X-Git-Url: https://git.p6c8.net/policy-templates.git/blobdiff_plain/bce2e7c83f74ac262fab4471693a11f789b6f59e..5020c2f38f46b242c8f1fe379efb161c2a6202c6:/README.md?ds=inline diff --git a/README.md b/README.md index 090e9b7..37047ed 100644 --- a/README.md +++ b/README.md @@ -1,3 +1,7 @@ +**These policies are in active development and so might contain changes that do not work with current versions of Firefox.** + +**You should use the [officially released versions](https://github.com/mozilla/policy-templates/releases) if you are deploying changes.** + Policies can be specified using the [Group Policy templates on Windows](https://github.com/mozilla/policy-templates/tree/master/windows), [Intune on Windows](https://support.mozilla.org/kb/managing-firefox-intune), [configuration profiles on macOS](https://github.com/mozilla/policy-templates/tree/master/mac), or by creating a file called `policies.json`. On Windows, create a directory called `distribution` where the EXE is located and place the file there. On Mac, the file goes into `Firefox.app/Contents/Resources/distribution`. On Linux, the file goes into `firefox/distribution`, where `firefox` is the installation directory for firefox, which varies by distribution or you can specify system-wide policy by placing the file in `/etc/firefox/policies`. | Policy Name | Description @@ -40,7 +44,7 @@ Policies can be specified using the [Group Policy templates on Windows](https:// | **[`DisableSafeMode`](#disablesafemode)** | Disable safe mode within the browser. | **[`DisableSecurityBypass`](#disablesecuritybypass)** | Prevent the user from bypassing security in certain cases. | **[`DisableSetDesktopBackground`](#disablesetdesktopbackground)** | Remove the "Set As Desktop Background..." menuitem when right clicking on an image. -| **[`DisableSystemAddonUpdate`](#disablesystemaddonupdate)** | Prevent system add-ons from being installed or update. +| **[`DisableSystemAddonUpdate`](#disablesystemaddonupdate)** | Prevent system add-ons from being installed or updated. | **[`DisableTelemetry`](#disabletelemetry)** | DisableTelemetry | **[`DisplayBookmarksToolbar`](#displaybookmarkstoolbar)** | Set the initial state of the bookmarks toolbar. | **[`DisplayMenuBar`](#displaymenubar)** | Set the state of the menubar. @@ -51,19 +55,22 @@ Policies can be specified using the [Group Policy templates on Windows](https:// | **[`EnableTrackingProtection`](#enabletrackingprotection)** | Configure tracking protection. | **[`EncryptedMediaExtensions`](#encryptedmediaextensions)** | Enable or disable Encrypted Media Extensions and optionally lock it. | **[`EnterprisePoliciesEnabled`](#enterprisepoliciesenabled)** | Enable policy support on macOS. +| **[`ExemptDomainFileTypePairsFromFileTypeDownloadWarnings`](#exemptdomainfiletypepairsfromfiletypedownloadwarnings)** | Disable warnings based on file extension for specific file types on domains. | **[`Extensions`](#extensions)** | Control the installation, uninstallation and locking of extensions. | **[`ExtensionSettings`](#extensionsettings)** | Manage all aspects of extensions. | **[`ExtensionUpdate`](#extensionupdate)** | Control extension updates. | **[`FirefoxHome`](#firefoxhome)** | Customize the Firefox Home page. -| **[`FlashPlugin`](#flashplugin)** | Configure the default Flash plugin policy as well as origins for which Flash is allowed. +| **[`FlashPlugin (Deprecated)`](#flashplugin-deprecated)** | Configure the default Flash plugin policy as well as origins for which Flash is allowed. | **[`Handlers`](#handlers)** | Configure default application handlers. | **[`HardwareAcceleration`](#hardwareacceleration)** | Control hardware acceleration. | **[`Homepage`](#homepage)** | Configure the default homepage and how Firefox starts. | **[`InstallAddonsPermission`](#installaddonspermission)** | Configure the default extension install policy as well as origins for extension installs are allowed. | **[`LegacyProfiles`](#legacyprofiles)** | Disable the feature enforcing a separate profile for each installation. +| **[`LegacySameSiteCookieBehaviorEnabled`](#legacysamesitecookiebehaviorenabled)** | Enable default