Firefox

Enable policy support on macOS.

—

—

—

—

Enable or disable automatic application update in the background, when the application is not running. If set to true, application updates may be installed (without user approval) in the background, even when the application is not running. The operating system might still require approval.

Enable or disable automatic application update.

Change the URL for application update.

Configure sites that support integrated authentication.

Block access to the Add-ons Manager (about:addons).

Block access to about:config.

Block access to About Profiles (about:profiles).

Block access to Troubleshooting Information (about:support).

Add bookmarks in either the bookmarks toolbar or menu.

Set the default download directory.

Turn off application updates.

Disable the built in PDF viewer. PDF files are downloaded and sent externally.

Disable or configure PDF.js, the built-in PDF viewer.

Remove access to all developer tools.

Disable the menus for reporting sites (Submit Feedback, Report Deceptive Site).

Disable Firefox Accounts integration (Sync).

Remove access to Firefox Screenshots.

Disable Firefox studies (Shield).

Disable the "Forget" button.

Remove the master password functionality. If this preference is set to true, the master password functionality is removed.

Require or prevent using a primary (formerly master) password. If this value is true, a primary password is required.

Remove Pocket in the Firefox UI.

Remove access to private browsing.

Disables the "Import data from another browser" option in the bookmarks window.

Disable the Refresh Firefox button on about:support and support.mozilla.org, as well as the prompt that displays offering to refresh Firefox when you haven't used it in a while.

Disable safe mode within the browser.

This preference removes the "Set As Desktop Background..." menu item when right clicking on an image.

Set the initial state of the menubar. A user can still hide it and it will stay hidden.

Prevent system add-ons from being installed or update.

Set the initial state of the bookmarks toolbar. A user can still hide it and it will stay hidden.

Don't check if Firefox is the default browser at startup.

Set and lock the download directory.

Control the installation, uninstallation and locking of extensions. Locked extensions cannot be disabled or uninstalled. For Install, you specify a list of URLs or paths. For Uninstall and Locked, you specify extension IDs.

Manage all aspects of extensions. A default configuration can be set for the special ID "*", which will apply to all extensions that don't have a custom configuration set in this policy.

—

Configure third party components.

Enable or disable Encrypted Media Extensions and optionally lock it.

Control hardware acceleration.

Customize the Firefox Home page.

Configure generative AI features

Configure the default homepage and how Firefox starts.

Show the home button on the toolbar.

Enable linking to local files by origin

Enable or disable the New Tab page.

Disable the creation of default bookmarks.

Override the first run page. If the value is blank, no first run page is displayed. Starting with Firefox 83, Firefox ESR 78.5, you can also specify multiple URLS separated by a vertical bar (|).

Override the upgrade page. If the value is blank, no upgrade page is displayed.

Enable or disable Picture-in-Picture.

Ask where to save each file before downloading.

Set the the list of requested locales for the application in order of preference. It will cause the corresponding language pack to become active.

Clear data on shutdown. Choose from Cache, Cookies, Download History, Form & Search History, Browsing History, Active Logins, Site Preferences and Offline Website Data.

Set whether or not search bar is displayed.

Set whether or not search bar is displayed.

Enable search suggestions.

Configure default application handlers. This policy is based on the internal format of handlers.json. You can configure handlers based on a mime type (mimeTypes), a file's extension (extensions), or a protocol (schemes).

Disable specific cryptographic ciphers. This policy was updated in Firefox 78 to allow enabling ciphers as well. Setting the value to true disables the cipher, setting the value to false enables the cipher. Previously setting the value to true or false disabled the cipher.

Configure DNS over HTTPS.

Configure proxy settings. These settings correspond to the connection settings in Firefox preferences. To specify ports, append them to the hostnames with a colon (:).

—

—

Enable or disable network prediction (DNS prefetching).

Configure cookie preferences.

Turn off saving information on web forms and the search bar.

Do not allow passwords to be shown in saved logins

Prevent the upload of telemetry data.

Configure tracking protection. If this policy is not configured, tracking protection is not enabled by default in the browser, but it is enabled by default in private browsing and the user can change it.

Configure the default Flash plugin policy as well as origins for which Flash is allowed.

Configure the default extension install policy as well as origins for extension installs are allowed.

Control whether or not Firefox offers to save passwords.

Sets the default value of signon.rememberSignons without locking it.

Remove access to the password manager via preferences and blocks about:logins on Firefox 70.

Set permissions associated with camera, microphone, location, notifications, and autoplay.

