]> git.p6c8.net - policy-templates.git/blobdiff - README.md
Bump version for release
[policy-templates.git] / README.md
index c86e4481e49c036b5791b8cc2175406ace4144b9..acf671da2321511b460231b1622079767e17eb83 100644 (file)
--- a/README.md
+++ b/README.md
@@ -23,14 +23,15 @@ Policies can be specified using the [Group Policy templates on Windows](https://
 | **[`Certificates -> ImportEnterpriseRoots`](#certificates--importenterpriseroots)** | Trust certificates that have been added to the operating system certificate store by a user or administrator.
 | **[`Certificates -> Install`](#certificates--install)** | Install certificates into the Firefox certificate store.
 | **[`Cookies`](#cookies)** | Configure cookie preferences.
+| **[`DefaultDownloadDirectory`](#defaultdownloaddirectory)** | Set the default download directory.
 | **[`DisableAppUpdate`](#disableappupdate)** | Turn off application updates.
 | **[`DisableBuiltinPDFViewer`](#disablebuiltinpdfviewer)** | Disable the built in PDF viewer.
 | **[`DisabledCiphers`](#disabledciphers)** | Disable ciphers.
 | **[`DisableDefaultBrowserAgent`](#disabledefaultbrowseragent)** | Prevent the default browser agent from taking any actions (Windows only).
 | **[`DisableDeveloperTools`](#disabledevelopertools)** | Remove access to all developer tools.
 | **[`DisableFeedbackCommands`](#disablefeedbackcommands)** | Disable the menus for reporting sites.
-| **[`DisableFirefoxScreenshots`](#disablefirefoxscreenshots)** | Remove access to Firefox Screenshots.
 | **[`DisableFirefoxAccounts`](#disablefirefoxaccounts)** | Disable Firefox Accounts integration (Sync).
+| **[`DisableFirefoxScreenshots`](#disablefirefoxscreenshots)** | Remove access to Firefox Screenshots.
 | **[`DisableFirefoxStudies`](#disablefirefoxstudies)** | Disable Firefox studies (Shield).
 | **[`DisableForgetButton`](#disableforgetbutton)** | Disable the "Forget" button.
 | **[`DisableFormHistory`](#disableformhistory)** | Turn off saving information on web forms and the search bar.
@@ -46,11 +47,10 @@ Policies can be specified using the [Group Policy templates on Windows](https://
 | **[`DisableSystemAddonUpdate`](#disablesystemaddonupdate)** | Prevent system add-ons from being installed or update.
 | **[`DisableTelemetry`](#disabletelemetry)** | DisableTelemetry
 | **[`DisplayBookmarksToolbar`](#displaybookmarkstoolbar)** | Set the initial state of the bookmarks toolbar.
-| **[`DisplayMenuBar (Deprecated)`](#displaymenubar-deprecated)** | Set the initial state of the menubar.
 | **[`DisplayMenuBar`](#displaymenubar)** | Set the state of the menubar.
+| **[`DisplayMenuBar (Deprecated)`](#displaymenubar-deprecated)** | Set the initial state of the menubar.
 | **[`DNSOverHTTPS`](#dnsoverhttps)** | Configure DNS over HTTPS.
 | **[`DontCheckDefaultBrowser`](#dontcheckdefaultbrowser)** | Don't check if Firefox is the default browser at startup.
-| **[`DefaultDownloadDirectory`](#defaultdownloaddirectory)** | Set the default download directory.
 | **[`DownloadDirectory`](#downloaddirectory)** | Set and lock the download directory.
 | **[`EnableTrackingProtection`](#enabletrackingprotection)** | Configure tracking protection.
 | **[`EncryptedMediaExtensions`](#encryptedmediaextensions)** | Enable or disable Encrypted Media Extensions and optionally lock it.
@@ -58,17 +58,16 @@ Policies can be specified using the [Group Policy templates on Windows](https://
 | **[`Extensions`](#extensions)** | Control the installation, uninstallation and locking of extensions.
 | **[`ExtensionSettings`](#extensionsettings)** | Manage all aspects of extensions.
 | **[`ExtensionUpdate`](#extensionupdate)** | Control extension updates.
-| **[`FlashPlugin`](#flashplugin)** | Configure the default Flash plugin policy as well as origins for which Flash is allowed.
 | **[`FirefoxHome`](#firefoxhome)** | Customize the Firefox Home page.
-| **[`HardwareAcceleration`](#hardwareacceleration)** | Control hardware acceleration.
+| **[`FlashPlugin`](#flashplugin)** | Configure the default Flash plugin policy as well as origins for which Flash is allowed.
 | **[`Handlers`](#handlers)** | Configure default application handlers.
+| **[`HardwareAcceleration`](#hardwareacceleration)** | Control hardware acceleration.
 | **[`Homepage`](#homepage)** | Configure the default homepage and how Firefox starts.
 | **[`InstallAddonsPermission`](#installaddonspermission)** | Configure the default extension install policy as well as origins for extension installs are allowed.
 | **[`LegacyProfiles`](#legacyprofiles)** | Disable the feature enforcing a separate profile for each installation.
 | **[`LocalFileLinks`](#localfilelinks)** | Enable linking to local files by origin.
 | **[`ManagedBookmarks`](#managedbookmarks)** | Configures a list of bookmarks managed by an administrator that cannot be changed by the user.
 | **[`ManualAppUpdateOnly`](#manualappupdateonly)** | Allow manual updates only and do not notify the user about updates..
-| **[`PrimaryPassword`](#primarypassword)** | Require or prevent using a primary (formerly master) password.
 | **[`NetworkPrediction`](#networkprediction)** | Enable or disable network prediction (DNS prefetching).
 | **[`NewTabPage`](#newtabpage)** | Enable or disable the New Tab page.
 | **[`NoDefaultBookmarks`](#nodefaultbookmarks)** | Disable the creation of default bookmarks.
@@ -83,6 +82,7 @@ Policies can be specified using the [Group Policy templates on Windows](https://
 | **[`PopupBlocking`](#popupblocking)** | Configure the default pop-up window policy as well as origins for which pop-up windows are allowed.
 | **[`Preferences`](#preferences)** | Set and lock preferences.
 | **[`Preferences (Deprecated)`](#preferences-deprecated)** | Set and lock some preferences.
+| **[`PrimaryPassword`](#primarypassword)** | Require or prevent using a primary (formerly master) password.
 | **[`PromptForDownloadLocation`](#promptfordownloadlocation)** | Ask where to save each file before downloading.
 | **[`Proxy`](#proxy)** | Configure proxy settings.
 | **[`RequestedLocales`](#requestedlocales)** | Set the the list of requested locales for the application in order of preference.
@@ -116,7 +116,7 @@ If set to true, application updates are installed without user approval within F
 
