Update GPO

[policy-templates.git] / README.md

diff --git a/README.md b/README.md
index d36efa39a43df1ad99d883a7e1037bca2267b955..37047ed759f1d26f87d8138b23ecf0478c160e24 100644 (file)
--- a/README.md
+++ b/README.md
@@ -44,7 +44,7 @@ Policies can be specified using the [Group Policy templates on Windows](https://
 | **[`DisableSafeMode`](#disablesafemode)** | Disable safe mode within the browser.
 | **[`DisableSecurityBypass`](#disablesecuritybypass)** | Prevent the user from bypassing security in certain cases.
 | **[`DisableSetDesktopBackground`](#disablesetdesktopbackground)** | Remove the "Set As Desktop Background..." menuitem when right clicking on an image.
 | **[`DisableSafeMode`](#disablesafemode)** | Disable safe mode within the browser.
 | **[`DisableSecurityBypass`](#disablesecuritybypass)** | Prevent the user from bypassing security in certain cases.
 | **[`DisableSetDesktopBackground`](#disablesetdesktopbackground)** | Remove the "Set As Desktop Background..." menuitem when right clicking on an image.

-| **[`DisableSystemAddonUpdate`](#disablesystemaddonupdate)** | Prevent system add-ons from being installed or update.
+| **[`DisableSystemAddonUpdate`](#disablesystemaddonupdate)** | Prevent system add-ons from being installed or updated.

 | **[`DisableTelemetry`](#disabletelemetry)** | DisableTelemetry
 | **[`DisplayBookmarksToolbar`](#displaybookmarkstoolbar)** | Set the initial state of the bookmarks toolbar.
 | **[`DisplayMenuBar`](#displaymenubar)** | Set the state of the menubar.
 | **[`DisableTelemetry`](#disabletelemetry)** | DisableTelemetry
 | **[`DisplayBookmarksToolbar`](#displaybookmarkstoolbar)** | Set the initial state of the bookmarks toolbar.
 | **[`DisplayMenuBar`](#displaymenubar)** | Set the state of the menubar.


@@ -55,11 +55,12 @@ Policies can be specified using the [Group Policy templates on Windows](https://
 | **[`EnableTrackingProtection`](#enabletrackingprotection)** | Configure tracking protection.
 | **[`EncryptedMediaExtensions`](#encryptedmediaextensions)** | Enable or disable Encrypted Media Extensions and optionally lock it.
 | **[`EnterprisePoliciesEnabled`](#enterprisepoliciesenabled)** | Enable policy support on macOS.
 | **[`EnableTrackingProtection`](#enabletrackingprotection)** | Configure tracking protection.
 | **[`EncryptedMediaExtensions`](#encryptedmediaextensions)** | Enable or disable Encrypted Media Extensions and optionally lock it.
 | **[`EnterprisePoliciesEnabled`](#enterprisepoliciesenabled)** | Enable policy support on macOS.

+| **[`ExemptDomainFileTypePairsFromFileTypeDownloadWarnings`](#exemptdomainfiletypepairsfromfiletypedownloadwarnings)** | Disable warnings based on file extension for specific file types on domains.

 | **[`Extensions`](#extensions)** | Control the installation, uninstallation and locking of extensions.
 | **[`ExtensionSettings`](#extensionsettings)** | Manage all aspects of extensions.
 | **[`ExtensionUpdate`](#extensionupdate)** | Control extension updates.
 | **[`FirefoxHome`](#firefoxhome)** | Customize the Firefox Home page.
 | **[`Extensions`](#extensions)** | Control the installation, uninstallation and locking of extensions.
 | **[`ExtensionSettings`](#extensionsettings)** | Manage all aspects of extensions.
 | **[`ExtensionUpdate`](#extensionupdate)** | Control extension updates.
 | **[`FirefoxHome`](#firefoxhome)** | Customize the Firefox Home page.

