/>
3513 </dict>
3514 ```
3515 #### policies.json
3516 ```
3517 {
3518   "policies": {
3519     "HardwareAcceleration": true | false
3520   }
3521 }
3522 ```
3523 ### Homepage
3524 Configure the default homepage and how Firefox starts.
3525
3526 `URL` is the default homepage.
3527
3528 `Locked` prevents the user from changing homepage preferences.
3529
3530 `Additional` allows for more than one homepage.
3531
3532 `StartPage` is how Firefox starts. The choices are no homepage, the default homepage or the previous session.
3533
3534 With Firefox 78, an additional option as added for `Startpage`, `homepage-locked`. If this is value is set for the Startpage, the user will always get the homepage at startup and cannot choose to restore their session.
3535
3536 **Compatibility:** Firefox 60, Firefox ESR 60 (StartPage was added in Firefox 60, Firefox ESR 60.4, homepage-locked added in Firefox 78)\
3537 **CCK2 Equivalent:** `homePage`,`lockHomePage`\
3538 **Preferences Affected:** `browser.startup.homepage`, `browser.startup.page`
3539
3540 #### Windows (GPO)
3541 ```
3542 Software\Policies\Mozilla\Firefox\Homepage\URL = "https://example.com"
3543 Software\Policies\Mozilla\Firefox\Homepage\Locked = 0x1 | 0x0
3544 Software\Policies\Mozilla\Firefox\Homepage\Additional\1 = "https://example.org"
3545 Software\Policies\Mozilla\Firefox\Homepage\Additional\2 = "https://example.edu"
3546 Software\Policies\Mozilla\Firefox\Homepage\StartPage = "none" | "homepage" | "previous-session" | "homepage-locked"
3547 ```
3548 #### Windows (Intune)
3549 OMA-URI:
3550 ```
3551 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~Homepage/HomepageURL
3552 ```
3553 Value (string):
3554 ```
3555 <enabled/>
3556
3557 <data id="HomepageURL" value="https://example.com"/>
3558 <data id="HomepageLocked" value="true | false"/>
3559 ```
3560 OMA-URI:
3561 ```
3562 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~Homepage/HomepageAdditional
3563 ```
3564 Value (string):
3565 ```
3566 <enabled/>
3567
3568 <data id="HomepageAdditional" value="1&#xF000;http://example.org&#xF000;2&#xF000;http://example.edu"/>
3569 ```
3570 OMA-URI:
3571 ```
3572 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~Homepage/HomepageStartPage
3573 ```
3574 Value (string):
3575 ```
3576 <enabled/>
3577
3578 <data id="StartPage" value="none | homepage | previous-session"/>
3579 ```
3580 #### macOS
3581 ```
3582 <dict>
3583   <key>Homepage</key>
3584   <dict>
3585     <key>URL</key>
3586     <string>http://example.com</string>
3587     <key>Locked</key>
3588     <true/> | <false/>
3589     <key>Additional</key>
3590     <array>
3591       <string>http://example.org</string>
3592       <string>http://example.edu</string>
3593     </array>
3594     <key>StartPage</key>
3595     <string>none | homepage | previous-session | homepage-locked</string>
3596   </dict>
3597 </dict>
3598 ```
3599 #### policies.json
3600 ```
3601 {
3602   "policies": {
3603     "Homepage": {
3604       "URL": "http://example.com/",
3605       "Locked": true | false,
3606       "Additional": ["http://example.org/",
3607                      "http://example.edu/"],
3608       "StartPage": "none" | "homepage" | "previous-session" | "homepage-locked"
3609     }
3610   }
3611 }
3612 ```
3613 ### HttpAllowlist
3614 Configure sites that will not be upgraded to HTTPS.
3615
3616 The sites are specified as a list of origins.
3617
3618 **Compatibility:** Firefox 127\
3619 **CCK2 Equivalent:** N/A\
3620 **Preferences Affected:** N/A
3621
3622 #### Windows (GPO)
3623 ```
3624 Software\Policies\Mozilla\Firefox\HttpAllowlist\1 = "http://example.org"
3625 Software\Policies\Mozilla\Firefox\HttpAllowlist\2 = "http://example.edu"
3626 ```
3627 #### Windows (Intune)
3628 OMA-URI:
3629 ```
3630 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox/HttpAllowlist
3631 ```
3632 Value (string):
3633 ```
3634 <enabled/>
3635 <data id="List" value="1&#xF000;http://example.org&#xF000;2&#xF000;http://example.edu"/>
3636 ```
3637 #### macOS
3638 ```
3639 <dict>
3640   <key>HttpAllowlist </key>
3641   <array>
3642     <string>http://example.org</string>
3643     <string>http://example.edu</string>
3644   </array>
3645 </dict>
3646 ```
3647 #### policies.json
3648 ```
3649 {
3650   "policies": {
3651     "HttpAllowlist ": ["http://example.org",
3652                        "http://example.edu"]
3653   }
3654 }
3655 ```
3656 ### HttpsOnlyMode
3657 Configure HTTPS-Only Mode.
3658
3659 | Value | Description
3660 | --- | --- |
3661 | allowed | HTTPS-Only Mode is off by default, but the user can turn it on.
3662 | disallowed | HTTPS-Only Mode is off and the user can't turn it on.
3663 | enabled | HTTPS-Only Mode is on by default, but the user can turn it off.
3664 | force_enabled | HTTPS-Only Mode is on and the user can't turn it off.
3665
3666 **Compatibility:** Firefox 127\
3667 **CCK2 Equivalent:** N/A\
3668 **Preferences Affected:** `dom.security.https_only_mode`
3669
3670 #### Windows (GPO)
3671 ```
3672 Software\Policies\Mozilla\Firefox\HttpsOnlyMode = "allowed", "disallowed", "enabled", "force_enabled"
3673 ```
3674 #### Windows (Intune)
3675 OMA-URI:
3676 ```
3677 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox/HttpsOnlyMode
3678 ```
3679 Value (string):
3680 ```
3681 <enabled/>
3682 <data id="HttpsOnlyMode" value="allowed | disallowed | enabled | force_enabled"/>
3683 ```
3684 #### macOS
3685 ```
3686 <dict>
3687   <key>HttpsOnlyMode</key>
3688   <string>allowed | disallowed | enabled | force_enabled</string>
3689 </dict>
3690 ```
3691 #### policies.json
3692 ```
3693 {
3694   "policies": {
3695     "HttpsOnlyMode": "allowed" | "disallowed" | "enabled" | "force_enabled"
3696   }
3697 }
3698 ```
3699 ### InstallAddonsPermission
3700 Configure the default extension install policy as well as origins for extension installs are allowed. This policy does not override turning off all extension installs.
3701
3702 `Allow` is a list of origins where extension installs are allowed.
3703
3704 `Default` determines whether or not extension installs are allowed by default.
3705
3706 **Compatibility:** Firefox 60, Firefox ESR 60\
3707 **CCK2 Equivalent:** `permissions.install`\
3708 **Preferences Affected:** `xpinstall.enabled`, `browser.newtabpage.activity-stream.asrouter.userprefs.cfr.addons`, `browser.newtabpage.activity-stream.asrouter.userprefs.cfr.features`
3709
3710 #### Windows (GPO)
3711 ```
3712 Software\Policies\Mozilla\Firefox\InstallAddonsPermission\Allow\1 = "https://example.org"
3713 Software\Policies\Mozilla\Firefox\InstallAddonsPermission\Allow\2 = "https://example.edu"
3714 Software\Policies\Mozilla\Firefox\InstallAddonsPermission\Default = 0x1 | 0x0
3715 ```
3716 #### Windows (Intune)
3717 OMA-URI:
3718 ```
3719 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~Addons/InstallAddonsPermission_Allow
3720 ```
3721 Value (string):
3722 ```
3723 <enabled/>
3724 <data id="Permissions" value="1&#xF000;https://example.org&#xF000;2&#xF000;https://example.edu"/>
3725 ```
3726 OMA-URI:
3727 ```
3728 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~Addons/InstallAddonsPermission_Default
3729 ```
3730 Value (string):
3731 ```
3732 <enabled/>
3733 ```
3734 #### macOS
3735 ```
3736 <dict>
3737   <key>InstallAddonsPermission</key>
3738   <dict>
3739     <key>Allow</key>
3740     <array>
3741       <string>http://example.org</string>
3742       <string>http://example.edu</string>
3743     </array>
3744     <key>Default</key>
3745     <true/> | <false/>
3746   </dict>
3747 </dict>
3748 ```
3749 #### policies.json
3750 ```
3751 {
3752   "policies": {
3753     "InstallAddonsPermission": {
3754       "Allow": ["http://example.org/",
3755                 "http://example.edu/"],
3756       "Default": true | false
3757     }
3758   }
3759 }
3760 ```
3761 ### LegacyProfiles
3762 Disable the feature enforcing a separate profile for each installation.
3763
3764 If this policy set to true, Firefox will not try to create different profiles for installations of Firefox in different directories. This is the equivalent of the MOZ_LEGACY_PROFILES environment variable.
3765
3766 If this policy set to false, Firefox will create a new profile for each unique installation of Firefox.
3767
3768 This policy only work on Windows via GPO (not policies.json).
3769
3770 **Compatibility:** Firefox 70, Firefox ESR 68.2 (Windows only, GPO only)\
3771 **CCK2 Equivalent:** N/A\
3772 **Preferences Affected:** N/A
3773
3774 #### Windows (GPO)
3775 ```
3776 Software\Policies\Mozilla\Firefox\LegacyProfiles = = 0x1 | 0x0
3777 ```
3778 #### Windows (Intune)
3779 OMA-URI:
3780 ```
3781 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox/LegacyProfiles
3782 ```
3783 Value (string):
3784 ```
3785 <enabled/> or <disabled/>
3786 ```
3787 ### LegacySameSiteCookieBehaviorEnabled
3788 Enable default legacy SameSite cookie behavior setting.
3789
3790 If this policy is set to true, it reverts all cookies to legacy SameSite behavior which means that cookies that don't explicitly specify a ```SameSite``` attribute are treated as if they were ```SameSite=None```.
3791
3792 **Compatibility:** Firefox 96\
3793 **CCK2 Equivalent:** N/A\
3794 **Preferences Affected:** `network.cookie.sameSite.laxByDefault`
3795
3796 #### Windows (GPO)
3797 ```
3798 Software\Policies\Mozilla\Firefox\LegacySameSiteCookieBehaviorEnabled = = 0x1 | 0x0
3799 ```
3800 #### Windows (Intune)
3801 OMA-URI:
3802 ```
3803 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox/LegacySameSiteCookieBehaviorEnabled
3804 ```
3805 Value (string):
3806 ```
3807 <enabled/> or <disabled/>
3808 ```
3809 #### macOS
3810 ```
3811 <dict>
3812   <key>LegacySameSiteCookieBehaviorEnabled</key>
3813   <true/> | <false/>
3814 </dict>
3815 ```
3816 #### policies.json
3817 ```
3818 {
3819   "policies": {
3820     "LegacySameSiteCookieBehaviorEnabled": true | false
3821 }
3822 ```
3823 ### LegacySameSiteCookieBehaviorEnabledForDomainList
3824 Revert to legacy SameSite behavior for cookies on specified sites.
3825
3826 If this policy is set to true, cookies set for domains in this list will revert to legacy SameSite behavior which means that cookies that don't explicitly specify a ```SameSite``` attribute are treated as if they were ```SameSite=None```.
3827
3828 **Compatibility:** Firefox 96\
3829 **CCK2 Equivalent:** N/A\
3830 **Preferences Affected:** `network.cookie.sameSite.laxByDefault.disabledHosts`
3831
3832 #### Windows (GPO)
3833 ```
3834 Software\Policies\Mozilla\Firefox\LegacySameSiteCookieBehaviorEnabledForDomainList\1 = "example.org"
3835 Software\Policies\Mozilla\Firefox\LegacySameSiteCookieBehaviorEnabledForDomainList\2 = "example.edu"
3836 ```
3837 #### Windows (Intune)
3838 OMA-URI:
3839 ```
3840 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox/LegacySameSiteCookieBehaviorEnabledForDomainList
3841 ```
3842 Value (string):
3843 ```
3844 <enabled/>
3845 <data id="LegacySameSiteCookieBehaviorEnabledForDomainList" value="1&#xF000;example.org&#xF000;2&#xF000;example.edu"/>
3846 ```
3847 #### macOS
3848 ```
3849 <dict>
3850   <key>LegacySameSiteCookieBehaviorEnabledForDomainList</key>
3851   <array>
3852     <string>example.org</string>
3853     <string>example.edu</string>
3854   </array>
3855 </dict>
3856 ```
3857 #### policies.json
3858 ```
3859 {
3860   "policies": {
3861     "LegacySameSiteCookieBehaviorEnabledForDomainList": ["example.org",
3862                                                          "example.edu"]
3863   }
3864 }
3865 ```
3866 ### LocalFileLinks
3867 Enable linking to local files by origin.
3868
3869 **Compatibility:** Firefox 68, Firefox ESR 68\
3870 **CCK2 Equivalent:** N/A\
3871 **Preferences Affected:** `capability.policy.localfilelinks.*`
3872
3873 #### Windows (GPO)
3874 ```
3875 Software\Policies\Mozilla\Firefox\LocalFileLinks\1 = "https://example.org"
3876 Software\Policies\Mozilla\Firefox\LocalFileLinks\2 = "https://example.edu"
3877 ```
3878 #### Windows (Intune)
3879 OMA-URI:
3880 ```
3881 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox/LocalFileLinks
3882 ```
3883 Value (string):
3884 ```
3885 <enabled/>
3886 <data id="LocalFileLinks" value="1&#xF000;https://example.org&#xF000;2&#xF000;https://example.edu"/>
3887 ```
3888 #### macOS
3889 ```
3890 <dict>
3891   <key>LocalFileLinks</key>
3892   <array>
3893     <string>http://example.org</string>
3894     <string>http://example.edu</string>
3895   </array>
3896 </dict>
3897 ```
3898 #### policies.json
3899 ```
3900 {
3901   "policies": {
3902     "LocalFileLinks": ["http://example.org/",
3903                        "http://example.edu/"]