Configure the default pop-up window policy as well as origins for which pop-up windows are allowed.

Trust certificates that have been added to the operating system certificate store by a user or administrator in the macOS Keychain.

Prevent the user from bypassing security in certain cases.

Install PKCS #11 modules.

Prevent installing search engines from webpages.

Enable default legacy SameSite cookie behavior setting.

Revert to legacy SameSite behavior for cookies on specified sites.

Block websites from being visited. The parameters take an array of Match Patterns, as documented in https://developer.mozilla.org/en-US/Add-ons/WebExtensions/Match_patterns. http/https addresses are supported as well as local file:// URLs. The arrays are limited to 1000 entries each.

Comma-separated list of domains allowed to access Google Workspace. This policy is based on the Chrome policy of the same name. If this policy is enabled, users can only access Google Workspace using accounts from the specified domains. If you want to allow Gmail, you can add 'consumer_accounts' to the list.

Comma-separated list of domains allowed to access Google Workspace. This policy is based on the Chrome policy of the same name. If this policy is enabled, users can only access Google Workspace using accounts from the specified domains. If you want to allow Gmail, you can add 'consumer_accounts' to the list.

Enable or disable the detection of captive portals.

Set and lock certain preferences.

Adds a menuitem to the help menu for specifying support information.

If this policy is set to true, Firefox will use credentials stored in the Company Portal to sign in to Microsoft Entra accounts. Affects `network.http.microsoft-entra-sso.enabled`.

If this preference is enabled, the specified websites are permitted to engage in SPNEGO authentication with the browser. Entries in the list are formatted as mydomain.com or https://myotherdomain.com. If this preference is disabled or not configured, no websites are permitted to engage in SPNEGO authentication with the browser. For more information, see https://developer.mozilla.org/en-US/docs/Mozilla/Integrated_authentication.

If this preference is enabled, the browser may delegate user authorization to the server for the specified websites. Entries in the list are formatted as mydomain.com or https://myotherdomain.com. If this preference is disabled or not configured, the browser will not delegate user authorization to the server for any websites. For more information, see https://developer.mozilla.org/en-US/docs/Mozilla/Integrated_authentication

If this preference is enabled, the specified websites are trusted to use NTLM authentification. Entries in the list are formatted as mydomain.com or https://myotherdomain.com. If this policy is disabled or not configured, no websites are trusted to use NTLM authentification. For more information, see https://developer.mozilla.org/en-US/docs/Mozilla/Integrated_authentication.

If this preference is enabled, you can always allow SPNEGO or NTLM on non FQDNs (fully qualified domain names). If this preference is disabled or not configured, NTLM and SPNEGO are not enabled on non FQDNs.

If this preference is enabled, you can always allow SPNEGO or NTLM on non FQDNs (fully qualified domain names). If this preference is disabled or not configured, NTLM and SPNEGO are not enabled on non FQDNs.

—

Enables integrated authentication in prviate browsing

—

—

—

—

—

—

—

—

Bookmark Title

Full URL to be bookmarked (e.g. https://www.example.org/)

Place bookmark in either the Bookmark menu or Bookmark Toolbar.

URL to icon file to display on bookmark (e.g. https://www.example.org/favicon.ico)

Folder to place bookmark in. If a folder is specified, it is automatically created and bookmarks with the same folder name are grouped together. You cannot nest folders.

If Enabled is set to false, the built-in PDF viewer is disabled.

If EnablePermissions is set to true, the built-in PDF viewer will honor document permissions like preventing the copying of text.

A list of URLs or native paths for extensions to be installed.

A list of extension IDs that should be uninstalled if found.

A list of extension IDs that the user cannot disable or uninstall.

—

—

—

—

—

Maps to a string indicating the installation mode for the extension.

Maps to a string indicating where Firefox can download a force_installed or normal_installed extension. If installing from the addons.mozilla.org, use the following URL (substituting SHORT_NAME from the URL on AMO), https://addons.mozilla.org/firefox/downloads/latest/SHORT_NAME/latest.xpi. If installing from the local file system, use a file:/// URL. Languages packs are available from https://releases.mozilla.org/pub/firefox/releases/VERSION/PLATFORM/xpi/LANGUAGE.xpi.

Each item in this list is an extension-style match pattern.

This setting allowlists the allowed types of extension/apps that can be installed in Firefox.

This maps to a string specifying the error message to display to users if they're blocked from installing an extension.

An array of domains on which content scripts can't be run.

Indicates whether or not to disable automatic updates for an individual extension.

