Policies can be specified using the [Group Policy templates on Windows](https://github.com/mozilla/policy-templates/tree/master/windows), [Intune on Windows](https://support.mozilla.org/kb/managing-firefox-intune), [configuration profiles on macOS](https://github.com/mozilla/policy-templates/tree/master/mac), or by creating a file called `policies.json`. On Windows, create a directory called `distribution` where the EXE is located and place the file there. On Mac, the file goes into `Firefox.app/Contents/Resources/distribution`. On Linux, the file goes into `firefox/distribution`, where `firefox` is the installation directory for firefox, which varies by distribution or you can specify system-wide policy by placing the file in `/etc/firefox/policies`.
+Unfortunately, JSON files do not support comments, but you can add extra entries to the JSON to use as comments. You will see an error in about:policies, but the policies will still work properly. For example:
+
+```
+{
+ "policies": {
+ "Authentication": {
+ "SPNEGO": ["mydomain.com", "https://myotherdomain.com"]
+ }
+ "Authentication_Comment": "These domains are required for us"
+ }
+}
+```
+
| Policy Name | Description
| --- | --- |
| **[`3rdparty`](#3rdparty)** | Set policies that WebExtensions can access via chrome.storage.managed.
| **[`Certificates`](#certificates)** |
| **[`Certificates -> ImportEnterpriseRoots`](#certificates--importenterpriseroots)** | Trust certificates that have been added to the operating system certificate store by a user or administrator.
| **[`Certificates -> Install`](#certificates--install)** | Install certificates into the Firefox certificate store.
+| **[`Containers`](#containers)** | Set policies related to [containers](https://addons.mozilla.org/firefox/addon/multi-account-containers/).
| **[`Cookies`](#cookies)** | Configure cookie preferences.
| **[`DefaultDownloadDirectory`](#defaultdownloaddirectory)** | Set the default download directory.
| **[`DisableAppUpdate`](#disableappupdate)** | Turn off application updates.
| **[`DisableSetDesktopBackground`](#disablesetdesktopbackground)** | Remove the "Set As Desktop Background..." menuitem when right clicking on an image.
| **[`DisableSystemAddonUpdate`](#disablesystemaddonupdate)** | Prevent system add-ons from being installed or updated.
| **[`DisableTelemetry`](#disabletelemetry)** | DisableTelemetry
+| **[`DisableThirdPartyModuleBlocking`](#disablethirdpartymoduleblocking)** | Do not allow blocking third-party modules.
| **[`DisplayBookmarksToolbar`](#displaybookmarkstoolbar)** | Set the initial state of the bookmarks toolbar.
+| **[`DisplayBookmarksToolbar (Deprecated)`](#displaybookmarkstoolbar-deprecated)** | Set the initial state of the bookmarks toolbar.
| **[`DisplayMenuBar`](#displaymenubar)** | Set the state of the menubar.
| **[`DisplayMenuBar (Deprecated)`](#displaymenubar-deprecated)** | Set the initial state of the menubar.
| **[`DNSOverHTTPS`](#dnsoverhttps)** | Configure DNS over HTTPS.
}
}
```
+### Containers
+Set policies related to [containers](https://addons.mozilla.org/firefox/addon/multi-account-containers/).
+
+Currently you can set the initial set of containers.
+
+For each container, you can specify the name, icon, and color.
+
+| Name | Description |
+| --- | --- |
+| `name`| Name of container
+| `icon` | Can be `fingerprint`, `briefcase`, `dollar`, `cart`, `vacation`, `gift`, `food`, `fruit`, `pet`, `tree`, `chill`, `circle`, `fence`
+| `color` | Can be `blue`, `turquoise`, `green`, `yellow`, `orange`, `red`, `pink`, `purple`, `toolbar`
+
+**Compatibility:** Firefox 113\
+**CCK2 Equivalent:** N/A\
+**Preferences Affected:** N/A
+
+#### Windows (GPO)
+Software\Policies\Mozilla\Firefox\Containers (REG_MULTI_SZ) =
+```
+{
+ "Default": [
+ {
+ "name": "My container",
+ "icon": "pet",
+ "color": "turquoise"
+ }
+ ]
+}
+```
+#### Windows (Intune)
+OMA-URI:
+```
+./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox/Containers
+```
+Value (string):
+```
+<enabled/>
+<data id="JSON" value='
+{
+ "Default": [
+ {
+ "name": "My container",
+ "icon": "pet",
+ "color": "turquoise"
+ }
+ ]
+}
+'/>
+```
+#### macOS
+```
+<dict>
+ <key>Default</key>
+ <dict>
+ <key>Containers</key>
+ <array>
+ <dict>
+ <key>name</key>
+ <string>My container</string>
+ <key>icon</key>
+ <string>pet</string>
+ <key>color</key>
+ <string>turquoise</string>
+ </dict>
+ </array>
+ </dict>
+</dict>
+```
+#### policies.json
+```
+{
+ "policies": {
+ "Containers": {
+ "Default": [
+ {
+ "name": "My container",
+ "icon": "pet",
+ "color": "turquoise"
+ }
+ ]
+ }
+ }
+}
+```
### Cookies
Configure cookie preferences.