3904   }
3905 }
3906 ```
3907 ### ManagedBookmarks
3908 Configures a list of bookmarks managed by an administrator that cannot be changed by the user.
3909
3910 The bookmarks are only added as a button on the personal toolbar. They are not in the bookmarks folder.
3911
3912 The syntax of this policy is exactly the same as the [Chrome ManagedBookmarks policy](https://cloud.google.com/docs/chrome-enterprise/policies/?policy=ManagedBookmarks). The schema is:
3913 ```
3914 {
3915  "items": {
3916   "id": "BookmarkType",
3917   "properties": {
3918    "children": {
3919     "items": {
3920      "$ref": "BookmarkType"
3921     },
3922     "type": "array"
3923    },
3924    "name": {
3925     "type": "string"
3926    },
3927    "toplevel_name": {
3928     "type": "string"
3929    },
3930    "url": {
3931     "type": "string"
3932    }
3933   },
3934   "type": "object"
3935  },
3936  "type": "array"
3937 }
3938 ```
3939 **Compatibility:** Firefox 83, Firefox ESR 78.5\
3940 **CCK2 Equivalent:** N/A\
3941 **Preferences Affected:** N/A
3942
3943 #### Windows (GPO)
3944 Software\Policies\Mozilla\Firefox\ManagedBookmarks (REG_MULTI_SZ) =
3945 ```
3946 [
3947   {
3948     "toplevel_name": "My managed bookmarks folder"
3949   },
3950   {
3951     "url": "example.com",
3952     "name": "Example"
3953   },
3954   {
3955     "name": "Mozilla links",
3956     "children": [
3957       {
3958         "url": "https://mozilla.org",
3959         "name": "Mozilla.org"
3960       },
3961       {
3962         "url": "https://support.mozilla.org/",
3963         "name": "SUMO"
3964       }
3965     ]
3966   }
3967 ]
3968 ```
3969 #### Windows (Intune)
3970 OMA-URI:
3971 ```
3972 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox/ManagedBookmarks
3973 ```
3974 Value (string):
3975 ```
3976 <enabled/>
3977 <data id="JSON" value='
3978 [
3979   {
3980     "toplevel_name": "My managed bookmarks folder"
3981   },
3982   {
3983     "url": "example.com",
3984     "name": "Example"
3985   },
3986   {
3987     "name": "Mozilla links",
3988     "children": [
3989       {
3990         "url": "https://mozilla.org",
3991         "name": "Mozilla.org"
3992       },
3993       {
3994         "url": "https://support.mozilla.org/",
3995         "name": "SUMO"
3996       }
3997     ]
3998   }
3999 ]'/>
4000 ```
4001 If you are using custom ADMX and ADML administrative templates in Intune, you can use this OMA-URI instead
4002 to workaround the limit on the length of strings. Put all of your JSON on one line.
4003
4004 OMA-URI:
4005 ```
4006 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~Extensions/ManagedBoomarksOneLine
4007 ```
4008 Value (string):
4009 ```
4010 <enabled/>
4011 <data id="JSONOneLine" value='[]'/>
4012 ```
4013 #### macOS
4014 ```
4015 <dict>
4016   <key>ManagedBookmarks</key>
4017   <array>
4018     <dict>
4019       <key>toplevel_name</key>
4020       <string>My managed bookmarks folder</string>
4021       <dict>
4022         <key>url</key>
4023         <string>example.com</string>
4024         <key>name</key>
4025         <string>Example</string>
4026       </dict>
4027       <dict>
4028       <key>name</key>
4029       <string>Mozilla links</string>
4030       <key>children</key>
4031       <array>
4032         <dict>
4033           <key>url</key>
4034           <string>https://mozilla.org</string>
4035           <key>name</key>
4036           <string>Mozilla</string>
4037         </dict>
4038         <dict>
4039           <key>url</key>
4040           <string>https://support.mozilla.org/</string>
4041           <key>name</key>
4042           <string>SUMO</string>
4043         </dict>
4044       </array>
4045     </dict>
4046   </array>
4047 </dict>
4048 ```
4049 #### policies.json
4050 ```
4051 {
4052   "policies": {
4053     "ManagedBookmarks": [
4054       {
4055         "toplevel_name": "My managed bookmarks folder"
4056       },
4057       {
4058         "url": "example.com",
4059         "name": "Example"
4060       },
4061       {
4062         "name": "Mozilla links",
4063         "children": [
4064           {
4065             "url": "https://mozilla.org",
4066             "name": "Mozilla.org"
4067           },
4068           {
4069             "url": "https://support.mozilla.org/",
4070             "name": "SUMO"
4071           }
4072         ]
4073       }
4074     ]
4075   }
4076 }
4077 ```
4078 ### ManualAppUpdateOnly
4079
4080 Switch to manual updates only.
4081
4082 If this policy is enabled:
4083  1. The user will never be prompted to install updates
4084  2. Firefox will not check for updates in the background, though it will check automatically when an update UI is displayed (such as the one in the About dialog). This check will be used to show "Update to version X" in the UI, but will not automatically download the update or prompt the user to update in any other way.
4085  3. The update UI will work as expected, unlike when using DisableAppUpdate.
4086
4087 This policy is primarily intended for advanced end users, not for enterprises, but it is available via GPO.
4088
4089 **Compatibility:** Firefox 87\
4090 **CCK2 Equivalent:** N/A\
4091 **Preferences Affected:** N/A
4092
4093 #### Windows (GPO)
4094 ```
4095 Software\Policies\Mozilla\Firefox\ManualAppUpdateOnly = 0x1 | 0x0
4096 ```
4097 #### Windows (Intune)
4098 OMA-URI:
4099 ```
4100 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox/ManualAppUpdateOnly
4101 ```
4102 Value (string):
4103 ```
4104 <enabled/> or <disabled/>
4105 ```
4106 #### macOS
4107 ```
4108 <dict>
4109   <key>ManualAppUpdateOnly</key>
4110   <true/> | <false/>
4111 </dict>
4112 ```
4113 #### policies.json
4114 ```
4115 {
4116   "policies": {
4117     "ManualAppUpdateOnly": true | false
4118   }
4119 }
4120 ```
4121 ### NetworkPrediction
4122 Enable or disable network prediction (DNS prefetching).
4123
4124 **Compatibility:** Firefox 67, Firefox ESR 60.7\
4125 **CCK2 Equivalent:** N/A\
4126 **Preferences Affected:** `network.dns.disablePrefetch`, `network.dns.disablePrefetchFromHTTPS`
4127
4128 #### Windows (GPO)
4129 ```
4130 Software\Policies\Mozilla\Firefox\NetworkPrediction = 0x1 | 0x0
4131 ```
4132 #### Windows (Intune)
4133 OMA-URI:
4134 ```
4135 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox/NetworkPrediction
4136 ```
4137 Value (string):
4138 ```
4139 <enabled/> or <disabled/>
4140 ```
4141 #### macOS
4142 ```
4143 <dict>
4144   <key>NetworkPrediction</key>
4145   <true/> | <false/>
4146 </dict>
4147 ```
4148 #### policies.json
4149 ```
4150 {
4151   "policies": {
4152     "NetworkPrediction": true | false
4153 }
4154 ```
4155 ### NewTabPage
4156 Enable or disable the New Tab page.
4157
4158 **Compatibility:** Firefox 68, Firefox ESR 68\
4159 **CCK2 Equivalent:** N/A\
4160 **Preferences Affected:** `browser.newtabpage.enabled`
4161
4162 #### Windows (GPO)
4163 ```
4164 Software\Policies\Mozilla\Firefox\NewTabPage = 0x1 | 0x0
4165 ```
4166 #### Windows (Intune)
4167 OMA-URI:
4168 ```
4169 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox/NewTabPage
4170 ```
4171 Value (string):
4172 ```
4173 <enabled/> or <disabled/>
4174 ```
4175 #### macOS
4176 ```
4177 <dict>
4178   <key>NewTabPage</key>
4179   <true/> | <false/>
4180 </dict>
4181 ```
4182 #### policies.json
4183 ```
4184 {
4185   "policies": {
4186     "NewTabPage": true | false
4187 }
4188 ```
4189 ### NoDefaultBookmarks
4190 Disable the creation of default bookmarks.
4191
4192 This policy is only effective if the user profile has not been created yet.
4193
4194 **Compatibility:** Firefox 60, Firefox ESR 60\
4195 **CCK2 Equivalent:** `removeDefaultBookmarks`\
4196 **Preferences Affected:** N/A
4197
4198 #### Windows (GPO)
4199 ```
4200 Software\Policies\Mozilla\Firefox\NoDefaultBookmarks = 0x1 | 0x0
4201 ```
4202 #### Windows (Intune)
4203 OMA-URI:
4204 ```
4205 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox/NoDefaultBookmarks
4206 ```
4207 Value (string):
4208 ```
4209 <enabled/> or <disabled/>
4210 ```
4211 #### macOS
4212 ```
4213 <dict>
4214   <key>NoDefaultBookmarks</key>
4215   <true/> | <false/>
4216 </dict>
4217 ```
4218 #### policies.json
4219 ```
4220 {
4221   "policies": {
4222     "NoDefaultBookmarks": true | false
4223   }
4224 }
4225 ```
4226 ### OfferToSaveLogins
4227 Control whether or not Firefox offers to save passwords.
4228
4229 **Compatibility:** Firefox 60, Firefox ESR 60\
4230 **CCK2 Equivalent:** `dontRememberPasswords`\
4231 **Preferences Affected:** `signon.rememberSignons`
4232
4233 #### Windows (GPO)
4234 ```
4235 Software\Policies\Mozilla\Firefox\OfferToSaveLogins = 0x1 | 0x0
4236 ```
4237 #### Windows (Intune)
4238 OMA-URI:
4239 ```
4240 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox/OfferToSaveLogins
4241 ```
4242 Value (string):
4243 ```
4244 <enabled/> or <disabled/>
4245 ```
4246 #### macOS
4247 ```
4248 <dict>
4249   <key>OfferToSaveLogins</key>
4250   <true/> | <false/>
4251 </dict>
4252 ```
4253 #### policies.json
4254 ```
4255 {
4256   "policies": {
4257     "OfferToSaveLogins": true | false
4258   }
4259 }
4260 ```
4261 ### OfferToSaveLoginsDefault
4262 Sets the default value of signon.rememberSignons without locking it.
4263
4264 **Compatibility:** Firefox 70, Firefox ESR 60.2\
4265 **CCK2 Equivalent:** `dontRememberPasswords`\
4266 **Preferences Affected:** `signon.rememberSignons`
4267
4268 #### Windows (GPO)
4269 ```
4270 Software\Policies\Mozilla\Firefox\OfferToSaveLoginsDefault = 0x1 | 0x0
4271 ```
4272 #### Windows (Intune)
4273 OMA-URI:
4274 ```
4275 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox/OfferToSaveLoginsDefault
4276 ```
4277 Value (string):
4278 ```
4279 <enabled/> or <disabled/>
4280 ```
4281 #### macOS
4282 ```
4283 <dict>
4284   <key>OfferToSaveLoginsDefault</key>
4285   <true/> | <false/>
4286 </dict>
4287 ```
4288 #### policies.json
4289 ```
4290 {
4291   "policies": {
4292     "OfferToSaveLoginsDefault": true | false
4293   }
4294 }
4295 ```
4296 ### OverrideFirstRunPage
4297 Override the first run page. If the value is an empty string (""), the first run page is not displayed.
4298
4299 Starting with Firefox 83, Firefox ESR 78.5, you can also specify multiple URLS separated by a vertical bar (|).
4300
4301 **Compatibility:** Firefox 60, Firefox ESR 60\
4302 **CCK2 Equivalent:** `welcomePage`,`noWelcomePage`\
4303 **Preferences Affected:** `startup.homepage_welcome_url`
4304
4305 #### Windows (GPO)
4306 ```
4307 Software\Policies\Mozilla\Firefox\OverrideFirstRunPage = "http://example.org"
4308 ```
4309 #### Windows (Intune)
4310 OMA-URI:
4311 ```
4312 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox/OverrideFirstRunPage
4313 ```
4314 Value (string):
4315 ```
4316 <enabled/>
4317 <data id="OverridePage" value="https://example.com"/>
4318 ```
4319 #### macOS
4320 ```
4321 <dict>
4322   <key>OverrideFirstRunPage</key>
4323   <string>http://example.org</string>
4324 </dict>
4325 ```
4326 #### policies.json
4327 ```
4328 {
4329   "policies": {
4330     "OverrideFirstRunPage": "http://example.org"
4331   }
4332 }
4333 ```
4334 ### OverridePostUpdatePage
4335 Override the upgrade page. If the value is an empty string (""), no extra pages are displayed when Firefox is upgraded.