 If set to false, application updates are downloaded but the user can choose when to install the update.
 
-If you have disabled updates via DisableAppUpdate, this policy has no effect.
+If you have disabled updates via `DisableAppUpdate`, this policy has no effect.
 
 **Compatibility:** Firefox 75, Firefox ESR 68.7\
 **CCK2 Equivalent:** N/A\
@@ -656,7 +656,7 @@ Note: [`ManagedBookmarks`](#managedbookmarks) is the new recommended way to add
 
 Add bookmarks in either the bookmarks toolbar or menu. Only `Title` and `URL` are required. If `Placement` is not specified, the bookmark will be placed on the toolbar. If `Folder` is specified, it is automatically created and bookmarks with the same folder name are grouped together.
 
-If you want to clear all bookmarks set with this policy, you can set the value to an empty array (```[]```). This can be on Windows via GPO or Intune with the new Bookmarks (JSON) policy.
+If you want to clear all bookmarks set with this policy, you can set the value to an empty array (```[]```). This can be on Windows via the new Bookmarks (JSON) policy available with GPO and Intune.
 
 **Compatibility:** Firefox 60, Firefox ESR 60\
 **CCK2 Equivalent:** `bookmarks.toolbar`,`bookmarks.menu`\
@@ -891,19 +891,32 @@ Configure cookie preferences.
 
 `Block` is a list of origins (not domains) where cookies are always blocked. You must include http or https.
 
-`Default` determines whether cookies are accepted at all.
+`Behavior` sets the default behavior for cookies based on the values below.
 
-`AcceptThirdParty` determines how third-party cookies are handled.
+`BehaviorPrivateBrowsing` sets the default behavior for cookies in private browsing based on the values below.
+
+| Value | Description
+| --- | ---
+| accept | Accept all cookies
+| reject-foreign | Reject third party cookies
+| reject | Reject all cookies
+| limit-foreign | Reject third party cookies for sites you haven't visited
+| reject-tracker | Reject cookies for known trackers (default)
+| reject-tracker-and-partition-foreign | Reject cookies for known trackers and partition third-party cookies (Total Cookie Protection) (default for private browsing)
+
+`Default` (Deprecated) determines whether cookies are accepted at all.
+
+`AcceptThirdParty` (Deprecated) determines how third-party cookies are handled.
 
 `ExpireAtSessionEnd` determines when cookies expire.
 
-`RejectTracker` only rejects cookies for trackers.
+`RejectTracker` (Deprecated) only rejects cookies for trackers.
 
 `Locked` prevents the user from changing cookie preferences.
 
-**Compatibility:** Firefox 60, Firefox ESR 60 (RejectTracker added in Firefox 63, AllowSession added in Firefox 79/78.1)\
+**Compatibility:** Firefox 60, Firefox ESR 60 (RejectTracker added in Firefox 63, AllowSession added in Firefox 79/78.1, Behavior added in Firefox 95/91.4)\
 **CCK2 Equivalent:** N/A\
-**Preferences Affected:** `network.cookie.cookieBehavior`, `network.cookie.lifetimePolicy`
+**Preferences Affected:** `network.cookie.cookieBehavior`, `network.cookie.cookieBehavior.pbmode`, `network.cookie.lifetimePolicy`
 
 #### Windows (GPO)
 ```
@@ -914,6 +927,8 @@ Software\Policies\Mozilla\Firefox\Cookies\Default = 0x1 | 0x0
 Software\Policies\Mozilla\Firefox\Cookies\AcceptThirdParty = "always" | "never" | "from-visited"
 Software\Policies\Mozilla\Firefox\Cookies\ExpireAtSessionEnd = 0x1 | 0x0
 Software\Policies\Mozilla\Firefox\Cookies\RejectTracker = 0x1 | 0x0
+Software\Policies\Mozilla\Firefox\Cookies\Behavior = "accept" | "reject-foreign" | "reject" | "limit-foreign" | "reject-tracker" | "reject-tracker-and-partition-foreign"
+Software\Policies\Mozilla\Firefox\Cookies\BehaviorPrivateBrowsing = "accept" | "reject-foreign" | "reject" | "limit-foreign" | "reject-tracker" | "reject-tracker-and-partition-foreign"
 Software\Policies\Mozilla\Firefox\Cookies\Locked = 0x1 | 0x0
 ```
 #### Windows (Intune)
@@ -985,6 +1000,24 @@ Value (string):
 ```
 <enabled/> or <disabled/>
 ```
+OMA-URI:
+```
+./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~Cookies/Cookies_Behavior
+```
+Value (string):
+```
+<enabled/>
+<data id="Cookies_Behavior" value="accept | reject-foreign | reject | limit-foreign | reject-tracker | reject-tracker-and-partition-foreign"/>
+```
+OMA-URI:
+```
+./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~Cookies/Cookies_BehaviorPrivateBrowsing
+```
+Value (string):
+```
+<enabled/>
+<data id="Cookies_BehaviorPrivateBrowsing" value="accept | reject-foreign | reject | limit-foreign | reject-tracker | reject-tracker-and-partition-foreign"/>
+```
 #### macOS
 ```
 <dict>
@@ -1012,6 +1045,10 @@ Value (string):
     <true/> | <false/>
     <key>Locked</key>
     <true/> | <false/>
+    <key>Behavior</key>
+    <string>accept | reject-foreign | reject | limit-foreign | reject-tracker | reject-tracker-and-partition-foreign</string>
+    <key>BehaviorPrivateBrowsing</key>
+    <string>accept | reject-foreign | reject | limit-foreign | reject-tracker | reject-tracker-and-partition-foreign</string>
   </dict>
 </dict>
 ```
@@ -1027,7 +1064,9 @@ Value (string):
       "AcceptThirdParty": "always" | "never" | "from-visited",
       "ExpireAtSessionEnd": true | false,
       "RejectTracker": true | false,
-      "Locked": true | false
+      "Locked": true | false,
+      "Behavior": "accept" | "reject-foreign" | "reject" | "limit-foreign" | "reject-tracker" | "reject-tracker-and-partition-foreign",
+      "BehaviorPrivateBrowsing": "accept" | "reject-foreign" | "reject" | "limit-foreign" | "reject-tracker" | "reject-tracker-and-partition-foreign",
     }
   }
 }
@@ -1072,7 +1111,7 @@ Remove the master password functionality.
 
