X-Git-Url: https://git.p6c8.net/policy-templates.git/blobdiff_plain/c623cbf438101ddb646243a84bad32ea9de9d244..2b03b48381ecca4864c3620f65a673c9f660de5e:/README.md diff --git a/README.md b/README.md index efbbd13..76bc17a 100644 --- a/README.md +++ b/README.md @@ -1,13 +1,14 @@ **These policies are in active development and so might contain changes that do not work with current versions of Firefox.** -**You should use the officially released versions (https://github.com/mozilla/policy-templates/releases) if you are deploying changes.** +**You should use the [officially released versions](https://github.com/mozilla/policy-templates/releases) if you are deploying changes.** -Policies can be specified using the Group Policy templates on Windows (https://github.com/mozilla/policy-templates/tree/master/windows), configuration profiles on macOS (https://github.com/mozilla/policy-templates/tree/master/mac), or by creating a file called `policies.json`. On Windows, create a directory called `distribution` where the EXE is located and place the file there. On Mac, the file goes into `Firefox.app/Contents/Resources/distribution`. On Linux, the file goes into `firefox/distribution`, where `firefox` is the installation directory for firefox, which varies by distribution. +Policies can be specified using the [Group Policy templates on Windows](https://github.com/mozilla/policy-templates/tree/master/windows), [Intune on Windows](https://support.mozilla.org/kb/managing-firefox-intune), [configuration profiles on macOS](https://github.com/mozilla/policy-templates/tree/master/mac), or by creating a file called `policies.json`. On Windows, create a directory called `distribution` where the EXE is located and place the file there. On Mac, the file goes into `Firefox.app/Contents/Resources/distribution`. On Linux, the file goes into `firefox/distribution`, where `firefox` is the installation directory for firefox, which varies by distribution or you can specify system-wide policy by placing the file in `/etc/firefox/policies`. | Policy Name | Description | --- | --- | -| **[`AppUpdateURL`](#AppUpdateURL)** | Change the URL for application update. -| **[`Authentication`](#Authentication)** | Configure sites that support integrated authentication. +| **[`AppAutoUpdate`](#appautoupdate)** | Enable or disable automatic application update. +| **[`AppUpdateURL`](#appupdateurl)** | Change the URL for application update. +| **[`Authentication`](#authentication)** | Configure sites that support integrated authentication. | **[`BlockAboutAddons`](#blockaboutaddons)** | Block access to the Add-ons Manager (about:addons). | **[`BlockAboutConfig`](#blockaboutconfig)** | Block access to about:config. | **[`BlockAboutProfiles`](#blockaboutprofiles)** | Block access to About Profiles (about:profiles). @@ -22,6 +23,8 @@ Policies can be specified using the Group Policy templates on Windows (https://g | **[`DisableMasterPasswordCreation`](#disablemasterpasswordcreation)** | Remove the master password functionality. | **[`DisableAppUpdate`](#disableappupdate)** | Turn off application updates. | **[`DisableBuiltinPDFViewer`](#disablebuiltinpdfviewer)** | Disable the built in PDF viewer. +| **[`DisabledCiphers`](#disabledciphers)** | Disable ciphers. +| **[`DisableDefaultBrowserAgent`](#disabledefaultbrowseragent)** | Prevent the default browser agent from taking any actions (Windows only). | **[`DisableDeveloperTools`](#disabledevelopertools)** | Remove access to all developer tools. | **[`DisableFeedbackCommands`](#disablefeedbackcommands)** | Disable the menus for reporting sites. | **[`DisableFirefoxScreenshots`](#disablefirefoxscreenshots)** | Remove access to Firefox Screenshots. @@ -29,6 +32,7 @@ Policies can be specified using the Group Policy templates on Windows (https://g | **[`DisableFirefoxStudies`](#disablefirefoxstudies)** | Disable Firefox studies (Shield). | **[`DisableForgetButton`](#disableforgetbutton)** | Disable the "Forget" button. | **[`DisableFormHistory`](#disableformhistory)** | Turn off saving information on web forms and the search bar. +| **[`DisablePasswordReveal`](#disablepasswordreveal)** | Do not allow passwords to be revealed in saved logins. | **[`DisablePocket`](#disablepocket)** | Remove Pocket in the Firefox UI. | **[`DisablePrivateBrowsing`](#disableprivatebrowsing)** | Remove access to private browsing. | **[`DisableProfileImport`](#disableprofileimport)** | Disables the "Import data from another browser" option in the bookmarks window. @@ -45,6 +49,7 @@ Policies can be specified using the Group Policy templates on Windows (https://g | **[`DefaultDownloadDirectory`](#defaultdownloaddirectory)** | Set the default download directory. | **[`DownloadDirectory`](#downloaddirectory)** | Set and lock the download directory. | **[`EnableTrackingProtection`](#enabletrackingprotection)** | Configure tracking protection. +| **[`EncryptedMediaExtensions`](#encryptedmediaextensions)** | Enable or disable Encrypted Media Extensions and optionally lock it. | **[`EnterprisePoliciesEnabled`](#enterprisepoliciesenabled)** | Enable policy support on macOS. | **[`Extensions`](#extensions)** | Control the installation, uninstallation and locking of extensions. | **[`ExtensionSettings`](#extensionsettings)** | Manage all aspects of extensions. @@ -56,6 +61,7 @@ Policies can be specified using the Group Policy templates on Windows (https://g | **[`InstallAddonsPermission`](#installaddonspermission)** | Configure the default extension install policy as well as origins for extension installs are allowed. | **[`LegacyProfiles`](#legacyprofiles)** | Disable the feature enforcing a separate profile for each installation. | **[`LocalFileLinks`](#localfilelinks)** | Enable linking to local files by origin. +| **[`MasterPassword`](#masterpassword)** | Require or prevent using a master password. | **[`NetworkPrediction`](#networkprediction)** | Enable or disable network prediction (DNS prefetching). | **[`NewTabPage`](#newtabpage)** | Enable or disable the New Tab page. | **[`NoDefaultBookmarks`](#nodefaultbookmarks)** | Disable the creation of default bookmarks. @@ -64,7 +70,9 @@ Policies can be specified using the Group Policy templates on Windows (https://g | **[`OverrideFirstRunPage`](#overridefirstrunpage)** | Override the first run page. | **[`OverridePostUpdatePage`](#overridepostupdatepage)** | Override the upgrade page. | **[`PasswordManagerEnabled`](#passwordmanagerenabled)** | Remove (some) access to the password manager. +| **[`PDFjs`](#pdfjs)** | Disable or configure PDF.js, the built-in PDF viewer. | **[`Permissions`](#permissions)** | Set permissions associated with camera, microphone, location, and notifications. +| **[`PictureInPicture`](#pictureinpicture)** | Enable or disable Picture-in-Picture. | **[`PopupBlocking`](#popupblocking)** | Configure the default pop-up window policy as well as origins for which pop-up windows are allowed. | **[`Preferences`](#preferences)** | Set and lock some preferences. | **[`PromptForDownloadLocation`](#promptfordownloadlocation)** | Ask where to save each file before downloading. @@ -78,13 +86,56 @@ Policies can be specified using the Group Policy templates on Windows (https://g | **[`SearchEngines -> PreventInstalls`](#searchengines--preventinstalls)** | Prevent installing search engines from webpages. | **[`SearchEngines -> Remove`](#searchengines--remove)** | Hide built-in search engines. | **[`SearchEngines -> Add`](#searchengines--add)** | Add new search engines. -| **[`SecurityDevices`](#securitydevices)** | Install PKCS #11 modules. | **[`SearchSuggestEnabled`](#searchsuggestenabled)** | Enable search suggestions. +| **[`SecurityDevices`](#securitydevices)** | Install PKCS #11 modules. | **[`SSLVersionMax`](#sslversionmax)** | Set and lock the maximum version of TLS. | **[`SSLVersionMin`](#sslversionmin)** | Set and lock the minimum version of TLS. | **[`SupportMenu`](#supportmenu)** | Add a menuitem to the help menu for specifying support information. +| **[`UserMessaging`](#usermessaging)** | Don't show certain messages to the user. | **[`WebsiteFilter`](#websitefilter)** | Block