4336
4337 **Compatibility:** Firefox 60, Firefox ESR 60\
4338 **CCK2 Equivalent:** `upgradePage`,`noUpgradePage`\
4339 **Preferences Affected:** `startup.homepage_override_url`
4340
4341 #### Windows (GPO)
4342 ```
4343 Software\Policies\Mozilla\Firefox\OverridePostUpdatePage = "http://example.org"
4344 ```
4345 #### Windows (Intune)
4346 OMA-URI:
4347 ```
4348 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox/OverridePostUpdatePage
4349 ```
4350 Value (string):
4351 ```
4352 <enabled/>
4353 <data id="OverridePage" value="https://example.com"/>
4354 ```
4355 #### macOS
4356 ```
4357 <dict>
4358   <key>OverridePostUpdatePage</key>
4359   <string>http://example.org</string>
4360 </dict>
4361 ```
4362 #### policies.json
4363 ```
4364 {
4365   "policies": {
4366     "OverridePostUpdatePage": "http://example.org"
4367   }
4368 }
4369 ```
4370 ### PasswordManagerEnabled
4371 Remove access to the password manager via preferences and blocks about:logins on Firefox 70.
4372
4373 **Compatibility:** Firefox 70, Firefox ESR 60.2\
4374 **CCK2 Equivalent:** N/A\
4375 **Preferences Affected:** `pref.privacy.disable_button.view_passwords`, `signon.rememberSignons`
4376
4377 #### Windows (GPO)
4378 ```
4379 Software\Policies\Mozilla\Firefox\PasswordManagerEnabled = 0x1 | 0x0
4380 ```
4381 #### Windows (Intune)
4382 OMA-URI:
4383 ```
4384 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox/PasswordManagerEnabled
4385 ```
4386 Value (string):
4387 ```
4388 <enabled/> or <disabled/>
4389 ```
4390 #### macOS
4391 ```
4392 <dict>
4393   <key>PasswordManagerEnabled</key>
4394   <true/> | <false/>
4395 </dict>
4396 ```
4397 #### policies.json
4398 ```
4399 {
4400   "policies": {
4401     "PasswordManagerEnabled": true | false
4402   }
4403 }
4404 ```
4405 ### PasswordManagerExceptions
4406 Prevent Firefox from saving passwords for specific sites.
4407
4408 The sites are specified as a list of origins.
4409
4410 **Compatibility:** Firefox 101\
4411 **CCK2 Equivalent:** N/A\
4412 **Preferences Affected:** N/A
4413
4414 #### Windows (GPO)
4415 ```
4416 Software\Policies\Mozilla\Firefox\PasswordManagerExceptions\1 = "https://example.org"
4417 Software\Policies\Mozilla\Firefox\PasswordManagerExceptions\2 = "https://example.edu"
4418 ```
4419 #### Windows (Intune)
4420 OMA-URI:
4421 ```
4422 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox/PasswordManagerExceptions
4423 ```
4424 Value (string):
4425 ```
4426 <enabled/>
4427 <data id="List" value="1&#xF000;https://example.org&#xF000;2&#xF000;https://example.edu"/>
4428 ```
4429 #### macOS
4430 ```
4431 <dict>
4432   <key>PasswordManagerExceptions</key>
4433   <array>
4434     <string>https://example.org</string>
4435     <string>https://example.edu</string>
4436   </array>
4437 </dict>
4438 ```
4439 #### policies.json
4440 ```
4441 {
4442   "policies": {
4443     "PasswordManagerExceptions": ["https://example.org",
4444                                   "https://example.edu"]
4445   }
4446 }
4447 ```
4448 ### PDFjs
4449 Disable or configure PDF.js, the built-in PDF viewer.
4450
4451 If `Enabled` is set to false, the built-in PDF viewer is disabled.
4452
4453 If `EnablePermissions` is set to true, the built-in PDF viewer will honor document permissions like preventing the copying of text.
4454
4455 Note: DisableBuiltinPDFViewer has not been deprecated. You can either continue to use it, or switch to using PDFjs->Enabled to disable the built-in PDF viewer. This new permission was added because we needed a place for PDFjs->EnabledPermissions.
4456
4457 **Compatibility:** Firefox 77, Firefox ESR 68.9\
4458 **CCK2 Equivalent:** N/A\
4459 **Preferences Affected:** `pdfjs.disabled`, `pdfjs.enablePermissions`
4460
4461 #### Windows (GPO)
4462 ```
4463 Software\Policies\Mozilla\Firefox\PDFjs\Enabled = 0x1 | 0x0
4464 Software\Policies\Mozilla\Firefox\PDFjs\EnablePermissions = 0x1 | 0x0
4465 ```
4466 #### Windows (Intune)
4467 OMA-URI:
4468 ```
4469 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~PDFjs/PDFjs_Enabled
4470 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~PDFjs/PDFjs_EnablePermissions
4471 ```
4472 Value (string):
4473 ```
4474 <enabled/>or <disabled/>
4475 ```
4476 #### macOS
4477 ```
4478 <dict>
4479   <key>PDFjs</key>
4480   <dict>
4481     <key>Enabled</key>
4482     <true/> | <false/>
4483     <key>EnablePermissions</key>
4484     <true/> | <false/>
4485   </dict>
4486 </dict>
4487 ```
4488 #### policies.json
4489 ```
4490 {
4491   "policies": {
4492     "PDFjs": {
4493       "Enabled": true | false,
4494       "EnablePermissions": true | false
4495     }
4496   }
4497 }
4498 ```
4499 ### Permissions
4500 Set permissions associated with camera, microphone, location, notifications, autoplay, and virtual reality. Because these are origins, not domains, entries with unique ports must be specified separately. This explicitly means that it is not possible to add wildcards. See examples below.
4501
4502 `Allow` is a list of origins where the feature is allowed.
4503
4504 `Block` is a list of origins where the feature is not allowed.
4505
4506 `BlockNewRequests` determines whether or not new requests can be made for the feature.
4507
4508 `Locked` prevents the user from changing preferences for the feature.
4509
4510 `Default` specifies the default value for Autoplay. block-audio-video is not supported on Firefox ESR 68.
4511
4512 **Compatibility:** Firefox 62, Firefox ESR 60.2 (Autoplay added in Firefox 74, Firefox ESR 68.6, Autoplay Default/Locked added in Firefox 76, Firefox ESR 68.8, VirtualReality added in Firefox 80, Firefox ESR 78.2)\
4513 **CCK2 Equivalent:** N/A\
4514 **Preferences Affected:** `permissions.default.camera`, `permissions.default.microphone`, `permissions.default.geo`, `permissions.default.desktop-notification`, `media.autoplay.default`, `permissions.default.xr`
4515
4516 #### Windows (GPO)
4517 ```
4518 Software\Policies\Mozilla\Firefox\Permissions\Camera\Allow\1 = "https://example.org"
4519 Software\Policies\Mozilla\Firefox\Permissions\Camera\Allow\2 = "https://example.com"
4520 Software\Policies\Mozilla\Firefox\Permissions\Camera\Block\1 = "https://example.edu"
4521 Software\Policies\Mozilla\Firefox\Permissions\Camera\BlockNewRequests = 0x1 | 0x0
4522 Software\Policies\Mozilla\Firefox\Permissions\Camera\Locked = 0x1 | 0x0
4523 Software\Policies\Mozilla\Firefox\Permissions\Microphone\Allow\1 = "https://example.org"
4524 Software\Policies\Mozilla\Firefox\Permissions\Microphone\Allow\2 = "https://example.com"
4525 Software\Policies\Mozilla\Firefox\Permissions\Microphone\Block\1 = "https://example.edu"
4526 Software\Policies\Mozilla\Firefox\Permissions\Microphone\BlockNewRequests = 0x1 | 0x0
4527 Software\Policies\Mozilla\Firefox\Permissions\Microphone\Locked = 0x1 | 0x0
4528 Software\Policies\Mozilla\Firefox\Permissions\Location\Allow\1 = "https://example.org"
4529 Software\Policies\Mozilla\Firefox\Permissions\Location\Allow\2 = "https://example.com"
4530 Software\Policies\Mozilla\Firefox\Permissions\Location\Block\1 = "https://example.edu"
4531 Software\Policies\Mozilla\Firefox\Permissions\Location\BlockNewRequests = 0x1 | 0x0
4532 Software\Policies\Mozilla\Firefox\Permissions\Location\Locked = 0x1 | 0x0
4533 Software\Policies\Mozilla\Firefox\Permissions\Notifications\Allow\1 = "https://example.org"
4534 Software\Policies\Mozilla\Firefox\Permissions\Notifications\Allow\2 = "https://example.com"
4535 Software\Policies\Mozilla\Firefox\Permissions\Notifications\Block\1 = "https://example.edu"
4536 Software\Policies\Mozilla\Firefox\Permissions\Notifications\BlockNewRequests = 0x1 | 0x0
4537 Software\Policies\Mozilla\Firefox\Permissions\Notifications\Locked = 0x1 | 0x0
4538 Software\Policies\Mozilla\Firefox\Permissions\Autoplay\Allow\1 = "https://example.org"
4539 Software\Policies\Mozilla\Firefox\Permissions\Autoplay\Allow\2 = "https://example.com"
4540 Software\Policies\Mozilla\Firefox\Permissions\Autoplay\Block\1 = "https://example.edu"
4541 Software\Policies\Mozilla\Firefox\Permissions\Autoplay\Default = "allow-audio-video" | "block-audio" | "block-audio-video"
4542 Software\Policies\Mozilla\Firefox\Permissions\Autoplay\Locked = 0x1 | 0x0
4543 Software\Policies\Mozilla\Firefox\Permissions\VirtualReality\Allow\1 = "https://example.org"
4544 Software\Policies\Mozilla\Firefox\Permissions\VirtualReality\Allow\2 = "https://example.com"
4545 Software\Policies\Mozilla\Firefox\Permissions\VirtualReality\Block\1 = "https://example.edu"
4546 Software\Policies\Mozilla\Firefox\Permissions\VirtualReality\BlockNewRequests = 0x1 | 0x0
4547 Software\Policies\Mozilla\Firefox\Permissions\VirtualReality\Locked = 0x1 | 0x0
4548 ```
4549 #### Windows (Intune)
4550 OMA-URI:
4551 ```
4552 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~Permissions~Camera/Camera_Allow
4553 ```
4554 Value (string):
4555 ```
4556 <enabled/>
4557 <data id="Permissions" value="1&#xF000;https://example.org&#xF000;2&#xF000;https://example.com"/>
4558 ```
4559 OMA-URI:
4560 ```
4561 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~Permissions~Camera/Camera_Block
4562 ```
4563 Value (string):
4564 ```
4565 <enabled/>
4566 <data id="Permissions" value="1&#xF000;https://example.edu"/>
4567 ```
4568 OMA-URI:
4569 ```
4570 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~Permissions~Camera/Camera_BlockNewRequests
4571 ```
4572 Value (string):
4573 ```
4574 <enabled/> or <disabled/>
4575 ```
4576 OMA-URI:
4577 ```
4578 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~Permissions~Camera/Camera_Locked
4579 ```
4580 Value (string):
4581 ```
4582 <enabled/> or <disabled/>
4583 ```
4584 OMA-URI:
4585 ```
4586 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~Permissions~Microphone/Microphone_Allow
4587 ```
4588 Value (string):
4589 ```
4590 <enabled/>
4591 <data id="Permissions" value="1&#xF000;https://example.org&#xF000;2&#xF000;https://example.com"/>
4592 ```
4593 OMA-URI:
4594 ```
4595 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~Permissions~Microphone/Microphone_Block
4596 ```
4597 Value (string):
4598 ```
4599 <enabled/>
4600 <data id="Permissions" value="1&#xF000;https://example.edu"/>
4601 ```
4602 OMA-URI:
4603 ```
4604 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~Permissions~Microphone/Microphone_BlockNewRequests
4605 ```
4606 Value (string):
4607 ```
4608 <enabled/> or <disabled/>
4609 ```
4610 OMA-URI:
4611 ```
4612 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~Permissions~Microphone/Microphone_Locked
4613 ```
4614 Value (string):
4615 ```
4616 <enabled/> or <disabled/>
4617 ```
4618 OMA-URI:
4619 ```
4620 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~Permissions~Location/Location_Allow
4621 ```
4622 Value (string):
4623 ```
4624 <enabled/>
4625 <data id="Permissions" value="1&#xF000;https://example.org&#xF000;2&#xF000;https://example.com"/>
4626 ```
4627 OMA-URI:
4628 ```
4629 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~Permissions~Location/Location_Block
4630 ```
4631 Value (string):
4632 ```
4633 <enabled/>
4634 <data id="Permissions" value="1&#xF000;https://example.edu"/>
4635 ```
4636 OMA-URI:
4637 ```
4638 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~Permissions~Location/Location_BlockNewRequests
4639 ```
4640 Value (string):
4641 ```
4642 <enabled/> or <disabled/>
4643 ```
4644 OMA-URI:
4645 ```
4646 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~Permissions~Location/Location_Locked
4647 ```
4648 Value (string):
4649 ```
4650 <enabled/> or <disabled/>
4651 ```
4652 OMA-URI:
4653 ```
4654 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~Permissions~Notifications/Notifications_Allow
4655 ```
4656 Value (string):
4657 ```
4658 <enabled/>
4659 <data id="Permissions" value="1&#xF000;https://example.org&#xF000;2&#xF000;https://example.com"/>
4660 ```
4661 OMA-URI:
4662 ```
4663 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~Permissions~Notifications/Notifications_BlockNewRequests
4664 ```
4665 Value (string):
4666 ```
4667 <enabled/> or <disabled/>
4668 ```
4669 OMA-URI:
4670 ```
4671 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~Permissions~Notifications/Notifications_Locked
4672 ```
4673 Value (string):
4674 ```
4675 <enabled/> or <disabled/>
4676 ```
4677 OMA-URI:
4678 ```
4679 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~Permissions~Autoplay/Autoplay_Allow
4680 ```
4681 Value (string):
4682 ```
4683 <enabled/>
4684 <data id="Permissions" value="1&#xF000;https://example.org&#xF000;2&#xF000;https://example.com"/>
4685 ```
4686 OMA-URI:
4687 ```
4688 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~Permissions~Autoplay/Autoplay_Block
4689 ```
4690 Value (string):
4691 ```
4692 <enabled/>
4693 <data id="Permissions" value="1&#xF000;https://example.edu"/>
4694 ```
4695 OMA-URI:
4696 ```
4697 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~Permissions~Autoplay/Autoplay_Default
4698 ```
4699 Value (string):
4700 ```
4701 <enabled/>
4702 <data id="Autoplay_Default" value="allow-audio-video | block-audio | block-audio-video"/>
4703 ```
4704 OMA-URI:
4705 ```
4706 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~Permissions~Autoplay/Autoplay_Locked
4707 ```
4708 Value (string):
4709 ```
4710 <enabled/> or <disabled/>
4711 ```
4712 OMA-URI:
4713 ```
4714 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~Permissions~VirtualReality/VirtualReality_Allow
4715 ```
4716 Value (string):
4717 ```
4718 <enabled/>
4719 <data id="Permissions" value="1&#xF000;https://example.org&#xF000;2&#xF000;https://example.com"/>
4720 ```
4721 OMA-URI:
4722 ```
4723 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~Permissions~VirtualReality/VirtualReality_Block
4724 ```
4725 Value (string):
4726 ```
4727 <enabled/>
4728 <data id="Permissions" value="1&#xF000;https://example.edu"/>
4729 ```
4730 OMA-URI:
4731 ```
4732 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~Permissions~VirtualReality/VirtualReality_BlockNewRequests
4733 ```
4734 Value (string):
4735 ```
4736 <enabled/> or <disabled/>
4737 ```
4738 OMA-URI:
4739 ```
4740 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~Permissions~Notifications/VirtualReality_Locked
4741 ```
4742 Value (string):
4743 ```
4744 <enabled/> or <disabled/>
4745 ```
4746 #### macOS
4747 ```
4748 <dict>
4749   <key>Permissions</key>
4750   <dict>
4751     <key>Camera</key>
4752     <dict>
4753       <key>Allow</key>
4754       <array>
4755         <string>https://example.org</string>
4756         <string>https://example.org:1234</string>
4757       </array>
4758       <key>Block</key>
4759       <array>
4760         <string>https://example.edu</string>
4761       </array>
4762       <key>BlockNewRequests</key>
4763       <true/> | <false/>
4764       <key>Locked</key>
4765       <true/> | <false/>
4766     </dict>
4767     <key>Microphone</key>
4768     <dict>
4769       <key>Allow</key>
4770       <array>
4771         <string>https://example.org</string>
4772       </array>
4773       <key>Block</key>
4774       <array>
4775         <string>https://example.edu</string>
4776       </array>
4777       <key>BlockNewRequests</key>
4778       <true/> | <false/>
4779       <key>Locked</key>
4780       <true/> | <false/>
4781     </dict>
4782     <key>Location</key>
4783     <dict>
4784       <key>Allow</key>
4785       <array>
4786         <string>https://example.org</string>
4787       </array>
4788       <key>Block</key>
4789       <array>
4790         <string>https://example.edu</string>
4791       </array>
4792       <key>BlockNewRequests</key>
4793       <true/> | <false/>
4794       <key>Locked</key>
4795       <true/> | <false/>
4796     </dict>
4797     <key>Notifications</key>
4798     <dict>
4799       <key>Allow</key>
4800       <array>
4801         <string>https://example.org</string>
4802       </array>
4803       <key>Block</key>
4804       <array>
4805         <string>https://example.edu</string>
4806       </array>
4807       <key>BlockNewRequests</key>
4808       <true/>
4809       <key>Locked</key>
4810       <true/>
4811     </dict>
4812     <key>Autoplay</key>
4813     <dict>
4814       <key>Allow</key>
4815       <array>
4816         <string>https://example.org</string>
4817       </array>
4818       <key>Block</key>
4819       <array>
4820         <string>https://example.edu</string>
4821       </array>
4822       <key>Default</key>
4823       <string>allow-audio-video | block-audio | block-audio-video</string>
4824       <key>Locked</key>
4825       <true/> | <false/>
4826     </dict>
4827   </dict>
4828 </dict>
4829 ```
4830 #### policies.json
4831 ```
4832 {
4833   "policies": {
4834     "Permissions": {
4835       "Camera": {
4836         "Allow": ["https://example.org","https://example.org:1234"],
4837         "Block": ["https://example.edu"],
4838         "BlockNewRequests": true | false,
4839         "Locked": true | false
4840       },
4841       "Microphone": {
4842         "Allow": ["https://example.org"],
4843         "Block": ["https://example.edu"],
4844         "BlockNewRequests": true | false,
4845         "Locked": true | false
4846       },
4847       "Location": {
4848         "Allow": ["https://example.org"],
4849         "Block": ["https://example.edu"],
4850         "BlockNewRequests": true | false,
4851         "Locked": true | false
4852       },
4853       "Notifications": {
4854         "Allow": ["https://example.org"],
4855         "Block": ["https://example.edu"],
4856         "BlockNewRequests": true | false,
4857         "Locked": true | false
4858       },
4859       "Autoplay": {
4860         "Allow": ["https://example.org"],
4861         "Block": ["https://example.edu"],
4862         "Default": "allow-audio-video" | "block-audio" | "block-audio-video",