 If this value is true, it works the same as setting [`PrimaryPassword`](#primarypassword) to false and removes the primary password functionality.
 
-If both DisableMasterPasswordCreation and PrimaryPassword are used, DisableMasterPasswordCreation takes precedent.
+If both `DisableMasterPasswordCreation` and `PrimaryPassword` are used, `DisableMasterPasswordCreation` takes precedent.
 
 **Compatibility:** Firefox 60, Firefox ESR 60\
 **CCK2 Equivalent:** `noMasterPassword`\
@@ -1106,6 +1145,50 @@ Value (string):
   }
 }
 ```
+### DefaultDownloadDirectory
+Set the default download directory.
+
+You can use ${home} for the native home directory.
+
+**Compatibility:** Firefox 68, Firefox ESR 68\
+**CCK2 Equivalent:** N/A\
+**Preferences Affected:** `browser.download.dir`, `browser.download.folderList`
+
+#### Windows (GPO)
+```
+Software\Policies\Mozilla\Firefox\DefaultDownloadDirectory = "${home}\Downloads"
+```
+#### Windows (Intune)
+OMA-URI:
+```
+./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox/DefaultDownloadDirectory
+```
+Value (string):
+```
+<enabled/>
+<data id="Preferences_String" value="${home}\Downloads"/>
+```
+#### macOS
+```
+<dict>
+  <key>DefaultDownloadDirectory</key>
+  <string>${home}/Downloads</string>
+</dict>
+```
+#### policies.json (macOS and Linux)
+```
+{
+  "policies": {
+    "DefaultDownloadDirectory": "${home}/Downloads"
+}
+```
+#### policies.json (Windows)
+```
+{
+  "policies": {
+    "DefaultDownloadDirectory": "${home}\\Downloads"
+}
+```
 ### DisableAppUpdate
 Turn off application updates within Firefox.
 
@@ -1374,21 +1457,21 @@ Value (string):
   }
 }
 ```
-### DisableFirefoxScreenshots
-Remove access to Firefox Screenshots.
+### DisableFirefoxAccounts
+Disable Firefox Accounts integration (Sync).
 
 **Compatibility:** Firefox 60, Firefox ESR 60\
-**CCK2 Equivalent:** N/A\
-**Preferences Affected:** `extensions.screenshots.disabled`
+**CCK2 Equivalent:** `disableSync`\
+**Preferences Affected:** `identity.fxaccounts.enabled`
 
 #### Windows (GPO)
 ```
-Software\Policies\Mozilla\Firefox\DisableFirefoxScreenshots = 0x1 | 0x0
+Software\Policies\Mozilla\Firefox\DisableFirefoxAccounts = 0x1 | 0x0
 ```
 #### Windows (Intune)
 OMA-URI:
 ```
-./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox/DisableFirefoxScreenshots
+./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox/DisableFirefoxAccounts
 ```
 Value (string):
 ```
@@ -1397,7 +1480,7 @@ Value (string):
 #### macOS
 ```
 <dict>
-  <key>DisableFirefoxScreenshots</key>
+  <key>DisableFirefoxAccounts</key>
   <true/> | <false/>
 </dict>
 ```
@@ -1405,25 +1488,25 @@ Value (string):
 ```
 {
   "policies": {
-    "DisableFirefoxScreenshots": true | false
+    "DisableFirefoxAccounts": true | false
   }
 }
 ```
-### DisableFirefoxAccounts
-Disable Firefox Accounts integration (Sync).
+### DisableFirefoxScreenshots
+Remove access to Firefox Screenshots.
 
 **Compatibility:** Firefox 60, Firefox ESR 60\
-**CCK2 Equivalent:** `disableSync`\
-**Preferences Affected:** `identity.fxaccounts.enabled`
+**CCK2 Equivalent:** N/A\
+**Preferences Affected:** `extensions.screenshots.disabled`
 
 #### Windows (GPO)
 ```
-Software\Policies\Mozilla\Firefox\DisableFirefoxAccounts = 0x1 | 0x0
+Software\Policies\Mozilla\Firefox\DisableFirefoxScreenshots = 0x1 | 0x0
 ```
 #### Windows (Intune)
 OMA-URI:
 ```
-./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox/DisableFirefoxAccounts
+./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox/DisableFirefoxScreenshots
 ```
 Value (string):
 ```
@@ -1432,7 +1515,7 @@ Value (string):
 #### macOS
 ```
 <dict>
-  <key>DisableFirefoxAccounts</key>
+  <key>DisableFirefoxScreenshots</key>
   <true/> | <false/>
 </dict>
 ```
@@ -1440,7 +1523,7 @@ Value (string):
 ```
 {
   "policies": {
-    "DisableFirefoxAccounts": true | false
+    "DisableFirefoxScreenshots": true | false
   }
 }
 ```
@@ -1927,32 +2010,6 @@ Value (string):
   }
 }
 ```
-### DisplayMenuBar (Deprecated)
-Set the initial state of the menubar. A user can still hide it and it will stay hidden.
-
-**Compatibility:** Firefox 60, Firefox ESR 60 (Windows, some Linux)\
-**CCK2 Equivalent:** `displayMenuBar`\
-**Preferences Affected:** N/A
-
-#### Windows (GPO)
-```
-Software\Policies\Mozilla\Firefox\DisplayMenuBar = 0x1 | 0x0
-```
-#### macOS
-```
-<dict>
-  <key>DisplayMenuBar</key>
-  <true/> | <false/>
-</dict>
-```
-#### policies.json
-```
-{
-  "policies": {
-    "DisplayMenuBar": true | false
-  }
-}
-```
 ### DisplayMenuBar
 Set the state of the menubar.
 
@@ -1997,6 +2054,32 @@ Value (string):
   }
 }
 ```
+### DisplayMenuBar (Deprecated)
+Set the initial state of the menubar. A user can still hide it and it will stay hidden.
+
+**Compatibility:** Firefox 60, Firefox ESR 60 (Windows, some Linux)\
+**CCK2 Equivalent:** `displayMenuBar`\
+**Preferences Affected:** N/A
+
+#### Windows (GPO)
+```
+Software\Policies\Mozilla\Firefox\DisplayMenuBar = 0x1 | 0x0
+```
+#### macOS
+```
+<dict>
+  <key>DisplayMenuBar</key>
+  <true/> | <false/>
+</dict>
+```
+#### policies.json
+```
+{
+  "policies": {
+    "DisplayMenuBar": true | false
+  }
+}
+```
 ### DNSOverHTTPS
 Configure DNS over HTTPS.
 