-| **[`FlashPlugin`](#flashplugin)** | Configure the default Flash plugin policy as well as origins for which Flash is allowed.
+| **[`FlashPlugin (Deprecated)`](#flashplugin-deprecated)** | Configure the default Flash plugin policy as well as origins for which Flash is allowed.

 | **[`Handlers`](#handlers)** | Configure default application handlers.
 | **[`HardwareAcceleration`](#hardwareacceleration)** | Control hardware acceleration.
 | **[`Homepage`](#homepage)** | Configure the default homepage and how Firefox starts.
 | **[`Handlers`](#handlers)** | Configure default application handlers.
 | **[`HardwareAcceleration`](#hardwareacceleration)** | Control hardware acceleration.
 | **[`Homepage`](#homepage)** | Configure the default homepage and how Firefox starts.


@@ -69,7 +70,7 @@ Policies can be specified using the [Group Policy templates on Windows](https://
 | **[`LegacySameSiteCookieBehaviorEnabledForDomainList`](#legacysamesitecookiebehaviorenabledfordomainlist)** | Revert to legacy SameSite behavior for cookies on specified sites.
 | **[`LocalFileLinks`](#localfilelinks)** | Enable linking to local files by origin.
 | **[`ManagedBookmarks`](#managedbookmarks)** | Configures a list of bookmarks managed by an administrator that cannot be changed by the user.
 | **[`LegacySameSiteCookieBehaviorEnabledForDomainList`](#legacysamesitecookiebehaviorenabledfordomainlist)** | Revert to legacy SameSite behavior for cookies on specified sites.
 | **[`LocalFileLinks`](#localfilelinks)** | Enable linking to local files by origin.
 | **[`ManagedBookmarks`](#managedbookmarks)** | Configures a list of bookmarks managed by an administrator that cannot be changed by the user.

-| **[`ManualAppUpdateOnly`](#manualappupdateonly)** | Allow manual updates only and do not notify the user about updates..
+| **[`ManualAppUpdateOnly`](#manualappupdateonly)** | Allow manual updates only and do not notify the user about updates.

 | **[`NetworkPrediction`](#networkprediction)** | Enable or disable network prediction (DNS prefetching).
 | **[`NewTabPage`](#newtabpage)** | Enable or disable the New Tab page.
 | **[`NoDefaultBookmarks`](#nodefaultbookmarks)** | Disable the creation of default bookmarks.
 | **[`NetworkPrediction`](#networkprediction)** | Enable or disable network prediction (DNS prefetching).
 | **[`NewTabPage`](#newtabpage)** | Enable or disable the New Tab page.
 | **[`NoDefaultBookmarks`](#nodefaultbookmarks)** | Disable the creation of default bookmarks.


@@ -78,6 +79,7 @@ Policies can be specified using the [Group Policy templates on Windows](https://
 | **[`OverrideFirstRunPage`](#overridefirstrunpage)** | Override the first run page.
 | **[`OverridePostUpdatePage`](#overridepostupdatepage)** | Override the upgrade page.
 | **[`PasswordManagerEnabled`](#passwordmanagerenabled)** | Remove (some) access to the password manager.
 | **[`OverrideFirstRunPage`](#overridefirstrunpage)** | Override the first run page.
 | **[`OverridePostUpdatePage`](#overridepostupdatepage)** | Override the upgrade page.
 | **[`PasswordManagerEnabled`](#passwordmanagerenabled)** | Remove (some) access to the password manager.

+| **[`PasswordManagerExceptions`](#passwordmanagerexceptions)** | Prevent Firefox from saving passwords for specific sites.

 | **[`PDFjs`](#pdfjs)** | Disable or configure PDF.js, the built-in PDF viewer.
 | **[`Permissions`](#permissions)** | Set permissions associated with camera, microphone, location, and notifications.
 | **[`PictureInPicture`](#pictureinpicture)** | Enable or disable Picture-in-Picture.
 | **[`PDFjs`](#pdfjs)** | Disable or configure PDF.js, the built-in PDF viewer.
 | **[`Permissions`](#permissions)** | Set permissions associated with camera, microphone, location, and notifications.
 | **[`PictureInPicture`](#pictureinpicture)** | Enable or disable Picture-in-Picture.