4863         "Locked": true | false
4864       }
4865     }
4866   }
4867 }
4868 ```
4869 ### PictureInPicture
4870
4871 Enable or disable Picture-in-Picture as well as prevent the user from enabling or disabling it (Locked).
4872
4873 **Compatibility:** Firefox 78, Firefox ESR 78\
4874 **CCK2 Equivalent:** N/A\
4875 **Preferences Affected:** `media.videocontrols.picture-in-picture.video-toggle.enabled`
4876
4877 #### Windows (GPO)
4878 ```
4879 Software\Policies\Mozilla\Firefox\PictureInPicture\Enabled = 0x1 | 0x0
4880 Software\Policies\Mozilla\Firefox\PictureInPicture\Locked = 0x1 | 0x0
4881
4882 ```
4883 #### Windows (Intune)
4884 OMA-URI:
4885 ```
4886 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~PictureInPicture/PictureInPicture_Enabled
4887 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~PictureInPicture/PictureInPicture_Locked
4888 ```
4889 Value (string):
4890 ```
4891 <enabled/> or <disabled/>
4892 ```
4893 #### macOS
4894 ```
4895 <dict>
4896   <key>PictureInPicture</key>
4897   <dict>
4898     <key>Enabled</key>
4899     <true/> | <false/>
4900     <key>Locked</key>
4901     <true/> | <false/>
4902   </dict>
4903 </dict>
4904 ```
4905 #### policies.json
4906 ```
4907 {
4908   "policies": {
4909     "PictureInPicture": {
4910       "Enabled": true | false,
4911       "Locked": true | false
4912     }
4913   }
4914 }
4915 ```
4916 ### PopupBlocking
4917 Configure the default pop-up window policy as well as origins for which pop-up windows are allowed.
4918
4919 `Allow` is a list of origins where popup-windows are allowed.
4920
4921 `Default` determines whether or not pop-up windows are allowed by default.
4922
4923 `Locked` prevents the user from changing pop-up preferences.
4924
4925 **Compatibility:** Firefox 60, Firefox ESR 60\
4926 **CCK2 Equivalent:** `permissions.popup`\
4927 **Preferences Affected:** `dom.disable_open_during_load`
4928
4929 #### Windows (GPO)
4930 ```
4931 Software\Policies\Mozilla\Firefox\PopupBlocking\Allow\1 = "https://example.org"
4932 Software\Policies\Mozilla\Firefox\PopupBlocking\Allow\2 = "https://example.edu"
4933 Software\Policies\Mozilla\Firefox\PopupBlocking\Default = 0x1 | 0x0
4934 Software\Policies\Mozilla\Firefox\PopupBlocking\Locked = 0x1 | 0x0
4935 ```
4936 #### Windows (Intune)
4937 OMA-URI:
4938 ```
4939 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~Popups/PopupBlocking_Allow
4940 ```
4941 Value (string):
4942 ```
4943 <enabled/>
4944 <data id="Permissions" value="1&#xF000;https://example.org&#xF000;2&#xF000;https://example.edu"/>
4945 ```
4946 OMA-URI:
4947 ```
4948 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~Popups/PopupBlocking_Default
4949 ```
4950 Value (string):
4951 ```
4952 <enabled/> or <disabled/>
4953 ```
4954 OMA-URI:
4955 ```
4956 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~Popups/PopupBlocking_Locked
4957 ```
4958 Value (string):
4959 ```
4960 <enabled/> or <disabled/>
4961 ```
4962 #### macOS
4963 ```
4964 <dict>
4965   <key>PopupBlocking</key>
4966   <dict>
4967     <key>Allow</key>
4968     <array>
4969       <string>http://example.org</string>
4970       <string>http://example.edu</string>
4971     </array>
4972     <key>Default</key>
4973     <true/> | <false/>
4974     <key>Locked</key>
4975     <true/> | <false/>
4976   </dict>
4977 </dict>
4978 ```
4979 #### policies.json
4980 ```
4981 {
4982   "policies": {
4983     "PopupBlocking": {
4984       "Allow": ["http://example.org/",
4985                 "http://example.edu/"],
4986       "Default": true | false,
4987       "Locked": true | false
4988     }
4989   }
4990 }
4991 ```
4992 ### PostQuantumKeyAgreementEnabled
4993 Enable post-quantum key agreement for TLS.
4994
4995 **Compatibility:** Firefox 127\
4996 **CCK2 Equivalent:** N/A\
4997 **Preferences Affected:** `security.tls.enable_kyber`, `network.http.http3.enable_kyber` (Firefox 128)
4998
4999 #### Windows (GPO)
5000 ```
5001 Software\Policies\Mozilla\Firefox\PostQuantumKeyAgreementEnabled = 0x1 | 0x0
5002 ```
5003 #### Windows (Intune)
5004 OMA-URI:
5005 ```
5006 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox/PostQuantumKeyAgreementEnabled
5007 ```
5008 Value (string):
5009 ```
5010 <enabled/> or <disabled/>
5011 ```
5012 #### macOS
5013 ```
5014 <dict>
5015   <key>PostQuantumKeyAgreementEnabled</key>
5016   <true/> | <false/>
5017 </dict>
5018 ```
5019 #### policies.json
5020 ```
5021 {
5022   "policies": {
5023     "PostQuantumKeyAgreementEnabled": true | false
5024   }
5025 }
5026 ```
5027 ### Preferences
5028 Set and lock preferences.
5029
5030 **NOTE** On Windows, in order to use this policy, you must clear all settings in the old **Preferences (Deprecated)** section in group policy.
5031
5032 Previously you could only set and lock a subset of preferences. Starting with Firefox 81 and Firefox ESR 78.3 you can set many more preferences. You can also set default preferences, user preferences and you can clear preferences.
5033
5034 Preferences that start with the following prefixes are supported:
5035 ```
5036 accessibility.
5037 alerts.* (Firefox 122, Firefox ESR 115.7)
5038 app.update.* (Firefox 86, Firefox ESR 78.8)
5039 browser.
5040 datareporting.policy.
5041 dom.
5042 extensions.
5043 general.autoScroll (Firefox 83, Firefox ESR 78.5)
5044 general.smoothScroll (Firefox 83, Firefox ESR 78.5)
5045 geo.
5046 gfx.
5047 intl.
5048 keyword.enabled (Firefox 95, Firefox ESR 91.4)
5049 layers.
5050 layout.
5051 media.
5052 network.
5053 pdfjs. (Firefox 84, Firefox ESR 78.6)
5054 places.
5055 pref.
5056 print.
5057 privacy.globalprivacycontrol.enabled (Firefox 127, Firefox ESR 128.0)
5058 privacy.userContext.enabled (Firefox 126, Firefox ESR 115.11)
5059 privacy.userContext.ui.enabled (Firefox 126, Firefox ESR 115.11)
5060 signon. (Firefox 83, Firefox ESR 78.5)
5061 spellchecker. (Firefox 84, Firefox ESR 78.6)
5062 toolkit.legacyUserProfileCustomizations.stylesheets (Firefox 95, Firefox ESR 91.4)
5063 ui.
5064 widget.
5065 xpinstall.signatures.required (Firefox ESR 102.10, Firefox ESR only)
5066 xpinstall.whitelist.required (Firefox 118, Firefox ESR 115.3)
5067 ```
5068 as well as the following security preferences:
5069
5070 | Preference | Type | Default
5071 | --- | --- | --- |
5072 | security.default_personal_cert | string | Ask Every Time
5073 | &nbsp;&nbsp;&nbsp;&nbsp;If set to Select Automatically, Firefox automatically chooses the default personal certificate.
5074 | security.disable_button.openCertManager | string | N/A
5075 | &nbsp;&nbsp;&nbsp;&nbsp;If set to true and locked, the View Certificates button in preferences is disabled (Firefox 121, Firefox ESR 115.6)
5076 | security.disable_button.openDeviceManager | string | N/A
5077 | &nbsp;&nbsp;&nbsp;&nbsp;If set to true and locked, the Security Devices button in preferences is disabled (Firefox 121, Firefox ESR 115.6)
5078 | security.insecure_connection_text.enabled | bool | false
5079 | &nbsp;&nbsp;&nbsp;&nbsp;If set to true, adds the words "Not Secure" for insecure sites.
5080 | security.insecure_connection_text.pbmode.enabled | bool | false
5081 | &nbsp;&nbsp;&nbsp;&nbsp;If set to true, adds the words "Not Secure" for insecure sites in private browsing.
5082 | security.mixed_content.block_active_content | boolean | true
5083 | &nbsp;&nbsp;&nbsp;&nbsp;If set to true, mixed active content (HTTP subresources such as scripts, fetch requests, etc. on a HTTPS page) will be blocked.
5084 | security.mixed_content.block_display_content | boolean | false
5085 | &nbsp;&nbsp;&nbsp;&nbsp;If set to true, mixed passive/display content (HTTP subresources such as images, videos, etc. on a HTTPS page) will be blocked. (Firefox 127, Firefox ESR 128.0)
5086 | security.mixed_content.upgrade_display_content | boolean | true
5087 | &nbsp;&nbsp;&nbsp;&nbsp;If set to true, mixed passive/display content (HTTP subresources such as images, videos, etc. on a HTTPS page) will be upgraded to HTTPS. (Firefox 127, Firefox ESR 128.0)
5088 | security.osclientcerts.autoload | boolean | false
5089 | &nbsp;&nbsp;&nbsp;&nbsp;If true, client certificates are loaded from the operating system certificate store.
5090 | security.OCSP.enabled | integer | 1
5091 | &nbsp;&nbsp;&nbsp;&nbsp;If 0, do not fetch OCSP. If 1, fetch OCSP for DV and EV certificates. If 2, fetch OCSP only for EV certificates.
5092 | security.OCSP.require | boolean | false
5093 | &nbsp;&nbsp;&nbsp;&nbsp; If true, if an OCSP request times out, the connection fails.
5094 | security.osclientcerts.assume_rsa_pss_support | boolean | true
5095 | &nbsp;&nbsp;&nbsp;&nbsp; If false, we don't assume an RSA key can do RSA-PSS. (Firefox 114, Firefox ESR 102.12)
5096 | security.ssl.enable_ocsp_stapling | boolean | true
5097 | &nbsp;&nbsp;&nbsp;&nbsp; If false, OCSP stapling is not enabled.
5098 | security.ssl.errorReporting.enabled | boolean | true
5099 | &nbsp;&nbsp;&nbsp;&nbsp;If false, SSL errors cannot be sent to Mozilla.
5100 | security.ssl.require_safe_negotiation | boolean | false
5101 | &nbsp;&nbsp;&nbsp;&nbsp;If true, Firefox will only negotiate TLS connections with servers that indicate they support secure renegotiation. (Firefox 118, Firefox ESR 115.3)
5102 | security.tls.enable_0rtt_data | boolean | true
5103 | &nbsp;&nbsp;&nbsp;&nbsp;If false, TLS early data is turned off. (Firefox 93, Firefox 91.2, Firefox 78.15)
5104 | security.tls.hello_downgrade_check | boolean | true
5105 | &nbsp;&nbsp;&nbsp;&nbsp;If false, the TLS 1.3 downgrade check is disabled.