@@ -2120,50 +2203,6 @@ Value (string):
   }
 }
 ```
-### DefaultDownloadDirectory
-Set the default download directory.
-
-You can use ${home} for the native home directory.
-
-**Compatibility:** Firefox 68, Firefox ESR 68\
-**CCK2 Equivalent:** N/A\
-**Preferences Affected:** `browser.download.dir`, `browser.download.folderList`
-
-#### Windows (GPO)
-```
-Software\Policies\Mozilla\Firefox\DefaultDownloadDirectory = "${home}\Downloads"
-```
-#### Windows (Intune)
-OMA-URI:
-```
-./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox/DefaultDownloadDirectory
-```
-Value (string):
-```
-<enabled/>
-<data id="Preferences_String" value="${home}\Downloads"/>
-```
-#### macOS
-```
-<dict>
-  <key>DefaultDownloadDirectory</key>
-  <string>${home}/Downloads</string>
-</dict>
-```
-#### policies.json (macOS and Linux)
-```
-{
-  "policies": {
-    "DefaultDownloadDirectory": "${home}/Downloads"
-}
-```
-#### policies.json (Windows)
-```
-{
-  "policies": {
-    "DefaultDownloadDirectory": "${home}\\Downloads"
-}
-```
 ### DownloadDirectory
 Set and lock the download directory.
 
@@ -2620,58 +2659,134 @@ Value (string):
   }
 }
 ```
-### FlashPlugin
-Configure the default Flash plugin policy as well as origins for which Flash is allowed.
-
-`Allow` is a list of origins where Flash are allowed.
-
-`Block` is a list of origins where Flash is not allowed.
-
-`Default` determines whether or not Flash is allowed by default.
-
-`Locked` prevents the user from changing Flash preferences.
+### FirefoxHome
+Customize the Firefox Home page.
 
-**Compatibility:** Firefox 60, Firefox ESR 60\
-**CCK2 Equivalent:** `permissions.plugin`\
-**Preferences Affected:** `plugin.state.flash`
+**Compatibility:** Firefox 68, Firefox ESR 68 (SponsoredTopSites and SponsoredPocket were added in Firefox 95, Firefox ESR 91.4)
+**CCK2 Equivalent:** N/A\
+**Preferences Affected:** `browser.newtabpage.activity-stream.showSearch`, `browser.newtabpage.activity-stream.feeds.topsites`, `browser.newtabpage.activity-stream.feeds.section.highlights`, `browser.newtabpage.activity-stream.feeds.section.topstories`, `browser.newtabpage.activity-stream.feeds.snippets`, `browser.newtabpage.activity-stream.showSponsoredTopSites`, `browser.newtabpage.activity-stream.showSponsored`
 