@@ -101,8 +103,10 @@ Policies can be specified using the [Group Policy templates on Windows](https://
 | **[`ShowHomeButton`](#showhomebutton)** | Show the home button on the toolbar.
 | **[`SSLVersionMax`](#sslversionmax)** | Set and lock the maximum version of TLS.
 | **[`SSLVersionMin`](#sslversionmin)** | Set and lock the minimum version of TLS.
 | **[`ShowHomeButton`](#showhomebutton)** | Show the home button on the toolbar.
 | **[`SSLVersionMax`](#sslversionmax)** | Set and lock the maximum version of TLS.
 | **[`SSLVersionMin`](#sslversionmin)** | Set and lock the minimum version of TLS.

+| **[`StartDownloadsInTempDirectory`](#startdownloadsintempdirectory)** | Force downloads to start off in a local, temporary location rather than the default download directory.

 | **[`SupportMenu`](#supportmenu)** | Add a menuitem to the help menu for specifying support information.
 | **[`UserMessaging`](#usermessaging)** | Don't show certain messages to the user.
 | **[`SupportMenu`](#supportmenu)** | Add a menuitem to the help menu for specifying support information.
 | **[`UserMessaging`](#usermessaging)** | Don't show certain messages to the user.

+| **[`UseSystemPrintDialog`](#usesystemprintdialog)** | Print using the system print dialog instead of print preview.

 | **[`WebsiteFilter`](#websitefilter)** | Block websites from being visited.
 | **[`WindowsSSO`](#windowssso)** | Allow Windows single sign-on for Microsoft, work, and school accounts.
 
 | **[`WebsiteFilter`](#websitefilter)** | Block websites from being visited.
 | **[`WindowsSSO`](#windowssso)** | Allow Windows single sign-on for Microsoft, work, and school accounts.
 


@@ -110,6 +114,12 @@ Policies can be specified using the [Group Policy templates on Windows](https://
 
 Allow WebExtensions to configure policy. For more information, see [Adding policy support to your extension](https://extensionworkshop.com/documentation/enterprise/adding-policy-support-to-your-extension/).
 
 
 Allow WebExtensions to configure policy. For more information, see [Adding policy support to your extension](https://extensionworkshop.com/documentation/enterprise/adding-policy-support-to-your-extension/).
 

+For GPO and Intune, the extension developer should provide an ADMX file.
+
+**Compatibility:** Firefox 68\
+**CCK2 Equivalent:** N/A\
+**Preferences Affected:** N/A
+

 #### macOS
 ```
 <dict>
 #### macOS
 ```
 <dict>


@@ -987,7 +997,7 @@ OMA-URI:
 Value (string):
 ```
 <enabled/>
 Value (string):
 ```
 <enabled/>

-<data id="Cookies_Allow" value="1&#xF000;https://example.com"/>
+<data id="Permissions" value="1&#xF000;https://example.com"/>

 ```
 OMA-URI:
 ```
 ```
 OMA-URI:
 ```


@@ -996,7 +1006,7 @@ OMA-URI:
 Value (string):
 ```
 <enabled/>
 Value (string):
 ```
 <enabled/>

-<data id="Cookies_Allow" value="1&#xF000;https://example.edu"/>
+<data id="Permissions" value="1&#xF000;https://example.edu"/>

 ```
 OMA-URI:
 ```
 ```
 OMA-URI:
 ```


@@ -1005,7 +1015,7 @@ OMA-URI:
 Value (string):
 ```
 <enabled/>
 Value (string):
 ```
 <enabled/>

-<data id="Cookies_Block" value="1&#xF000;https://example.org"/>
+<data id="Permissions" value="1&#xF000;https://example.org"/>

 ```
 OMA-URI:
 ```
 ```
 OMA-URI:
 ```


@@ -1921,7 +1931,7 @@ Value (string):
 }
 ```
 ### DisableSystemAddonUpdate
 }
 ```
 ### DisableSystemAddonUpdate

-Prevent system add-ons from being installed or update.
+Prevent system add-ons from being installed or updated.

