DEV Community

Weather Clock Dash
Weather Clock Dash

Posted on

Firefox Enterprise Deployment: Policies, Group Policy, and Configuration Management

#firefox #sysadmin #security #enterprise

If you're deploying Firefox in an enterprise environment, Firefox has a mature policy management system that most IT admins don't know about. Here's how it works.

The enterprise.cfg and policies.json Approach

Firefox supports two ways to enforce settings at the organization level:

1. policies.json — JSON configuration file in the Firefox application directory
2. enterprise.cfg + mozilla.cfg — Legacy JavaScript-based configuration

For most deployments, policies.json is the modern approach.

policies.json Location

Place the file here based on OS:

Linux: /usr/lib/firefox/distribution/policies.json or /etc/firefox/policies/policies.json

macOS: Firefox.app/Contents/Resources/distribution/policies.json

Windows: C:\Program Files\Mozilla Firefox\distribution\policies.json or via Group Policy (ADMX templates)

Basic policies.json Structure 

{
  "policies": {
    "BlockAboutConfig": false,
    "DisableTelemetry": true,
    "EnableTrackingProtection": {
      "Value": true,
      "Locked": true,
      "Cryptomining": true,
      "Fingerprinting": true
    },
    "DNSOverHTTPS": {
      "Enabled": true,
      "ProviderURL": "https://1.1.1.1/dns-query",
      "Locked": false
    }
  }
}
Enter fullscreen mode Exit fullscreen mode

Commonly Used Policies

Disable Telemetry 

"DisableTelemetry": true
Enter fullscreen mode Exit fullscreen mode

Stops Firefox from sending usage data to Mozilla. Important for regulated environments.

Enforce HTTPS-Only Mode 

"HttpsOnlyMode": "enabled"
Enter fullscreen mode Exit fullscreen mode

Options: "enabled", "force_enabled", "disabled". Use force_enabled to prevent users from overriding.

Control Extension Installation 

"ExtensionSettings": {
  "*": {
    "blocked_install_message": "Contact IT to install extensions",
    "installation_mode": "blocked"
  },
  "uBlock0@raymondhill.net": {
    "installation_mode": "force_installed",
    "install_url": "https://addons.mozilla.org/firefox/downloads/file/4261129/ublock_origin.xpi"
  }
}
Enter fullscreen mode Exit fullscreen mode

This blocks all extension installation except uBlock Origin, which is force-installed.

Set Homepage and New Tab 

"Homepage": {
  "URL": "https://intranet.company.com",
  "Locked": false,
  "StartPage": "homepage"
},
"NewTabPage": false
Enter fullscreen mode Exit fullscreen mode

Pre-configure Bookmarks 

"Bookmarks": [
  {
    "Title": "Company Intranet",
    "URL": "https://intranet.company.com",
    "Favicon": "https://intranet.company.com/favicon.ico",
    "Placement": "toolbar",
    "Folder": "Work"
  }
]
Enter fullscreen mode Exit fullscreen mode

Certificate Management 

"Certificates": {
  "ImportEnterpriseRoots": true
}
Enter fullscreen mode Exit fullscreen mode

Imports OS certificate store — critical for organizations with internal CA certificates.

Or install specific certs:

"Certificates": {
  "Install": [
    "company-root-ca.pem"
  ]
}
Enter fullscreen mode Exit fullscreen mode

Proxy Configuration 

"Proxy": {
  "Mode": "pac_script",
  "AutoConfigURL": "http://proxy.company.com/proxy.pac",
  "Locked": true
}
Enter fullscreen mode Exit fullscreen mode

Disable Password Manager 

"PasswordManagerEnabled": false
Enter fullscreen mode Exit fullscreen mode

For environments using a separate password manager.

Windows Group Policy (ADMX Templates)

For Windows deployments, Mozilla provides ADMX templates:

  1. Download from Mozilla's GitHub
  2. Copy firefox.admx to C:\Windows\PolicyDefinitions
  3. Copy firefox.adml to C:\Windows\PolicyDefinitions\en-US
  4. Configure in Group Policy Editor (gpedit.msc or domain GPMC)

Group Policy settings override user settings and integrate with Active Directory deployment.

Linux (Flatpak/Snap/Native)

System-wide native install: Use /etc/firefox/policies/policies.json

Snap: Different path; many enterprise policies don't apply to Snap Firefox. Prefer the native Firefox package for enterprise deployment.

Flatpak: Policies can be placed at ~/.var/app/org.mozilla.firefox/.mozilla/firefox/policies.json per-user, but system-wide enforcement requires additional configuration.

Recommendation for enterprise Linux: Use the native Mozilla-distributed package (.deb/.rpm), not the distro package or Snap/Flatpak, for full policy support.

Verifying Policies Are Applied

Navigate to about:policies in Firefox to see all currently active policies and their values. Shows "active" vs "inactive" and source (GPO, JSON file, etc.).

The Policy Reference

Mozilla maintains a full Firefox Enterprise Policy documentation on GitHub with every available policy, its options, and examples. This is the definitive reference — it's updated with each Firefox release.

ESR (Extended Support Release)

For enterprise environments, consider Firefox ESR:

  • Maintained for ~1 year (vs 4 weeks for release)
  • Same security patches, deferred feature updates
  • Reduces compatibility risk from browser updates
  • Download: https://www.mozilla.org/en-US/firefox/enterprise/

ESR versions align with major Firefox releases. The current ESR (Firefox 128 ESR as of late 2024) is supported until Firefox 140 ESR ships.

What Firefox Can't Do in Enterprise

  • No Active Directory Kerberos SSO out of the box (unlike IE/Edge)
  • Installing enterprise certificate authority requires explicit policy
  • Some internal web apps targeting IE or Chrome may have compatibility issues
  • Remote desktop / Citrix scenarios need per-user profile configuration

Firefox is a solid enterprise browser, particularly for Linux environments where alternatives are limited.

Top comments (0)