 #### Windows (GPO)
 ```
-Software\Policies\Mozilla\Firefox\FlashPlugin\Allow\1 = "https://example.org"
-Software\Policies\Mozilla\Firefox\FlashPlugin\Block\1 = "https://example.edu"
-Software\Policies\Mozilla\Firefox\FlashPlugin\Default = 0x1 | 0x0
-Software\Policies\Mozilla\Firefox\FlashPlugin\Locked = 0x1 | 0x0
+Software\Policies\Mozilla\Firefox\FirefoxHome\Search = 0x1 | 0x0
+Software\Policies\Mozilla\Firefox\FirefoxHome\TopSites = 0x1 | 0x0
+Software\Policies\Mozilla\Firefox\FirefoxHome\SponsoredTopSites = 0x1 | 0x0
+Software\Policies\Mozilla\Firefox\FirefoxHome\Highlights = 0x1 | 0x0
+Software\Policies\Mozilla\Firefox\FirefoxHome\Pocket = 0x1 | 0x0
+Software\Policies\Mozilla\Firefox\FirefoxHome\SponsoredPocket = 0x1 | 0x0
+Software\Policies\Mozilla\Firefox\FirefoxHome\Snippets = 0x1 | 0x0
+Software\Policies\Mozilla\Firefox\FirefoxHome\Locked = 0x1 | 0x0
 ```
 #### Windows (Intune)
 OMA-URI:
 ```
-./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~Flash/FlashPlugin_Allow
+./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox/CustomizeFirefoxHome
 ```
 Value (string):
 ```
 <enabled/>
-<data id="Permissions" value="1&#xF000;https://example.org&#xF000;2&#xF000;https://example.edu"/>
-```
-OMA-URI:
-```
-./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~Flash/FlashPlugin_Locked
-```
-Value (string):
-```
-<enabled/> or <disabled/>
-```
-OMA-URI:
-```
-./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~Flash/FlashPlugin_Default
-```
-Value (string):
-```
-<enabled/> or <disabled/>
+<data id="FirefoxHome_Search"  value="true | false"/>
+<data id="FirefoxHome_TopSites"  value="true | false"/>
+<data id="FirefoxHome_SponsoredTopSites"  value="true | false"/>
+<data id="FirefoxHome_Highlights"  value="true | false"/>
+<data id="FirefoxHome_Pocket"  value="true | false"/>
+<data id="FirefoxHome_SponsoredPocket"  value="true | false"/>
+<data id="FirefoxHome_Snippets"  value="true | false"/>
+<data id="FirefoxHome_Locked"  value="true | false"/>
 ```
 #### macOS
 ```
 <dict>
-  <key>FlashPlugin</key>
+  <key>FirefoxHome</key>
+  <dict>
+    <key>Search</key>
+    <true/> | <false/>
+    <key>TopSites</key>
+    <true/> | <false/>
+    <key>SponsoredTopSites</key>
+    <true/> | <false/>
+    <key>Highlights</key>
+    <true/> | <false/>
+    <key>Pocket</key>
+    <true/> | <false/>
+    <key>SponsoredPocket</key>
+    <true/> | <false/>
+    <key>Snippets</key>
+    <true/> | <false/>
+    <key>Locked</key>
+    <true/> | <false/>
+  </dict>
+</dict>
+```
+#### policies.json
+```
+{
+  "policies": {
+    "FirefoxHome": {
+      "Search": true | false,
+      "TopSites": true | false,
+      "SponsoredTopSites": true | false,
+      "Highlights": true | false,
+      "Pocket": true | false,
+      "SponsoredPocket": true | false,
+      "Snippets": true | false,
+      "Locked": true | false
+    }
+  }
+}
+```
+### FlashPlugin (Deprecated)
+Configure the default Flash plugin policy as well as origins for which Flash is allowed.
+
+`Allow` is a list of origins where Flash are allowed.
+
+`Block` is a list of origins where Flash is not allowed.
+
+`Default` determines whether or not Flash is allowed by default.
+
+`Locked` prevents the user from changing Flash preferences.
+
+**Compatibility:** Firefox 60, Firefox ESR 60\
+**CCK2 Equivalent:** `permissions.plugin`\
+**Preferences Affected:** `plugin.state.flash`
+
+#### Windows (GPO)
+```
+Software\Policies\Mozilla\Firefox\FlashPlugin\Allow\1 = "https://example.org"
+Software\Policies\Mozilla\Firefox\FlashPlugin\Block\1 = "https://example.edu"
+Software\Policies\Mozilla\Firefox\FlashPlugin\Default = 0x1 | 0x0
+Software\Policies\Mozilla\Firefox\FlashPlugin\Locked = 0x1 | 0x0
+```
+#### Windows (Intune)
+OMA-URI:
+```
+./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~Flash/FlashPlugin_Allow
+```
+Value (string):
+```
+<enabled/>
+<data id="Permissions" value="1&#xF000;https://example.org&#xF000;2&#xF000;https://example.edu"/>
+```
+OMA-URI:
+```
+./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~Flash/FlashPlugin_Locked
+```
+Value (string):
+```
+<enabled/> or <disabled/>
+```
+OMA-URI:
+```
+./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~Flash/FlashPlugin_Default
+```
+Value (string):
+```
+<enabled/> or <disabled/>
+```
+#### macOS
+```
+<dict>
+  <key>FlashPlugin</key>
   <dict>
     <key>Allow</key>
     <array>
@@ -2701,9 +2816,6 @@ Value (string):
   }
 }
 ```
-
-
-
 ### Handlers
 Configure default application handlers. This policy is based on the internal format of `handlers.json`.
 
