X-Git-Url: https://git.p6c8.net/policy-templates.git/blobdiff_plain/dc7b52ed6597d6a4ed7a2379ae31f74309ef2c8c..561d4fbf945526022acf97ed6d4364c879d512cf:/README.md?ds=sidebyside diff --git a/README.md b/README.md index 50fb47f..542840e 100644 --- a/README.md +++ b/README.md @@ -1,8 +1,8 @@ **These policies are in active development and so might contain changes that do not work with current versions of Firefox.** -**You should use the officially released versions (https://github.com/mozilla/policy-templates/releases) if you are deploying changes.** +**You should use the [officially released versions](https://github.com/mozilla/policy-templates/releases) if you are deploying changes.** -Policies can be specified using the Group Policy templates on Windows (https://github.com/mozilla/policy-templates/tree/master/windows), configuration profiles on macOS (https://github.com/mozilla/policy-templates/tree/master/mac), or by creating a file called `policies.json`. On Windows, create a directory called `distribution` where the EXE is located and place the file there. On Mac, the file goes into `Firefox.app/Contents/Resources/distribution`. On Linux, the file goes into `firefox/distribution`, where `firefox` is the installation directory for firefox, which varies by distribution. +Policies can be specified using the [Group Policy templates on Windows](https://github.com/mozilla/policy-templates/tree/master/windows), [Intune on Windows](https://support.mozilla.org/kb/managing-firefox-intune), [configuration profiles on macOS](https://github.com/mozilla/policy-templates/tree/master/mac), or by creating a file called `policies.json`. On Windows, create a directory called `distribution` where the EXE is located and place the file there. On Mac, the file goes into `Firefox.app/Contents/Resources/distribution`. On Linux, the file goes into `firefox/distribution`, where `firefox` is the installation directory for firefox, which varies by distribution. | Policy Name | Description | --- | --- | @@ -23,6 +23,7 @@ Policies can be specified using the Group Policy templates on Windows (https://g | **[`DisableMasterPasswordCreation`](#disablemasterpasswordcreation)** | Remove the master password functionality. | **[`DisableAppUpdate`](#disableappupdate)** | Turn off application updates. | **[`DisableBuiltinPDFViewer`](#disablebuiltinpdfviewer)** | Disable the built in PDF viewer. +| **[`DisabledCiphers`](#disabledciphers)** | Disable ciphers. | **[`DisableDefaultBrowserAgent`](#disabledefaultbrowseragent)** | Prevent the default browser agent from taking any actions (Windows only). | **[`DisableDeveloperTools`](#disabledevelopertools)** | Remove access to all developer tools. | **[`DisableFeedbackCommands`](#disablefeedbackcommands)** | Disable the menus for reporting sites. @@ -31,9 +32,9 @@ Policies can be specified using the Group Policy templates on Windows (https://g | **[`DisableFirefoxStudies`](#disablefirefoxstudies)** | Disable Firefox studies (Shield). | **[`DisableForgetButton`](#disableforgetbutton)** | Disable the "Forget" button. | **[`DisableFormHistory`](#disableformhistory)** | Turn off saving information on web forms and the search bar. +| **[`DisablePasswordReveal`](#disablepasswordreveal)** | Do not allow passwords to be revealed in saved logins. | **[`DisablePocket`](#disablepocket)** | Remove Pocket in the Firefox UI. | **[`DisablePrivateBrowsing`](#disableprivatebrowsing)** | Remove access to private browsing. -| **[`DisablePasswordReveal`](#disablepasswordreveal)** | Do