 
 **Compatibility:** Firefox 60, Firefox ESR 60\
 **CCK2 Equivalent:** N/A\
 
 **Compatibility:** Firefox 60, Firefox ESR 60\
 **CCK2 Equivalent:** N/A\


@@ -2431,6 +2441,72 @@ Enable policy support on macOS.
   <true/>
 </dict>
 ```
   <true/>
 </dict>
 ```

+### ExemptDomainFileTypePairsFromFileTypeDownloadWarnings
+
+Disable warnings based on file extension for specific file types on domains.
+
+This policy is based on the [Chrome policy](https://chromeenterprise.google/policies/#ExemptDomainFileTypePairsFromFileTypeDownloadWarnings) of the same name.
+
+Important: The documentation for the policy for both Edge and Chrome is incorrect. The ```domains``` value must be a domain, not a URL pattern. Also, we do not support using ```*``` to mean all domains.
+
+**Compatibility:** Firefox 102\
+**CCK2 Equivalent:** N/A\
+**Preferences Affected:** N/A
+
+#### Windows (GPO)
+Software\Policies\Mozilla\Firefox\ExemptDomainFileTypePairsFromFileTypeDownloadWarnings (REG_MULTI_SZ) =
+```
+[
+  {
+     "file_extension": "jnlp",
+     "domains": ["example.com"]
+  }
+]
+```
+#### Windows (Intune)
+OMA-URI:
+```
+./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox/ExemptDomainFileTypePairsFromFileTypeDownloadWarnings
+```
+Value (string):
+```
+<enabled/>
+<data id="JSON" value='
+[
+  {
+     "file_extension": "jnlp",
+     "domains": ["example.com"]
+  }
+]
+'/>
+```
+#### macOS
+```
+<dict>
+  <key>ExemptDomainFileTypePairsFromFileTypeDownloadWarnings</key>
+  <array>
+    <dict>
+      <key>file_extension</key>
+      <string>jnlp</string>
+      <key>domains</key>
+      <array>
+        <string>example.com</string>
+      </array>
+    </dict>
+  </array>
+</dict>
+```
+#### policies.json
+```
+{
+  "policies": {
+    "ExemptDomainFileTypePairsFromFileTypeDownloadWarnings": [{
+      "file_extension": "jnlp",
+      "domains": ["example.com"]
+    }]
+  }
+}
+```

 ### Extensions
 Control the installation, uninstallation and locking of extensions.
 
 ### Extensions
 Control the installation, uninstallation and locking of extensions.
 


@@ -3816,6 +3892,50 @@ Value (string):
   }
 }
 ```
   }
 }
 ```

+### PasswordManagerExceptions
+Prevent Firefox from saving passwords for specific sites.
+
+The sites are specified as a list of origins.
+
+**Compatibility:** Firefox 101\
+**CCK2 Equivalent:** N/A\
+**Preferences Affected:** N/A
+
+#### Windows (GPO)
+```
+Software\Policies\Mozilla\Firefox\PasswordManagerExceptions\1 = "https://example.org"
+Software\Policies\Mozilla\Firefox\PasswordManagerExceptions\2 = "https://example.edu"
+```
+#### Windows (Intune)
+OMA-URI:
+```
+./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox/PasswordManagerExceptions
+```
+Value (string):
+```
+<enabled/>
+<data id="List" value="1&#xF000;https://example.org&#xF000;2&#xF000;https://example.edu"/>
+```
+#### macOS
+```
+<dict>
+  <key>PasswordManagerExceptions</key>
+  <array>
+    <string>https://example.org</string>
+    <string>https://example.edu</string>
+  </array>
+</dict>
+```
+#### policies.json
+```
+{
+  "policies": {
+    "PasswordManagerExceptions": ["https://example.org",
+                                  "https://example.edu"]
+  }
+}
+```
+

 ### PDFjs
 Disable or configure PDF.js, the built-in PDF viewer.
 
 ### PDFjs
 Disable or configure PDF.js, the built-in PDF viewer.
 


@@ -4334,13 +4454,14 @@ Using the preference as the key, set the `Value` to the corresponding preference
 