@@ -2886,72 +2998,6 @@ Value (string):
   }
 }
 ```
-### FirefoxHome
-Customize the Firefox Home page.
-
-**Compatibility:** Firefox 68, Firefox ESR 68\
-**CCK2 Equivalent:** N/A\
-**Preferences Affected:** `browser.newtabpage.activity-stream.showSearch`, `browser.newtabpage.activity-stream.feeds.topsites`, `browser.newtabpage.activity-stream.feeds.section.highlights`, `browser.newtabpage.activity-stream.feeds.section.topstories`, `browser.newtabpage.activity-stream.feeds.snippets`
-
-#### Windows (GPO)
-```
-Software\Policies\Mozilla\Firefox\FirefoxHome\Search = 0x1 | 0x0
-Software\Policies\Mozilla\Firefox\FirefoxHome\TopSites = 0x1 | 0x0
-Software\Policies\Mozilla\Firefox\FirefoxHome\Highlights = 0x1 | 0x0
-Software\Policies\Mozilla\Firefox\FirefoxHome\Pocket = 0x1 | 0x0
-Software\Policies\Mozilla\Firefox\FirefoxHome\Snippets = 0x1 | 0x0
-Software\Policies\Mozilla\Firefox\FirefoxHome\Locked = 0x1 | 0x0
-```
-#### Windows (Intune)
-OMA-URI:
-```
-./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox/CustomizeFirefoxHome
-```
-Value (string):
-```
-<enabled/>
-<data id="FirefoxHome_Search"  value="true | false"/>
-<data id="FirefoxHome_TopSites"  value="true | false"/>
-<data id="FirefoxHome_Highlights"  value="true | false"/>
-<data id="FirefoxHome_Pocket"  value="true | false"/>
-<data id="FirefoxHome_Snippets"  value="true | false"/>
-<data id="FirefoxHome_Locked"  value="true | false"/>
-```
-#### macOS
-```
-<dict>
-  <key>FirefoxHome</key>
-  <dict>
-    <key>Search</key>
-    <true/> | <false/>
-    <key>TopSites</key>
-    <true/> | <false/>
-    <key>Highlights</key>
-    <true/> | <false/>
-    <key>Pocket</key>
-    <true/> | <false/>
-    <key>Snippets</key>
-    <true/> | <false/>
-    <key>Locked</key>
-    <true/> | <false/>
-  </dict>
-</dict>
-```
-#### policies.json
-```
-{
-  "policies": {
-    "FirefoxHome": {
-      "Search": true | false,
-      "TopSites": true | false,
-      "Highlights": true | false,
-      "Pocket": true | false,
-      "Snippets": true | false,
-      "Locked": true | false
-    }
-  }
-}
-```
 ### HardwareAcceleration
 Control hardware acceleration.
 
@@ -3388,45 +3434,6 @@ This policy is primarily intended for advanced end users, not for enterprises.
   }
 }
 ```
-### PrimaryPassword
-Require or prevent using a primary (formerly master) password.
-
-If this value is true, a primary password is required. If this value is false, it works the same as if [`DisableMasterPasswordCreation`](#disablemasterpasswordcreation) was true and removes the primary password functionality.
-
-If both DisableMasterPasswordCreation and PrimaryPassword are used, DisableMasterPasswordCreation takes precedent.
-
-**Compatibility:** Firefox 79, Firefox ESR 78.1\
-**CCK2 Equivalent:** `noMasterPassword`\
-**Preferences Affected:** N/A
-
-#### Windows (GPO)
-```
-Software\Policies\Mozilla\Firefox\PrimaryPassword = 0x1 | 0x0
-```
-#### Windows (Intune)
-OMA-URI:
-```
-./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox/PrimaryPassword
-```
-Value (string):
-```
-<enabled/> or <disabled/>
-```
-#### macOS
-```
-<dict>
-  <key>PrimaryPassword</key>
-  <true/> | <false/>
-</dict>
-```
-#### policies.json
-```
-{
-  "policies": {
-    "PrimaryPassword": true | false
-  }
-}
-```
 ### NetworkPrediction
 Enable or disable network prediction (DNS prefetching).
 
@@ -4184,6 +4191,7 @@ general.smoothScroll (Firefox 83, Firefox ESR 78.5)
 geo.
 gfx.
 intl.
+keyword.enabled (Firefox 95, Firefox ESR 91.4)
 layers.
 layout.
 media.
@@ -4193,6 +4201,7 @@ places.
 print.
 signon. (Firefox 83, Firefox ESR 78.5)
 spellchecker. (Firefox 84, Firefox ESR 78.6)
+toolkit.legacyUserProfileCustomizations.stylesheets (Firefox 95, Firefox ESR 91.4)
 ui.
 widget.
 ```
@@ -4493,6 +4502,45 @@ Value (string):
   }
 }
 ```
+### PrimaryPassword
+Require or prevent using a primary (formerly master) password.
+
+If this value is true, a primary password is required. If this value is false, it works the same as if [`DisableMasterPasswordCreation`](#disablemasterpasswordcreation) was true and removes the primary password functionality.
+
+If both DisableMasterPasswordCreation and PrimaryPassword are used, DisableMasterPasswordCreation takes precedent.
+
+**Compatibility:** Firefox 79, Firefox ESR 78.1\
+**CCK2 Equivalent:** `noMasterPassword`\
+**Preferences Affected:** N/A
+
+#### Windows (GPO)
+```
+Software\Policies\Mozilla\Firefox\PrimaryPassword = 0x1 | 0x0
+```
+#### Windows (Intune)
+OMA-URI:
+```
+./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox/PrimaryPassword
+```
+Value (string):
+```
+<enabled/> or <disabled/>
+```
+#### macOS
+```
+<dict>
+  <key>PrimaryPassword</key>
+  <true/> | <false/>
+</dict>
+```
+#### policies.json
+```
+{
+  "policies": {
+    "PrimaryPassword": true | false
+  }
+}
+```
 ### PromptForDownloadLocation
 Ask where to save each file before downloading.
 
@@ -4924,35 +4972,86 @@ Value (string):
 
 ### SearchEngines (This policy is only available on the ESR.)
 
-### SearchEngines | Default
+### SearchEngines | Add
 
-Set the default search engine. This policy is only available on the ESR.
+Add new search engines (up to five). This policy is only available on the ESR. `Name` and `URLTemplate` are required.
 
-**Compatibility:** Firefox ESR 60\
-**CCK2 Equivalent:** `defaultSearchEngine`\
+`Name` is the name of the search engine.
+
+`URLTemplate` is the search URL with {searchTerms} to substitute for the search term.
+
+`Method` is either GET or POST
+
+`IconURL` is a URL for the icon to use.
+
+`Alias` is a keyword to use for the engine.
+
+`Description` is a description of the search engine.
+
+`PostData` is the POST data as name value pairs separated by &.
+
+`SuggestURLTemplate` is a search suggestions URL with {searchTerms} to substitute for the search term.
+
+`Encoding` is the query charset for the engine. It defaults to UTF-8.
+
+**Compatibility:** Firefox ESR 60 (POST support in Firefox ESR 68, Encoding support in Firefox 91)\
+**CCK2 Equivalent:** `searchplugins`\
 **Preferences Affected:** N/A
 