—

—

—

Configure third party extensions. Keys in this dictionary specify IDs of extensions to configure, and values are dictionaries containing each third party extension configuration.

—

—

If Enabled is set to false, encrypted media extensions (like Widevine) are not downloaded by Firefox unless the user consents to installing them.

If Locked is set to true and Enabled is set to false, Firefox will not download encrypted media extensions (like Widevine) or ask the user to install them.

—

—

—

—

—

—

—

—

Controls whether generative AI features are enabled by default

Controls access to AI chatbots in the sidebar

Controls whether AI is used to generate link previews

Controls whether AI is used to suggest names and tabs for tab groups

Prevents the user from changing generative AI preferences

Optional. Set the default home page.

Optional. Set additional homepages.

Optional. This preference sets what displays when Firefox starts. It can be the homepage, the previous session, or a blank page.

If true, prevents the user from changing homepage preferences.

—

—

—

—

Action

—

—

—

—

—

—

—

—

—

Set the default search engine. This policy is only available on the ESR.

Prevent installing search engines from webpages. This policy is only available on the ESR.

Hide built-in search engines. This policy is only available on the ESR.

Add new search engines. This policy is only available on the ESR.

—

—

Name of the search engine

—

—

URL for the icon to use

keyword to use for the engine

Description of the search engine.

POST data as name value pairs separated by '&'

Search suggestions URL with {searchTerms} to substitute for the search term.

The query charset for the engine.

Specify MIME types. More info here: https://developer.mozilla.org/en-US/docs/Web/HTTP/Basics_of_HTTP/MIME_types

—

—

https://developer.mozilla.org/en-US/docs/Web/HTTP/Basics_of_HTTP/MIME_types

—

Can be either saveToDisk, useHelperApp, useSystemDefault.

If true, the user is asked if what they want to do with the file. If false, the action is taken without user intervention.

Can be either saveToDisk, useHelperApp, useSystemDefault.

If true, the user is asked if what they want to do with the file. If false, the action is taken without user intervention.

An array of handlers with the first one being the default. If you don't want to have a default handler, use an empty object for the first handler. Choose between path or uriTemplate.

—

The display name of the handler (might not be used).

The native path to the executable to be used.

A url to a web based application handler. The URL must be https and contain a %s to be used for substitution.

Can be either saveToDisk, useHelperApp, useSystemDefault.

If true, the user is asked if what they want to do with the file. If false, the action is taken without user intervention.

An array of handlers with the first one being the default. If you don't want to have a default handler, use an empty object for the first handler. Choose between path or uriTemplate.

—

The display name of the handler (might not be used).

The native path to the executable to be used.

A url to a web based application handler. The URL must be https and contain a %s to be used for substitution.

—

—

—

—

—

—

—

—

—

—

—

Enable DNS over HTTPS.

URL to an alternative DNS over HTTPS provider.

If this is true, DNS over HTTPS preferences cannot be changed.

List of excluded domains from DNS over HTTPS.

—

If this preference is enabled, you will be setting the proxy mode.

If this preference is enabled, Proxy preferences cannot be changed.

If this preference is enabled, do not prompt for authentication if password is saved.

If this preference is enabled, you will use Proxy DNS when using SOCKS v5.

HTTP Proxy URL.

If this preference is enabled, use the HTTP proxy server for all protocols.

SSL Proxy URL.

FTP Proxy URL.

SOCKS Proxy URL.

Select SOCKS Version.

Proxy bypass URLs.

Proxy bypass URLs.

A list of origins (not domains) where cookies are always allowed.

A list of origins (not domains) where cookies are only allowed for the current session.

A list of origins (not domains) where cookies are always blocked.

This has been added replacing the existing options Default, AcceptThirdParty, and RejectTracker.

—

This sets the default value for "Accept cookies from websites".

This sets the default value for "Accept third-party cookies".

This determines when cookies expire.

Only reject trackers.

If this is true, cookies preferences cannot be changed.

—

—

—

If Value is set to false, tracking protection is disabled and locked in both the regular browser and private browsing. If Value is set to true, tracking protection is enabled by default in both the regular browser and private browsing.

If this is true, Tracking Protection preferences cannot be changed.

If Cryptomining is set to true, cryptomining scripts on websites are blocked.

If Fingerprinting is set to true, fingerprinting scripts on websites are blocked.

If this preference is enabled, sites on the allow list do not override Flash being completely disabled. Flash is activated by default for the domains indicated unless Flash is completely disabled. If a top level domain is specified (http://example.org), Flash is allowed for all subdomains as well.