legacy SameSite cookie behavior setting. +| **[`LegacySameSiteCookieBehaviorEnabledForDomainList`](#legacysamesitecookiebehaviorenabledfordomainlist)** | Revert to legacy SameSite behavior for cookies on specified sites. | **[`LocalFileLinks`](#localfilelinks)** | Enable linking to local files by origin. | **[`ManagedBookmarks`](#managedbookmarks)** | Configures a list of bookmarks managed by an administrator that cannot be changed by the user. -| **[`ManualAppUpdateOnly`](#manualappupdateonly)** | Allow manual updates only and do not notify the user about updates.. +| **[`ManualAppUpdateOnly`](#manualappupdateonly)** | Allow manual updates only and do not notify the user about updates. | **[`NetworkPrediction`](#networkprediction)** | Enable or disable network prediction (DNS prefetching). | **[`NewTabPage`](#newtabpage)** | Enable or disable the New Tab page. | **[`NoDefaultBookmarks`](#nodefaultbookmarks)** | Disable the creation of default bookmarks. @@ -72,6 +79,7 @@ Policies can be specified using the [Group Policy templates on Windows](https:// | **[`OverrideFirstRunPage`](#overridefirstrunpage)** | Override the first run page. | **[`OverridePostUpdatePage`](#overridepostupdatepage)** | Override the upgrade page. | **[`PasswordManagerEnabled`](#passwordmanagerenabled)** | Remove (some) access to the password manager. +| **[`PasswordManagerExceptions`](#passwordmanagerexceptions)** | Prevent Firefox from saving passwords for specific sites. | **[`PDFjs`](#pdfjs)** | Disable or configure PDF.js, the built-in PDF viewer. | **[`Permissions`](#permissions)** | Set permissions associated with camera, microphone, location, and notifications. | **[`PictureInPicture`](#pictureinpicture)** | Enable or disable Picture-in-Picture. @@ -95,8 +103,10 @@ Policies can be specified using the [Group Policy templates on Windows](https:// | **[`ShowHomeButton`](#showhomebutton)** | Show the home button on the toolbar. | **[`SSLVersionMax`](#sslversionmax)** | Set and lock the maximum version of TLS. | **[`SSLVersionMin`](#sslversionmin)** | Set and lock the minimum version of TLS. +| **[`StartDownloadsInTempDirectory`](#startdownloadsintempdirectory)** | Force downloads to start off in a local, temporary location rather than the default download directory. | **[`SupportMenu`](#supportmenu)** | Add a menuitem to the help menu for specifying support information. | **[`UserMessaging`](#usermessaging)** | Don't show certain messages to the user. +| **[`UseSystemPrintDialog`](#usesystemprintdialog)** | Print using the system print dialog instead of print preview. | **[`WebsiteFilter`](#websitefilter)** | Block websites from being visited. | **[`WindowsSSO`](#windowssso)** | Allow Windows single sign-on for Microsoft, work, and school accounts. @@ -104,86 +114,138 @@ Policies can be specified using the [Group Policy templates on Windows](https:// Allow WebExtensions to configure policy. For more information, see [Adding policy support to your extension](https://extensionworkshop.com/documentation/enterprise/adding-policy-support-to-your-extension/). -### AppAutoUpdate +For GPO and Intune, the extension developer should provide an ADMX file. -Enable or disable **automatic** application update. +**Compatibility:** Firefox 68\ +**CCK2 Equivalent:** N/A\ +**Preferences Affected:** N/A -If set to true, application updates are installed without user approval within Firefox. The operating system might still require approval. +#### macOS +``` + + 3rdparty + + Extensions + + uBlock0@raymondhill.net + + adminSettings + + selectedFilterLists + + ublock-privacy + ublock-badware + ublock-filters + user-filters + + + + + + +``` +#### policies.json +``` +{ + "policies": { + "3rdparty": { + "Extensions": { + "uBlock0@raymondhill.net": { + "adminSettings": { + "selectedFilterLists": [ + "ublock-privacy", + "ublock-badware", + "ublock-filters", + "user-filters" + ] + } + } + } + } + } +} +``` -If set to false, application updates are downloaded but the user can choose when to install the update. +### AllowedDomainsForApps -If you have disabled updates via `DisableAppUpdate`, this policy has no effect. +Define domains