websites from being visited. +### AppAutoUpdate + +Enable or disable **automatic** application update. + +If set to true, application updates are installed without user approval. + +If set to false, application updates are downloaded but the user can choose when to install the update. + +If you have disabled updates via DisableAppUpdate, this policy has no effect. + +**Compatibility:** Firefox 75, Firefox ESR 68.7\ +**CCK2 Equivalent:** N/A\ +**Preferences Affected:** app.update.auto + +#### Windows (GPO) +``` +Software\Policies\Mozilla\Firefox\AppAutoUpdate = 0x1 | 0x0 +``` +#### Windows (Intune) +OMA-URI: +``` +./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox/AppAutoUpdate +``` +Value (string): +``` + or +``` +#### macOS +``` + + AppAutoUpdate + | + +``` +#### policies.json +``` +{ + "policies": { + "AppAutoUpdate": true | false + } +} +``` ### AppUpdateURL Change the URL for application update. @@ -97,6 +148,16 @@ Change the URL for application update. ``` Software\Policies\Mozilla\Firefox\AppUpdateURL = "https://yoursite.com" ``` +#### Windows (Intune) +OMA-URI: +``` +./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox/AppUpdateURL +``` +Value (string): +``` + + +``` #### macOS ``` @@ -118,9 +179,11 @@ Configure sites that support integrated authentication. See https://developer.mozilla.org/en-US/docs/Mozilla/Integrated_authentication for more information. -**Compatibility:** Firefox 60, Firefox ESR 60 (AllowNonFQDN added in 62/60.2, AllowProxies added in 70/68.2, Locked added in 71/68.3)\ +`PrivateBrowsing` enables integrated authentication in prviate browsing. + +**Compatibility:** Firefox 60, Firefox ESR 60 (AllowNonFQDN added in 62/60.2, AllowProxies added in 70/68.2, Locked added in 71/68.3, PrivateBrowsing added in 77/68.9)\ **CCK2 Equivalent:** N/A\ -**Preferences Affected:** `network.negotiate-auth.trusted-uris`,`network.negotiate-auth.delegation-uris`,`network.automatic-ntlm-auth.trusted-uris`,`network.automatic-ntlm-auth.allow-non-fqdn`,`network.negotiate-auth.allow-non-fqdn`,`network.automatic-ntlm-auth.allow-proxies`,`network.negotiate-auth.allow-proxies` +**Preferences Affected:** `network.negotiate-auth.trusted-uris`,`network.negotiate-auth.delegation-uris`,`network.automatic-ntlm-auth.trusted-uris`,`network.automatic-ntlm-auth.allow-non-fqdn`,`network.negotiate-auth.allow-non-fqdn`,`network.automatic-ntlm-auth.allow-proxies`,`network.negotiate-auth.allow-proxies`,`network.auth.private-browsing-sso` #### Windows (GPO) ``` @@ -135,6 +198,61 @@ Software\Policies\Mozilla\Firefox\Authentication\AllowNonFQDN\NTLM = 0x1 | 0x0 Software\Policies\Mozilla\Firefox\Authentication\AllowProxies\SPNEGO = 0x1 | 0x0 Software\Policies\Mozilla\Firefox\Authentication\AllowProxies\NTLM = 0x1 | 0x0 Software\Policies\Mozilla\Firefox\Authentication\Locked = 0x1 | 0x0 +Software\Policies\Mozilla\Firefox\Authentication\PrivateBrowsing = 0x1 | 0x0 +``` +#### Windows (Intune) +OMA-URI: +``` +./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~Authentication/Authentication_SPNEGO +``` +Value (string): +``` + + +``` +OMA-URI: +``` +./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~Authentication/Authentication_Delegated +``` +Value (string): +``` + + +``` +OMA-URI: +``` +./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~Authentication/Authentication_NTLM +``` +Value (string): +``` + + +``` +OMA-URI: +``` +./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~Authentication/Authentication_AllowNonFQDN +``` +Value (string): +``` + + + +``` +OMA-URI: +``` +./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~Authentication/Authentication_Locked +``` +Value (string): +``` + or +``` +OMA-URI: +``` +./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~Authentication/Authentication_PrivateBrowsing +``` +Value (string): +``` + or ``` #### macOS ``` @@ -172,6 +290,8 @@ Software\Policies\Mozilla\Firefox\Authentication\Locked = 0x1 | 0x0 Locked | + PrivateBrowsing + | ``` @@ -191,7 +311,8 @@ Software\Policies\Mozilla\Firefox\Authentication\Locked = 0x1 | 0x0 "SPNEGO": true | false, "NTLM": true | false }, - "Locked": true | false + "Locked": true | false, + "PrivateBrowsing": true | false } } } @@ -208,6 +329,15 @@ Block access to the Add-ons Manager (about:addons). ``` Software\Policies\Mozilla\Firefox\BlockAboutAddons = 0x1 | 0x0 ``` +#### Windows (Intune) +OMA-URI: +``` +./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox/BlockAboutAddons +``` +Value (string): +``` + or +``` #### macOS ``` @@ -235,6 +365,15 @@ Block access to about:config. ``` Software\Policies\Mozilla\Firefox\BlockAboutConfig = 0x1 | 0x0 ``` +#### Windows (Intune) +OMA-URI: +``` +./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox/BlockAboutConfig +``` +Value (string): +``` + or +``` #### macOS ``` @@ -262,6 +401,15 @@ Block access to About Profiles (about:profiles). ``` Software\Policies\Mozilla\Firefox\BlockAboutProfiles = 0x1 | 0x0 ``` +#### Windows (Intune) +OMA-URI: +``` +./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox/BlockAboutProfiles +``` +Value (string): +``` + or +``` #### macOS ``` @@ -289,6 +437,15 @@ Block access to Troubleshooting Information (about:support). ``` Software\Policies\Mozilla\Firefox\BlockAboutSupport = 0x1 | 0x0 ``` +#### Windows (Intune) +OMA-URI: +``` +./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox/BlockAboutSupport +``` +Value (string): +``` + or +``` #### macOS ``` @@ -320,6 +477,20 @@ Software\Policies\Mozilla\Firefox\Bookmarks\1\Favicon = "https://example.com/fav Software\Policies\Mozilla\Firefox\Bookmarks\1\Placement = "toolbar" | "menu" Software\Policies\Mozilla\Firefox\Bookmarks\1\Folder = "FolderName" ``` +#### Windows (Intune) +OMA-URI: +``` +./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~Bookmarks/Bookmark01 +``` +Value (string): +``` + + + + + + +``` #### macOS ``` @@ -367,6 +538,15 @@ Enable or disable the detection of captive portals. ``` Software\Policies\Mozilla\Firefox\CaptivePortal = 0x1 | 0x0 ``` +#### Windows (Intune) +OMA-URI: +``` +./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox/CaptivePortal +``` +Value (string): +``` + or +``` #### macOS ``` @@ -398,6 +578,15 @@ See https://support.mozilla.org/kb/setting-certificate-authorities-firefox for m ``` Software\Policies\Mozilla\Firefox\Certificates\ImportEnterpriseRoots = 0x1 | 0x0 ``` +#### Windows (Intune) +OMA-URI: +``` +./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~Certificates/Certificates_ImportEnterpriseRoots +``` +Value (string): +``` + or +``` #### macOS ``` @@ -450,6 +639,16 @@ Binary (DER) and ASCII (PEM) certificates are both supported. Software\Policies\Mozilla\Firefox\Certificates\Install\1 = "cert1.der" Software\Policies\Mozilla\Firefox\Certificates\Install\2 = "C:\Users\username\cert2.pem" ``` +#### Windows (Intune) +OMA-URI: +``` +./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~Certificates/Certificates_Install +``` +Value (string): +``` + + +``` #### macOS ``` @@ -499,11 +698,71 @@ Configure cookie preferences. Software\Policies\Mozilla\Firefox\Cookies\Allow\1 = "https://example.com" Software\Policies\Mozilla\Firefox\Cookies\Block\1 = "https://example.org" Software\Policies\Mozilla\Firefox\Cookies\Default = 0x1 | 0x0 -Software\Policies\Mozilla\Firefox\Cookies\AcceptThirdParty = "always" | "never" |"from-visited" +Software\Policies\Mozilla\Firefox\Cookies\AcceptThirdParty = "always" | "never" | "from-visited" Software\Policies\Mozilla\Firefox\Cookies\ExpireAtSessionEnd = 0x1 | 0x0 Software\Policies\Mozilla\Firefox\Cookies\RejectTracker = 0x1 | 0x0 Software\Policies\Mozilla\Firefox\Cookies\Locked = 0x1 | 0x0 ``` +#### Windows (Intune) +OMA-URI: +``` +./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~Cookies/Cookies_Allow +``` +Value (string): +``` + + +``` +OMA-URI: +``` +./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~Cookies/Cookies_Block +``` +Value (string): +``` + + +``` +OMA-URI: +``` +./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~Cookies/Cookies_Default +``` +Value (string): +``` + or +``` +OMA-URI: +``` +./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~Cookies/Cookies_AcceptThirdParty +``` +Value (string): +``` + + +``` +OMA-URI: +``` +./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~Cookies/Cookies_ExpireAtSessionEnd +``` +Value (string): +``` + or +``` +OMA-URI: +``` +./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~Cookies/Cookies_RejectTracker +``` +Value (string): +``` + or +``` +OMA-URI: +``` +./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~Cookies/Cookies_Locked +``` +Value (string): +``` + or +``` #### macOS ``` @@ -557,7 +816,15 @@ Remove the "Set As Desktop Background..." menuitem when right clicking on an ima ``` Software\Policies\Mozilla\Firefox\DisableSetDesktopBackground = 0x1 | 0x0 ``` - +#### Windows (Intune) +OMA-URI: +``` +./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox/DisableSetDesktopBackground +``` +Value (string): +``` + or +``` #### macOS ``` @@ -584,7 +851,15 @@ Remove the master password functionality. ``` Software\Policies\Mozilla\Firefox\DisableMasterPasswordCreation = 0x1 | 0x0 ``` - +#### Windows (Intune) +OMA-URI: +``` +./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox/DisableMasterPasswordCreation +``` +Value (string): +``` + or +``` #### macOS ``` @@ -611,6 +886,15 @@ Turn off application updates. ``` Software\Policies\Mozilla\Firefox\DisableAppUpdate = 0x1 | 0x0 ``` +#### Windows (Intune) +OMA-URI: +``` +./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox/DisableAppUpdate +``` +Value (string): +``` + or +``` #### macOS ``` @@ -637,7 +921,15 @@ Disable the built in PDF viewer. PDF files are downloaded and sent externally. ``` Software\Policies\Mozilla\Firefox\DisableBuiltinPDFViewer = 0x1 | 0x0 ``` - +#### Windows (Intune) +OMA-URI: +``` +./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox/DisableBuiltinPDFViewer +``` +Value (string): +``` + or +``` #### macOS ``` @@ -653,6 +945,130 @@ Software\Policies\Mozilla\Firefox\DisableBuiltinPDFViewer = 0x1 | 0x0 } } ``` +### DisabledCiphers +Disable specific cryptographic ciphers. + +--- +**Note:** + +This policy was updated in Firefox 78 to allow enabling ciphers as well. Setting the value to true disables the cipher, setting the value to false enables the cipher. Previously setting the value to true or false disabled the cipher. + +--- +**Compatibility:** Firefox 76, Firefox ESR 68.8 (TLS_RSA_WITH_AES_128_GCM_SHA256 and TLS_RSA_WITH_AES_256_GCM_SHA384 were added in Firefox 78)\ +**CCK2 Equivalent:** N/A\ +**Preferences Affected:** N/A + +#### Windows (GPO) +``` +Software\Policies\Mozilla\Firefox\DisabledCiphers\TLS_DHE_RSA_WITH_AES_128_CBC_SHA = 0x1 | 0x0 +Software\Policies\Mozilla\Firefox\DisabledCiphers\TLS_DHE_RSA_WITH_AES_256_CBC_SHA = 0x1 | 0x0 +Software\Policies\Mozilla\Firefox\DisabledCiphers\TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA = 0x1 | 0x0 +Software\Policies\Mozilla\Firefox\DisabledCiphers\TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA = 0x1 | 0x0 +Software\Policies\Mozilla\Firefox\DisabledCiphers\TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 = 0x1 | 0x0 +Software\Policies\Mozilla\Firefox\DisabledCiphers\TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256 = 0x1 | 0x0 +Software\Policies\Mozilla\Firefox\DisabledCiphers\TLS_RSA_WITH_AES_128_CBC_SHA = 0x1 | 0x0 +Software\Policies\Mozilla\Firefox\DisabledCiphers\TLS_RSA_WITH_AES_256_CBC_SHA = 0x1 | 0x0 +Software\Policies\Mozilla\Firefox\DisabledCiphers\TLS_RSA_WITH_3DES_EDE_CBC_SHA = 0x1 | 0x0 +Software\Policies\Mozilla\Firefox\DisabledCiphers\TLS_RSA_WITH_AES_128_GCM_SHA256 = 0x1 | 0x0 +Software\Policies\Mozilla\Firefox\DisabledCiphers\TLS_RSA_WITH_AES_256_GCM_SHA384 = 0x1 | 0x0 +``` +#### Windows (Intune) +OMA-URI: +``` +./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~DisabledCiphers/DisabledCiphers_TLS_DHE_RSA_WITH_AES_128_CBC_SHA +./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~DisabledCiphers/DisabledCiphers_TLS_DHE_RSA_WITH_AES_256_CBC_SHA +./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~DisabledCiphers/DisabledCiphers_TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA +./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~DisabledCiphers/DisabledCiphers_TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA +./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~DisabledCiphers/DisabledCiphers_TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 +./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~DisabledCiphers/DisabledCiphers_TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256 +./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~DisabledCiphers/DisabledCiphers_TLS_RSA_WITH_AES_128_CBC_SHA +./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~DisabledCiphers/DisabledCiphers_TLS_RSA_WITH_AES_256_CBC_SHA +./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~DisabledCiphers/DisabledCiphers_TLS_RSA_WITH_3DES_EDE_CBC_SHA +./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~DisabledCiphers/DisabledCiphers_TLS_RSA_WITH_AES_128_GCM_SHA256 +./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~DisabledCiphers/DisabledCiphers_TLS_RSA_WITH_AES_256_GCM_SHA384 +``` +Value (string): +``` + or +``` +#### macOS +``` + + DisabledCiphers + + TLS_DHE_RSA_WITH_AES_128_CBC_SHA + | + TLS_DHE_RSA_WITH_AES_256_CBC_SHA + | + TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA + | + TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA + | + TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 + | + TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256 + | + TLS_RSA_WITH_AES_128_CBC_SHA + | + TLS_RSA_WITH_AES_256_CBC_SHA + | + TLS_RSA_WITH_3DES_EDE_CBC_SHA + | + TLS_RSA_WITH_AES_128_GCM_SHA256 + | + TLS_RSA_WITH_AES_256_GCM_SHA384 + | + + +``` +#### policies.json +``` +{ + "policies": { + "DisabledCiphers" { + "TLS_DHE_RSA_WITH_AES_128_CBC_SHA": true | false, + "TLS_DHE_RSA_WITH_AES_256_CBC_SHA": true | false, + "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA": true | false, + "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA": true | false, + "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256": true | false, + "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256": true | false, + "TLS_RSA_WITH_AES_128_CBC_SHA": true | false, + "TLS_RSA_WITH_AES_256_CBC_SHA": true | false, + "TLS_RSA_WITH_3DES_EDE_CBC_SHA": true | false + "TLS_RSA_WITH_AES_128_GCM_SHA256": true | false + "TLS_RSA_WITH_AES_256_GCM_SHA384": true | false + } + } +} +``` +### DisableDefaultBrowserAgent +Prevent the default browser agent from taking any actions. Only applicable to Windows; other platforms don’t have the agent. + +**Compatibility:** Firefox 75, Firefox ESR 68.7 (Windows only)\ +**CCK2 Equivalent:** N/A\ +**Preferences Affected:** N/A + +#### Windows (GPO) +``` +Software\Policies\Mozilla\Firefox\DisableDefaultBrowserAgent = 0x1 | 0x0 +``` +#### Windows (Intune) +OMA-URI: +``` +./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox/DisableDefaultBrowserAgent +``` +Value (string): +``` + or +``` +#### policies.json +``` +{ + "policies": { + "DisableDefaultBrowserAgent": true | false + } +} +``` ### DisableDeveloperTools Remove access to all developer tools. @@ -664,7 +1080,15 @@ Remove access to all developer tools. ``` Software\Policies\Mozilla\Firefox\DisableDeveloperTools = 0x1 | 0x0` ``` - +#### Windows (Intune) +OMA-URI: +``` +./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox/DisableDeveloperTools +``` +Value (string): +``` + or +``` #### macOS ``` @@ -691,6 +1115,15 @@ Disable the menus for reporting sites (Submit Feedback, Report Deceptive Site). ``` Software\Policies\Mozilla\Firefox\DisableFeedbackCommands = 0x1 | 0x0 ``` +#### Windows (Intune) +OMA-URI: +``` +./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox/DisableFeedbackCommands +``` +Value (string): +``` + or +``` #### macOS ``` @@ -717,6 +1150,15 @@ Remove access to Firefox Screenshots. ``` Software\Policies\Mozilla\Firefox\DisableFirefoxScreenshots = 0x1 | 0x0 ``` +#### Windows (Intune) +OMA-URI: +``` +./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox/DisableFirefoxScreenshots +``` +Value (string): +``` + or +``` #### macOS ``` @@ -743,6 +1185,15 @@ Disable Firefox Accounts