 #### Windows (GPO)
 ```
-Software\Policies\Mozilla\Firefox\SearchEngines\Default = NAME_OF_SEARCH_ENGINE
+Software\Policies\Mozilla\Firefox\SearchEngines\Add\1\Name = "Example1"
+Software\Policies\Mozilla\Firefox\SearchEngines\Add\1\URLTemplate = "https://www.example.org/q={searchTerms}"
+Software\Policies\Mozilla\Firefox\SearchEngines\Add\1\Method = "GET" | "POST"
+Software\Policies\Mozilla\Firefox\SearchEngines\Add\1\IconURL = "https://www.example.org/favicon.ico"
+Software\Policies\Mozilla\Firefox\SearchEngines\Add\1\Alias = "example"
+Software\Policies\Mozilla\Firefox\SearchEngines\Add\1\Description = "Example Description"
+Software\Policies\Mozilla\Firefox\SearchEngines\Add\1\SuggestURLTemplate = "https://www.example.org/suggestions/q={searchTerms}"
+Software\Policies\Mozilla\Firefox\SearchEngines\Add\1\PostData = "name=value&q={searchTerms}"
 ```
 #### Windows (Intune)
 OMA-URI:
 ```
-./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~Search/SearchEngines_Default
+./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~Search/SearchEngines_1
 ```
 Value (string):
 ```
 <enabled/>
-<data id="SearchEngines_Default" value="NAME_OF_SEARCH_ENGINE"/>
+<data id="SearchEngine_Name" value="Example1"/>
+<data id="SearchEngine_URLTemplate" value="https://www.example.org/q={searchTerms"/>
+<data id="SearchEngine_Method" value="GET | POST"/>
+<data id="SearchEngine_IconURL" value="https://www.example.org/favicon.ico"/>
+<data id="SearchEngine_Alias" value="example"/>
+<data id="SearchEngine_Description" value="Example Description"/>
+<data id="SearchEngine_SuggestURLTemplate" value="https://www.example.org/suggestions/q={searchTerms}"/>
+<data id="SearchEngine_PostData" value="name=value&amp;q={searchTerms}"/>
 ```
 #### macOS
 ```
 <dict>
   <key>SearchEngines</key>
   <dict>
-    <key>Default</key>
-    <string>NAME_OF_SEARCH_ENGINE</string>
+    <key>Add</key>
+    <array>
+      <dict>
+        <key>Name</key>
+        <string>Example1</string>
+        <key>URLTemplate</key>
+        <string>https://www.example.org/q={searchTerms}</string>
+        <key>Method</key>
+        <string>GET | POST </string>
+        <key>IconURL</key>
+        <string>https://www.example.org/favicon.ico</string>
+        <key>Alias</key>
+        <string>example</string>
+        <key>Description</key>
+        <string>Example Description</string>
+        <key>SuggestURLTemplate</key>
+        <string>https://www.example.org/suggestions/q={searchTerms}</string>
+        <key>PostData</key>
+        <string>name=value&q={searchTerms}</string>
+      </dict>
+    <array>
   </dict>
 </dict>
 ```
@@ -4961,39 +5060,51 @@ Value (string):
 {
   "policies": {
     "SearchEngines": {
-      "Default": "NAME_OF_SEARCH_ENGINE"
+      "Add": [
+        {
+          "Name": "Example1",
+          "URLTemplate": "https://www.example.org/q={searchTerms}",
+          "Method": "GET" | "POST",
+          "IconURL": "https://www.example.org/favicon.ico",
+          "Alias": "example",
+          "Description": "Description",
+          "PostData": "name=value&q={searchTerms}",
+          "SuggestURLTemplate": "https://www.example.org/suggestions/q={searchTerms}"
+        }
+      ]
     }
   }
 }
 ```
-### SearchEngines | PreventInstalls
+### SearchEngines | Default
 
-Prevent installing search engines from webpages.
+Set the default search engine. This policy is only available on the ESR.
 
 **Compatibility:** Firefox ESR 60\
-**CCK2 Equivalent:** `disableSearchEngineInstall`\
+**CCK2 Equivalent:** `defaultSearchEngine`\
 **Preferences Affected:** N/A
 
 #### Windows (GPO)
 ```
-Software\Policies\Mozilla\Firefox\SearchEngines\PreventInstalls = 0x1 | 0x0
+Software\Policies\Mozilla\Firefox\SearchEngines\Default = NAME_OF_SEARCH_ENGINE
 ```
 #### Windows (Intune)
 OMA-URI:
 ```
-./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~Search/SearchEngines_PreventInstalls
+./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~Search/SearchEngines_Default
 ```
 Value (string):
 ```
-<enabled/> or <disabled/>
+<enabled/>
+<data id="SearchEngines_Default" value="NAME_OF_SEARCH_ENGINE"/>
 ```
 #### macOS
 ```
 <dict>
   <key>SearchEngines</key>
   <dict>
-    <key>PreventInstalls</key>
-    <true/> | <false/>
+    <key>Default</key>
+    <string>NAME_OF_SEARCH_ENGINE</string>
   </dict>
 </dict>
 ```
@@ -5002,42 +5113,39 @@ Value (string):
 {
   "policies": {
     "SearchEngines": {
-      "PreventInstalls": true | false
+      "Default": "NAME_OF_SEARCH_ENGINE"
     }
   }
 }
 ```
-### SearchEngines | Remove
+### SearchEngines | PreventInstalls
 
-Hide built-in search engines. This policy is only available on the ESR.
+Prevent installing search engines from webpages.
 