5106 | security.tls.version.enable-deprecated | boolean | false
5107 | &nbsp;&nbsp;&nbsp;&nbsp;If true, browser will accept TLS 1.0. and TLS 1.1. (Firefox 86, Firefox 78.8)
5108 | security.warn_submit_secure_to_insecure | boolean | true
5109 | &nbsp;&nbsp;&nbsp;&nbsp;If false, no warning is shown when submitting a form from https to http.
5110
5111 Using the preference as the key, set the `Value` to the corresponding preference value.
5112
5113 `Status` can be "default", "locked", "user" or "clear"
5114
5115 * `"default"`: Read/Write: Settings appear as default even if factory default differs.
5116 * `"locked"`: Read-Only: Settings appear as default even if factory default differs.
5117 * `"user"`: Read/Write: Settings appear as changed if it differs from factory default.
5118 * `"clear"`: Read/Write: `Value` has no effect. Resets to factory defaults on each startup.
5119
5120 `"user"` preferences persist across invocations of Firefox. It is the equivalent of a user setting the preference. They are most useful when a preference is needed very early in startup so it can't be set as default by policy. An example of this is ```toolkit.legacyUserProfileCustomizations.stylesheets```.
5121
5122 `"user"` preferences persist even if the policy is removed, so if you need to remove them, you should use the clear policy.
5123
5124 You can also set the `Type` starting in Firefox 123 and Firefox ESR 115.8. It can be `number`, `boolean` or `string`. This is especially useful if you are seeing 0 or 1 values being converted to booleans when set as user preferences.
5125
5126 See the examples below for more detail.
5127
5128 IMPORTANT: Make sure you're only setting a particular preference using this mechanism and not some other way.
5129
5130 Status
5131 **Compatibility:** Firefox 81, Firefox ESR 78.3\
5132 **CCK2 Equivalent:** `preferences`\
5133 **Preferences Affected:** Many
5134
5135 #### Windows (GPO)
5136 Software\Policies\Mozilla\Firefox\Preferences (REG_MULTI_SZ) =
5137 ```
5138 {
5139   "accessibility.force_disabled": {
5140     "Value": 1,
5141     "Status": "default",
5142     "Type": "number"
5143
5144   },
5145   "browser.cache.disk.parent_directory": {
5146     "Value": "SOME_NATIVE_PATH",
5147     "Status": "user"
5148   },
5149   "browser.tabs.warnOnClose": {
5150     "Value": false,
5151     "Status": "locked"
5152   }
5153 }
5154 ```
5155 #### Windows (Intune)
5156 OMA-URI:
5157 ```
5158 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox/Preferences
5159 ```
5160 Value (string):
5161 ```
5162 <enabled/>
5163 <data id="JSON" value='
5164 {
5165   "accessibility.force_disabled": {
5166     "Value": 1,
5167     "Status": "default",
5168     "Type": "number"
5169   },
5170   "browser.cache.disk.parent_directory": {
5171     "Value": "SOME_NATIVE_PATH",
5172     "Status": "user"
5173   },
5174   "browser.tabs.warnOnClose": {
5175     "Value": false,
5176     "Status": "locked"
5177   }
5178 }'/>
5179 ```
5180 If you are using custom ADMX and ADML administrative templates in Intune, you can use this OMA-URI instead
5181 to workaround the limit on the length of strings. Put all of your JSON on one line.
5182
5183 OMA-URI:
5184 ```
5185 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~Extensions/PreferencesOneLine
5186 ```
5187 Value (string):
5188 ```
5189 <enabled/>
5190 <data id="JSONOneLine" value='{}'/>
5191 ```
5192 #### macOS
5193 ```
5194 <dict>
5195   <key>Preferences</key>
5196   <dict>
5197     <key>accessibility.force_disabled</key>
5198     <dict>
5199       <key>Value</key>
5200       <integer>1</integer>
5201       <key>Status</key>
5202       <string>default</string>
5203       <key>Type</key>
5204       <string>number</string>
5205     </dict>
5206     <key>browser.cache.disk.parent_directory</key>
5207     <dict>
5208       <key>Value</key>
5209       <string>SOME_NATIVE_PATH</string>
5210       <key>Status</key>
5211       <string>user</string>
5212     </dict>
5213     <key>browser.tabs.warnOnClose</key>
5214     <dict>
5215       <key>Value</key>
5216       <false/>
5217       <key>Status</key>
5218       <string>locked</string>
5219     </dict>
5220   </dict>
5221 </dict>
5222 ```
5223 #### policies.json
5224 ```
5225 {
5226   "policies": {
5227     "Preferences": {
5228       "accessibility.force_disabled": {
5229         "Value": 1,
5230         "Status": "default"
5231         "Type": "number"
5232       },
5233       "browser.cache.disk.parent_directory": {
5234         "Value": "SOME_NATIVE_PATH",
5235         "Status": "user"
5236       },
5237       "browser.tabs.warnOnClose": {
5238         "Value": false,
5239         "Status": "locked"
5240       }
5241     }
5242   }
5243 }
5244 ```
5245 ### PrimaryPassword
5246 Require or prevent using a primary (formerly master) password.
5247
5248 If this value is true, a primary password is required. If this value is false, it works the same as if [`DisableMasterPasswordCreation`](#disablemasterpasswordcreation) was true and removes the primary password functionality.
5249
5250 If both DisableMasterPasswordCreation and PrimaryPassword are used, DisableMasterPasswordCreation takes precedent.
5251
5252 **Compatibility:** Firefox 79, Firefox ESR 78.1\
5253 **CCK2 Equivalent:** `noMasterPassword`\
5254 **Preferences Affected:** N/A
5255
5256 #### Windows (GPO)
5257 ```
5258 Software\Policies\Mozilla\Firefox\PrimaryPassword = 0x1 | 0x0
5259 ```
5260 #### Windows (Intune)
5261 OMA-URI:
5262 ```
5263 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox/PrimaryPassword
5264 ```
5265 Value (string):
5266 ```
5267 <enabled/> or <disabled/>
5268 ```
5269 #### macOS
5270 ```
5271 <dict>
5272   <key>PrimaryPassword</key>
5273   <true/> | <false/>
5274 </dict>
5275 ```
5276 #### policies.json
5277 ```
5278 {
5279   "policies": {
5280     "PrimaryPassword": true | false
5281   }
5282 }
5283 ```
5284 ### PrintingEnabled
5285 Enable or disable printing.
5286
5287 **Compatibility:** Firefox 120, Firefox ESR 115.5\
5288 **CCK2 Equivalent:** N/A\
5289 **Preferences Affected:** `print.enabled`
5290
5291 #### Windows (GPO)
5292 ```
5293 Software\Policies\Mozilla\Firefox\PrintingEnabled = 0x1 | 0x0
5294 ```
5295 #### Windows (Intune)
5296 OMA-URI:
5297 ```
5298 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox/PrintingEnabled
5299 ```
5300 Value (string):
5301 ```
5302 <enabled/> or <disabled/>
5303 ```
5304 #### macOS
5305 ```
5306 <dict>
5307   <key>PrintingEnabled</key>
5308   <true/> | <false/>
5309 </dict>
5310 ```
5311 #### policies.json
5312 ```
5313 {
5314   "policies": {
5315     "PrintingEnabled": true | false
5316   }
5317 }
5318 ```
5319 ### PromptForDownloadLocation
5320 Ask where to save each file before downloading.
5321
5322 **Compatibility:** Firefox 68, Firefox ESR 68\
5323 **CCK2 Equivalent:** N/A\
5324 **Preferences Affected:** `browser.download.useDownloadDir`
5325
5326 #### Windows (GPO)
5327 ```
5328 Software\Policies\Mozilla\Firefox\PromptForDownloadLocation = 0x1 | 0x0
5329 ```
5330 #### Windows (Intune)
5331 OMA-URI:
5332 ```
5333 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox/PromptForDownloadLocation
5334 ```
5335 Value (string):
5336 ```
5337 <enabled/> or <disabled/>
5338 ```
5339 #### macOS
5340 ```
5341 <dict>
5342   <key>PromptForDownloadLocation</key>
5343   <true/> | <false/>
5344 </dict>
5345 ```
5346 #### policies.json
5347 ```
5348 {
5349   "policies": {
5350     "PromptForDownloadLocation": true | false
5351   }
5352 }
5353 ```
5354 ### Proxy
5355 Configure proxy settings. These settings correspond to the connection settings in Firefox preferences.
5356 To specify ports, append them to the hostnames with a colon (:).
5357
5358 Unless you lock this policy, changes the user already has in place will take effect.
5359
5360 `Mode` is the proxy method being used.
5361
5362 `Locked` is whether or not proxy settings can be changed.
5363
5364 `HTTPProxy` is the HTTP proxy server.
5365
5366 `UseHTTPProxyForAllProtocols` is whether or not the HTTP proxy should be used for all other proxies.
5367
5368 `SSLProxy` is the SSL proxy server.
5369
5370 `FTPProxy` is the FTP proxy server.
5371
5372 `SOCKSProxy` is the SOCKS proxy server
5373
5374 `SOCKSVersion` is the SOCKS version (4 or 5)
5375
5376 `Passthrough` is list of hostnames or IP addresses that will not be proxied. Use `<local>` to bypass proxying for all hostnames which do not contain periods.
5377
5378 `AutoConfigURL` is a  URL for proxy configuration (only used if Mode is autoConfig).
5379
5380 `AutoLogin` means do not prompt for authentication if password is saved.
5381
5382 `UseProxyForDNS` to use proxy DNS when using SOCKS v5.
5383
5384 **Compatibility:** Firefox 60, Firefox ESR 60\
5385 **CCK2 Equivalent:** `networkProxy*`\
5386 **Preferences Affected:** `network.proxy.type`, `network.proxy.autoconfig_url`, `network.proxy.socks_remote_dns`, `signon.autologin.proxy`, `network.proxy.socks_version`, `network.proxy.no_proxies_on`, `network.proxy.share_proxy_settings`, `network.proxy.http`, `network.proxy.http_port`, `network.proxy.ftp`, `network.proxy.ftp_port`, `network.proxy.ssl`, `network.proxy.ssl_port`, `network.proxy.socks`, `network.proxy.socks_port`
5387
5388 #### Windows (GPO)
5389 ```
5390 Software\Policies\Mozilla\Firefox\Proxy\Mode = "none" | "system" | "manual" | "autoDetect" | "autoConfig"
5391 Software\Policies\Mozilla\Firefox\Proxy\Locked = 0x1 | 0x0
5392 Software\Policies\Mozilla\Firefox\Proxy\HTTPProxy = https://httpproxy.example.com
5393 Software\Policies\Mozilla\Firefox\Proxy\UseHTTPProxyForAllProtocols = 0x1 | 0x0
5394 Software\Policies\Mozilla\Firefox\Proxy\SSLProxy = https://sslproxy.example.com
5395 Software\Policies\Mozilla\Firefox\Proxy\FTPProxy = https://ftpproxy.example.com
5396 Software\Policies\Mozilla\Firefox\Proxy\SOCKSProxy = https://socksproxy.example.com
5397 Software\Policies\Mozilla\Firefox\Proxy\SOCKSVersion = 0x4 | 0x5
5398 Software\Policies\Mozilla\Firefox\Proxy\Passthrough = <local>
5399 Software\Policies\Mozilla\Firefox\Proxy\AutoConfigURL = URL_TO_AUTOCONFIG
5400 Software\Policies\Mozilla\Firefox\Proxy\AutoLogin = 0x1 | 0x0
5401 Software\Policies\Mozilla\Firefox\Proxy\UseProxyForDNS = 0x1 | 0x0
5402 ```
5403 #### Windows (Intune)