integration (Sync). ``` Software\Policies\Mozilla\Firefox\DisableFirefoxAccounts = 0x1 | 0x0 ``` +#### Windows (Intune) +OMA-URI: +``` +./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox/DisableFirefoxAccounts +``` +Value (string): +``` + or +``` #### macOS ``` @@ -762,13 +1213,22 @@ Software\Policies\Mozilla\Firefox\DisableFirefoxAccounts = 0x1 | 0x0 Disable Firefox studies (Shield). **Compatibility:** Firefox 60, Firefox ESR 60\ -**CCK2 Equivalent:** `disableForget`\ +**CCK2 Equivalent:** N/A\ **Preferences Affected:** N/A #### Windows (GPO) ``` Software\Policies\Mozilla\Firefox\DisableFirefoxStudies = 0x1 | 0x0 ``` +#### Windows (Intune) +OMA-URI: +``` +./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox/DisableFirefoxStudies +``` +Value (string): +``` + or +``` #### macOS ``` @@ -795,6 +1255,15 @@ Disable the "Forget" button. ``` Software\Policies\Mozilla\Firefox\DisableForgetButton = 0x1 | 0x0 ``` +#### Windows (Intune) +OMA-URI: +``` +./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox/DisableForgetButton +``` +Value (string): +``` + or +``` #### macOS ``` @@ -821,6 +1290,15 @@ Turn off saving information on web forms and the search bar. ``` Software\Policies\Mozilla\Firefox\DisableFormHistory = 0x1 | 0x0 ``` +#### Windows (Intune) +OMA-URI: +``` +./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox/DisableFormHistory +``` +Value (string): +``` + or +``` #### macOS ``` @@ -847,7 +1325,15 @@ Do not allow passwords to be shown in saved logins ``` Software\Policies\Mozilla\Firefox\DisablePasswordReveal = 0x1 | 0x0 ``` - +#### Windows (Intune) +OMA-URI: +``` +./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox/DisablePasswordReveal +``` +Value (string): +``` + or +``` #### macOS ``` @@ -874,6 +1360,15 @@ Remove Pocket in the Firefox UI. It does not remove it from the new tab page. ``` Software\Policies\Mozilla\Firefox\DisablePocket = 0x1 | 0x0 ``` +#### Windows (Intune) +OMA-URI: +``` +./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox/DisablePocket +``` +Value (string): +``` + or +``` #### macOS ``` @@ -900,6 +1395,15 @@ Remove access to private browsing. ``` Software\Policies\Mozilla\Firefox\DisablePrivateBrowsing = 0x1 | 0x0 ``` +#### Windows (Intune) +OMA-URI: +``` +./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox/DisablePrivateBrowsing +``` +Value (string): +``` + or +``` #### macOS ``` @@ -926,6 +1430,15 @@ Disables the "Import data from another browser" option in the bookmarks window. ``` Software\Policies\Mozilla\Firefox\DisableProfileImport = 0x1 | 0x0 ``` +#### Windows (Intune) +OMA-URI: +``` +./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox/DisableProfileImport +``` +Value (string): +``` + or +``` #### macOS ``` @@ -952,6 +1465,15 @@ Disable the Refresh Firefox button on about:support and support.mozilla.org, as ``` Software\Policies\Mozilla\Firefox\DisableProfileRefresh = 0x1 | 0x0 ``` +#### Windows (Intune) +OMA-URI: +``` +./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox/DisableProfileRefresh +``` +Value (string): +``` + or +``` #### macOS ``` @@ -980,6 +1502,15 @@ On Windows, this disables safe mode via the command line as well. ``` Software\Policies\Mozilla\Firefox\DisableSafeMode = 0x1 | 0x0 ``` +#### Windows (Intune) +OMA-URI: +``` +./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox/DisableSafeMode +``` +Value (string): +``` + or +``` #### macOS ``` @@ -1011,6 +1542,24 @@ Prevent the user from bypassing security in certain cases. Software\Policies\Mozilla\Firefox\DisableSecurityBypass\InvalidCertificate = 0x1 | 0x0 Software\Policies\Mozilla\Firefox\DisableSecurityBypass\SafeBrowsing = 0x1 | 0x0 ``` +#### Windows (Intune) +OMA-URI: +``` +./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox/P_DisableSecurityBypass_InvalidCertificate +``` +Value (string): +``` + or +``` +OMA-URI: +``` +./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox/P_DisableSecurityBypass_SafeBrowsing +``` +Value (string): +``` + or +``` + #### macOS ``` @@ -1028,8 +1577,8 @@ Software\Policies\Mozilla\Firefox\DisableSecurityBypass\SafeBrowsing = 0x1 | 0x0 { "policies": { "DisableSecurityBypass": { - "InvalidCertificate": true false, - "SafeBrowsing": true false + "InvalidCertificate": true | false, + "SafeBrowsing": true | false } } } @@ -1042,7 +1591,17 @@ Prevent system add-ons from being installed or update. **Preferences Affected:** N/A #### Windows (GPO) -```Software\Policies\Mozilla\Firefox\DisableSystemAddonUpdate = 0x1 | 0x0 +``` +Software\Policies\Mozilla\Firefox\DisableSystemAddonUpdate = 0x1 | 0x0 +``` +#### Windows (Intune) +OMA-URI: +``` +./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox/DisableSystemAddonUpdate +``` +Value (string): +``` + or ``` #### macOS ``` @@ -1072,6 +1631,15 @@ Mozilla recommends that you do not disable telemetry. Information collected thro ``` Software\Policies\Mozilla\Firefox\DisableTelemetry = 0x1 | 0x0 ``` +#### Windows (Intune) +OMA-URI: +``` +./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox/DisableTelemetry +``` +Value (string): +``` + or +``` #### macOS ``` @@ -1098,6 +1666,15 @@ Set the initial state of the bookmarks toolbar. A user can still hide it and it ``` Software\Policies\Mozilla\Firefox\DisplayBookmarksToolbar = 0x1 | 0x0 ``` +#### Windows (Intune) +OMA-URI: +``` +./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox/DisplayBookmarksToolbar +``` +Value (string): +``` + or +``` #### macOS ``` @@ -1158,6 +1735,16 @@ Set the state of the menubar. ``` Software\Policies\Mozilla\Firefox\DisplayMenuBar = "always", "never", "default-on", "default-off" ``` +#### Windows (Intune) +OMA-URI: +``` +./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox/DisplayMenuBar_Enum +``` +Value (string): +``` + + +``` #### macOS ``` @@ -1182,7 +1769,9 @@ Configure DNS over HTTPS. `Locked` prevents the user from changing DNS over HTTPS preferences. -**Compatibility:** Firefox 63, Firefox ESR 68\ +`ExcludedDomains` excludes domains from DNS over HTTPS. + +**Compatibility:** Firefox 63, Firefox ESR 68 (ExcludedDomains added in 75/68.7)\ **CCK2 Equivalent:** N/A\ **Preferences Affected:** `network.trr.mode`,`network.trr.uri` @@ -1191,6 +1780,42 @@ Configure DNS over HTTPS. Software\Policies\Mozilla\Firefox\DNSOverHTTPS\Enabled = 0x1 | 0x0 Software\Policies\Mozilla\Firefox\DNSOverHTTPS\ProviderURL = "URL_TO_ALTERNATE_PROVIDER" Software\Policies\Mozilla\Firefox\DNSOverHTTPS\Locked = 0x1 | 0x0 +Software\Policies\Mozilla\Firefox\DNSOverHTTPS\ExcludedDomains\1 = "example.com" +``` +#### Windows (Intune) +OMA-URI: +``` +./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~DNSOverHTTPS/DNSOverHTTPS_Enabled +``` +Value (string): +``` + or +``` +OMA-URI: +``` +./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~DNSOverHTTPS/DNSOverHTTPS_ProviderURL +``` +Value (string): +``` + + +``` +OMA-URI: +``` +./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~DNSOverHTTPS/DNSOverHTTPS_Locked +``` +Value (string): +``` + or +``` +OMA-URI: +``` +./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~DNSOverHTTPS/DNSOverHTTPS_ExcludedDomains +``` +Value (string): +``` + + ``` #### macOS ``` @@ -1203,6 +1828,10 @@ Software\Policies\Mozilla\Firefox\DNSOverHTTPS\Locked = 0x1 | 0x0 URL_TO_ALTERNATE_PROVIDER Locked | + ExcludedDomains + + example.com + ``` @@ -1213,7 +1842,8 @@ Software\Policies\Mozilla\Firefox\DNSOverHTTPS\Locked = 0x1 | 0x0 "DNSOverHTTPS": { "Enabled": true | false, "ProviderURL": "URL_TO_ALTERNATE_PROVIDER", - "Locked": true | false + "Locked": true | false, + "ExcludedDomains": ["example.com"] } } } @@ -1229,6 +1859,15 @@ Don't check if Firefox is the default browser at startup. ``` Software\Policies\Mozilla\Firefox\DontCheckDefaultBrowser = 0x1 | 0x0 ``` +#### Windows (Intune) +OMA-URI: +``` +./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox/DontCheckDefaultBrowser +``` +Value (string): +``` + or +``` #### macOS ``` @@ -1257,6 +1896,16 @@ You can use ${home} for the native home directory. ``` Software\Policies\Mozilla\Firefox\DefaultDownloadDirectory = "${home}\Downloads" ``` +#### Windows (Intune) +OMA-URI: +``` +./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox/DefaultDownloadDirectory +``` +Value (string): +``` + + +``` #### macOS ``` @@ -1291,6 +1940,16 @@ You can use ${home} for the native home directory. ``` Software\Policies\Mozilla\Firefox\DownloadDirectory = "${home}\Downloads" ``` +#### Windows (Intune) +OMA-URI: +``` +./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox/DownloadDirectory +``` +Value (string): +``` + + +``` #### macOS ``` @@ -1339,6 +1998,19 @@ Software\Policies\Mozilla\Firefox\EnableTrackingProtection\Cryptomining = 0x1 | Software\Policies\Mozilla\Firefox\EnableTrackingProtection\Fingerprinting = 0x1 | 0x0 Software\Policies\Mozilla\Firefox\EnableTrackingProtection\Exceptions\1 = "https://example.com" ``` +#### Windows (Intune) +OMA-URI: +``` +./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox/TrackingProtection +``` +Value (string): +``` + + + + + +``` #### macOS ``` @@ -1364,14 +2036,62 @@ Software\Policies\Mozilla\Firefox\EnableTrackingProtection\Exceptions\1 = "https { "policies": { "EnableTrackingProtection": { - "Value": [true, false], - "Locked": [true, false], - "Cryptomining": [true, false], - "Fingerprinting": [true, false], + "Value": true | false, + "Locked": true | false, + "Cryptomining": true | false, + "Fingerprinting": true | false, "Exceptions": ["https://example.com"] } } ``` +### EncryptedMediaExtensions +Enable or disable Encrypted Media Extensions and optionally lock it. + +If `Enabled` is set to false, encrypted media extensions (like Widevine) are not downloaded by Firefox unless the user consents to installing them. + +If `Locked` is set to true and `Enabled` is set to false, Firefox will not download encrypted media extensions (like Widevine) or ask the user to install them. + +**Compatibility:** Firefox 77, Firefox ESR 68.9\ +**CCK2 Equivalent:** N/A\ +**Preferences Affected:** `media.eme.enabled` + +#### Windows (GPO) +``` +Software\Policies\Mozilla\Firefox\EncryptedMediaExtensions\Enabled = 0x1 | 0x0 +Software\Policies\Mozilla\Firefox\EncryptedMediaExtensions\Locked = 0x1 | 0x0 +``` +#### Windows (Intune) +OMA-URI: +``` +./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~EncryptedMediaExtensions/EncryptedMediaExtensions_Enabled +./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~EncryptedMediaExtensions/EncryptedMediaExtensions_Locked +``` +Value (string): +``` +or +``` +#### macOS +``` + + EncryptedMediaExtensions + + Enabled + | + + | + + +``` +#### policies.json +``` +{ + "policies": { + "EncryptedMediaExtensions": { + "Enabled": true | false, + "Locked": true | false + } +} +``` ### EnterprisePoliciesEnabled Enable policy support on macOS. @@ -1480,6 +2200,26 @@ Software\Policies\Mozilla\Firefox\ExtensionSettings (REG_MULTI_SZ) = } } ``` +#### Windows (Intune) +OMA-URI: +``` +./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~Extensions/ExtensionSettings +``` +Value (string): +``` + + +``` #### macOS ``` @@ -1540,6 +2280,15 @@ Control extension updates. ``` Software\Policies\Mozilla\Firefox\ExtensionUpdate = 0x1 | 0x0 ``` +#### Windows (Intune) +OMA-URI: +``` +./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox/ExtensionUpdate +``` +Value (string): +``` + or +``` #### macOS ``` @@ -1577,6 +2326,32 @@ Software\Policies\Mozilla\Firefox\FlashPlugin\Block\1 = "https://example.edu" Software\Policies\Mozilla\Firefox\FlashPlugin\Default = 0x1 | 0x0 Software\Policies\Mozilla\Firefox\FlashPlugin\Locked = 0x1 | 0x0 ``` +#### Windows (Intune) +OMA-URI: +``` +./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~Flash/FlashPlugin_Allow +``` +Value (string): +``` + + +``` +OMA-URI: +``` +./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~Flash/FlashPlugin_Locked +``` +Value (string): +``` + or +``` +OMA-URI: +``` +./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~Flash/FlashPlugin_Default +``` +Value (string): +``` + or +``` #### macOS ``` @@ -1626,6 +2401,21 @@ Software\Policies\Mozilla\Firefox\FirefoxHome\Pocket = 0x1 | 0x0 Software\Policies\Mozilla\Firefox\FirefoxHome\Snippets = 0x1 | 0x0 Software\Policies\Mozilla\Firefox\FirefoxHome\Locked = 0x1 | 0x0 ``` +#### Windows (Intune) +OMA-URI: +``` +./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox/CustomizeFirefoxHome +``` +Value (string): +``` + + + + + + + +``` #### macOS ``` @@ -1672,6 +2462,15 @@ Control hardware acceleration. ``` Software\Policies\Mozilla\Firefox\HardwareAcceleration = 0x1 | 0x0 ``` +#### Windows (Intune) +OMA-URI: +``` +./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox/HardwareAcceleration +``` +Value (string): +``` + or +``` #### macOS ``` @@ -1698,7 +2497,9 @@ Configure the default homepage and how Firefox starts. `StartPage` is how Firefox starts. The choices are no homepage, the default homepage or the previous session. -**Compatibility:** Firefox 60, Firefox ESR 60 (StartPage was added in Firefox 60, Firefox ESR 60.4)\ +With Firefox 78, an additional option as added for `Startpage`, `homepage-locked`. This allows for locking the homepage, but still allowing the user to choose whether or not they want to restore their session. + +**Compatibility:** Firefox 60, Firefox ESR 60 (StartPage was added in Firefox 60, Firefox ESR 60.4, homepage-locked added in Firefox 78)\ **CCK2 Equivalent:** `homePage`,`lockHomePage`\ **Preferences Affected:** `browser.startup.homepage`,`browser.startup.page` @@ -1708,7 +2509,39 @@ Software\Policies\Mozilla\Firefox\Homepage\URL = "https://example.com" Software\Policies\Mozilla\Firefox\Homepage\Locked = 0x1 | 0x0 Software\Policies\Mozilla\Firefox\Homepage\Additional\1 = "https://example.org" Software\Policies\Mozilla\Firefox\Homepage\Additional\2 = "https://example.edu" -Software\Policies\Mozilla\Firefox\Homepage\StartPage = "none" | "homepage" | "previous-session" +Software\Policies\Mozilla\Firefox\Homepage\StartPage = "none" | "homepage" | "previous-session" | "homepage-locked" +``` +#### Windows (Intune) +OMA-URI: +``` +./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~Homepage/HomepageURL +``` +Value (string): +``` + + + + +``` +OMA-URI: +``` +./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~Homepage/HomepageAdditional +``` +Value (string): +``` + + + +``` +OMA-URI: +``` +./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~Homepage/HomepageStartPage +``` +Value (string): +``` + + + ``` #### macOS ``` @@ -1725,7 +2558,7 @@ Software\Policies\Mozilla\Firefox\Homepage\StartPage = "none" | "homepage" | "p http://example.edu StartPage - none | homepage | previous-session + none | homepage | previous-session | homepage-locked ``` @@ -1738,7 +2571,7 @@ Software\Policies\Mozilla\Firefox\Homepage\StartPage = "none" | "homepage" | "p "Locked": true | false, "Additional": ["http://example.org/", "http://example.edu/"], - "StartPage": "none" | "homepage" | "previous-session" + "StartPage": "none" | "homepage" | "previous-session" | "homepage-locked" } } } @@ -1760,6 +2593,24 @@ Software\Policies\Mozilla\Firefox\InstallAddonsPermission\Allow\1 = "https://exa Software\Policies\Mozilla\Firefox\InstallAddonsPermission\Allow\2 = "https://example.edu" Software\Policies\Mozilla\Firefox\InstallAddonsPermission\Default = 0x1 | 0x0 ``` +#### Windows (Intune) +OMA-URI: +``` +./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~Addons/InstallAddonsPermission_Allow +``` +Value (string): +``` + + +``` +OMA-URI: +``` +./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~Addons/InstallAddonsPermission_Default +``` +Value (string): +``` + +``` #### macOS ``` @@ -1804,6 +2655,15 @@ This policy only work on Windows via GPO (not policies.json). ``` Software\Policies\Mozilla\Firefox\LegacyProfiles = = 0x1 | 0x0 ``` +#### Windows (Intune) +OMA-URI: +``` +./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox/LegacyProfiles +``` +Value (string): +``` + or +``` ### LocalFileLinks Enable linking to local files by origin. @@ -1816,6 +2676,16 @@ Enable linking to local files by origin. Software\Policies\Mozilla\Firefox\LocalFileLinks\1 = "https://example.org" Software\Policies\Mozilla\Firefox\LocalFileLinks\2 = "https://example.edu" ``` +#### Windows (Intune) +OMA-URI: +``` +./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox/LocalFileLinks +``` +Value (string): +``` + + +``` #### macOS ``` @@ -1835,23 +2705,32 @@ Software\Policies\Mozilla\Firefox\LocalFileLinks\2 = "https://example.edu" } } ``` -### NoDefaultBookmarks -Disable the creation of default bookmarks. +### MasterPassword +Require or prevent using a master password. -This policy is only effective if the user profile has not been created yet. +If this value is true, a master password is required. If this values is false, it works the same as `DisableMasterPasswordCreation` and removes the master password functionality. -**Compatibility:** Firefox 60, Firefox ESR 60\ -**CCK2 Equivalent:** `removeDefaultBookmarks`\ +**Compatibility:** Firefox 78, Firefox ESR 78\ +**CCK2 Equivalent:** `noMasterPassword`\ **Preferences Affected:** N/A #### Windows (GPO) ``` -Software\Policies\Mozilla\Firefox\NoDefaultBookmarks = 0x1 | 0x0 +Software\Policies\Mozilla\Firefox\MasterPassword = 0x1 | 0x0 +``` +#### Windows (Intune) +OMA-URI: +``` +./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox/MasterPassword +``` +Value (string): +``` + or ``` #### macOS ``` - NoDefaultBookmarks + MasterPassword | ``` @@ -1859,7 +2738,7 @@ Software\Policies\Mozilla\Firefox\NoDefaultBookmarks = 0x1 | 0x0 ``` { "policies": { - "NoDefaultBookmarks": true | false + "MasterPassword": true | false } } ``` @@ -1874,6 +2753,15 @@ Enable or disable network prediction (DNS prefetching). ``` Software\Policies\Mozilla\Firefox\NetworkPrediction = 0x1 | 0x0 ``` +#### Windows (Intune) +OMA-URI: +``` +./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox/NetworkPrediction +``` +Value (string): +``` + or +``` #### macOS ``` @@ -1899,6 +2787,15 @@ Enable or disable the New Tab page. ``` Software\Policies\Mozilla\Firefox\NewTabPage = 0x1 | 0x0 ``` +#### Windows (Intune) +OMA-URI: +``` +./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox/NewTabPage +``` +Value (string): +``` + or +``` #### macOS ``` @@ -1913,6 +2810,43 @@ Software\Policies\Mozilla\Firefox\NewTabPage = 0x1 | 0x0 "NewTabPage": true | false } ``` +### NoDefaultBookmarks +Disable the creation of default bookmarks. + +This policy is only effective if the user profile has not been created yet. + +**Compatibility:** Firefox 60, Firefox ESR 60\ +**CCK2 Equivalent:** `removeDefaultBookmarks`\ +**Preferences Affected:** N/A + +#### Windows (GPO) +``` +Software\Policies\Mozilla\Firefox\NoDefaultBookmarks = 0x1 | 0x0 +``` +#### Windows (Intune) +OMA-URI: +``` +./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox/NoDefaultBookmarks +``` +Value (string): +``` + or +``` +#### macOS +``` + + NoDefaultBookmarks + | + +``` +#### policies.json +``` +{ + "policies": { + "NoDefaultBookmarks": true | false + } +} +``` ### OfferToSaveLogins Control whether or not Firefox offers to save passwords. @@ -1924,6 +2858,15 @@ Control whether or not Firefox offers to save passwords. ``` Software\Policies\Mozilla\Firefox\OfferToSaveLogins = 0x1 | 0x0 ``` +#### Windows (Intune) +OMA-URI: +``` +./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox/OfferToSaveLogins +``` +Value (string): +``` + or +``` #### macOS ``` @@ -1950,6 +2893,15 @@ Sets the default value of signon.rememberSignons without locking it. ``` Software\Policies\Mozilla\Firefox\OfferToSaveLoginsDefault = 0x1 | 0x0 ``` +#### Windows (Intune) +OMA-URI: +``` +./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox/OfferToSaveLoginsDefault +``` +Value (string): +``` + or +``` #### macOS ``` @@ -1976,6 +2928,16 @@ Override the first run page. If the value is blank, no first run page is display ``` Software\Policies\Mozilla\Firefox\OverrideFirstRunPage = "http://example.org" ``` +#### Windows (Intune) +OMA-URI: +``` +./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox/OverrideFirstRunPage +``` +Value (string): +``` + + +``` #### macOS ``` @@ -1999,7 +2961,17 @@ Override the upgrade page. If the value is blank, no upgrade page is displayed. #### Windows (GPO) ``` -Software\Policies\Mozilla\Firefox\OverridePostUpdatePage = "http://example.org" +Software\Policies\Mozilla\Firefox\OverridePostUpdatePage = "http://example.org" +``` +#### Windows (Intune) +OMA-URI: +``` +./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox/OverridePostUpdatePage +``` +Value (string): +``` + + ``` #### macOS ``` @@ -2020,12 +2992,21 @@ Remove access to the password manager via preferences and blocks about:logins on **Compatibility:** Firefox 70, Firefox ESR 60.2\ **CCK2 Equivalent:** N/A\ -**Preferences Affected:** `prefs.privacy.disable_button.view_passwords` +**Preferences Affected:** `pref.privacy.disable_button.view_passwords` #### Windows (GPO) ``` Software\Policies\Mozilla\Firefox\PasswordManagerEnabled = 0x1 | 0x0 ``` +#### Windows (Intune) +OMA-URI: +``` +./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox/PasswordManagerEnabled +``` +Value (string): +``` + or +``` #### macOS ``` @@ -2041,8 +3022,58 @@ Software\Policies\Mozilla\Firefox\PasswordManagerEnabled = 0x1 | 0x0 } } ``` +### PDFjs +Disable or configure PDF.js, the built-in PDF viewer. + +If `Enabled` is set to false, the built-in PDF viewer is disabled. + +If `EnablePermissions` is set to true, the built-in PDF viewer will honor document permissions like preventing the copying of text. + +Note: DisableBuiltinPDFViewer has not been deprecated. You can either continue to use it, or switch to using PDFjs->Enabled to disable the built-in PDF viewer. This new permission was added because we needed a place for PDFjs->EnabledPermissions. + +**Compatibility:** Firefox 77, Firefox ESR 68.9\ +**CCK2 Equivalent:** N/A\ +**Preferences Affected:** `pdfjs.diabled`,`pdfjs.enablePermissions` + +#### Windows (GPO) +``` +Software\Policies\Mozilla\Firefox\PDFjs\Enabled = 0x1 | 0x0 +Software\Policies\Mozilla\Firefox\PDFjs\EnablePermissions = 0x1 | 0x0 +``` +#### Windows (Intune) +OMA-URI: +``` +./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~PDFjs/PDFjs_Enabled +./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~PDFjs/PDFjs_EnablePermissions +``` +Value (string): +``` +or +``` +#### macOS +``` + + PDFjs + + Enabled + | + + | + + +``` +#### policies.json +``` +{ + "policies": { + "PSFjs": { + "Enabled": true | false, + "EnablePermissions": true | false + } +} +``` ### Permissions -Set permissions associated with camera, microphone, location, and notifications. Because these are origins, not domains, entries with unique ports must be specified separately. See examples below. +Set permissions associated with camera, microphone, location, notifications, and autoplay. Because these are origins, not domains, entries with unique ports must be specified separately. See examples below. `Allow` is a list of origins where the feature is allowed. @@ -2052,9 +3083,11 @@ Set permissions associated with camera, microphone, location, and notifications. `Locked` prevents the user from changing preferences for the feature. -**Compatibility:** Firefox 62, Firefox ESR 60.2\ +`Default` specifies the default value for Autoplay. block-audio-video is not supported on Firefox ESR 68. + +**Compatibility:** Firefox 62, Firefox ESR 60.2 (Autoplay added in Firefox 74, Firefox ESR 68.6, Autoplay Default/Locked added in Firefox 76, Firefox ESR 68.8)\ **CCK2 Equivalent:** N/A\ -**Preferences Affected:** `permissions.default.camera`,`permissions.default.microphone`,`permissions.default.geo`,`permissions.default.desktop-notification` +**Preferences Affected:** `permissions.default.camera`,`permissions.default.microphone`,`permissions.default.geo`,`permissions.default.desktop-notification`,`media.autoplay.default` #### Windows (GPO) ``` @@ -2075,6 +3108,87 @@ Software\Policies\Mozilla\Firefox\Permissions\Notifications\Allow\1 = "https://e Software\Policies\Mozilla\Firefox\Permissions\Notifications\Block\1 = "https://example.edu" Software\Policies\Mozilla\Firefox\Permissions\Notifications\BlockNewRequests = 0x1 | 0x0 Software\Policies\Mozilla\Firefox\Permissions\Notifications\Locked = 0x1 | 0x0 +Software\Policies\Mozilla\Firefox\Permissions\Autoplay\Allow\1 = "https://example.org" +Software\Policies\Mozilla\Firefox\Permissions\Autoplay\Block\1 = "https://example.edu" +Software\Policies\Mozilla\Firefox\Permissions\Autoplay\Default = "allow-audio-video" | "block-audio" | "block-audio-video" +Software\Policies\Mozilla\Firefox\Permissions\Autoplay\Locked = 0x1 | 0x0 +``` +#### Windows (Intune) +OMA-URI: +``` +./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~Permissions~Location/Location_BlockNewRequests +``` +Value (string): +``` + or +``` +OMA-URI: +``` +./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~Permissions~Location/Location_Locked +``` +Value (string): +``` + or +``` +OMA-URI: +``` +./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~Permissions~Notifications/Notifications_Allow +``` +Value (string): +``` + + +``` +OMA-URI: +``` +./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~Permissions~Notifications/Notifications_BlockNewRequests +``` +Value (string): +``` + or +``` +OMA-URI: +``` +./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~Permissions~Notifications/Notifications_Locked +``` +Value (string): +``` + or +``` +OMA-URI: +``` +./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~Permissions~Autoplay/Autoplay_Allow +``` +Value (string): +``` + + +``` +OMA-URI: +``` +./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~Permissions~Autoplay/Autoplay_Block +``` +Value (string): +``` + + +``` +OMA-URI: +``` +./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~Permissions~Autoplay/Autoplay_Default +``` +Value (string): +``` + + +``` +OMA-URI: +``` +./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~Permissions~Autoplay/Autoplay_Locked +``` +Value (string): +``` + or ``` #### macOS ``` @@ -2093,9 +3207,9 @@ Software\Policies\Mozilla\Firefox\Permissions\Notifications\Locked = 0x1 | 0x0 https://example.edu BlockNewRequests - + | Locked - + | Microphone @@ -2108,9 +3222,9 @@ Software\Policies\Mozilla\Firefox\Permissions\Notifications\Locked = 0x1 | 0x0 https://example.edu BlockNewRequests - + | Locked - + | Location @@ -2123,9 +3237,9 @@ Software\Policies\Mozilla\Firefox\Permissions\Notifications\Locked = 0x1 | 0x0 https://example.edu BlockNewRequests - + | Locked - + | Notifications @@ -2142,6 +3256,21 @@ Software\Policies\Mozilla\Firefox\Permissions\Notifications\Locked = 0x1 | 0x0 Locked + Autoplay + + Allow + + https://example.org + + Block + + https://example.edu + + Default + allow-audio-video | block-audio | block-audio-video + Locked + | + ``` @@ -2173,11 +3302,53 @@ Software\Policies\Mozilla\Firefox\Permissions\Notifications\Locked = 0x1 | 0x0 "Block": ["https://example.edu"], "BlockNewRequests": true | false, "Locked": true | false + }, + "Autoplay": { + "Allow": ["https://example.org"], + "Block": ["https://example.edu"], + "Default": "allow-audio-video" | "block-audio" | "block-audio-video", + "Locked": true | false } } } } ``` +### PictureInPicture + +Enable or disable Picture-in-Picture. + +**Compatibility:** Firefox 78, Firefox ESR 78\ +**CCK2 Equivalent:** N/A\ +**Preferences Affected:** `media.videocontrols.picture-in-picture.video-toggle.enabled` + +#### Windows (GPO) +``` +Software\Policies\Mozilla\Firefox\PictureInPicture = 0x1 | 0x0 +``` +#### Windows (Intune) +OMA-URI: +``` +./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox/PictureInPicture +``` +Value (string): +``` + or +``` +#### macOS +``` + + PictureInPicture + | + +``` +#### policies.json +``` +{ + "policies": { + "PictureInPicture": true | false + } +} +``` ### PopupBlocking Configure the default pop-up window policy as well as origins for which pop-up windows are allowed. @@ -2198,6 +3369,32 @@ Software\Policies\Mozilla\Firefox\PopupBlocking\Allow\2 = "https://example.edu" Software\Policies\Mozilla\Firefox\PopupBlocking\Default = 0x1 | 0x0 Software\Policies\Mozilla\Firefox\PopupBlocking\Locked = 0x1 | 0x0 ``` +#### Windows (Intune) +OMA-URI: +``` +./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~Popups/PopupBlocking_Allow +``` +Value (string): +``` + + +``` +OMA-URI: +``` +./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~Popups/PopupBlocking_Default +``` +Value (string): +``` + or +``` +OMA-URI: +``` +./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~Popups/PopupBlocking_Locked +``` +Value (string): +``` + or +``` #### macOS ``` @@ -2239,7 +3436,7 @@ Set and lock certain preferences. | --- | --- | --- | --- | accessibility.force_disabled | integer | Firefox 70, Firefox ESR 68.2 | 0 |     If set to 1, platform accessibility is disabled. -| app.update.auto | boolean | Firefox 68, Firefox ESR 68 | true +| app.update.auto (Deprecated - Switch to AppAutoUpdate policy) | boolean | Firefox 68, Firefox ESR 68 | true |     If false, Firefox doesn't automatically install update. | browser.bookmarks.autoExportHTML | boolean | Firefox 70, Firefox ESR 68.2 | false |     If true, bookmarks are exported on shutdown. @@ -2303,7 +3500,7 @@ Set and lock certain preferences. |     If false, the geolocation API is disabled. | Language dependent | intl.accept_languages | string | Firefox 70, Firefox ESR 68.2 |     If set, preferred language for web pages. -| media.eme.enabled | boolean | Firefox 70, Firefox ESR 68.2 | true +| media.eme.enabled (Deprecated - Switch to EncryptedMediaExtensions policy) | boolean | Firefox 70, Firefox ESR 68.2 | true |     If false, Encrypted Media Extensions are not enabled. | media.gmp-gmpopenh264.enabled | boolean | Firefox 68, Firefox ESR 68 | true |     If false, the OpenH264 plugin is not downloaded. @@ -2326,7 +3523,7 @@ disabled |     If set to Select Automatically, Firefox automatically chooses the default personal certificate. | security.mixed_content.block_active_content | boolean | Firefox 70, Firefox ESR 68.2 | true |     If false, mixed active content (HTTP and HTTPS) is not blocked. -| security.osclientcerts.autoload | boolean | Firefox 72, Firefox ESR 68.4 (Windows only) | false +| security.osclientcerts.autoload | boolean | Firefox 72 (Windows), Firefox 75 (macOS) | false |     If true, client certificates are loaded from the operating system certificate store. | security.ssl.errorReporting.enabled | boolean | Firefox 68, Firefox ESR 68 | true |     If false, SSL errors cannot be sent to Mozilla. @@ -2341,6 +3538,15 @@ disabled Software\Policies\Mozilla\Firefox\Preferences\boolean_preference_name = 0x1 | 0x0 Software\Policies\Mozilla\Firefox\Preferences\string_preference_name = "string_value" ``` +#### Windows (Intune) +OMA-URI: (periods are replaced by underscores) +``` +./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~Preferences/boolean_preference_name +``` +Value (string): +``` + or +``` #### macOS ``` @@ -2368,13 +3574,22 @@ Software\Policies\Mozilla\Firefox\Preferences\string_preference_name = "string_v Ask where to save each file before downloading. **Compatibility:** Firefox 68, Firefox ESR 68\ -**CCK2 Equivalent:** N/A +**CCK2 Equivalent:** N/A\ **Preferences Affected:** `browser.download.useDownloadDir` #### Windows (GPO) ``` Software\Policies\Mozilla\Firefox\PromptForDownloadLocation = 0x1 | 0x0 ``` +#### Windows (Intune) +OMA-URI: +``` +./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox/PromptForDownloadLocation +``` +Value (string): +``` + or +``` #### macOS ``` @@ -2437,6 +3652,27 @@ Software\Policies\Mozilla\Firefox\Proxy\AutoConfigURL = URL_TO_AUTOCONFIG Software\Policies\Mozilla\Firefox\Proxy\AutoLogin = 0x1 | 0x0 Software\Policies\Mozilla\Firefox\Proxy\UseProxyForDNS = 0x1 | 0x0 ``` +#### Windows (Intune) +OMA-URI: +``` +./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox/Proxy +``` +Value (string): +``` + + + + + + + + + + + + + +``` #### macOS ``` @@ -2475,17 +3711,17 @@ Software\Policies\Mozilla\Firefox\Proxy\UseProxyForDNS = 0x1 | 0x0 "policies": { "Proxy": { "Mode": "none", "system", "manual", "autoDetect", "autoConfig", - "Locked": [true, false], + "Locked": true | false, "HTTPProxy": "hostname", - "UseHTTPProxyForAllProtocols": [true, false], + "UseHTTPProxyForAllProtocols": true | false, "SSLProxy": "hostname", "FTPProxy": "hostname", "SOCKSProxy": "hostname", "SOCKSVersion": 4 | 5 "Passthrough": "", "AutoConfigURL": "URL_TO_AUTOCONFIG", - "AutoLogin": [true, false], - "UseProxyForDNS": [true, false] + "AutoLogin": true | false, + "UseProxyForDNS": true | false } } } @@ -2507,6 +3743,16 @@ or Software\Policies\Mozilla\Firefox\RequestedLocales = "de,en-US" ``` +#### Windows (Intune) +OMA-URI: +``` +./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox/RequestedLocalesString +``` +Value (string): +``` + + +``` #### macOS ``` @@ -2541,6 +3787,8 @@ or } } ``` + + ### SanitizeOnShutdown (Selective) Clear data on shutdown. Choose from Cache, Cookies, Download History, Form & Search History, Browsing History, Active Logins, Site Preferences and Offline Website Data. @@ -2561,6 +3809,15 @@ Software\Policies\Mozilla\Firefox\SanitizeOnShutdown\SiteSettings = 0x1 | 0x0 Software\Policies\Mozilla\Firefox\SanitizeOnShutdown\OfflineApps = 0x1 | 0x0 Software\Policies\Mozilla\Firefox\SanitizeOnShutdown\Locked = 0x1 | 0x0 ``` +#### Windows (Intune) +OMA-URI: +``` +./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~SanitizeOnShutdown/I_SanitizeOnShutdown_Locked +``` +Value (string): +``` + or +``` #### macOS ``` @@ -2615,6 +3872,15 @@ Clear all data on shutdown, including Browsing & Download History, Cookies, Acti ``` Software\Policies\Mozilla\Firefox\SanitizeOnShutdown = 0x1 | 0x0 ``` +#### Windows (Intune) +OMA-URI: +``` +./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox/C_SanitizeOnShutdown +``` +Value (string): +``` + or +``` #### macOS ``` @@ -2641,6 +3907,17 @@ Set whether or not search bar is displayed. ``` Software\Policies\Mozilla\Firefox\SearchBar = "unified" | "separate" ``` + +#### Windows (Intune) +OMA-URI: +``` +./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox/SearchBar +``` +Value (string): +``` + + +``` #### macOS ``` @@ -2648,7 +3925,6 @@ Software\Policies\Mozilla\Firefox\SearchBar = "unified" | "separate" unified | separate ``` - #### policies.json ``` { @@ -2657,10 +3933,7 @@ Software\Policies\Mozilla\Firefox\SearchBar = "unified" | "separate" } } ``` - - - - + ### SearchEngines (This policy is only available on the ESR.) @@ -2676,6 +3949,16 @@ Set the default search engine. This policy is only available on the ESR. ``` Software\Policies\Mozilla\Firefox\SearchEngines\Default = NAME_OF_SEARCH_ENGINE ``` +#### Windows (Intune) +OMA-URI: +``` +./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~Search/SearchEngines_Default +``` +Value (string): +``` + + +``` #### macOS ``` @@ -2708,6 +3991,15 @@ Prevent installing search engines from webpages. ``` Software\Policies\Mozilla\Firefox\SearchEngines\PreventInstalls = 0x1 | 0x0 ``` +#### Windows (Intune) +OMA-URI: +``` +./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~Search/SearchEngines_PreventInstalls +``` +Value (string): +``` + or +``` #### macOS ``` @@ -2740,6 +4032,16 @@ Hide built-in search engines. This policy is only available on the ESR. ``` Software\Policies\Mozilla\Firefox\SearchEngines\Remove\1 = NAME_OF_SEARCH_ENGINE ``` +#### Windows (Intune) +OMA-URI: +``` +./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~Search/SearchEngines_Remove +``` +Value (string): +``` + + +``` #### macOS ``` @@ -2797,7 +4099,23 @@ Software\Policies\Mozilla\Firefox\SearchEngines\Add\1\Description = "Example Des Software\Policies\Mozilla\Firefox\SearchEngines\Add\1\SuggestURLTemplate = "https://www.example.org/suggestions/q={searchTerms}" Software\Policies\Mozilla\Firefox\SearchEngines\Add\1\PostData = "name=value&q={searchTerms}" ``` - +#### Windows (Intune) +OMA-URI: +``` +./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~Search/SearchEngines_1 +``` +Value (string): +``` + + + + + + + + + +``` #### macOS ``` @@ -2860,6 +4178,15 @@ Enable search suggestions. ``` Software\Policies\Mozilla\Firefox\SearchSuggestEnabled = 0x1 | 0x0 ``` +#### Windows (Intune) +OMA-URI: +``` +./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox/SearchSuggestEnabled +``` +Value (string): +``` + or +``` #### macOS ``` @@ -2887,6 +4214,16 @@ Install PKCS #11 modules. ``` Software\Policies\Mozilla\Firefox\SecurityDevices\NAME_OF_DEVICE = PATH_TO_LIBRARY_FOR_DEVICE ``` +#### Windows (Intune) +OMA-URI: +``` +./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox/SecurityDevices +``` +Value (string): +``` + + +``` #### macOS ``` @@ -2920,6 +4257,16 @@ Set and lock the maximum version of TLS. ``` Software\Policies\Mozilla\Firefox\SSLVersionMax = "tls1" | "tls1.1" | "tls1.2" | "tls1.3" ``` +#### Windows (Intune) +OMA-URI: +``` +./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox/SSLVersionMax +``` +Value (string): +``` + + +``` #### macOS ``` @@ -2948,6 +4295,16 @@ Set and lock the minimum version of TLS. ``` Software\Policies\Mozilla\Firefox\SSLVersionMin = "tls1" | "tls1.1" | "tls1.2" | "tls1.3" ``` +#### Windows (Intune) +OMA-URI: +``` +./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox/SSLVersionMin +``` +Value (string): +``` + + +``` #### macOS ``` @@ -2977,6 +4334,18 @@ Software\Policies\Mozilla\Firefox\SupportMenu\Title = "Support Menu" Software\Policies\Mozilla\Firefox\SupportMenu\URL = "http://example.com/support" Software\Policies\Mozilla\Firefox\SupportMenu\AccessKey = "S" ``` +#### Windows (Intune) +OMA-URI: +``` +./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox/SupportMenu +``` +Value (string): +``` + + + + +``` #### macOS ``` @@ -3003,6 +4372,70 @@ Software\Policies\Mozilla\Firefox\SupportMenu\AccessKey = "S" } } ``` +### UserMessaging + +Prevent installing search engines from webpages. + +`WhatsNew` Remove the "What's New" icon and menuitem. (Firefox 75 only) + +`ExtensionRecommendations` Don't recommend extensions. + +`FeatureRecommendations` Don't recommend browser features. + +`UrlbarInterventions` Don't offer Firefox specific suggestions in the URL bar. (Firefox 75 only) + +**Compatibility:** Firefox 75, Firefox ESR 68.7\ +**CCK2 Equivalent:** N/A\ +**Preferences Affected:** `browser.messaging-system.whatsNewPanel.enabled`,`browser.newtabpage.activity-stream.asrouter.userprefs.cfr.addons`,`browser.newtabpage.activity-stream.asrouter.userprefs.cfr.features` + +#### Windows (GPO) +``` +Software\Policies\Mozilla\Firefox\UserMessaging\WhatsNew = 0x1 | 0x0 +Software\Policies\Mozilla\Firefox\UserMessaging\ExtensionRecommendations = 0x1 | 0x0 +Software\Policies\Mozilla\Firefox\UserMessaging\FeatureRecommendations = 0x1 | 0x0 +Software\Policies\Mozilla\Firefox\UserMessaging\UrlbarInterventions = 0x1 | 0x0 +``` +#### Windows (Intune) +OMA-URI: +``` +./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox/UserMessaging_WhatsNew +./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox/UserMessaging_ExtensionRecommendations +./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox/UserMessaging_FeatureRecommendations +./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox/UserMessaging_UrlbarInterventions +``` +Value (string): +``` + or +``` +#### macOS +``` + + UserMessaging + + WhatsNew + | + ExtensionRecommendations + | + FeatureRecommendations + | + UrlbarInterventions + | + + +``` +#### policies.json +``` +{ + "policies": { + "UserMessaging": { + "WhatsNew": true | false, + "ExtensionRecommendations": true | false, + "FeatureRecommendations": true | false, + "UrlbarInterventions": true | false + } + } +} +``` ### WebsiteFilter Block websites from being visited. The parameters take an array of Match Patterns, as documented in https://developer.mozilla.org/en-US/Add-ons/WebExtensions/Match_patterns. Only http/https addresses are supported at the moment. The arrays are limited to 1000 entries each. @@ -3012,8 +4445,27 @@ Block websites from being visited. The parameters take an array of Match Pattern #### Windows (GPO) ``` -Software\Policies\Mozilla\Firefox\WebsiteFilters\Block\1 = "" -Software\Policies\Mozilla\Firefox\WebsiteFilters\Exceptions\1 = "http://example.org/*" +Software\Policies\Mozilla\Firefox\WebsiteFilter\Block\1 = "" +Software\Policies\Mozilla\Firefox\WebsiteFilter\Exceptions\1 = "http://example.org/*" +``` +#### Windows (Intune) +OMA-URI: +``` +./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox/B_WebsiteFilter_Block +``` +Value (string): +``` + + +``` +OMA-URI: +``` +./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox/B_WebsiteFilter_Exceptions +``` +Value (string): +``` + + ``` #### macOS ```