If this preference is enabled, Flash is blocked for the domains indicated. If a top level domain is specified (http://example.org), Flash is blocked from all subdomains as well.

If this is true, Flash preferences cannot be changed. If this is false, Flash is never activated on websites even if they are in the specified in the Allow list.

If this is true, Flash preferences cannot be changed.

—

—

If this preference is enabled, add-ons are always allowed for the domains indicated unless add-on install is disabled. If a top level domain is specified (http://example.org), add-ons are allowed for all subdomains as well.

If this is set to false, add-ons cannot be installed by the user.

—

This preference allows you to change the camera permissions.

This preference allows you to change the microphone permissions.

This preference allows you to change the location permissions.

This preference allows you to change the notifications permissions.

This preference allows you to change the autoplay permissions.

This preference allows you to change the virtual reality permissions.

If this preference is enabled, access to the camera is always allowed for the domains indicated. If this preference is disabled or not configured, the default camera preference is followed.

If this preference is enabled, access to the camera is blocked for the domains indicated. If this preference is disabled or not configured, access to the camera is not blocked by default.

If this preference is enabled, sites that are not in the Allow preference will not be allowed to ask permission to access the camera. If this preference is disabled or not configured, any site that is not in the Block preference can ask permission to access the camera.

If this preference is enabled, camera preferences cannot be changed by the user. If this preference is disabled or not configured, the user can change their camera preferences.

—

—

If this preference is enabled, access to the microphone is always allowed for the domains indicated. If this preference is disabled or not configured, the default microphone preference is followed.

If this preference is enabled, access to the microphone is blocked for the domains indicated. If this preference is disabled or not configured, access to the microphone is not blocked by default.

If this preference is enabled, sites that are not in the Allow preference will not be allowed to ask permission to access the microphone. If this preference is disabled or not configured, any site that is not in the Block preference can ask permission to access the microphone.

If this preference is enabled, microphone preferences cannot be changed by the user. If this preference is disabled or not configured, the user can change their microphone preferences.

—

—

If this preference is enabled, access to location is always allowed for the domains indicated. If this preference is disabled or not configured, the default location preference is followed.

If this preference is enabled, access to location is blocked for the domains indicated. If this preference is disabled or not configured, access to location is not blocked by default.

If this preference is enabled, sites that are not in the Allow preference will not be allowed to ask permission to access location. If this preference is disabled or not configured, any site that is not in the Block preference can ask permission to access the location.

If this preference is enabled, location preferences cannot be changed by the user. If this preference is disabled or not configured, the user can change their location preferences.

—

—

If this preference is enabled, notifications can always be sent for the domains indicated. If this preference is disabled or not configured, the default nofication preference is followed.

If this preference is enabled, notifications are always blocked for the domains indicated. If this preference is disabled or not configured, notifications are not blocked by default.

If this preference is enabled, sites that are not in the Allow preference will not be allowed to ask permission to send notifications. If this preference is disabled or not configured, any site that is not in the Block preference can ask permission to send notifications.

If this preference is enabled, notification preferences cannot be changed by the user. If this preference is disabled or not configured, the user can change their notification preferences.

—

—

If this preference is enabled, autoplay can always be enabled for the domains indicated. If this preference is disabled or not configured, the default autoplay preference is followed.

If this preference is enabled, autoplay are always blocked for the domains indicated. If this preference is disabled or not configured, autoplay is not blocked by default.

Configures the default Autoplay behavior.

If this preference is enabled, autoplay preferences cannot be changed by the user. If this preference is disabled or not configured, the user can change their autoplay preferences.

—

—

If this preference is enabled, access to virtual reality is always allowed for the domains indicated. If this preference is disabled or not configured, the default virtual reality preference is followed.

If this preference is enabled, access to virtual reality is blocked for the domains indicated. If this preference is disabled or not configured, access to the virtual reality is not blocked by default.

If this preference is enabled, sites that are not in the Allow preference will not be allowed to ask permission to access virtual reality. If this preference is disabled or not configured, any site that is not in the Block preference can ask permission to access virtual reality.

If this preference is enabled, virtual reality preferences cannot be changed by the user. If this preference is disabled or not configured, the user can change their virtual reality preferences.

—

—

Specify the domains for which pop-up windows are always allowed. If a top level domain is specified (http://example.org), pop-up windows are allowed for all subdomains as well.

If this is false, pop-up windows are allowed by default.

If this is true, pop-up blocking preferences cannot be changed.