5404 **Note**
5405 These setttings were moved to a category to make them easier to configure via Intune.
5406
5407 OMA-URI:
5408 ```
5409 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~ProxySettings/Proxy_Locked
5410 ```
5411 Value (string):
5412 ```
5413 <enabled/> or <disabled/>
5414 ```
5415 OMA-URI:
5416 ```
5417 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~ProxySettings/Proxy_ConnectionType
5418 ```
5419 Value (string):
5420 ```
5421 <enabled/>
5422 <data id="Proxy_ConnectionType" value="none | system | manual | autoDetect | autoConfig"/>
5423 ```
5424 OMA-URI:
5425 ```
5426 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~ProxySettings/Proxy_HTTPProxy
5427 ```
5428 Value (string):
5429 ```
5430 <enabled/>
5431 <data id="Proxy_HTTPProxy" value="httpproxy.example.com"/>
5432 ```
5433 OMA-URI:
5434 ```
5435 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~ProxySettings/Proxy_UseHTTPProxyForAllProtocols
5436 ```
5437 Value (string):
5438 ```
5439 <enabled/> or <disabled/>
5440 ```
5441 OMA-URI:
5442 ```
5443 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~ProxySettings/Proxy_SSLProxy
5444 ```
5445 Value (string):
5446 ```
5447 <enabled/>
5448 <data id="Proxy_SSLProxy" value="sslproxy.example.com"/>
5449 ```
5450 OMA-URI:
5451 ```
5452 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~ProxySettings/Proxy_SOCKSProxy
5453 ```
5454 Value (string):
5455 ```
5456 <enabled/>
5457 <data id="Proxy_SOCKSProxy" value="socksproxy.example.com"/>
5458 <data id="Proxy_SOCKSVersion" value="4 | 5"/>
5459 ```
5460 OMA-URI:
5461 ```
5462 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~ProxySettings/Proxy_AutoConfigURL
5463 ```
5464 Value (string):
5465 ```
5466 <enabled/>
5467 <data id="Proxy_AutoConfigURL" value="URL_TO_AUTOCONFIG"/>
5468 ```
5469 OMA-URI:
5470 ```
5471 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~ProxySettings/Proxy_Passthrough
5472 ```
5473 Value (string):
5474 ```
5475 <enabled/>
5476 <data id="Proxy_Passthrough" value="&lt;local&gt;"/>
5477 ```
5478 OMA-URI:
5479 ```
5480 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~ProxySettings/Proxy_AutoLogin
5481 ```
5482 Value (string):
5483 ```
5484 <enabled/> or <disabled/>
5485 ```
5486 OMA-URI:
5487 ```
5488 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~ProxySettings/Proxy_UseProxyForDNS
5489 ```
5490 Value (string):
5491 ```
5492 <enabled/> or <disabled/>
5493 ```
5494 OMA-URI (Old way):
5495 ```
5496 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox/Proxy
5497 ```
5498 Value (string):
5499 ```
5500 <enabled/>
5501 <data id="ProxyLocked" value="true | false"/>
5502 <data id="ConnectionType" value="none | system | manual | autoDetect | autoConfig"/>
5503 <data id="HTTPProxy" value="httpproxy.example.com"/>
5504 <data id="UseHTTPProxyForAllProtocols" value="true | false"/>
5505 <data id="SSLProxy" value="sslproxy.example.com"/>
5506 <data id="FTPProxy" value="ftpproxy.example.com"/>
5507 <data id="SOCKSProxy" value="socksproxy.example.com"/>
5508 <data id="SOCKSVersion" value="4 | 5"/>
5509 <data id="AutoConfigURL" value="URL_TO_AUTOCONFIG"/>
5510 <data id="Passthrough" value="<local>"/>
5511 <data id="AutoLogin" value="true | false"/>
5512 <data id="UseProxyForDNS" value="true | false"/>
5513 ```
5514 #### macOS
5515 ```
5516 <dict>
5517   <key>Proxy</key>
5518   <dict>
5519     <key>Mode</key>
5520     <string>none | system | manual | autoDetect | autoConfig</string>
5521     <key>Locked</key>
5522     <true> | </false>
5523     <key>HTTPProxy</key>
5524     <string>https://httpproxy.example.com</string>
5525     <key>UseHTTPProxyForAllProtocols</key>
5526     <true> | </false>
5527     <key>SSLProxy</key>
5528     <string>https://sslproxy.example.com</string>
5529     <key>FTPProxy</key>
5530     <string>https://ftpproxy.example.com</string>
5531     <key>SOCKSProxy</key>
5532     <string>https://socksproxy.example.com</string>
5533     <key>SOCKSVersion</key>
5534     <string>4 | 5</string>
5535     <key>Passthrough</key>
5536     <string>&lt;local>&gt;</string>
5537     <key>AutoConfigURL</key>
5538     <string>URL_TO_AUTOCONFIG</string>
5539     <key>AutoLogin</key>
5540     <true> | </false>
5541     <key>UseProxyForDNS</key>
5542     <true> | </false>
5543   </dict>
5544 </dict>
5545 ```
5546 #### policies.json
5547 ```
5548 {
5549   "policies": {
5550     "Proxy": {
5551       "Mode": "none" | "system" | "manual" | "autoDetect" | "autoConfig",
5552       "Locked": true | false,
5553       "HTTPProxy": "hostname",
5554       "UseHTTPProxyForAllProtocols": true | false,
5555       "SSLProxy": "hostname",
5556       "FTPProxy": "hostname",
5557       "SOCKSProxy": "hostname",
5558       "SOCKSVersion": 4 | 5,
5559       "Passthrough": "<local>",
5560       "AutoConfigURL": "URL_TO_AUTOCONFIG",
5561       "AutoLogin": true | false,
5562       "UseProxyForDNS": true | false
5563     }
5564   }
5565 }
5566 ```
5567 ### RequestedLocales
5568 Set the the list of requested locales for the application in order of preference. It will cause the corresponding language pack to become active.
5569
5570 Note: For Firefox 68, this can now be a string so that you can specify an empty value.
5571
5572 **Compatibility:** Firefox 64, Firefox ESR 60.4, Updated in Firefox 68, Firefox ESR 68\
5573 **CCK2 Equivalent:** N/A\
5574 **Preferences Affected:** N/A
5575 #### Windows (GPO)
5576 ```
5577 Software\Policies\Mozilla\Firefox\RequestedLocales\1 = "de"
5578 Software\Policies\Mozilla\Firefox\RequestedLocales\2 = "en-US"
5579
5580 or
5581
5582 Software\Policies\Mozilla\Firefox\RequestedLocales = "de,en-US"
5583 ```
5584 #### Windows (Intune)
5585 OMA-URI:
5586 ```
5587 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox/RequestedLocalesString
5588 ```
5589 Value (string):
5590 ```
5591 <enabled/>
5592 <data id="Preferences_String" value="de,en-US"/>
5593 ```
5594 #### macOS
5595 ```
5596 <dict>
5597   <key>RequestedLocales</key>
5598   <array>
5599     <string>de</string>
5600     <string>en-US</string>
5601   </array>
5602 </dict>
5603
5604 or
5605
5606 <dict>
5607   <key>RequestedLocales</key>
5608   <string>de,en-US</string>
5609 </dict>
5610
5611 ```
5612 #### policies.json
5613 ```
5614 {
5615   "policies": {
5616     "RequestedLocales": ["de", "en-US"]
5617   }
5618 }
5619
5620 or
5621
5622 {
5623   "policies": {
5624     "RequestedLocales": "de,en-US"
5625   }
5626 }
5627 ```
5628 <a name="SanitizeOnShutdown"></a>
5629
5630 ### SanitizeOnShutdown (Selective)
5631 Clear data on shutdown.
5632
5633 Note: Starting with Firefox 128, History clears FormData and Downloads as well.
5634
5635 `Cache`
5636
5637 `Cookies`
5638
5639 `Downloads` Download History (*Deprecated*)
5640
5641 `FormData` Form & Search History (*Deprecated*)
5642
5643 `History` Browsing History, Download History, Form & Search History.
5644
5645 `Sessions` Active Logins
5646
5647 `SiteSettings` Site Preferences
5648
5649 `OfflineApps` Offline Website Data.
5650
5651 `Locked` prevents the user from changing these preferences.
5652
5653 **Compatibility:** Firefox 68, Firefox ESR 68 (Locked added in 74/68.6, History update in Firefox 128)\
5654 **CCK2 Equivalent:** N/A\
5655 **Preferences Affected:** `privacy.sanitize.sanitizeOnShutdown`, `privacy.clearOnShutdown.cache`, `privacy.clearOnShutdown.cookies`, `privacy.clearOnShutdown.downloads`, `privacy.clearOnShutdown.formdata`, `privacy.clearOnShutdown.history`, `privacy.clearOnShutdown.sessions`, `privacy.clearOnShutdown.siteSettings`, `privacy.clearOnShutdown.offlineApps`, `privacy.clearOnShutdown_v2.historyFormDataAndDownloads` (Firefox 128), `privacy.clearOnShutdown_v2.cookiesAndStorage` (Firefox 128), `privacy.clearOnShutdown_v2.cache` (Firefox 128), `privacy.clearOnShutdown_v2.siteSettings` (Firefox 128)
5656
5657 #### Windows (GPO)
5658 ```
5659 Software\Policies\Mozilla\Firefox\SanitizeOnShutdown\Cache = 0x1 | 0x0
5660 Software\Policies\Mozilla\Firefox\SanitizeOnShutdown\Cookies = 0x1 | 0x0
5661 Software\Policies\Mozilla\Firefox\SanitizeOnShutdown\Downloads = 0x1 | 0x0
5662 Software\Policies\Mozilla\Firefox\SanitizeOnShutdown\FormData = 0x1 | 0x0
5663 Software\Policies\Mozilla\Firefox\SanitizeOnShutdown\History = 0x1 | 0x0
5664 Software\Policies\Mozilla\Firefox\SanitizeOnShutdown\Sessions = 0x1 | 0x0
5665 Software\Policies\Mozilla\Firefox\SanitizeOnShutdown\SiteSettings = 0x1 | 0x0
5666 Software\Policies\Mozilla\Firefox\SanitizeOnShutdown\OfflineApps = 0x1 | 0x0
5667 Software\Policies\Mozilla\Firefox\SanitizeOnShutdown\Locked = 0x1 | 0x0
5668 ```
5669 #### Windows (Intune)
5670 OMA-URI:
5671 ```
5672 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~SanitizeOnShutdown/A_SanitizeOnShutdown_Cache
5673 ```
5674 Value (string):
5675 ```
5676 <enabled/> or <disabled/>
5677 ```
5678 OMA-URI:
5679 ```
5680 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~SanitizeOnShutdown/B_SanitizeOnShutdown_Cookies
5681 ```
5682 Value (string):
5683 ```
5684 <enabled/> or <disabled/>
5685 ```
5686 OMA-URI:
5687 ```
5688 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~SanitizeOnShutdown/C_SanitizeOnShutdown_Downloads
5689 ```
5690 Value (string):
5691 ```
5692 <enabled/> or <disabled/>
5693 ```
5694 OMA-URI:
5695 ```
5696 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~SanitizeOnShutdown/D_SanitizeOnShutdown_FormData
5697 ```
5698 Value (string):
5699 ```
5700 <enabled/> or <disabled/>
5701 ```
5702 OMA-URI:
5703 ```
5704 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~SanitizeOnShutdown/E_SanitizeOnShutdown_History
5705 ```
5706 Value (string):
5707 ```
5708 <enabled/> or <disabled/>
5709 ```
5710 OMA-URI:
5711 ```
5712 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~SanitizeOnShutdown/F_SanitizeOnShutdown_Sessions
5713 ```
5714 Value (string):
5715 ```
5716 <enabled/> or <disabled/>
5717 ```
5718 OMA-URI:
5719 ```
5720 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~SanitizeOnShutdown/G_SanitizeOnShutdown_SiteSettings
5721 ```
5722 Value (string):
5723 ```
5724 <enabled/> or <disabled/>
5725 ```
5726 OMA-URI:
5727 ```
5728 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~SanitizeOnShutdown/H_SanitizeOnShutdown_OfflineApps
5729 ```
5730 Value (string):
5731 ```
5732 <enabled/> or <disabled/>
5733 ```
5734 OMA-URI:
5735 ```
5736 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~SanitizeOnShutdown/I_SanitizeOnShutdown_Locked
5737 ```
5738 Value (string):
5739 ```
5740 <enabled/> or <disabled/>
5741 ```
5742 #### macOS
5743 ```
5744 <dict>
5745   <key>SanitizeOnShutdown</key>
5746   <dict>
5747     <key>Cache</key>
5748     <true/> | <false/>
5749     <key>Cookies</key>
5750     <true/> | <false/>
5751     <key>Downloads</key>
5752     <true/> | <false/>
5753     <key>FormData</key>
5754     <true/> | <false/>
5755     <key>History</key>
5756     <true/> | <false/>
5757     <key>Sessions</key>
5758     <true/> | <false/>
5759     <key>SiteSettings</key>
5760     <true/> | <false/>
5761     <key>OfflineApps</key>
5762     <true/> | <false/>
5763     <key>Locked</key>
5764     <true/> | <false/>
5765   </dict>
5766 </dict>
5767 ```
5768 #### policies.json
5769 ```
5770 {
5771   "policies": {
5772     "SanitizeOnShutdown": {
5773       "Cache": true | false,
5774       "Cookies": true | false,
5775       "Downloads": true | false,
5776       "FormData": true | false,
5777       "History": true | false,
5778       "Sessions": true | false,
5779       "SiteSettings": true | false,
5780       "OfflineApps": true | false,
5781       "Locked": true | false
5782     }
5783   }
5784 }
5785 ```
5786 ### SanitizeOnShutdown (All)
5787 Clear all data on shutdown, including Browsing & Download History, Cookies, Active Logins, Cache, Form & Search History, Site Preferences and Offline Website Data.
5788
5789 **Compatibility:** Firefox 60, Firefox ESR 60\
5790 **CCK2 Equivalent:** N/A\
5791 **Preferences Affected:** `privacy.sanitize.sanitizeOnShutdown`, `privacy.clearOnShutdown.cache`, `privacy.clearOnShutdown.cookies`, `privacy.clearOnShutdown.downloads`, `privacy.clearOnShutdown.formdata`, `privacy.clearOnShutdown.history`, `privacy.clearOnShutdown.sessions`, `privacy.clearOnShutdown.siteSettings`, `privacy.clearOnShutdown.offlineApps`
5792 #### Windows (GPO)
5793 ```
5794 Software\Policies\Mozilla\Firefox\SanitizeOnShutdown = 0x1 | 0x0
5795 ```
5796 #### Windows (Intune)
5797 OMA-URI:
5798 ```
5799 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox/C_SanitizeOnShutdown
5800 ```
5801 Value (string):
5802 ```
5803 <enabled/> or <disabled/>
5804 ```
5805 #### macOS
5806 ```
5807 <dict>
5808   <key>SanitizeOnShutdown</key>
5809   <true/> | <false/>
5810 </dict>
5811 ```
5812 #### policies.json
5813 ```
5814 {
5815   "policies": {
5816     "SanitizeOnShutdown": true | false
5817   }
5818 }
5819 ```
5820 ### SearchBar
5821 Set whether or not search bar is displayed.
5822
5823 **Compatibility:** Firefox 60, Firefox ESR 60\
5824 **CCK2 Equivalent:** `showSearchBar`\
5825 **Preferences Affected:** N/A
5826
5827 #### Windows (GPO)
5828 ```
5829 Software\Policies\Mozilla\Firefox\SearchBar = "unified" | "separate"
5830 ```
5831
5832 #### Windows (Intune)
5833 OMA-URI:
5834 ```
5835 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox/SearchBar
5836 ```
5837 Value (string):
5838 ```
5839 <enabled/>
5840 <data id="SearchBar" value="unified | separate"/>
5841 ```
5842 #### macOS
5843 ```
5844 <dict>
5845   <key>SearchBar</key>
5846   <string>unified | separate</string>
5847 </dict>
5848 ```
5849 #### policies.json
5850 ```
5851 {
5852   "policies": {
5853     "SearchBar": "unified" | "separate"
5854   }
5855 }
5856 ```
5857 <a name="SearchEngines"></a>
5858
5859 ### SearchEngines (This policy is only available on the ESR.)
5860
5861 ### SearchEngines | Add
5862
5863 Add new search engines. Although there are only five engines available in the ADMX template, there is no limit. To add more in the ADMX template, you can duplicate the XML.
5864
5865 This policy is only available on the ESR. `Name` and `URLTemplate` are required.
5866
5867 `Name` is the name of the search engine.
5868
5869 `URLTemplate` is the search URL with {searchTerms} to substitute for the search term.
5870
5871 `Method` is either GET or POST
5872
5873 `IconURL` is a URL for the icon to use.