 `Status` can be "default", "locked", "user" or "clear"
 
 
 `Status` can be "default", "locked", "user" or "clear"
 

-Default preferences can be modified by the user.
+* `"default"`: Read/Write: Settings appear as default even if factory default differs.
+* `"locked"`: Read-Only: Settings appear as default even if factory default differs.
+* `"user"`: Read/Write: Settings appear as changed if it differs from factory default.
+* `"clear"`: Read/Write: `Value` has no effect. Resets to factory defaults on each startup.

 
 

-If a value is locked, it is also set as the default.
+`"user"` preferences persist across invocations of Firefox. It is the equivalent of a user setting the preference. They are most useful when a preference is needed very early in startup so it can't be set as default by policy. An example of this is ```toolkit.legacyUserProfileCustomizations.stylesheets```.

 
 

-User preferences persist across invocations of Firefox. It is the equivalent of a user setting the preference. They are most useful when a preference is needed very early in startup so it can't be set as default by policy. An example of this is ```toolkit.legacyUserProfileCustomizations.stylesheets```.
-
-User preferences persist even if the policy is removed, so if you need to remove them, you should use the clear policy.
+`"user"` preferences persist even if the policy is removed, so if you need to remove them, you should use the clear policy.

 
 See the examples below for more detail.
 
 
 See the examples below for more detail.
 


@@ -5546,6 +5667,40 @@ Value (string):
   }
 }
 ```
   }
 }
 ```

+### StartDownloadsInTempDirectory
+Force downloads to start off in a local, temporary location rather than the default download directory.
+
+**Compatibility:** Firefox 102\
+**CCK2 Equivalent:** N/A\
+**Preferences Affected:** `browser.downloads.start_downloads_in_tmp_dir`
+
+#### Windows (GPO)
+```
+Software\Policies\Mozilla\Firefox\StartDownloadsInTempDirectory = 0x1 | 0x0
+```
+#### Windows (Intune)
+OMA-URI:
+```
+./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox/StartDownloadsInTempDirectory
+```
+Value (string):
+```
+<enabled/> or <disabled/>
+```
+#### macOS
+```
+<dict>
+  <key>StartDownloadsInTempDirectory</key>
+  <true/> | <false/>
+</dict>
+```
+#### policies.json
+```
+{
+  "policies": {
+    "StartDownloadsInTempDirectory": true | false
+}
+```

 ### UserMessaging
 
 Prevent Firefox from messaging the user in certain situations.
 ### UserMessaging
 
 Prevent Firefox from messaging the user in certain situations.


@@ -5560,9 +5715,11 @@ Prevent Firefox from messaging the user in certain situations.
 
 `SkipOnboarding` If true, don't show onboarding messages on the new tab page.
 
 
 `SkipOnboarding` If true, don't show onboarding messages on the new tab page.
 

+`MoreFromMozilla` If false, don't show the "More from Mozilla" section in Preferences. (Firefox 98)
+

 **Compatibility:** Firefox 75, Firefox ESR 68.7\
 **CCK2 Equivalent:** N/A\
 **Compatibility:** Firefox 75, Firefox ESR 68.7\
 **CCK2 Equivalent:** N/A\

-**Preferences Affected:** `browser.messaging-system.whatsNewPanel.enabled`, `browser.newtabpage.activity-stream.asrouter.userprefs.cfr.addons`, `browser.newtabpage.activity-stream.asrouter.userprefs.cfr.features`, `browser.aboutwelcome.enabled`
+**Preferences Affected:** `browser.messaging-system.whatsNewPanel.enabled`, `browser.newtabpage.activity-stream.asrouter.userprefs.cfr.addons`, `browser.newtabpage.activity-stream.asrouter.userprefs.cfr.features`, `browser.aboutwelcome.enabled`, `browser.preferences.moreFromMozilla`

