Firefox for Enterprise Community Forum

We are managing Firefox settings using Intune via Imported ADMX templates.

We are managing Extension Settings via 'Extension Management (JSON on one line)' which works fine for our force installs, force removals etc.

We have noticed that some users have installed 3rd party extensions which create the ExtensionSettings key in the registry with the 3rd party extension details.

The issue we see if when ExtensionSettings exists as a REG_SZ or REG_MULTI_SZ under `HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Mozilla\Firefox` it is then ignored if the `HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Mozilla\Firefox\ExtensionSettings` key exists.

Is there a setting we can use to have these settings merged by Firefox or have the REG_SZ/REG_MULTI_SZ take priority or is the only way to ensure enterprise policy continues to work we need to migrate our extension settings into the key rather than string?

Thanks!

I am trying to use group policy to block all extensions from being installed and only allow approved extensions.

I have followed the article:

https://firefox-admin-docs.mozilla.org/reference/policies/extensionsettings/

And here is my JSON config but it doesnt seem to be working and I can still install any extension.

{

 "*": { 

"blocked_install_message": "Please email the IT Helpdesk if you think an extension should be unblocked.", "installation_mode": "blocked" }, "com.abr.startapp@adminbyrequest.com": { "installation_mode": "force_installed", "install_url": "https://addons.mozilla.org/firefox/downloads/latest/admin-by-request/latest.xpi" } }

Please can anyone advise or confirm if this is a bug.

We are using firefox version 147.0.4 (64-bit)

Thanks

How to disable Firefox add-ons in order to block to install temporary extensions. I am generating policies via Firefox Policy generator. {

 "name": "myconfig",
 "time": "2025-12-14T13:17:27.479Z",
 "configuration": {
   "arrayfields": {},
   "checkboxes": {
     "BlockAboutAddons": true,
     "BlockAboutConfig": true,
     "BlockAboutProfiles": true
   },
   "input": {},
   "textareas": {},
   "select": {}
 }

}

I have a few questions regarding the auto-update policy of extensions installed via ExtensionSettings with the force_installed installation mode.

1. Can the extension receive auto-updates just like extensions installed through normal means? (e.g. extensions installed from https://addons.mozilla.org)
2. If so, will the user be notified when the extension requests new permissions?

Hello,

For enterprise solutions, for our browser extension can we disable the switch button where user can turn-off the "Access your data for all websites"?

This can be informed to the end user and also approved by the IT admins.

But the option to disable at runtime on the fly needs to be disabled.

Hi guys,

I'm trying to uninstall an extension using a GPO, but it's not working.

I've placed a GPO on the user's OU and configured the ID to be removed in the User-Part of that GPO. I previously retrieved the ID using about:debugging.

But nothing happens; the extension isn't removed. (Logoff/Logon/reboot/gpupdate /force .....)

128.11.0esr (64-Bit)

KeePassXC-Browser Extension

The GPOs for Edge and Chrome have the same function. Enter the ID there, and the extension is reliably removed.

Any suggestions? Thanks

Michael

We're exploring adopting a default deny policy for Firefox extensions in our enterprise. However when I tested this by creating a custom policies.json Firefox unexpectedly removed all extensions for me, including the ones I thought I had allow listed. Here is my policies.json but just keeping in the Facebook Container add-on to illustrate:

{

   "policies": {
       "ExtensionSettings": {
           "*": {
               "blocked_install_message": "Only approved Firefox extensions can be installed, please email your request to itdept@example.org",
               "installation_mode": "blocked",
               "allowed_types": ["theme", "dictionary", "locale"]
           },
           "@contain-facebook.xpi": { "installation_mode": "allowed" }
       }
   }

}

What I would like is to to allow pre-approved extensions (including if they already are installed) and all other types of add-on, but remove and prohibit installation of unapproved extensions.

Can anyone assist, please?

In /Library/Preferences/org.mozilla.firefox.plist:

``` <plist version="1.0"> <dict> <key>EnterprisePoliciesEnabled</key> <true /> <key>ExtensionSettings</key> <dict> <key>cloudmetering@snowsoftware.com</key> <dict> <key>install_url</key> <string>https://raw.githubusercontent.com/SnowSoftware/agent-firefox-extension/refs/heads/main/cloudmetering-v1.2.3.xpi</string> <key>installation_mode</key> <string>force_installed</string> </dict> </dict> </dict> </plist>```

In about:policies: {"cloudmetering@snowsoftware.com":{"installation_mode":"blocked","install_url":"https://raw.githubusercontent.com/SnowSoftware/agent-firefox-extension/refs/heads/main/cloudmetering-v1.2.3.xpi"}}

The plist file did read "blocked" at one point, but it no longer does. Why isn't firefox picking up the new value from the plist file? Restarting/refresing FF has not helped so far.

Добрый день Есть ли возможность установить плагин .xpi в mozilla через cmd. AltLinux. Конечно я уже прочел статьи существующие. Не сработали рекомендации. Можно ли сделать вывод что Firefox 128.0 ESR не поддерживает установку плагинов через cmd? Если да, то можем ли мы сослаться на официальный ответ firefox ? Благодарю за рекомендации.

Hello,

New subscriber here. I have been given the task to test the install and uninstall of the Purview Firefox browser extension using Intune. I created 2 groups in EntraID, one for each (install and uninstall).

I have no issues with the installation. Initially, I left the test device in the install group and then added it to the uninstall group to remove it. (this usually works with other apps, it worked this way with the Purview Chrome browsing extension as well other apps) but when I do this, nothing happens.

Next, I removed the device from the install group and added it to the uninstall group only. Once the configuration profile applies to the test device, it allows the user to remove it manually (before it did not) but the extension remains installed.

I have created a policy using the administrative template extension uninstall option as well as with the OMA-URI settings but the same happens. When i check the device configuration for the device in Intune, it says it succeeded but that is not the case. The OMA-URI setting I was not too sure about, but gave it a shot. I used the UUID value for the Purview Firefox extension

I am attaching some pictures and hope someone can tell me what I am doing wrong. I can add additional information, if needed. I have opened a ticket with Microsoft last week but have not called me yet. I ran into this forum today.

Thanks in advance

I am having the same issue as this other user here: https://www.reddit.com/r/sysadmin/comments/17wvuwh/help_pinning_extension_in_firefox_with_gpo/

Preliminaries -- Initially (before trying to force-pin), I had these GPOs enabled:

Extensions to Install -> https://addons.mozilla.org/firefox/downloads/file/4410896/bitwarden_password_manager-2024.12.4.xpi

Prevent extensions from being disabled or removed ->

• {446900e4-71c2-419f-a6a7-df9c091e268b}
• {3f6129fb-6c55-4452-ab6f-7c109b2301df}
• https://addons.mozilla.org/firefox/downloads/file/4410896/bitwarden_password_manager-2024.12.4.xpi

(Those GPOs above all work.)

What I'm trying to do: Force-pin Bitwarden.

I believe I've followed the documentation correctly (except for not including a "*" case): https://mozilla.github.io/policy-templates/#extensionsettings

I've enabled this GPO with this value:

Extension Management ->

{

 "{446900e4-71c2-419f-a6a7-df9c091e268b}": {
   "default_area": "navbar"
 }

}

After running various "GPUpdate"s and whatnot, the option to uncheck "Pin to toolbar" is still available to click.

I've verified in "about:policies#active" that the JSON item appears next to "ExtensionSettings" and that there are no errors listed in the "Errors" tab.

I've also verified that it appears in the correct location in the Registry.

Since another user had the same issue (Reddit link above), I figured it'd be a good idea to check in with y'all to see if we are missing something.

Thanks for your help!