5874
5875 `Alias` is a keyword to use for the engine.
5876
5877 `Description` is a description of the search engine.
5878
5879 `PostData` is the POST data as name value pairs separated by &.
5880
5881 `SuggestURLTemplate` is a search suggestions URL with {searchTerms} to substitute for the search term.
5882
5883 `Encoding` is the query charset for the engine. It defaults to UTF-8.
5884
5885 **Compatibility:** Firefox ESR 60 (POST support in Firefox ESR 68, Encoding support in Firefox 91)\
5886 **CCK2 Equivalent:** `searchplugins`\
5887 **Preferences Affected:** N/A
5888
5889 #### Windows (GPO)
5890 ```
5891 Software\Policies\Mozilla\Firefox\SearchEngines\Add\1\Name = "Example1"
5892 Software\Policies\Mozilla\Firefox\SearchEngines\Add\1\URLTemplate = "https://www.example.org/q={searchTerms}"
5893 Software\Policies\Mozilla\Firefox\SearchEngines\Add\1\Method = "GET" | "POST"
5894 Software\Policies\Mozilla\Firefox\SearchEngines\Add\1\IconURL = "https://www.example.org/favicon.ico"
5895 Software\Policies\Mozilla\Firefox\SearchEngines\Add\1\Alias = "example"
5896 Software\Policies\Mozilla\Firefox\SearchEngines\Add\1\Description = "Example Description"
5897 Software\Policies\Mozilla\Firefox\SearchEngines\Add\1\SuggestURLTemplate = "https://www.example.org/suggestions/q={searchTerms}"
5898 Software\Policies\Mozilla\Firefox\SearchEngines\Add\1\PostData = "name=value&q={searchTerms}"
5899 ```
5900 #### Windows (Intune)
5901 OMA-URI:
5902 ```
5903 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~Search/SearchEngines_1
5904 ```
5905 Value (string):
5906 ```
5907 <enabled/>
5908 <data id="SearchEngine_Name" value="Example1"/>
5909 <data id="SearchEngine_URLTemplate" value="https://www.example.org/q={searchTerms"/>
5910 <data id="SearchEngine_Method" value="GET | POST"/>
5911 <data id="SearchEngine_IconURL" value="https://www.example.org/favicon.ico"/>
5912 <data id="SearchEngine_Alias" value="example"/>
5913 <data id="SearchEngine_Description" value="Example Description"/>
5914 <data id="SearchEngine_SuggestURLTemplate" value="https://www.example.org/suggestions/q={searchTerms}"/>
5915 <data id="SearchEngine_PostData" value="name=value&amp;q={searchTerms}"/>
5916 ```
5917 #### macOS
5918 ```
5919 <dict>
5920   <key>SearchEngines</key>
5921   <dict>
5922     <key>Add</key>
5923     <array>
5924       <dict>
5925         <key>Name</key>
5926         <string>Example1</string>
5927         <key>URLTemplate</key>
5928         <string>https://www.example.org/q={searchTerms}</string>
5929         <key>Method</key>
5930         <string>GET | POST </string>
5931         <key>IconURL</key>
5932         <string>https://www.example.org/favicon.ico</string>
5933         <key>Alias</key>
5934         <string>example</string>
5935         <key>Description</key>
5936         <string>Example Description</string>
5937         <key>SuggestURLTemplate</key>
5938         <string>https://www.example.org/suggestions/q={searchTerms}</string>
5939         <key>PostData</key>
5940         <string>name=value&q={searchTerms}</string>
5941       </dict>
5942     <array>
5943   </dict>
5944 </dict>
5945 ```
5946 #### policies.json
5947 ```
5948 {
5949   "policies": {
5950     "SearchEngines": {
5951       "Add": [
5952         {
5953           "Name": "Example1",
5954           "URLTemplate": "https://www.example.org/q={searchTerms}",
5955           "Method": "GET" | "POST",
5956           "IconURL": "https://www.example.org/favicon.ico",
5957           "Alias": "example",
5958           "Description": "Description",
5959           "PostData": "name=value&q={searchTerms}",
5960           "SuggestURLTemplate": "https://www.example.org/suggestions/q={searchTerms}"
5961         }
5962       ]
5963     }
5964   }
5965 }
5966 ```
5967 ### SearchEngines | Default
5968
5969 Set the default search engine. This policy is only available on the ESR.
5970
5971 **Compatibility:** Firefox ESR 60\
5972 **CCK2 Equivalent:** `defaultSearchEngine`\
5973 **Preferences Affected:** N/A
5974
5975 #### Windows (GPO)
5976 ```
5977 Software\Policies\Mozilla\Firefox\SearchEngines\Default = NAME_OF_SEARCH_ENGINE
5978 ```
5979 #### Windows (Intune)
5980 OMA-URI:
5981 ```
5982 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~Search/SearchEngines_Default
5983 ```
5984 Value (string):
5985 ```
5986 <enabled/>
5987 <data id="SearchEngines_Default" value="NAME_OF_SEARCH_ENGINE"/>
5988 ```
5989 #### macOS
5990 ```
5991 <dict>
5992   <key>SearchEngines</key>
5993   <dict>
5994     <key>Default</key>
5995     <string>NAME_OF_SEARCH_ENGINE</string>
5996   </dict>
5997 </dict>
5998 ```
5999 #### policies.json
6000 ```
6001 {
6002   "policies": {
6003     "SearchEngines": {
6004       "Default": "NAME_OF_SEARCH_ENGINE"
6005     }
6006   }
6007 }
6008 ```
6009 ### SearchEngines | PreventInstalls
6010
6011 Prevent installing search engines from webpages.
6012
6013 **Compatibility:** Firefox ESR 60\
6014 **CCK2 Equivalent:** `disableSearchEngineInstall`\
6015 **Preferences Affected:** N/A
6016
6017 #### Windows (GPO)
6018 ```
6019 Software\Policies\Mozilla\Firefox\SearchEngines\PreventInstalls = 0x1 | 0x0
6020 ```
6021 #### Windows (Intune)
6022 OMA-URI:
6023 ```
6024 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~Search/SearchEngines_PreventInstalls
6025 ```
6026 Value (string):
6027 ```
6028 <enabled/> or <disabled/>
6029 ```
6030 #### macOS
6031 ```
6032 <dict>
6033   <key>SearchEngines</key>
6034   <dict>
6035     <key>PreventInstalls</key>
6036     <true/> | <false/>
6037   </dict>
6038 </dict>
6039 ```
6040 #### policies.json
6041 ```
6042 {
6043   "policies": {
6044     "SearchEngines": {
6045       "PreventInstalls": true | false
6046     }
6047   }
6048 }
6049 ```
6050 ### SearchEngines | Remove
6051
6052 Hide built-in search engines. This policy is only available on the ESR.
6053
6054 **Compatibility:** Firefox ESR 60.2\
6055 **CCK2 Equivalent:** `removeDefaultSearchEngines` (removed all built-in engines)\
6056 **Preferences Affected:** N/A
6057
6058 #### Windows (GPO)
6059 ```
6060 Software\Policies\Mozilla\Firefox\SearchEngines\Remove\1 = NAME_OF_SEARCH_ENGINE
6061 ```
6062 #### Windows (Intune)
6063 OMA-URI:
6064 ```
6065 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~Search/SearchEngines_Remove
6066 ```
6067 Value (string):
6068 ```
6069 <enabled/>
6070 <data id="SearchEngines_Remove" value="1&#xF000;NAME_OF_SEARCH_ENGINE"/>
6071 ```
6072 #### macOS
6073 ```
6074 <dict>
6075   <key>SearchEngines</key>
6076   <dict>
6077     <key>Remove</key>
6078     <array>
6079       <string>NAME_OF_SEARCH_ENGINE</string>
6080     </array>
6081   </dict>
6082 </dict>
6083 ```
6084 #### policies.json
6085 ```
6086 {
6087   "policies": {
6088     "SearchEngines": {
6089       "Remove": ["NAME_OF_SEARCH_ENGINE"]
6090     }
6091   }
6092 }
6093 ```
6094 ### SearchSuggestEnabled
6095
6096 Enable search suggestions.
6097
6098 **Compatibility:** Firefox 68, Firefox ESR 68\
6099 **CCK2 Equivalent:** N/A\
6100 **Preferences Affected:** `browser.urlbar.suggest.searches`, `browser.search.suggest.enabled`
6101
6102 #### Windows (GPO)
6103 ```
6104 Software\Policies\Mozilla\Firefox\SearchSuggestEnabled = 0x1 | 0x0
6105 ```
6106 #### Windows (Intune)
6107 OMA-URI:
6108 ```
6109 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~Search/SearchSuggestEnabled
6110 ```
6111 Value (string):
6112 ```
6113 <enabled/> or <disabled/>
6114 ```
6115 #### macOS
6116 ```
6117 <dict>
6118   <key>SearchSuggestEnabled</key>
6119   <true/> | <false/>
6120 </dict>
6121 ```
6122 #### policies.json
6123 ```
6124 {
6125   "policies": {
6126     "SearchSuggestEnabled": true | false
6127   }
6128 }
6129 ```
6130 ### SecurityDevices
6131
6132 Add or delete PKCS #11 modules.
6133
6134 **Compatibility:** Firefox 114, Firefox ESR 112.12\
6135 **CCK2 Equivalent:** N/A\
6136 **Preferences Affected:** N/A
6137
6138 #### Windows (GPO)
6139 ```
6140 Software\Policies\Mozilla\Firefox\SecurityDevices\Add\NAME_OF_DEVICE_TO_ADD = PATH_TO_LIBRARY_FOR_DEVICE
6141 Software\Policies\Mozilla\Firefox\SecurityDevices\Remove\1 = NAME_OF_DEVICE_TO_REMOVE
6142 ```
6143 #### Windows (Intune)
6144 OMA-URI:
6145 ```
6146 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox/SecurityDevices/SecurityDevices_Add
6147 ```
6148 Value (string):
6149 ```
6150 <enabled/>
6151 <data id="SecurityDevices" value="NAME_OF_DEVICE_TO_ADD&#xF000;PATH_TO_LIBRARY_FOR_DEVICE"/>
6152 ```
6153 OMA-URI:
6154 ```
6155 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox/SecurityDevices/SecurityDevices_Delete
6156 ```
6157 Value (string):
6158 ```
6159 <enabled/>
6160 <data id="SecurityDevices" value="1&#xF000;NAME_OF_DEVICE_TO_REMOVE"/>
6161 ```
6162 #### macOS
6163 ```
6164 <dict>
6165   <key>SecurityDevices</key>
6166   <dict>
6167     <key>Add<key>
6168     <dict>
6169       <key>NAME_OF_DEVICE_TO_ADD</key>
6170       <string>PATH_TO_LIBRARY_FOR_DEVICE</string>
6171     </dict>
6172     <key>Delete</add>
6173     <array>
6174       <string>NAME_OF_DEVICE_TO_DELETE</string>
6175     </array>
6176   </dict>
6177 </dict>
6178 ```
6179 #### policies.json
6180 ```
6181 {
6182   "policies": {
6183     "SecurityDevices": {
6184       "Add": {
6185         "NAME_OF_DEVICE_TO_ADD": "PATH_TO_LIBRARY_FOR_DEVICE"
6186       },
6187       "Delete": ["NAME_OF_DEVICE_TO_DELETE"]
6188     }
6189   }
6190 }
6191 ```
6192 ### SecurityDevices (Deprecated)
6193
6194 Install PKCS #11 modules.
6195
6196 **Compatibility:** Firefox 64, Firefox ESR 60.4\
6197 **CCK2 Equivalent:** `certs.devices`\
6198 **Preferences Affected:** N/A
6199
6200 #### Windows (GPO)
6201 ```
6202 Software\Policies\Mozilla\Firefox\SecurityDevices\NAME_OF_DEVICE = PATH_TO_LIBRARY_FOR_DEVICE
6203 ```
6204 #### Windows (Intune)
6205 OMA-URI:
6206 ```
6207 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox/SecurityDevices
6208 ```
6209 Value (string):
6210 ```
6211 <enabled/>
6212 <data id="SecurityDevices" value="NAME_OF_DEVICE&#xF000;PATH_TO_LIBRARY_FOR_DEVICE"/>
6213 ```
6214 #### macOS
6215 ```
6216 <dict>
6217   <key>SecurityDevices</key>
6218   <dict>
6219     <key>NAME_OF_DEVICE</key>
6220     <string>PATH_TO_LIBRARY_FOR_DEVICE</string>
6221   </dict>
6222 </dict>
6223 ```
6224 #### policies.json
6225 ```
6226 {
6227   "policies": {
6228     "SecurityDevices": {
6229       "NAME_OF_DEVICE": "PATH_TO_LIBRARY_FOR_DEVICE"
6230     }
6231   }
6232 }
6233 ```
6234 ### ShowHomeButton
6235 Show the home button on the toolbar.
6236
6237 Future versions of Firefox will not show the home button by default.
6238
6239 **Compatibility:** Firefox 88, Firefox ESR 78.10\
6240 **CCK2 Equivalent:** N/A\
6241 **Preferences Affected:** N/A
6242
6243 #### Windows (GPO)
6244 ```
6245 Software\Policies\Mozilla\Firefox\ShowHomeButton = 0x1 | 0x0
6246 ```
6247 #### Windows (Intune)
6248 OMA-URI:
6249 ```
6250 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~Homepage/Homepage_ShowHomeButton