allowed to access Google Workspace. -**Compatibility:** Firefox 75, Firefox ESR 68.7\ +This policy is based on the [Chrome policy](https://chromeenterprise.google/policies/#AllowedDomainsForApps) of the same name. + +If this policy is enabled, users can only access Google Workspace using accounts from the specified domains. If you want to allow Gmail, you can add ```consumer_accounts``` to the list. + +**Compatibility:** Firefox 89, Firefox ESR 78.11\ **CCK2 Equivalent:** N/A\ -**Preferences Affected:** `app.update.auto` +**Preferences Affected:** N/A #### Windows (GPO) ``` -Software\Policies\Mozilla\Firefox\AppAutoUpdate = 0x1 | 0x0 +Software\Policies\Mozilla\Firefox\AllowedDomainsForApps = "managedfirefox.com,example.com" ``` #### Windows (Intune) OMA-URI: ``` -./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox/AppAutoUpdate +./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox/AllowedDomainsForApps ``` Value (string): ``` - or + + ``` #### macOS ``` - AppAutoUpdate - | + AllowedDomainsForApps + managedfirefox.com,example.com ``` #### policies.json ``` { "policies": { - "AppAutoUpdate": true | false + "AllowedDomainsForApps": "managedfirefox.com,example.com" } } ``` -### AllowedDomainsForApps +### AppAutoUpdate -Define domains allowed to access Google Workspace. +Enable or disable **automatic** application update. -This policy is based on the [Chrome policy](https://chromeenterprise.google/policies/#AllowedDomainsForApps) of the same name. +If set to true, application updates are installed without user approval within Firefox. The operating system might still require approval. -If this policy is enabled, users can only access Google Workspace using accounts from the specified domains. If you want to allow Gmail, you can add ```consumer_accounts``` to the list. +If set to false, application updates are downloaded but the user can choose when to install the update. -**Compatibility:** Firefox 89, Firefox ESR 78.11\ +If you have disabled updates via `DisableAppUpdate`, this policy has no effect. + +**Compatibility:** Firefox 75, Firefox ESR 68.7\ **CCK2 Equivalent:** N/A\ -**Preferences Affected:** N/A +**Preferences Affected:** `app.update.auto` #### Windows (GPO) ``` -Software\Policies\Mozilla\Firefox\AllowedDomainsForApps = "managedfirefox.com,example.com" +Software\Policies\Mozilla\Firefox\AppAutoUpdate = 0x1 | 0x0 ``` #### Windows (Intune) OMA-URI: ``` -./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox/AllowedDomainsForApps +./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox/AppAutoUpdate ``` Value (string): ``` - - + or ``` #### macOS ``` - AllowedDomainsForApps - managedfirefox.com,example.com + AppAutoUpdate + | ``` #### policies.json ``` { "policies": { - "AllowedDomainsForApps": "managedfirefox.com,example.com" + "AppAutoUpdate": true | false } } ``` @@ -935,7 +997,7 @@ OMA-URI: Value (string): ``` - + ``` OMA-URI: ``` @@ -944,7 +1006,7 @@ OMA-URI: Value (string): ``` - + ``` OMA-URI: ``` @@ -953,7 +1015,7 @@ OMA-URI: Value (string): ``` - + ``` OMA-URI: ``` @@ -1067,80 +1129,6 @@ Value (string): } } ``` -### DisableSetDesktopBackground -Remove the "Set As Desktop Background..." menuitem when right clicking on an image. - -**Compatibility:** Firefox 60, Firefox ESR 60\ -**CCK2 Equivalent:** `removeSetDesktopBackground`\ -**Preferences Affected:** N/A - -#### Windows (GPO) -``` -Software\Policies\Mozilla\Firefox\DisableSetDesktopBackground = 0x1 | 0x0 -``` -#### Windows (Intune) -OMA-URI: -``` -./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox/DisableSetDesktopBackground -``` -Value (string): -``` - or -``` -#### macOS -``` - - DisableSetDesktopBackground - | - -``` -#### policies.json -``` -{ - "policies": { - "DisableSetDesktopBackground": true | false - } -} -``` -### DisableMasterPasswordCreation -Remove the master password functionality. - -If this value is true, it works the same as setting [`PrimaryPassword`](#primarypassword) to false and removes the primary password functionality. - -If both `DisableMasterPasswordCreation` and `PrimaryPassword` are used, `DisableMasterPasswordCreation` takes precedent. - -**Compatibility:** Firefox 