not allow passwords to be revealed in saved logins. | **[`DisableProfileImport`](#disableprofileimport)** | Disables the "Import data from another browser" option in the bookmarks window. | **[`DisableProfileRefresh`](#disableprofilerefresh)** | Disable the Refresh Firefox button on about:support and support.mozilla.org | **[`DisableSafeMode`](#disablesafemode)** | Disable safe mode within the browser. @@ -81,8 +82,8 @@ Policies can be specified using the Group Policy templates on Windows (https://g | **[`SearchEngines -> PreventInstalls`](#searchengines--preventinstalls)** | Prevent installing search engines from webpages. | **[`SearchEngines -> Remove`](#searchengines--remove)** | Hide built-in search engines. | **[`SearchEngines -> Add`](#searchengines--add)** | Add new search engines. -| **[`SecurityDevices`](#securitydevices)** | Install PKCS #11 modules. | **[`SearchSuggestEnabled`](#searchsuggestenabled)** | Enable search suggestions. +| **[`SecurityDevices`](#securitydevices)** | Install PKCS #11 modules. | **[`SSLVersionMax`](#sslversionmax)** | Set and lock the maximum version of TLS. | **[`SSLVersionMin`](#sslversionmin)** | Set and lock the minimum version of TLS. | **[`SupportMenu`](#supportmenu)** | Add a menuitem to the help menu for specifying support information. @@ -174,9 +175,11 @@ Configure sites that support integrated authentication. See https://developer.mozilla.org/en-US/docs/Mozilla/Integrated_authentication for more information. -**Compatibility:** Firefox 60, Firefox ESR 60 (AllowNonFQDN added in 62/60.2, AllowProxies added in 70/68.2, Locked added in 71/68.3)\ +`PrivateBrowsing` enables integrated authentication in prviate browsing. + +**Compatibility:** Firefox 60, Firefox ESR 60 (AllowNonFQDN added in 62/60.2, AllowProxies added in 70/68.2, Locked added in 71/68.3, PrivateBrowsing added in 77/68.9)\ **CCK2 Equivalent:** N/A\ -**Preferences Affected:** `network.negotiate-auth.trusted-uris`,`network.negotiate-auth.delegation-uris`,`network.automatic-ntlm-auth.trusted-uris`,`network.automatic-ntlm-auth.allow-non-fqdn`,`network.negotiate-auth.allow-non-fqdn`,`network.automatic-ntlm-auth.allow-proxies`,`network.negotiate-auth.allow-proxies` +**Preferences Affected:** `network.negotiate-auth.trusted-uris`,`network.negotiate-auth.delegation-uris`,`network.automatic-ntlm-auth.trusted-uris`,`network.automatic-ntlm-auth.allow-non-fqdn`,`network.negotiate-auth.allow-non-fqdn`,`network.automatic-ntlm-auth.allow-proxies`,`network.negotiate-auth.allow-proxies`,`network.auth.private-browsing-sso` #### Windows (GPO) ``` @@ -191,6 +194,7 @@ Software\Policies\Mozilla\Firefox\Authentication\AllowNonFQDN\NTLM = 0x1 | 0x0 Software\Policies\Mozilla\Firefox\Authentication\AllowProxies\SPNEGO = 0x1 | 0x0 Software\Policies\Mozilla\Firefox\Authentication\AllowProxies\NTLM = 0x1 | 0x0 Software\Policies\Mozilla\Firefox\Authentication\Locked = 0x1 | 0x0 +Software\Policies\Mozilla\Firefox\Authentication\PrivateBrowsing = 0x1 | 0x0 ``` #### Windows (Intune) OMA-URI: @@ -200,7 +204,6 @@ OMA-URI: Value (string): ``` - ``` OMA-URI: @@ -210,7 +213,6 @@ OMA-URI: Value (string): ``` - ``` OMA-URI: @@ -220,7 +222,6 @@ OMA-URI: Value (string): ``` - ``` OMA-URI: @@ -230,19 +231,24 @@ OMA-URI: Value (string): ``` - ``` OMA-URI: ``` -./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~Homepage/HomepageStartPage +./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~Authentication/Authentication_Locked ``` Value (string): ``` - - - + or +``` +OMA-URI: +``` +./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~Authentication/Authentication_PrivateBrowsing +``` +Value (string): +``` + or ``` #### macOS ``` @@ -280,6 +286,8 @@ Value (string): Locked | + PrivateBrowsing + | ``` @@ -299,7 +307,8 @@ Value (string): "SPNEGO": true | false, "NTLM": true | false }, - "Locked": true | false + "Locked": true | false, + "PrivateBrowsing": true | false } } } @@ -932,6 +941,86 @@ Value (string): } } ``` +### DisabledCiphers +Disable specific cryptographic ciphers. + +**Compatibility:** Firefox 76, Firefox ESR 68.8\ +**CCK2 Equivalent:** N/A\ +**Preferences Affected:** N/A + +#### Windows (GPO) +``` +Software\Policies\Mozilla\Firefox\DisabledCiphers\TLS_DHE_RSA_WITH_AES_128_CBC_SHA = 0x1 | 0x0 +Software\Policies\Mozilla\Firefox\DisabledCiphers\TLS_DHE_RSA_WITH_AES_256_CBC_SHA = 0x1 | 0x0 +Software\Policies\Mozilla\Firefox\DisabledCiphers\TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA = 0x1 | 0x0 +Software\Policies\Mozilla\Firefox\DisabledCiphers\TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA = 0x1 | 0x0 +Software\Policies\Mozilla\Firefox\DisabledCiphers\TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 = 0x1 | 0x0 +Software\Policies\Mozilla\Firefox\DisabledCiphers\TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256 = 0x1 | 0x0 +Software\Policies\Mozilla\Firefox\DisabledCiphers\TLS_RSA_WITH_AES_128_CBC_SHA = 0x1 | 0x0 +Software\Policies\Mozilla\Firefox\DisabledCiphers\TLS_RSA_WITH_AES_256_CBC_SHA = 0x1 | 0x0 +Software\Policies\Mozilla\Firefox\DisabledCiphers\TLS_RSA_WITH_3DES_EDE_CBC_SHA = 0x1 | 0x0 +``` +#### Windows (Intune) +OMA-URI: +``` +./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~DisabledCiphers/DisabledCiphers_TLS_DHE_RSA_WITH_AES_128_CBC_SHA +./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~DisabledCiphers/DisabledCiphers_TLS_DHE_RSA_WITH_AES_256_CBC_SHA +./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~DisabledCiphers/DisabledCiphers_TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA +./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~DisabledCiphers/DisabledCiphers_TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA +./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~DisabledCiphers/DisabledCiphers_TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 +./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~DisabledCiphers/DisabledCiphers_TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256 +./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~DisabledCiphers/DisabledCiphers_TLS_RSA_WITH_AES_128_CBC_SHA +./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~DisabledCiphers/DisabledCiphers_TLS_RSA_WITH_AES_256_CBC_SHA +./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~DisabledCiphers/DisabledCiphers_TLS_RSA_WITH_3DES_EDE_CBC_SHA +``` +Value (string): +``` + or +``` +#### macOS +``` + + DisabledCiphers + + TLS_DHE_RSA_WITH_AES_128_CBC_SHA + | + TLS_DHE_RSA_WITH_AES_256_CBC_SHA + | + TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA + | + TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA + | + TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 + | + TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256 + | + TLS_RSA_WITH_AES_128_CBC_SHA + | + TLS_RSA_WITH_AES_256_CBC_SHA + | + TLS_RSA_WITH_3DES_EDE_CBC_SHA + | + + +``` +#### policies.json +``` +{ + "policies": { + "DisabledCiphers" { + "TLS_DHE_RSA_WITH_AES_128_CBC_SHA": true | false, + "TLS_DHE_RSA_WITH_AES_256_CBC_SHA": true | false, + "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA": true | false, + "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA": true | false, + "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256": true | false, + "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256": true | false, + "TLS_RSA_WITH_AES_128_CBC_SHA": true | false, + "TLS_RSA_WITH_AES_256_CBC_SHA": true | false, + "TLS_RSA_WITH_3DES_EDE_CBC_SHA": true | false + } + } +} +``` ### DisableDefaultBrowserAgent Prevent the default browser agent from taking any actions. Only applicable to Windows; other platforms don’t have the agent. @@ -1673,6 +1762,41 @@ Software\Policies\Mozilla\Firefox\DNSOverHTTPS\ProviderURL = "URL_TO_ALTERNATE_P Software\Policies\Mozilla\Firefox\DNSOverHTTPS\Locked = 0x1 | 0x0 Software\Policies\Mozilla\Firefox\DNSOverHTTPS\ExcludedDomains\1 = "example.com" ``` +#### Windows (Intune) +OMA-URI: +``` +./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~DNSOverHTTPS/DNSOverHTTPS_Enabled +``` +Value (string): +``` + or +``` +OMA-URI: +``` +./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~DNSOverHTTPS/DNSOverHTTPS_ProviderURL +``` +Value (string): +``` + + +``` +OMA-URI: +``` +./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~DNSOverHTTPS/DNSOverHTTPS_Locked +``` +Value (string): +``` + or +``` +OMA-URI: +``` +./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~DNSOverHTTPS/DNSOverHTTPS_ExcludedDomains +``` +Value (string): +``` + + +``` #### macOS ``` @@ -1715,6 +1839,15 @@ Don't check if Firefox is the default browser at startup. ``` Software\Policies\Mozilla\Firefox\DontCheckDefaultBrowser = 0x1 | 0x0 ``` +#### Windows (Intune) +OMA-URI: +``` +./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox/DontCheckDefaultBrowser +``` +Value (string): +``` + or +``` #### macOS ``` @@ -1743,6 +1876,16 @@ You can use ${home} for the native home directory. ``` Software\Policies\Mozilla\Firefox\DefaultDownloadDirectory = "${home}\Downloads" ``` +#### Windows (Intune) +OMA-URI: +``` +./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox/DefaultDownloadDirectory +``` +Value (string): +``` + + +``` #### macOS ``` @@ -1777,6 +1920,16 @@ You can use ${home} for the native home directory. ``` Software\Policies\Mozilla\Firefox\DownloadDirectory = "${home}\Downloads" ``` +#### Windows (Intune) +OMA-URI: +``` +./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox/DownloadDirectory +``` +Value (string): +``` + + +``` #### macOS ``` @@ -2059,6 +2212,15 @@ Control extension updates. ``` Software\Policies\Mozilla\Firefox\ExtensionUpdate = 0x1 | 0x0 ``` +#### Windows (Intune) +OMA-URI: +``` +./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox/ExtensionUpdate +``` +Value (string): +``` + or +``` #### macOS ``` @@ -2105,7 +2267,6 @@ Value (string): ``` - ``` OMA-URI: ``` @@ -2172,6 +2333,21 @@ Software\Policies\Mozilla\Firefox\FirefoxHome\Pocket = 0x1 | 0x0 Software\Policies\Mozilla\Firefox\FirefoxHome\Snippets = 0x1 | 0x0 Software\Policies\Mozilla\Firefox\FirefoxHome\Locked = 0x1 | 0x0 ``` +#### Windows (Intune) +OMA-URI: +``` +./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox/CustomizeFirefoxHome +``` +Value (string): +``` + + + + + + + +``` #### macOS ``` @@ -2218,6 +2394,15 @@ Control hardware acceleration. ``` Software\Policies\Mozilla\Firefox\HardwareAcceleration = 0x1 | 0x0 ``` +#### Windows (Intune) +OMA-URI: +``` +./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox/HardwareAcceleration +``` +Value (string): +``` + or +``` #### macOS ``` @@ -2400,6 +2585,15 @@ This policy only work on Windows via GPO (not policies.json). ``` Software\Policies\Mozilla\Firefox\LegacyProfiles = = 0x1 | 0x0 ``` +#### Windows (Intune) +OMA-URI: +``` +./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox/LegacyProfiles +``` +Value (string): +``` + or +``` ### LocalFileLinks Enable linking to local files by origin. @@ -2412,6 +2606,16 @@ Enable linking to local files by origin. Software\Policies\Mozilla\Firefox\LocalFileLinks\1 = "https://example.org" Software\Policies\Mozilla\Firefox\LocalFileLinks\2 = "https://example.edu" ``` +#### Windows (Intune) +OMA-URI: +``` +./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox/LocalFileLinks +``` +Value (string): +``` + + +``` #### macOS ``` @@ -2431,23 +2635,30 @@ Software\Policies\Mozilla\Firefox\LocalFileLinks\2 = "https://example.edu" } } ``` -### NoDefaultBookmarks -Disable the creation of default bookmarks. - -This policy is only effective if the user profile has not been created yet. +### NetworkPrediction +Enable or disable network prediction (DNS prefetching). -**Compatibility:** Firefox 60, Firefox ESR 60\ -**CCK2 Equivalent:** `removeDefaultBookmarks`\ -**Preferences Affected:** N/A +**Compatibility:** Firefox 67, Firefox ESR 60.7\ +**CCK2 Equivalent:** N/A\ +**Preferences Affected:** `network.dns.disablePrefetch`,`network.dns.disablePrefetchFromHTTPS` #### Windows (GPO) ``` -Software\Policies\Mozilla\Firefox\NoDefaultBookmarks = 0x1 | 0x0 +Software\Policies\Mozilla\Firefox\NetworkPrediction = 0x1 | 0x0 +``` +#### Windows (Intune) +OMA-URI: +``` +./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox/NetworkPrediction +``` +Value (string): +``` + or ``` #### macOS ``` - NoDefaultBookmarks + NetworkPrediction | ``` @@ -2455,25 +2666,33 @@ Software\Policies\Mozilla\Firefox\NoDefaultBookmarks = 0x1 | 0x0 ``` { "policies": { - "NoDefaultBookmarks": true | false - } + "NetworkPrediction": true | false } ``` -### NetworkPrediction -Enable or disable network prediction (DNS prefetching). +### NewTabPage +Enable or disable the New Tab page. -**Compatibility:** Firefox 67, Firefox ESR 60.7\ +**Compatibility:** Firefox 68, Firefox ESR 68\ **CCK2 Equivalent:** N/A\ -**Preferences Affected:** `network.dns.disablePrefetch`,`network.dns.disablePrefetchFromHTTPS` +**Preferences Affected:** `browser.newtabpage.enabled` #### Windows (GPO) ``` -Software\Policies\Mozilla\Firefox\NetworkPrediction = 0x1 | 0x0 +Software\Policies\Mozilla\Firefox\NewTabPage = 0x1 | 0x0 +``` +#### Windows (Intune) +OMA-URI: +``` +./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox/NewTabPage +``` +Value (string): +``` + or ``` #### macOS ``` - NetworkPrediction + NewTabPage | ``` @@ -2481,24 +2700,26 @@ Software\Policies\Mozilla\Firefox\NetworkPrediction = 0x1 | 0x0 ``` { "policies": { - "NetworkPrediction": true | false + "NewTabPage": true | false } ``` -### NewTabPage -Enable or disable the New Tab page. +### NoDefaultBookmarks +Disable the creation of default bookmarks. -**Compatibility:** Firefox 68, Firefox ESR 68\ -**CCK2 Equivalent:** N/A\ -**Preferences Affected:** `browser.newtabpage.enabled` +This policy is only effective if the user profile has not been created yet. + +**Compatibility:** Firefox 60, Firefox ESR 60\ +**CCK2 Equivalent:** `removeDefaultBookmarks`\ +**Preferences Affected:** N/A #### Windows (GPO) ``` -Software\Policies\Mozilla\Firefox\NewTabPage = 0x1 | 0x0 +Software\Policies\Mozilla\Firefox\NoDefaultBookmarks = 