-**Compatibility:** Firefox ESR 60.2\
-**CCK2 Equivalent:** `removeDefaultSearchEngines` (removed all built-in engines)\
+**Compatibility:** Firefox ESR 60\
+**CCK2 Equivalent:** `disableSearchEngineInstall`\
 **Preferences Affected:** N/A
 
 #### Windows (GPO)
 ```
-Software\Policies\Mozilla\Firefox\SearchEngines\Remove\1 = NAME_OF_SEARCH_ENGINE
+Software\Policies\Mozilla\Firefox\SearchEngines\PreventInstalls = 0x1 | 0x0
 ```
 #### Windows (Intune)
 OMA-URI:
 ```
-./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~Search/SearchEngines_Remove
+./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~Search/SearchEngines_PreventInstalls
 ```
 Value (string):
 ```
-<enabled/>
-<data id="SearchEngines_Remove" value="1&#xF000;NAME_OF_SEARCH_ENGINE"/>
+<enabled/> or <disabled/>
 ```
 #### macOS
 ```
 <dict>
   <key>SearchEngines</key>
   <dict>
-    <key>Remove</key>
-    <array>
-      <string>NAME_OF_SEARCH_ENGINE</string>
-    </array>
+    <key>PreventInstalls</key>
+    <true/> | <false/>
   </dict>
 </dict>
 ```
@@ -5046,91 +5154,42 @@ Value (string):
 {
   "policies": {
     "SearchEngines": {
-      "Remove": ["NAME_OF_SEARCH_ENGINE"]
+      "PreventInstalls": true | false
     }
   }
 }
 ```
-### SearchEngines | Add
-
-Add new search engines (up to five). This policy is only available on the ESR. `Name` and `URLTemplate` are required.
-
-`Name` is the name of the search engine.
-
-`URLTemplate` is the search URL with {searchTerms} to substitute for the search term.
-
-`Method` is either GET or POST
-
-`IconURL` is a URL for the icon to use.
-
-`Alias` is a keyword to use for the engine.
-
-`Description` is a description of the search engine.
-
-`PostData` is the POST data as name value pairs separated by &.
-
-`SuggestURLTemplate` is a search suggestions URL with {searchTerms} to substitute for the search term.
+### SearchEngines | Remove
 
-`Encoding` is the query charset for the engine. It defaults to UTF-8.
+Hide built-in search engines. This policy is only available on the ESR.
 
-**Compatibility:** Firefox ESR 60 (POST support in Firefox ESR 68, Encoding support in Firefox 91)\
-**CCK2 Equivalent:** `searchplugins`\
+**Compatibility:** Firefox ESR 60.2\
+**CCK2 Equivalent:** `removeDefaultSearchEngines` (removed all built-in engines)\
 **Preferences Affected:** N/A
 
 #### Windows (GPO)
 ```
-Software\Policies\Mozilla\Firefox\SearchEngines\Add\1\Name = "Example1"
-Software\Policies\Mozilla\Firefox\SearchEngines\Add\1\URLTemplate = "https://www.example.org/q={searchTerms}"
-Software\Policies\Mozilla\Firefox\SearchEngines\Add\1\Method = "GET" | "POST"
-Software\Policies\Mozilla\Firefox\SearchEngines\Add\1\IconURL = "https://www.example.org/favicon.ico"
-Software\Policies\Mozilla\Firefox\SearchEngines\Add\1\Alias = "example"
-Software\Policies\Mozilla\Firefox\SearchEngines\Add\1\Description = "Example Description"
-Software\Policies\Mozilla\Firefox\SearchEngines\Add\1\SuggestURLTemplate = "https://www.example.org/suggestions/q={searchTerms}"
-Software\Policies\Mozilla\Firefox\SearchEngines\Add\1\PostData = "name=value&q={searchTerms}"
+Software\Policies\Mozilla\Firefox\SearchEngines\Remove\1 = NAME_OF_SEARCH_ENGINE
 ```
 #### Windows (Intune)
 OMA-URI:
 ```
-./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~Search/SearchEngines_1
+./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~Search/SearchEngines_Remove
 ```
 Value (string):
 ```
 <enabled/>
-<data id="SearchEngine_Name" value="Example1"/>
-<data id="SearchEngine_URLTemplate" value="https://www.example.org/q={searchTerms"/>
-<data id="SearchEngine_Method" value="GET | POST"/>
-<data id="SearchEngine_IconURL" value="https://www.example.org/favicon.ico"/>
-<data id="SearchEngine_Alias" value="example"/>
-<data id="SearchEngine_Description" value="Example Description"/>
-<data id="SearchEngine_SuggestURLTemplate" value="https://www.example.org/suggestions/q={searchTerms}"/>
-<data id="SearchEngine_PostData" value="name=value&amp;q={searchTerms}"/>
+<data id="SearchEngines_Remove" value="1&#xF000;NAME_OF_SEARCH_ENGINE"/>
 ```
 #### macOS
 ```
 <dict>
   <key>SearchEngines</key>
   <dict>
-    <key>Add</key>
-    <array>
-      <dict>
-        <key>Name</key>
-        <string>Example1</string>
-        <key>URLTemplate</key>
-        <string>https://www.example.org/q={searchTerms}</string>
-        <key>Method</key>
-        <string>GET | POST </string>
-        <key>IconURL</key>
-        <string>https://www.example.org/favicon.ico</string>
-        <key>Alias</key>
-        <string>example</string>
-        <key>Description</key>
-        <string>Example Description</string>
-        <key>SuggestURLTemplate</key>
-        <string>https://www.example.org/suggestions/q={searchTerms}</string>
-        <key>PostData</key>
-        <string>name=value&q={searchTerms}</string>
-      </dict>
+    <key>Remove</key>
     <array>
+      <string>NAME_OF_SEARCH_ENGINE</string>
+    </array>
   </dict>
 </dict>
 ```
@@ -5139,18 +5198,7 @@ Value (string):
 {
   "policies": {
     "SearchEngines": {
-      "Add": [
-        {
-          "Name": "Example1",
-          "URLTemplate": "https://www.example.org/q={searchTerms}",
-          "Method": "GET" | "POST",
-          "IconURL": "https://www.example.org/favicon.ico",
-          "Alias": "example",
-          "Description": "Description",
-          "PostData": "name=value&q={searchTerms}",
-          "SuggestURLTemplate": "https://www.example.org/suggestions/q={searchTerms}"
-        }
-      ]
+      "Remove": ["NAME_OF_SEARCH_ENGINE"]
     }
   }
 }

patrick-canterino.de