60, Firefox ESR 60\ -**CCK2 Equivalent:** `noMasterPassword`\ -**Preferences Affected:** N/A - -#### Windows (GPO) -``` -Software\Policies\Mozilla\Firefox\DisableMasterPasswordCreation = 0x1 | 0x0 -``` -#### Windows (Intune) -OMA-URI: -``` -./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox/DisableMasterPasswordCreation -``` -Value (string): -``` - or -``` -#### macOS -``` - - DisableMasterPasswordCreation - | - -``` -#### policies.json -``` -{ - "policies": { - "DisableMasterPasswordCreation": true | false - } -} -``` ### DefaultDownloadDirectory Set the default download directory. @@ -1256,9 +1244,29 @@ Value (string): } ``` ### DisabledCiphers -Disable specific cryptographic ciphers. - -**Preferences Affected:** `security.ssl3.dhe_rsa_aes_128_sha`, `security.ssl3.dhe_rsa_aes_256_sha`, `security.ssl3.ecdhe_ecdsa_aes_128_gcm_sha256`, `security.ssl3.ecdhe_rsa_aes_128_gcm_sha256`, `security.ssl3.ecdhe_rsa_aes_128_sha`, `security.ssl3.ecdhe_rsa_aes_256_sha`, `security.ssl3.rsa_aes_128_gcm_sha256`, `security.ssl3.rsa_aes_128_sha`, `security.ssl3.rsa_aes_256_gcm_sha384`, `security.ssl3.rsa_aes_256_sha`, `security.ssl3.rsa_des_ede3_sha` +Disable specific cryptographic ciphers, listed below. + +``` +TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 +TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256 +TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256 +TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256 +TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384 +TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 +TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA +TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA +TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA +TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA +TLS_DHE_RSA_WITH_AES_128_CBC_SHA +TLS_DHE_RSA_WITH_AES_256_CBC_SHA +TLS_RSA_WITH_AES_128_GCM_SHA256 +TLS_RSA_WITH_AES_256_GCM_SHA384 +TLS_RSA_WITH_AES_128_CBC_SHA +TLS_RSA_WITH_AES_256_CBC_SHA +TLS_RSA_WITH_3DES_EDE_CBC_SHA +``` + +**Preferences Affected:** `security.ssl3.ecdhe_rsa_aes_128_gcm_sha256`, `security.ssl3.ecdhe_ecdsa_aes_128_gcm_sha256`, `security.ssl3.ecdhe_ecdsa_chacha20_poly1305_sha256`, `security.ssl3.ecdhe_rsa_chacha20_poly1305_sha256`, `security.ssl3.ecdhe_ecdsa_aes_256_gcm_sha384`, `security.ssl3.ecdhe_rsa_aes_256_gcm_sha384`, `security.ssl3.ecdhe_rsa_aes_128_sha`, `security.ssl3.ecdhe_ecdsa_aes_128_sha`, `security.ssl3.ecdhe_rsa_aes_256_sha`, `security.ssl3.ecdhe_ecdsa_aes_256_sha`, `security.ssl3.dhe_rsa_aes_128_sha`, `security.ssl3.dhe_rsa_aes_256_sha`, `security.ssl3.rsa_aes_128_gcm_sha256`, `security.ssl3.rsa_aes_256_gcm_sha384`, `security.ssl3.rsa_aes_128_sha`, `security.ssl3.rsa_aes_256_sha`, `security.ssl3.deprecated.rsa_des_ede3_sha` --- **Note:** @@ -1266,38 +1274,19 @@ Disable specific cryptographic ciphers. This policy was updated in Firefox 78 to allow enabling ciphers as well. Setting the value to true disables the cipher, setting the value to false enables the cipher. Previously setting the value to true or false disabled the cipher. --- -**Compatibility:** Firefox 76, Firefox ESR 68.8 (TLS_RSA_WITH_AES_128_GCM_SHA256 and TLS_RSA_WITH_AES_256_GCM_SHA384 were added in Firefox 78)\ +**Compatibility:** Firefox 76, Firefox ESR 68.8 (TLS_RSA_WITH_AES_128_GCM_SHA256 and TLS_RSA_WITH_AES_256_GCM_SHA384 were added in Firefox 78, TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA, TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA, TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA38, TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256, TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384, and TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256 were added in Firefox 97 and Firefox 91.6)\ **CCK2 Equivalent:** N/A\ **Preferences Affected:** N/A #### Windows (GPO) ``` -Software\Policies\Mozilla\Firefox\DisabledCiphers\TLS_DHE_RSA_WITH_AES_128_CBC_SHA = 0x1 | 0x0 -Software\Policies\Mozilla\Firefox\DisabledCiphers\TLS_DHE_RSA_WITH_AES_256_CBC_SHA = 0x1 | 0x0 -Software\Policies\Mozilla\Firefox\DisabledCiphers\TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA = 0x1 | 