0x1 | 0x0 ``` #### Windows (Intune) OMA-URI: ``` -./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox/NewTabPage +./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox/NoDefaultBookmarks ``` Value (string): ``` @@ -2507,7 +2728,7 @@ Value (string): #### macOS ``` - NewTabPage + NoDefaultBookmarks | ``` @@ -2515,7 +2736,8 @@ Value (string): ``` { "policies": { - "NewTabPage": true | false + "NoDefaultBookmarks": true | false + } } ``` ### OfferToSaveLogins @@ -2529,6 +2751,15 @@ Control whether or not Firefox offers to save passwords. ``` Software\Policies\Mozilla\Firefox\OfferToSaveLogins = 0x1 | 0x0 ``` +#### Windows (Intune) +OMA-URI: +``` +./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox/OfferToSaveLogins +``` +Value (string): +``` + or +``` #### macOS ``` @@ -2555,6 +2786,15 @@ Sets the default value of signon.rememberSignons without locking it. ``` Software\Policies\Mozilla\Firefox\OfferToSaveLoginsDefault = 0x1 | 0x0 ``` +#### Windows (Intune) +OMA-URI: +``` +./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox/OfferToSaveLoginsDefault +``` +Value (string): +``` + or +``` #### macOS ``` @@ -2616,6 +2856,16 @@ Override the upgrade page. If the value is blank, no upgrade page is displayed. ``` Software\Policies\Mozilla\Firefox\OverridePostUpdatePage = "http://example.org" ``` +#### Windows (Intune) +OMA-URI: +``` +./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox/OverridePostUpdatePage +``` +Value (string): +``` + + +``` #### macOS ``` @@ -2676,9 +2926,11 @@ Set permissions associated with camera, microphone, location, notifications, and `Locked` prevents the user from changing preferences for the feature. -**Compatibility:** Firefox 62, Firefox ESR 60.2 (Autoplay added in Firefox 74, Firefox ESR 68.6\ +`Default` specifies the default value for Autoplay. block-audio-video is not supported on Firefox ESR 68. + +**Compatibility:** Firefox 62, Firefox ESR 60.2 (Autoplay added in Firefox 74, Firefox ESR 68.6, Autoplay Default/Locked added in Firefox 76, Firefox ESR 68.8)\ **CCK2 Equivalent:** N/A\ -**Preferences Affected:** `permissions.default.camera`,`permissions.default.microphone`,`permissions.default.geo`,`permissions.default.desktop-notification` +**Preferences Affected:** `permissions.default.camera`,`permissions.default.microphone`,`permissions.default.geo`,`permissions.default.desktop-notification`,`media.autoplay.default` #### Windows (GPO) ``` @@ -2701,6 +2953,8 @@ Software\Policies\Mozilla\Firefox\Permissions\Notifications\BlockNewRequests = 0 Software\Policies\Mozilla\Firefox\Permissions\Notifications\Locked = 0x1 | 0x0 Software\Policies\Mozilla\Firefox\Permissions\Autoplay\Allow\1 = "https://example.org" Software\Policies\Mozilla\Firefox\Permissions\Autoplay\Block\1 = "https://example.edu" +Software\Policies\Mozilla\Firefox\Permissions\Autoplay\Default = "allow-audio-video" | "block-audio" | "block-audio-video" +Software\Policies\Mozilla\Firefox\Permissions\Autoplay\Locked = 0x1 | 0x0 ``` #### Windows (Intune) OMA-URI: @@ -2753,6 +3007,32 @@ Value (string): ``` +OMA-URI: +``` +./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~Permissions~Autoplay/Autoplay_Block +``` +Value (string): +``` + + +``` +OMA-URI: +``` +./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~Permissions~Autoplay/Autoplay_Default +``` +Value (string): +``` + + +``` +OMA-URI: +``` +./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~Permissions~Autoplay/Autoplay_Locked +``` +Value (string): +``` + or +``` #### macOS ``` @@ -2770,9 +3050,9 @@ Value (string): https://example.edu BlockNewRequests - + | Locked - + | Microphone @@ -2785,9 +3065,9 @@ Value (string): https://example.edu BlockNewRequests - + | Locked - + | Location @@ -2800,9 +3080,9 @@ Value (string): https://example.edu BlockNewRequests - + | Locked - + | Notifications @@ -2829,6 +3109,10 @@ Value (string): https://example.edu + Default + allow-audio-video | block-audio | block-audio-video + Locked + | @@ -2864,7 +3148,9 @@ Value (string): }, "Autoplay": { "Allow": ["https://example.org"], - "Block": ["https://example.edu"] + "Block": ["https://example.edu"], + "Default": "allow-audio-video" | "block-audio" | "block-audio-video", + "Locked": true | false } } } @@ -2890,6 +3176,32 @@ Software\Policies\Mozilla\Firefox\PopupBlocking\Allow\2 = "https://example.edu" Software\Policies\Mozilla\Firefox\PopupBlocking\Default = 0x1 | 0x0 Software\Policies\Mozilla\Firefox\PopupBlocking\Locked = 0x1 | 0x0 ``` +#### Windows (Intune) +OMA-URI: +``` +./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~Popups/PopupBlocking_Allow +``` +Value (string): +``` + + +``` +OMA-URI: +``` +./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~Popups/PopupBlocking_Default +``` +Value (string): +``` + or +``` +OMA-URI: +``` +./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~Popups/PopupBlocking_Locked +``` +Value (string): +``` + or +``` #### macOS ``` @@ -3018,7 +3330,7 @@ disabled |     If set to Select Automatically, Firefox automatically chooses the default personal certificate. | security.mixed_content.block_active_content | boolean | Firefox 70, Firefox ESR 68.2 | true |     If false, mixed active content (HTTP and HTTPS) is not blocked. -| security.osclientcerts.autoload | boolean | Firefox 72, Firefox ESR 68.4 (Windows only) | false +| security.osclientcerts.autoload | boolean | Firefox 72 (Windows), Firefox 75 (macOS) | false |     If true, client certificates are loaded from the operating system certificate store. | security.ssl.errorReporting.enabled | boolean | Firefox 68, Firefox ESR 68 | true |     If false, SSL errors cannot be sent to Mozilla. @@ -3076,6 +3388,15 @@ Ask where to save each file before downloading. ``` Software\Policies\Mozilla\Firefox\PromptForDownloadLocation = 0x1 | 0x0 ``` +#### Windows (Intune) +OMA-URI: +``` +./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox/PromptForDownloadLocation +``` +Value (string): +``` + or +``` #### macOS ``` @@ -3229,6 +3550,16 @@ or Software\Policies\Mozilla\Firefox\RequestedLocales = "de,en-US" ``` +#### Windows (Intune) +OMA-URI: +``` +./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox/RequestedLocalesString +``` +Value (string): +``` + + +``` #### macOS ``` @@ -3383,6 +3714,16 @@ Set whether or not search bar is displayed. ``` Software\Policies\Mozilla\Firefox\SearchBar = "unified" | "separate" ``` + +#### Windows (Intune) +OMA-URI: +``` +./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox/SearchBar +``` +Value (string): +``` + + #### macOS ``` @@ -3390,7 +3731,6 @@ Software\Policies\Mozilla\Firefox\SearchBar = "unified" | "separate" unified | separate ``` - #### policies.json ``` { @@ -3415,6 +3755,16 @@ Set the default search engine. This policy is only available on the ESR. ``` Software\Policies\Mozilla\Firefox\SearchEngines\Default = NAME_OF_SEARCH_ENGINE ``` +#### Windows (Intune) +OMA-URI: +``` +./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~Search/SearchEngines_Default +``` +Value (string): +``` + + +``` #### macOS ``` @@ -3488,6 +3838,16 @@ Hide built-in search engines. This policy is only available on the ESR. ``` Software\Policies\Mozilla\Firefox\SearchEngines\Remove\1 = NAME_OF_SEARCH_ENGINE ``` +#### Windows (Intune) +OMA-URI: +``` +./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~Search/SearchEngines_Remove +``` +Value (string): +``` + + +``` #### macOS ``` @@ -3545,7 +3905,23 @@ Software\Policies\Mozilla\Firefox\SearchEngines\Add\1\Description = "Example Des Software\Policies\Mozilla\Firefox\SearchEngines\Add\1\SuggestURLTemplate = "https://www.example.org/suggestions/q={searchTerms}" Software\Policies\Mozilla\Firefox\SearchEngines\Add\1\PostData = "name=value&q={searchTerms}" ``` - +#### Windows (Intune) +OMA-URI: +``` +./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~Search/SearchEngines_1 +``` +Value (string): +``` + + + + + + + + + +``` #### macOS ``` @@ -3608,6 +3984,15 @@ Enable search suggestions. ``` Software\Policies\Mozilla\Firefox\SearchSuggestEnabled = 0x1 | 0x0 ``` +#### Windows (Intune) +OMA-URI: +``` +./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox/SearchSuggestEnabled +``` +Value (string): +``` + or +``` #### macOS ``` @@ -3635,6 +4020,16 @@ Install PKCS #11 modules. ``` Software\Policies\Mozilla\Firefox\SecurityDevices\NAME_OF_DEVICE = PATH_TO_LIBRARY_FOR_DEVICE ``` +#### Windows (Intune) +OMA-URI: +``` +./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox/SecurityDevices +``` +Value (string): +``` + + +``` #### macOS ``` @@ -3668,6 +4063,16 @@ Set and lock the maximum version of TLS. ``` Software\Policies\Mozilla\Firefox\SSLVersionMax = "tls1" | "tls1.1" | "tls1.2" | "tls1.3" ``` +#### Windows (Intune) +OMA-URI: +``` +./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox/SSLVersionMax +``` +Value (string): +``` + + +``` #### macOS ``` @@ -3735,6 +4140,18 @@ Software\Policies\Mozilla\Firefox\SupportMenu\Title = "Support Menu" Software\Policies\Mozilla\Firefox\SupportMenu\URL = "http://example.com/support" Software\Policies\Mozilla\Firefox\SupportMenu\AccessKey = "S" ``` +#### Windows (Intune) +OMA-URI: +``` +./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox/SupportMenu +``` +Value (string): +``` + + + + +``` #### macOS ``` @@ -3784,6 +4201,18 @@ Software\Policies\Mozilla\Firefox\UserMessaging\ExtensionRecommendations = 0x1 | Software\Policies\Mozilla\Firefox\UserMessaging\FeatureRecommendations = 0x1 | 0x0 Software\Policies\Mozilla\Firefox\UserMessaging\UrlbarInterventions = 0x1 | 0x0 ``` +#### Windows (Intune) +OMA-URI: +``` +./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox/UserMessaging_WhatsNew +./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox/UserMessaging_ExtensionRecommendations +./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox/UserMessaging_FeatureRecommendations +./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox/UserMessaging_UrlbarInterventions +``` +Value (string): +``` + or +``` #### macOS ``` @@ -3825,6 +4254,25 @@ Block websites from being visited. The parameters take an array of Match Pattern Software\Policies\Mozilla\Firefox\WebsiteFilter\Block\1 = "" Software\Policies\Mozilla\Firefox\WebsiteFilter\Exceptions\1 = "http://example.org/*" ``` +#### Windows (Intune) +OMA-URI: +``` +./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox/B_WebsiteFilter_Block +``` +Value (string): +``` + + +``` +OMA-URI: +``` +./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox/B_WebsiteFilter_Exceptions +``` +Value (string): +``` + + +``` #### macOS ```