{
"policies": {
"DefaultDownloadDirectory": "${home}/Downloads"
+ }
}
```
#### policies.json (Windows)
{
"policies": {
"DefaultDownloadDirectory": "${home}\\Downloads"
+ }
}
```
### DisableAppUpdate
}
}
```
+### DisableThirdPartyModuleBlocking
+Do not allow blocking third-party modules from the `about:third-party` page.
+
+This policy only works on Windows through GPO (not policies.json).
+
+**Compatibility:** Firefox 110 (Windows only, GPO only)\
+**CCK2 Equivalent:** N/A\
+**Preferences Affected:** N/A
+
+#### Windows (GPO)
+```
+Software\Policies\Mozilla\Firefox\DisableThirdPartyModuleBlocking = = 0x1 | 0x0
+```
+#### Windows (Intune)
+OMA-URI:
+```
+./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox/DisableThirdPartyModuleBlocking
+```
+Value (string):
+```
+<enabled/> or <disabled/>
+```
### DisplayBookmarksToolbar
+Set the initial state of the bookmarks toolbar. A user can still change how it is displayed.
+
+`always` means the bookmarks toolbar is always shown.
+
+`never` means the bookmarks toolbar is not shown.
+
+`newtab` means the bookmarks toolbar is only shown on the new tab page.
+
+**Compatibility:** Firefox 109, Firefox ESR 102.7\
+**CCK2 Equivalent:** N/A\
+**Preferences Affected:** N/A
+
+#### Windows (GPO)
+```
+Software\Policies\Mozilla\Firefox\DisplayBookmarksToolbar = "always", "never", "newtab"
+```
+#### Windows (Intune)
+OMA-URI:
+```
+./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox/DisplayBookmarksToolbar_Enum
+```
+Value (string):
+```
+<enabled/>
+<data id="DisplayBookmarksToolbar" value="always | never | newtab"/>
+```
+#### macOS
+```
+<dict>
+ <key>DisplayBookmarksToolbar</key>
+ <string>always | never | newtab</string>
+</dict>
+```
+#### policies.json
+```
+{
+ "policies": {
+ "DisplayBookmarksToolbar": "always" | "never" | "newtab"
+ }
+}
+```
+### DisplayBookmarksToolbar (Deprecated)
Set the initial state of the bookmarks toolbar. A user can still hide it and it will stay hidden.
**Compatibility:** Firefox 60, Firefox ESR 60\
If `Fingerprinting` is set to true, fingerprinting scripts on websites are blocked.
+If `EmailTracking` is set to true, hidden email tracking pixels and scripts on websites are blocked. (Firefox 112)
+
`Exceptions` are origins for which tracking protection is not enabled.
**Compatibility:** Firefox 60, Firefox ESR 60 (Cryptomining and Fingerprinting added in 70/68.2, Exceptions added in 73/68.5)\
| `blocked_install_message` | This maps to a string specifying the error message to display to users if they're blocked from installing an extension. This setting allows you to append text to the generic error message displayed when the extension is blocked. This could be be used to direct users to your help desk, explain why a particular extension is blocked, or something else. This setting can be used only for the default configuration.
| `restricted_domains` | An array of domains on which content scripts can't be run. This setting can be used only for the default configuration.
| `updates_disabled` | (Firefox 89, Firefox ESR 78.11) Boolean that indicates whether or not to disable automatic updates for an individual extension.
+| `default_area` | (Firefox 113) This settings specifies where the extension icon should be placed. Possible values are "navbar" and "menupanel"
**Compatibility:** Firefox 69, Firefox ESR 68.1 (As of Firefox 85, Firefox ESR 78.7, installing a theme makes it the default.)\
**CCK2 Equivalent:** N/A\
toolkit.legacyUserProfileCustomizations.stylesheets (Firefox 95, Firefox ESR 91.4)
ui.
widget.
+xpinstall.signatures.required (Firefox ESR 102.10, Firefox ESR only)
```
as well as the following security preferences:
| Preference | Type | Default
| If set to true, adds the words "Not Secure" for insecure sites.
| security.insecure_connection_text.pbmode.enabled | bool | false
| If set to true, adds the words "Not Secure" for insecure sites in private browsing.
