How is Firefox for Enterprise different from normal Firefox?

Mozilla offers two ways to use Firefox in an organization:

• Firefox and Firefox ESR: the conventional way to configure Firefox browsers across an organization with enterprise policies and the tools described below.
• Firefox Enterprise is a paid product for organizations with strict security, governance and compliance requirements. It adds an Admin Console that you run on your own infrastructure, along with security controls that aren't available in Firefox.

Firefox and Firefox ESR

You can choose either Firefox or the Firefox Extended Support Release (ESR) channel, which has longer support cycles. To pick the one that best matches your needs, see Choose a Firefox update channel.

To deploy and configure Firefox across your organization, you can use:

• MSI installers: a Mozilla-signed MSI wrapper of the full installer, to simplify deployments with Active Directory. See Deploy Firefox with MSI installers.
• ADM and ADMX templates (Windows): manage Firefox with Group Policy. See Customize Firefox using Group Policy (Windows).
• plist templates (macOS): manage Firefox policies on macOS. See Manage policies on macOS desktops.
• policies.json: a configuration file that works on Windows, macOS and Linux, if Group Policy or plist files don't suit your needs. See Customize Firefox using policies.json.
• Update policies: turn on automatic updates, force Firefox to relaunch to install an update, pin Firefox to a version, or point at your own update server. See Device update settings.

For the full list of policies, see the Firefox Admin Docs.

Firefox Enterprise

Firefox Enterprise is built for organizations with strict security, governance, and compliance requirements. It combines the familiar Firefox browser with additional security controls and a management console that organizations can run on their own infrastructure. IT teams can use the console to centrally configure browser policies, manage access to web applications, control how sensitive data is shared, and govern the use of AI tools.

Firefox Enterprise provides the following capabilities beyond what's available in Firefox and Firefox ESR with enterprise policies:

Central management

• A visual, form-driven policy editor in the Admin Console, so you don't have to edit JSON policy files by hand.
• Policies that you can assign to your whole organization, an organizational unit or an individual user.
• Many policy changes can apply while browsers are running, without a browser restart.
• The option to make the Admin Console the only source of policies, ignoring any set locally on the device.
• Control over which releases run across your deployment, including a required minimum version.

Sign-in and access

• Company sign-in: employees sign in with your organization's single sign-on before the browser opens. Firefox Enterprise works with any OpenID Connect (OIDC) identity provider, including the multi-factor authentication your provider requires.
• Sign-out and session lock rules: choose whether employees are signed out when Firefox Enterprise closes, restarts or crashes.
• Remote sign-out: sign out a user or device from the Admin Console, for example if a laptop is lost or stolen.
• Device posture checks: browsers report device security details to the Admin Console, such as disk encryption, endpoint security software and Active Directory domain membership. You can require a specific posture before employees sign in, and Firefox Enterprise signs them out if their device stops meeting it.
• Access connector: employees can reach your internal web apps without a VPN, even from a personal device.

Data protection

• Data loss prevention: block or warn about pasting, file uploads, downloads and printing on the websites you choose, with a message you write. All checks run in the browser on the device, so content is never sent over the network to be inspected.
• Watermarks: stamp text such as the employee's email address and the time across sensitive pages.
• Lockdown mode: apply extra protections to specific websites without a virtual desktop (VDI) or remote browser isolation (RBI). For example, Firefox Enterprise can turn off JavaScript just-in-time compilation, block service workers, load the site over HTTPS only, and open it in its own container.
• Profile data encryption: History, form data, logins, and TLS session tokens are encrypted on disk, so that a copied profile folder can't be decrypted without the key from an organization's Admin Console.

Security and on-premises hosting

• Security event logging: log downloads, printing, extension installs, visits to websites blocked by policy, and unsafe websites and downloads flagged by Safe Browsing. Each type of event is off until you turn it on, and you choose how much detail to include. Events go to your Admin Console, not to Mozilla, and you can send them on to your SIEM.
• Crash reports go to your Admin Console, or you can turn crash reporting off.
• Run all supporting services (e.g., sync, updates) on your own infrastructure, so browsers never have to connect to Mozilla.

Other differences from Firefox

• Firefox Enterprise leaves out consumer features that don't apply at work: sponsored stories and shortcuts on New Tab, Firefox VPN, Firefox Relay email masks, breach alerts and extension recommendations.
• Employees see a notice when they sign in that the browser is managed by their organization and some activity may be monitored.
• Profiles can only be opened by Firefox Enterprise, not by regular Firefox.

Learn more on the Firefox Enterprise page and in the Firefox Enterprise release notes.

Professional support

Organizations that need private, expert help from Mozilla can get it through Firefox Professional Support. This includes a private way to report and resolve issues, guaranteed response times, and the option to work with Mozilla engineers on custom development and compatibility. The public documentation and community forums stay free and open to everyone.