0x0 -Software\Policies\Mozilla\Firefox\DisabledCiphers\TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA = 0x1 | 0x0 -Software\Policies\Mozilla\Firefox\DisabledCiphers\TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 = 0x1 | 0x0 -Software\Policies\Mozilla\Firefox\DisabledCiphers\TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256 = 0x1 | 0x0 -Software\Policies\Mozilla\Firefox\DisabledCiphers\TLS_RSA_WITH_AES_128_CBC_SHA = 0x1 | 0x0 -Software\Policies\Mozilla\Firefox\DisabledCiphers\TLS_RSA_WITH_AES_256_CBC_SHA = 0x1 | 0x0 -Software\Policies\Mozilla\Firefox\DisabledCiphers\TLS_RSA_WITH_3DES_EDE_CBC_SHA = 0x1 | 0x0 -Software\Policies\Mozilla\Firefox\DisabledCiphers\TLS_RSA_WITH_AES_128_GCM_SHA256 = 0x1 | 0x0 -Software\Policies\Mozilla\Firefox\DisabledCiphers\TLS_RSA_WITH_AES_256_GCM_SHA384 = 0x1 | 0x0 +Software\Policies\Mozilla\Firefox\DisabledCiphers\CIPHER_NAME = 0x1 | 0x0 ``` #### Windows (Intune) OMA-URI: ``` -./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~DisabledCiphers/DisabledCiphers_TLS_DHE_RSA_WITH_AES_128_CBC_SHA -./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~DisabledCiphers/DisabledCiphers_TLS_DHE_RSA_WITH_AES_256_CBC_SHA -./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~DisabledCiphers/DisabledCiphers_TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA -./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~DisabledCiphers/DisabledCiphers_TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA -./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~DisabledCiphers/DisabledCiphers_TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 -./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~DisabledCiphers/DisabledCiphers_TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256 -./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~DisabledCiphers/DisabledCiphers_TLS_RSA_WITH_AES_128_CBC_SHA -./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~DisabledCiphers/DisabledCiphers_TLS_RSA_WITH_AES_256_CBC_SHA -./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~DisabledCiphers/DisabledCiphers_TLS_RSA_WITH_3DES_EDE_CBC_SHA -./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~DisabledCiphers/DisabledCiphers_TLS_RSA_WITH_AES_128_GCM_SHA256 -./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~DisabledCiphers/DisabledCiphers_TLS_RSA_WITH_AES_256_GCM_SHA384 +./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~DisabledCiphers/DisabledCiphers_CIPHER_NAME + ``` Value (string): ``` @@ -1308,27 +1297,7 @@ Value (string): DisabledCiphers - TLS_DHE_RSA_WITH_AES_128_CBC_SHA - | - TLS_DHE_RSA_WITH_AES_256_CBC_SHA - | - TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA - | - TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA - | - TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 - | - TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256 - | - TLS_RSA_WITH_AES_128_CBC_SHA - | - TLS_RSA_WITH_AES_256_CBC_SHA - | - TLS_RSA_WITH_3DES_EDE_CBC_SHA - | - TLS_RSA_WITH_AES_128_GCM_SHA256 - | - TLS_RSA_WITH_AES_256_GCM_SHA384 + CIPHER_NAME | @@ -1338,17 +1307,7 @@ Value (string): { "policies": { "DisabledCiphers": { - "TLS_DHE_RSA_WITH_AES_128_CBC_SHA": true | false, - "TLS_DHE_RSA_WITH_AES_256_CBC_SHA": true | false, - "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA": true | false, - "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA": true | false, - "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256": true | false, - "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256": true | false, - "TLS_RSA_WITH_AES_128_CBC_SHA": true | false, - "TLS_RSA_WITH_AES_256_CBC_SHA": true | false, - "TLS_RSA_WITH_3DES_EDE_CBC_SHA": true | false, - "TLS_RSA_WITH_AES_128_GCM_SHA256": true | false, - "TLS_RSA_WITH_AES_256_GCM_SHA384": true | false + "CIPHER_NAME": true | false, } } } @@ -1628,6 +1587,45 @@ Value (string): } } ``` +### DisableMasterPasswordCreation +Remove the master password functionality. + +If this value is true, it works the same as setting [`PrimaryPassword`](#primarypassword) to false and removes the primary password functionality. + +If both `DisableMasterPasswordCreation` and `PrimaryPassword` are used, `DisableMasterPasswordCreation` takes precedent. + +**Compatibility:** Firefox 60, Firefox ESR 60\ +**CCK2 Equivalent:** `noMasterPassword`\ +**Preferences Affected:** N/A + +#### Windows (GPO) +``` +Software\Policies\Mozilla\Firefox\DisableMasterPasswordCreation = 0x1 | 0x0 +``` +#### Windows (Intune) +OMA-URI: +``` +./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox/DisableMasterPasswordCreation +``` +Value (string): +``` + or +``` +#### macOS +``` + + DisableMasterPasswordCreation + | + +``` +#### policies.json +``` +{ + "policies": { + "DisableMasterPasswordCreation": true | false + } +} +``` ### DisablePasswordReveal Do not allow passwords to be shown in saved logins @@ -1897,8 +1895,43 @@ Value (string): } } ``` +### DisableSetDesktopBackground +Remove the "Set As Desktop Background..." menuitem when right clicking on an image. + +**Compatibility:** Firefox 60, Firefox ESR 60\ +**CCK2 Equivalent:** `removeSetDesktopBackground`\ +**Preferences Affected:** N/A + +#### Windows (GPO) +``` +Software\Policies\Mozilla\Firefox\DisableSetDesktopBackground = 0x1 | 0x0 +``` +#### Windows (Intune) +OMA-URI: +``` +./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox/DisableSetDesktopBackground +``` +Value (string): +``` + or +``` +#### macOS +``` + + DisableSetDesktopBackground + | + +``` +#### policies.json +``` +{ + "policies": { + "DisableSetDesktopBackground": true | false + } +} +``` ### DisableSystemAddonUpdate -Prevent system add-ons from being installed or update. +Prevent system add-ons from being installed or updated. **Compatibility:** Firefox 60, Firefox ESR 60\ **CCK2 Equivalent:** N/A\ @@ -2408,6 +2441,72 @@ Enable policy support on macOS. ``` +### ExemptDomainFileTypePairsFromFileTypeDownloadWarnings + +Disable warnings based on file extension for specific file types on domains. + +This policy is based on the [Chrome policy](https://chromeenterprise.google/policies/#ExemptDomainFileTypePairsFromFileTypeDownloadWarnings) of the same name. + +Important: The documentation for the policy for both Edge and Chrome is incorrect. The ```domains``` value must be a domain, not a URL pattern. Also, we do not support using ```*``` to mean all domains. + +**Compatibility:** Firefox 102\ +**CCK2 Equivalent:** N/A\ +**Preferences Affected:** N/A + +#### Windows (GPO) +Software\Policies\Mozilla\Firefox\ExemptDomainFileTypePairsFromFileTypeDownloadWarnings (REG_MULTI_SZ) = +``` +[ + { + "file_extension": "jnlp", + "domains": ["example.com"] + } +] +``` +#### Windows (Intune) +OMA-URI: +``` +./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox/ExemptDomainFileTypePairsFromFileTypeDownloadWarnings +``` +Value (string): +``` + + +``` +#### macOS +``` + + ExemptDomainFileTypePairsFromFileTypeDownloadWarnings + + + file_extension + jnlp + domains + + example.com + + + + +``` +#### policies.json +``` +{ + "policies": { + "ExemptDomainFileTypePairsFromFileTypeDownloadWarnings": [{ + "file_extension": "jnlp", + "domains": ["example.com"] + }] + } +} +``` ### Extensions Control the installation, uninstallation and locking of extensions. @@ -3207,6 +3306,85 @@ Value (string): ``` or ``` +### LegacySameSiteCookieBehaviorEnabled +Enable default legacy SameSite cookie behavior setting. + +If this policy is set to true, it reverts all cookies to legacy SameSite behavior which means that cookies that don't explicitly specify a ```SameSite``` attribute are treated as if they were ```SameSite=None```. + +**Compatibility:** Firefox 96\ +**CCK2 Equivalent:** N/A\ +**Preferences Affected:** `network.cookie.sameSite.laxByDefault` + +#### Windows (GPO) +``` +Software\Policies\Mozilla\Firefox\LegacySameSiteCookieBehaviorEnabled = = 0x1 | 0x0 +``` +#### Windows (Intune) +OMA-URI: +``` +./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox/LegacySameSiteCookieBehaviorEnabled +``` +Value (string): +``` + or +``` +#### macOS +``` + + LegacySameSiteCookieBehaviorEnabled + | + +``` +#### policies.json +``` +{ + "policies": { + "LegacySameSiteCookieBehaviorEnabled": true | false +} +``` +### LegacySameSiteCookieBehaviorEnabledForDomainList +Revert to legacy SameSite behavior