-| security.insecure_field_warning.contextual.enabled | bool | true
-| If set to false, remove the warning for inscure login fields.
| security.mixed_content.block_active_content | boolean | true
| If false, mixed active content (HTTP and HTTPS) is not blocked.
| security.osclientcerts.autoload | boolean | false
| If true, client certificates are loaded from the operating system certificate store.
+| security.OCSP.enabled | integer | 1
+| If 0, do not fetch OCSP. If 1, fetch OCSP for DV and EV certificates. If 2, fetch OCSP only for EV certificates
+| security.OCSP.require | boolean | false
+| If true, if an OCSP request times out, the connection fails.
+| security.ssl.enable_ocsp_stapling | boolean | true
+| If false, OCSP stapling is not enabled.
| security.ssl.errorReporting.enabled | boolean | true
| If false, SSL errors cannot be sent to Mozilla.
| security.tls.enable_0rtt_data | boolean | true
Software\Policies\Mozilla\Firefox\Proxy\UseProxyForDNS = 0x1 | 0x0
```
#### Windows (Intune)
+**Note**
+These setttings were moved to a category to make them easier to configure via Intune.
+
+OMA-URI:
+```
+./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~ProxySettings/Proxy_Locked
+```
+Value (string):
+```
+<enabled/> or <disabled/>
+```
+OMA-URI:
+```
+./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~ProxySettings/Proxy_ConnectionType
+```
+Value (string):
+```
+<enabled/>
+<data id="Proxy_ConnectionType" value="none | system | manual | autoDetect | autoConfig"/>
+```
+OMA-URI:
+```
+./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~ProxySettings/Proxy_HTTPProxy
+```
+Value (string):
+```
+<enabled/>
+<data id="Proxy_HTTPProxy" value="httpproxy.example.com"/>
+```
+OMA-URI:
+```
+./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~ProxySettings/Proxy_UseHTTPProxyForAllProtocols
+```
+Value (string):
+```
+<enabled/> or <disabled/>
+```
+OMA-URI:
+```
+./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~ProxySettings/Proxy_SSLProxy
+```
+Value (string):
+```
+<enabled/>
+<data id="Proxy_SSLProxy" value="sslproxy.example.com"/>
+```
OMA-URI:
```
+./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~ProxySettings/Proxy_SOCKSProxy
+```
+Value (string):
+```
+<enabled/>
+<data id="Proxy_SOCKSProxy" value="socksproxy.example.com"/>
+<data id="Proxy_SOCKSVersion" value="4 | 5"/>
+```
+OMA-URI:
+```
+./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~ProxySettings/Proxy_AutoConfigURL
+```
+Value (string):
+```
+<enabled/>
+<data id="Proxy_AutoConfigURL" value="URL_TO_AUTOCONFIG"/>
+```
+OMA-URI:
+```
+./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~ProxySettings/Proxy_Passthrough
+```
+Value (string):
+```
+<enabled/>
+<data id="Proxy_Passthrough" value="<local>"/>
+```
+OMA-URI:
+```
+./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~ProxySettings/Proxy_AutoLogin
+```
+Value (string):
+```
+<enabled/> or <disabled/>
+```
+OMA-URI:
+```
+./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~ProxySettings/Proxy_UseProxyForDNS
+```
+Value (string):
+```
+<enabled/> or <disabled/>
+```
+OMA-URI (Old way):
+```
./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox/Proxy
```
Value (string):
<enabled/>
<data id="ProxyLocked" value="true | false"/>
<data id="ConnectionType" value="none | system | manual | autoDetect | autoConfig"/>
-<data id="HTTPProxy" value="https://httpproxy.example.com"/>
+<data id="HTTPProxy" value="httpproxy.example.com"/>
<data id="UseHTTPProxyForAllProtocols" value="true | false"/>
-<data id="SSLProxy" value="https://sslproxy.example.com"/>
-<data id="FTPProxy" value="https://ftpproxy.example.com"/>
-<data id="SOCKSProxy" value="https://socksproxy.example.com"/>
+<data id="SSLProxy" value="sslproxy.example.com"/>
+<data id="FTPProxy" value="ftpproxy.example.com"/>
+<data id="SOCKSProxy" value="socksproxy.example.com"/>
<data id="SOCKSVersion" value="4 | 5"/>
<data id="AutoConfigURL" value="URL_TO_AUTOCONFIG"/>
<data id="Passthrough" value="<local>"/>
git.p6c8.net / policy-templates.git / blobdiff