6251 ```
6252 Value (string):
6253 ```
6254 <enabled/> or <disabled/>
6255 ```
6256 #### macOS
6257 ```
6258 <dict>
6259   <key>ShowHomeButton</key>
6260   <true/> | <false/>
6261 </dict>
6262 ```
6263 #### policies.json
6264 ```
6265 {
6266   "policies": {
6267     "ShowHomeButton": true | false
6268   }
6269 }
6270 ```
6271 ### SSLVersionMax
6272
6273 Set and lock the maximum version of TLS. (Firefox defaults to a maximum of TLS 1.3.)
6274
6275 **Compatibility:** Firefox 66, Firefox ESR 60.6\
6276 **CCK2 Equivalent:** N/A\
6277 **Preferences Affected:** `security.tls.version.max`
6278
6279 #### Windows (GPO)
6280 ```
6281 Software\Policies\Mozilla\Firefox\SSLVersionMax = "tls1" | "tls1.1" | "tls1.2" | "tls1.3"
6282 ```
6283 #### Windows (Intune)
6284 OMA-URI:
6285 ```
6286 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox/SSLVersionMax
6287 ```
6288 Value (string):
6289 ```
6290 <enabled/>
6291 <data id="SSLVersion" value="tls1 | tls1.2 | tls1.3"/>
6292 ```
6293 #### macOS
6294 ```
6295 <dict>
6296   <key>SSLVersionMax</key>
6297   <string>tls1 | tls1.1 | tls1.2 | tls1.3</string>
6298 </dict>
6299 ```
6300
6301 #### policies.json
6302 ```
6303 {
6304   "policies": {
6305     "SSLVersionMax": "tls1" | "tls1.1" | "tls1.2" | "tls1.3"
6306   }
6307 }
6308 ```
6309 ### SSLVersionMin
6310
6311 Set and lock the minimum version of TLS. (Firefox defaults to a minimum of TLS 1.2.)
6312
6313 **Compatibility:** Firefox 66, Firefox ESR 60.6\
6314 **CCK2 Equivalent:** N/A\
6315 **Preferences Affected:** `security.tls.version.min`
6316
6317 #### Windows (GPO)
6318 ```
6319 Software\Policies\Mozilla\Firefox\SSLVersionMin = "tls1" | "tls1.1" | "tls1.2" | "tls1.3"
6320 ```
6321 #### Windows (Intune)
6322 OMA-URI:
6323 ```
6324 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox/SSLVersionMin
6325 ```
6326 Value (string):
6327 ```
6328 <enabled/>
6329 <data id="SSLVersion" value="tls1 | tls1.2 | tls1.3"/>
6330 ```
6331 #### macOS
6332 ```
6333 <dict>
6334   <key>SSLVersionMin</key>
6335   <string>tls1 | tls1.1 | tls1.2 | tls1.3</string>
6336 </dict>
6337 ```
6338
6339 #### policies.json
6340 ```
6341 {
6342   "policies": {
6343     "SSLVersionMin": "tls1" | "tls1.1" | "tls1.2" | "tls1.3"
6344   }
6345 }
6346 ```
6347 ### StartDownloadsInTempDirectory
6348 Force downloads to start off in a local, temporary location rather than the default download directory.
6349
6350 **Compatibility:** Firefox 102\
6351 **CCK2 Equivalent:** N/A\
6352 **Preferences Affected:** `browser.download.start_downloads_in_tmp_dir`
6353
6354 #### Windows (GPO)
6355 ```
6356 Software\Policies\Mozilla\Firefox\StartDownloadsInTempDirectory = 0x1 | 0x0
6357 ```
6358 #### Windows (Intune)
6359 OMA-URI:
6360 ```
6361 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox/StartDownloadsInTempDirectory
6362 ```
6363 Value (string):
6364 ```
6365 <enabled/> or <disabled/>
6366 ```
6367 #### macOS
6368 ```
6369 <dict>
6370   <key>StartDownloadsInTempDirectory</key>
6371   <true/> | <false/>
6372 </dict>
6373 ```
6374 #### policies.json
6375 ```
6376 {
6377   "policies": {
6378     "StartDownloadsInTempDirectory": true | false
6379 }
6380 ```
6381 ### SupportMenu
6382 Add a menuitem to the help menu for specifying support information.
6383
6384 **Compatibility:** Firefox 68.0.1, Firefox ESR 68.0.1\
6385 **CCK2 Equivalent:** helpMenu\
6386 **Preferences Affected:** N/A
6387
6388 #### Windows (GPO)
6389 ```
6390 Software\Policies\Mozilla\Firefox\SupportMenu\Title = "Support Menu"
6391 Software\Policies\Mozilla\Firefox\SupportMenu\URL = "http://example.com/support"
6392 Software\Policies\Mozilla\Firefox\SupportMenu\AccessKey = "S"
6393 ```
6394 #### Windows (Intune)
6395 OMA-URI:
6396 ```
6397 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox/SupportMenu
6398 ```
6399 Value (string):
6400 ```
6401 <enabled/>
6402 <data id="SupportMenuTitle" value="Support Menu"/>
6403 <data id="SupportMenuURL" value="http://example.com/support"/>
6404 <data id="SupportMenuAccessKey" value="S"/>
6405 ```
6406 #### macOS
6407 ```
6408 <dict>
6409   <key>SupportMenu</key>
6410   <dict>
6411     <key>Title</key>
6412     <string>SupportMenu</string>
6413     <key>URL</key>
6414     <string>http://example.com/support</string>
6415     <key>AccessKey</key>
6416     <string>S</string>
6417   </dict>
6418 </dict>
6419 ```
6420 #### policies.json
6421 ```
6422 {
6423   "policies": {
6424     "SupportMenu": {
6425       "Title": "Support Menu",
6426       "URL": "http://example.com/support",
6427       "AccessKey": "S"
6428     }
6429   }
6430 }
6431 ```
6432 ### TranslateEnabled
6433 Enable or disable webpage translation.
6434
6435 Note: Web page translation is done completely on the client, so there is no data or privacy risk.
6436
6437 If you only want to disable the popup, you can set the pref `browser.translations.automaticallyPopup` to false using the [Preferences](#preferences) policy.
6438
6439 **Compatibility:** Firefox 126\
6440 **CCK2 Equivalent:** N/A\
6441 **Preferences Affected:** `browser.translations.enable`
6442
6443 #### Windows (GPO)
6444 ```
6445 Software\Policies\Mozilla\Firefox\TranslateEnabled = 0x1 | 0x0
6446 ```
6447 #### Windows (Intune)
6448 OMA-URI:
6449 ```
6450 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox/TranslateEnabled
6451 ```
6452 Value (string):
6453 ```
6454 <enabled/> or <disabled/>
6455 ```
6456 #### macOS
6457 ```
6458 <dict>
6459   <key>TranslateEnabled</key>
6460   <true/> | <false/>
6461 </dict>
6462 ```
6463 #### policies.json
6464 ```
6465 {
6466   "policies": {
6467     "TranslateEnabled": true | false
6468   }
6469 }
6470 ```
6471 ### UserMessaging
6472
6473 Prevent Firefox from messaging the user in certain situations.
6474
6475 `WhatsNew` Remove the "What's New" icon and menuitem. (*Deprecated*)
6476
6477 `ExtensionRecommendations` If false, don't recommend extensions while the user is visiting web pages.
6478
6479 `FeatureRecommendations` If false, don't recommend browser features.
6480
6481 `UrlbarInterventions` If false, Don't offer Firefox specific suggestions in the URL bar.
6482
6483 `SkipOnboarding` If true, don't show onboarding messages on the new tab page.
6484
6485 `MoreFromMozilla` If false, don't show the "More from Mozilla" section in Preferences. (Firefox 98)
6486
6487 `Locked` prevents the user from changing user messaging preferences.
6488
6489 **Compatibility:** Firefox 75, Firefox ESR 68.7\
6490 **CCK2 Equivalent:** N/A\
6491 **Preferences Affected:** `browser.newtabpage.activity-stream.asrouter.userprefs.cfr.addons`, `browser.newtabpage.activity-stream.asrouter.userprefs.cfr.features`, `browser.aboutwelcome.enabled`, `browser.preferences.moreFromMozilla`
6492
6493 #### Windows (GPO)
6494 ```
6495 Software\Policies\Mozilla\Firefox\UserMessaging\ExtensionRecommendations = 0x1 | 0x0
6496 Software\Policies\Mozilla\Firefox\UserMessaging\FeatureRecommendations = 0x1 | 0x0
6497 Software\Policies\Mozilla\Firefox\UserMessaging\UrlbarInterventions = 0x1 | 0x0
6498 Software\Policies\Mozilla\Firefox\UserMessaging\SkipOnboarding = 0x1 | 0x0
6499 Software\Policies\Mozilla\Firefox\UserMessaging\MoreFromMozilla = 0x1 | 0x0
6500 Software\Policies\Mozilla\Firefox\UserMessaging\Locked = 0x1 | 0x0
6501 ```
6502 #### Windows (Intune)
6503 OMA-URI:
6504 ```
6505 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~UserMessaging/UserMessaging_ExtensionRecommendations
6506 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~UserMessaging/UserMessaging_FeatureRecommendations
6507 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~UserMessaging/UserMessaging_UrlbarInterventions
6508 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~UserMessaging/UserMessaging_SkipOnboarding
6509 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~UserMessaging/UserMessaging_MoreFromMozilla
6510 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~UserMessaging/UserMessaging_Locked
6511 ```
6512 Value (string):
6513 ```
6514 <enabled/> or <disabled/>
6515 ```
6516 #### macOS
6517 ```
6518 <dict>
6519   <key>UserMessaging</key>
6520   <dict>
6521     <key>ExtensionRecommendations</key>
6522     <true/> | <false/>
6523     <key>FeatureRecommendations</key>
6524     <true/> | <false/>
6525     <key>UrlbarInterventions</key>
6526     <true/> | <false/>
6527     <key>SkipOnboarding</key>
6528     <true/> | <false/>
6529     <key>MoreFromMozilla</key>
6530     <true/> | <false/>
6531     <key>Locked</key>
6532     <true/> | <false/>
6533   </dict>
6534 </dict>
6535 ```
6536 #### policies.json
6537 ```
6538 {
6539   "policies": {
6540     "UserMessaging": {
6541       "ExtensionRecommendations": true | false,
6542       "FeatureRecommendations": true | false,
6543       "UrlbarInterventions": true | false,
6544       "SkipOnboarding": true | false,
6545       "MoreFromMozilla": true | false,
6546       "Locked": true | false
6547     }
6548   }
6549 }
6550 ```
6551 ### UseSystemPrintDialog
6552 Use the system print dialog instead of the print preview window.
6553
6554 **Compatibility:** Firefox 102\
6555 **CCK2 Equivalent:** N/A\
6556 **Preferences Affected:** `print.prefer_system_dialog`
6557
6558 #### Windows (GPO)
6559 ```
6560 Software\Policies\Mozilla\Firefox\UseSystemPrintDialog = 0x1 | 0x0
6561 ```
6562 #### Windows (Intune)
6563 OMA-URI:
6564 ```
6565 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox/UseSystemPrintDialog
6566 ```
6567 Value (string):
6568 ```
6569 <enabled/> or <disabled/>
6570 ```
6571 #### macOS
6572 ```
6573 <dict>
6574   <key>UseSystemPrintDialog</key>
6575   <true/> | <false/>
6576 </dict>
6577 ```
6578 #### policies.json
6579 ```
6580 {
6581   "policies": {
6582     "UseSystemPrintDialog": true | false
6583   }
6584 }
6585 ```
6586 ### WebsiteFilter
6587 Block websites from being visited. The parameters take an array of Match Patterns, as documented in https://developer.mozilla.org/en-US/Add-ons/WebExtensions/Match_patterns.
6588 The arrays are limited to 1000 entries each.
6589
6590 If you want to block all URLs, you can use `<all_urls>` or `*://*/*`. You can't have just a `*` on the right side.
6591
6592 For specific protocols, use `https://*/*` or `http://*/*`.
6593
6594 As of Firefox 83 and Firefox ESR 78.5, file URLs are supported.
6595
6596 **Compatibility:** Firefox 60, Firefox ESR 60\
6597 **CCK2 Equivalent:** N/A\
6598 **Preferences Affected:** N/A
6599
6600 #### Windows (GPO)
6601 ```
6602 Software\Policies\Mozilla\Firefox\WebsiteFilter\Block\1 = "<all_urls>"
6603 Software\Policies\Mozilla\Firefox\WebsiteFilter\Exceptions\1 = "http://example.org/*"
6604 ```
6605 #### Windows (Intune)
6606 OMA-URI:
6607 ```
6608 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox/B_WebsiteFilter_Block
6609 ```
6610 Value (string):
6611 ```
6612 <enabled/> <data id="WebsiteFilter" value="1&#xF000;&#60;all_urls&#62;"/>
6613 ```
6614 OMA-URI:
6615 ```
6616 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox/B_WebsiteFilter_Exceptions
6617 ```
6618 Value (string):
6619 ```
6620 <enabled/>
6621 <data id="WebsiteFilter" value="1&#xF000;http://example.org/*"/>
6622 ```
6623 If you are using custom ADMX and ADML administrative templates in Intune, you can use this OMA-URI instead
6624 to workaround the limit on the length of strings. Put all of your JSON on one line.
6625
6626 OMA-URI:
6627 ```
6628 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~Extensions/WebsiteFilterOneLine
6629 ```
6630 Value (string):
6631 ```
6632 <enabled/>
6633 <data id="JSONOneLine" value='{"Block": ["<all_urls>"],"Exceptions": ["http://example.org/*"]}'/>
6634 ```
6635 #### macOS
6636 ```
6637 <dict>
6638   <key>WebsiteFilter</key>
6639   <dict>
6640     <key>Block</key>
6641     <array>
6642       <string><all_urls></string>
6643     </array>
6644     <key>Exceptions</key>
6645     <array>
6646       <string>http://example.org/*</string>
6647     </array>
6648   </dict>
6649
6650 </dict>
6651 ```
6652 #### policies.json
6653 ```
6654 {
6655   "policies": {
6656     "WebsiteFilter": {
6657       "Block": ["<all_urls>"],
6658       "Exceptions": ["http://example.org/*"]
6659     }
6660   }
6661 }
6662 ```
6663 ### WindowsSSO
6664 Allow Windows single sign-on for Microsoft, work, and school accounts.
6665
6666 If this policy is set to true, Firefox will use credentials stored in Windows to sign in to Microsoft, work, and school accounts.
6667
6668 **Compatibility:** Firefox 91\
6669 **CCK2 Equivalent:** N/A\
6670 **Preferences Affected:** `network.http.windows-sso.enabled`
6671
6672 #### Windows (GPO)
6673 ```
6674 Software\Policies\Mozilla\Firefox\WindowsSSO = 0x1 | 0x0
6675 ```
6676 #### Windows (Intune)
6677 OMA-URI:
6678 ```
6679 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox/WindowsSSO
6680 ```
6681 Value (string):
6682 ```
6683 <enabled/> or <disabled/>
6684 ```
6685 #### policies.json
6686 ```
6687 {
6688   "policies": {
6689     "WindowsSSO": true | false
6690   }
6691 }
6692 ```