for cookies on specified sites. + +If this policy is set to true, cookies set for domains in this list will revert to legacy SameSite behavior which means that cookies that don't explicitly specify a ```SameSite``` attribute are treated as if they were ```SameSite=None```. + +**Compatibility:** Firefox 96\ +**CCK2 Equivalent:** N/A\ +**Preferences Affected:** `network.cookie.sameSite.laxByDefault.disabledHosts` + +#### Windows (GPO) +``` +Software\Policies\Mozilla\Firefox\LegacySameSiteCookieBehaviorEnabledForDomainList\1 = "example.org" +Software\Policies\Mozilla\Firefox\LegacySameSiteCookieBehaviorEnabledForDomainList\2 = "example.edu" +``` +#### Windows (Intune) +OMA-URI: +``` +./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox/LegacySameSiteCookieBehaviorEnabledForDomainList +``` +Value (string): +``` + + +``` +#### macOS +``` + + LegacySameSiteCookieBehaviorEnabledForDomainList + + example.org + example.edu + + +``` +#### policies.json +``` +{ + "policies": { + "LegacySameSiteCookieBehaviorEnabledForDomainList": ["example.org", + "example.edu"] + } +} +``` ### LocalFileLinks Enable linking to local files by origin. @@ -3714,6 +3892,50 @@ Value (string): } } ``` +### PasswordManagerExceptions +Prevent Firefox from saving passwords for specific sites. + +The sites are specified as a list of origins. + +**Compatibility:** Firefox 101\ +**CCK2 Equivalent:** N/A\ +**Preferences Affected:** N/A + +#### Windows (GPO) +``` +Software\Policies\Mozilla\Firefox\PasswordManagerExceptions\1 = "https://example.org" +Software\Policies\Mozilla\Firefox\PasswordManagerExceptions\2 = "https://example.edu" +``` +#### Windows (Intune) +OMA-URI: +``` +./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox/PasswordManagerExceptions +``` +Value (string): +``` + + +``` +#### macOS +``` + + PasswordManagerExceptions + + https://example.org + https://example.edu + + +``` +#### policies.json +``` +{ + "policies": { + "PasswordManagerExceptions": ["https://example.org", + "https://example.edu"] + } +} +``` + ### PDFjs Disable or configure PDF.js, the built-in PDF viewer. @@ -4232,13 +4454,14 @@ Using the preference as the key, set the `Value` to the corresponding preference `Status` can be "default", "locked", "user" or "clear" -Default preferences can be modified by the user. +* `"default"`: Read/Write: Settings appear as default even if factory default differs. +* `"locked"`: Read-Only: Settings appear as default even if factory default differs. +* `"user"`: Read/Write: Settings appear as changed if it differs from factory default. +* `"clear"`: Read/Write: `Value` has no effect. Resets to factory defaults on each startup. -If a value is locked, it is also set as the default. +`"user"` preferences persist across invocations of Firefox. It is the equivalent of a user setting the preference. They are most useful when a preference is needed very early in startup so it can't be set as default by policy. An example of this is ```toolkit.legacyUserProfileCustomizations.stylesheets```. -User preferences persist across invocations of Firefox. It is the equivalent of a user setting the preference. They are most useful when a preference is needed very early in startup so it can't be set as default by policy. An example of this is ```toolkit.legacyUserProfileCustomizations.stylesheets```. - -User preferences persist even if the policy is removed, so if you need to remove them, you should use the clear policy. +`"user"` preferences persist even if the policy is removed, so if you need to remove them, you should use the clear policy. See the examples below for more detail. @@ -4970,7 +5193,9 @@ Value (string): ### SearchEngines | Add -Add new search engines (up to five). This policy is only available on the ESR. `Name` and `URLTemplate` are required. +Add new search engines. Although there are only five engines available in the ADMX template, there is no limit. To add more in the ADMX template, you can duplicate the XML. + +This policy is only available on the ESR. `Name` and `URLTemplate` are required. `Name` is the name of the search engine. @@ -5294,7 +5519,7 @@ Software\Policies\Mozilla\Firefox\ShowHomeButton = 0x1 | 0x0 #### Windows (Intune) OMA-URI: ``` -./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox/ShowHomeButton +./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~Homepage/Homepage_ShowHomeButton ``` Value (string): ``` @@ -5442,6 +5667,40 @@ Value (string): } } ``` +### StartDownloadsInTempDirectory +Force downloads to start off in a local, temporary location rather than the default download directory. + +**Compatibility:** Firefox 102\ +**CCK2 Equivalent:** N/A\ +**Preferences Affected:** `browser.downloads.start_downloads_in_tmp_dir` + +#### Windows (GPO) +``` +Software\Policies\Mozilla\Firefox\StartDownloadsInTempDirectory = 0x1 | 0x0 +``` +#### Windows (Intune) +OMA-URI: +``` +./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox/StartDownloadsInTempDirectory +``` +Value (string): +``` + or +``` +#### macOS +``` + + StartDownloadsInTempDirectory + | + +``` +#### policies.json +``` +{ + "policies": { + "StartDownloadsInTempDirectory": true | false +} +``` ### UserMessaging Prevent Firefox from messaging the user in certain situations. @@ -5456,9 +5715,11 @@ Prevent Firefox from messaging the user in certain situations. `SkipOnboarding` If true, don't show onboarding messages on the new tab page. +`MoreFromMozilla` If false, don't show the "More from Mozilla" section in Preferences. (Firefox 98) + **Compatibility:** Firefox 75, Firefox ESR 68.7\ **CCK2 Equivalent:** N/A\ -**Preferences Affected:** `browser.messaging-system.whatsNewPanel.enabled`, `browser.newtabpage.activity-stream.asrouter.userprefs.cfr.addons`, `browser.newtabpage.activity-stream.asrouter.userprefs.cfr.features`, `browser.aboutwelcome.enabled` +**Preferences Affected:** `browser.messaging-system.whatsNewPanel.enabled`, `browser.newtabpage.activity-stream.asrouter.userprefs.cfr.addons`, `browser.newtabpage.activity-stream.asrouter.userprefs.cfr.features`, `browser.aboutwelcome.enabled`, `browser.preferences.moreFromMozilla` #### Windows (GPO) ``` @@ -5467,6 +5728,7 @@ Software\Policies\Mozilla\Firefox\UserMessaging\ExtensionRecommendations = 0x1 | Software\Policies\Mozilla\Firefox\UserMessaging\FeatureRecommendations = 0x1 | 0x0 Software\Policies\Mozilla\Firefox\UserMessaging\UrlbarInterventions = 0x1 | 0x0 Software\Policies\Mozilla\Firefox\UserMessaging\SkipOnboarding = 0x1 | 0x0 +Software\Policies\Mozilla\Firefox\UserMessaging\MoreFromMozilla = 0x1 | 0x0 ``` #### Windows (Intune) OMA-URI: @@ -5476,6 +5738,7 @@ OMA-URI: ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~UserMessaging/UserMessaging_FeatureRecommendations ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~UserMessaging/UserMessaging_UrlbarInterventions ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~UserMessaging/UserMessaging_SkipOnboarding +./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~UserMessaging/UserMessaging_MoreFromMozilla ``` Value (string): ``` @@ -5496,6 +5759,8 @@ Value (string): | SkipOnboarding | + MoreFromMozilla + | ``` @@ -5507,12 +5772,48 @@ Value (string): "WhatsNew": true | false, "ExtensionRecommendations": true | false, "FeatureRecommendations": true | false, - "UrlbarInterventions": true | false - "SkipOnboarding": true | false + "UrlbarInterventions": true | false, + "SkipOnboarding": true | false, + "MoreFromMozilla": true | false } } } ``` +### UseSystemPrintDialog +Use the system print dialog instead of the print preview window. + +**Compatibility:** Firefox 102\ +**CCK2 Equivalent:** N/A\ +**Preferences Affected:** `print.prefer_system_dialog` + +#### Windows (GPO) +``` +Software\Policies\Mozilla\Firefox\UseSystemPrintDialog = 0x1 | 0x0 +``` +#### Windows (Intune) +OMA-URI: +``` +./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox/UseSystemPrintDialog +``` +Value (string): +``` + or +``` +#### macOS +``` + + UseSystemPrintDialog + | + +``` +#### policies.json +``` +{ + "policies": { + "UseSystemPrintDialog": true | false + } +} +``` ### WebsiteFilter Block websites from being visited. The parameters take an array of Match Patterns, as documented in https://developer.mozilla.org/en-US/Add-ons/WebExtensions/Match_patterns. The arrays are limited to 1000 entries each.