Firefox for Enterprise Support Forum

We are taking advantage of the Mozilla.cfg and PrefLock and that works great! Now I am looking for a way to lock down the Applications set in Firefox and I don't seem to be having any luck doing so.

Goal is to lock down the Applications section In Firefox under "General" (See the screenshot). Its currently set to a few default applications we use. These settings seem to change at random depending on user actions, or after browser updates. Is there any way to lock them in place once the settings are set? Would like the settings to stick and we don't want users to have do to anything. Example: If Adobe is set for PDF's, I just want it to always open in Adobe. Maybe grey out the section or something so it cannot be changed if possible.

Thanks!

I have created GPOs to block websites. Edge and Chrome work as expected but the Firefox Block Websites is not blocking anything. I have tried User and Computer GPO's they do not work. Does anyone know the trick to making this work for Firefox?

Hi I need to know how to deploy firefox via intune. LOB or windows app(win32) is the best way to deploy firefox? Once we deploy this,how we can enable auto update of firefox? Is there an option to enable auto update of firefox in all windows devices where the firefox is installed by the users manually from internet sites(different versions) not from intune. Waiting for the response. Thank you

Hello, I use on 90 computers Mozilla Firefox, v.89. In need to stop update and update notifications. I understand the benefits of an updated version, but I need to keep a version without updates, for a time. Update notifications confuse PC operators working on stations with limited users. Thank you.

Dear community,

we are an international Non-for profit organization with mostly small offices of about 2-10 staff on 3 continents. The majority of those offices does not have IT staff/knowledge, and infrastructure is often sketchy. We use mostly Windows, but have some offices with Linux. We currently use local users, and after an initial configuration of e.g. Firefox/Thunderbird, we don't have any way to intervene automatically.

So we are looking for an efficient way to control software configurations after deployment without the need for manual intervention. The scope would initially not be a lot, mostly installing/uninstalling addons. E.g. if a malicious addon is found, we want to have a way to uninstall it on all devices. Right now, we have to ask all staff to do this, and evidently this doesn't work out all the time.

Firefox and Thunderbird are 2 key programs installed on all devices, although evidently we use other software as well. I think that with TB78 the policies.json implementation might not be yet finished completely, but for now, Firefox would be more critical (also some staff tend to install addons we do not want on the device).

As far as I know, when it comes ways how to centrally manage Firefox/Thunderbird without a domain controller/GPO, there are some options:

1) Azure AD: Identity management, and maybe also ways to configure Thunderbird/Firefox (although Azure AD does not seem to have GPO, but maybe scripts could be executed at the endpoint?). Won't work for Linux I guess. Also Azure could be based in a US datacenter, and as an European NGO we have much less data protection for US-based data.

2) third party management tool (e.g. like Teamviewer remote management, or chocolately) which allows remote execution of scripts. We could update the policies.json file in the firefox profile via a chocolately/Teamviewer script to uninstall/install addons, etc. Not sure if chocolately works on Linux.

3) GPOs with Domain Controller after all via a pre-auth VPN. Won't work for Linux I guess, but maybe script to deploy policies.json. Also there would be yet another thing to potentially fail (VPN connection), and we would need 2 different deployment methods (GPO for Windows, scripts for Linux).

4) write an Firefox/Thunderbird addon which simply downloads a policies.json file from a central location, and places it in the users FF/TB profile folder. upon restart of FF/TB it should deploy the changes based on the new policies.json file. A bit cumbersome, and doesn't cover other software.

5) a simple bat/sh script which is executed upon start.

To me, it seems a third party tool (teamviewer, chocolately) seems the best option, as it could cover FF/TB, but also other software which is installed.

Before we proceed I would like to know of experiences, and best practices: could anybody provide some information how this was achieved?

kind regards,

Has anything changed in Mozilla Maintenance Service in regards to security required for the logged on user in order for Mozilla updates to be installed? We do not allow our users local admin rights, but instead they have an application where they can request admin rights when needed, and with the release of Firefox 89, we are seeing peoples Mozilla products disappear. In the logs it looks like an update is being made, and once the old version has been deleted, the new version fails to install.