—

If this preference is enabled, Firefox will read certificates from the macOS keychain. If this preference is disabled or not configured, Firefox will not read certificates from the macOS keychain.

If this preference is enabled, Firefox will install the listed certificates. It will look in /Library/Application Support/Mozilla/Certificates and ~/Library/Application Support/Mozilla/Certificates. If this preference is disabled or not configured, Firefox will not install additional certificates. Starting in Firefox 65, you can specify a fully qualified path (e.g. /Library/Company/cer1.der). If Firefox does not find something at your fully qualified path, it will search the default directories.

—

Prevents adding an exception when an invalid certificate is shown. If this preference is enabled, the "Add Exception" button is not available when a certificate is invalid. This prevents the user from overriding the certificate error. If this preference is disabled or not configured, certificate errors can be overridden.

Prevents selecting "ignore the risk" and visiting a harmful site anyway. If this preference is enabled, a user cannot bypass the warning and visit a harmful site. If this preference is disabled or not configured, a user can choose to visit a harmful site.

—

—

If enabled, remove the "What's New" icon and menuitem.

If enabled, don't recommend extensions.

If enabled, don't recommend browser features.

If enabled, don't show onboarding messages on the new tab page.

If enabled, don't offer Firefox specific suggestions in the URL bar.

—

If this preference is enabled, you can specify match patterns that indicate sites to be blocked. The match patterns are documented at https://developer.mozilla.org/en-US/Add-ons/WebExtensions/Match_patterns. Only http/https addresses are supported at the moment. There is a 1000 entry limit. If this preference is disabled or not configured, no websites are blocked.

If this preference is enabled, and the website filter is enabled, you can specify match patterns for sites you do not want to block. The match patterns are documented at https://developer.mozilla.org/en-US/Add-ons/WebExtensions/Match_patterns. Only http/https addresses are supported at the moment. There is a 1000 entry limit. If this preference is disabled or not configured, there are no exceptions to the website filter.

—

—

—

The protocol to allow for specified URLs.

The protocol to allow for specified URLs.

—

If set to 1, platform accessibility is disabled.

If false, Firefox doesn't automatically install update.

If true, bookmarks are exported on shutdown.

If set, the name of the file where bookmarks are exported and imported.

If true, bookmarks are restored to their defaults.

If false, don't store cache on the hard drive.

If set, changes the location of the disk cache.

If true, single words are sent to DNS, not directly to search.

If set, a list of URLs to use as the default top sites on the new tab page.

If true, bookmarks are always imported on startup.

If false, malware protection is not enabled (Not recommended)

If false, phishing protection is not enabled (Not recommended)

If false, updates for search engines are not checked.

If true, a notification isn't shown if startup is slow.

If false, there is no warning when the browser is closed.

If true, tab previews are shown in the Windows taskbar.

If false, bookmarks aren't suggested when typing in the URL bar.

If false, history isn't suggested when typing in the URL bar.

If false, open tabs aren't suggested when typing in the URL bar.

If true, don't show the privacy policy tab on first run.

If false, web page can close windows.

If false, web pages can focus and activate windows.

If true, web pages can't move or resize windows.

If false, web pages can't override context menus.

See https://support.mozilla.org/en-US/kb/dom-events-changes-introduced-firefox-66

See https://support.mozilla.org/en-US/kb/dom-events-changes-introduced-firefox-66

If false, the extensions blocklist is not used (Not recommended)

If false, the Recommendations tab is not displayed in the Add-ons Manager.

If false, recommendations are not shown on the Extensions tab in the Add-ons Manager.

If false, the geolocation API is disabled.

If set, preferred language for web pages.

If false, Encrypted Media Extensions are not enabled.

If false, the OpenH264 plugin is not downloaded.

If false, the Widevine plugin is not downloaded.

If false, WebRTC is disabled

If set, a list of domains for which mDNS hostname obfuscation is disabled.

If true, IPv6 DNS lokoups are disabled.

If true, display the punycode version of internationalized domain names.

If false, history is not enabled.

If false, print settings are not saved between jobs.

If set to "Select Automatically", Firefox automatically chooses the default personal certificate. Other possible option is "Ask Every Time".

If false, mixed active content (HTTP and HTTPS) is not blocked.

If true, client certificates are loaded from the operating system certificate store.

If false, SSL errors cannot be sent to Mozilla.

If false, the TLS 1.3 downgrade check is disabled.

If false, TLS early data is turned off.

If true, browser will accept TLS 1.0. and TLS 1.1.

If set, overrides the GTK theme for widgets.

—

—

—

—

—