 
 #### Windows (GPO)
 ```
 
 #### Windows (GPO)
 ```


@@ -5571,6 +5728,7 @@ Software\Policies\Mozilla\Firefox\UserMessaging\ExtensionRecommendations = 0x1 |
 Software\Policies\Mozilla\Firefox\UserMessaging\FeatureRecommendations = 0x1 | 0x0
 Software\Policies\Mozilla\Firefox\UserMessaging\UrlbarInterventions = 0x1 | 0x0
 Software\Policies\Mozilla\Firefox\UserMessaging\SkipOnboarding = 0x1 | 0x0
 Software\Policies\Mozilla\Firefox\UserMessaging\FeatureRecommendations = 0x1 | 0x0
 Software\Policies\Mozilla\Firefox\UserMessaging\UrlbarInterventions = 0x1 | 0x0
 Software\Policies\Mozilla\Firefox\UserMessaging\SkipOnboarding = 0x1 | 0x0

+Software\Policies\Mozilla\Firefox\UserMessaging\MoreFromMozilla = 0x1 | 0x0

 ```
 #### Windows (Intune)
 OMA-URI:
 ```
 #### Windows (Intune)
 OMA-URI:


@@ -5580,6 +5738,7 @@ OMA-URI:
 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~UserMessaging/UserMessaging_FeatureRecommendations
 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~UserMessaging/UserMessaging_UrlbarInterventions
 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~UserMessaging/UserMessaging_SkipOnboarding
 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~UserMessaging/UserMessaging_FeatureRecommendations
 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~UserMessaging/UserMessaging_UrlbarInterventions
 ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~UserMessaging/UserMessaging_SkipOnboarding

+./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~UserMessaging/UserMessaging_MoreFromMozilla

 ```
 Value (string):
 ```
 ```
 Value (string):
 ```


@@ -5600,6 +5759,8 @@ Value (string):
     <true/> | <false/>
     <key>SkipOnboarding</key>
     <true/> | <false/>
     <true/> | <false/>
     <key>SkipOnboarding</key>
     <true/> | <false/>

+    <key>MoreFromMozilla</key>
+    <true/> | <false/>

   </dict>
 </dict>
 ```
   </dict>
 </dict>
 ```


@@ -5611,12 +5772,48 @@ Value (string):
       "WhatsNew": true | false,
       "ExtensionRecommendations": true | false,
       "FeatureRecommendations": true | false,
       "WhatsNew": true | false,
       "ExtensionRecommendations": true | false,
       "FeatureRecommendations": true | false,

-      "UrlbarInterventions": true | false
-      "SkipOnboarding": true | false
+      "UrlbarInterventions": true | false,
+      "SkipOnboarding": true | false,
+      "MoreFromMozilla": true | false

     }
   }
 }
 ```
     }
   }
 }
 ```

+### UseSystemPrintDialog
+Use the system print dialog instead of the print preview window.
+
+**Compatibility:** Firefox 102\
+**CCK2 Equivalent:** N/A\
+**Preferences Affected:** `print.prefer_system_dialog`
+
+#### Windows (GPO)
+```
+Software\Policies\Mozilla\Firefox\UseSystemPrintDialog = 0x1 | 0x0
+```
+#### Windows (Intune)
+OMA-URI:
+```
+./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox/UseSystemPrintDialog
+```
+Value (string):
+```
+<enabled/> or <disabled/>
+```
+#### macOS
+```
+<dict>
+  <key>UseSystemPrintDialog</key>
+  <true/> | <false/>
+</dict>
+```
+#### policies.json
+```
+{
+  "policies": {
+    "UseSystemPrintDialog": true | false
+  }
+}
+```

 ### WebsiteFilter
 Block websites from being visited. The parameters take an array of Match Patterns, as documented in https://developer.mozilla.org/en-US/Add-ons/WebExtensions/Match_patterns.
 The arrays are limited to 1000 entries each.
 ### WebsiteFilter
 Block websites from being visited. The parameters take an array of Match Patterns, as documented in https://developer.mozilla.org/en-US/Add-ons/WebExtensions/Match_patterns.
 The arrays are limited to 1000 entries each.