Managing Firefox Extensions with policies.json

This article provides a comprehensive overview for enterprise system administrators on how to manage browser add-ons in Mozilla Firefox using the policies.json configuration file. You will learn where to place the configuration file across different operating systems, how to retrieve unique extension identifiers, and the exact JSON syntax required to either silently force-install critical extensions or block unauthorized ones from being used by end-users.

1. Set Up the policies.json File

To deploy enterprise policies in Firefox without using Active Directory or Group Policy Objects (GPO), you must create a file named policies.json. Firefox looks for this file in a specific distribution folder depending on the operating system.

Create the distribution directory if it does not already exist, and place the policies.json file in the corresponding path:

• Windows: C:\Program Files\Mozilla Firefox\distribution\policies.json
• macOS: /Applications/Firefox.app/Contents/Resources/distribution/policies.json
• Linux: /etc/firefox/policies/policies.json

2. Obtain the Extension ID and Install URL

To manage a specific extension, you need its unique Extension ID. If you are force-installing it, you also need its source URL.

To find the Extension ID:

1. Install the extension on a test machine.
2. Open Firefox and navigate to about:support in the address bar.
3. Scroll down to the Add-ons section.
4. Locate the extension in the list and copy the string in the ID column (it usually looks like an email address, e.g., uBlock0@raymondhill.net, or a GUID wrapped in curly braces).

To find the Install URL:

1. Go to the Mozilla Add-ons store (addons.mozilla.org) and find the extension.
2. Right-click the Add to Firefox button and select Copy Link.
3. For enterprise stability, replace the version-specific filename at the end of the URL with latest.xpi.
   • Example: https://addons.mozilla.org/firefox/downloads/latest/ublock-origin/latest.xpi

3. Configure the ExtensionSettings Policy

Firefox uses the ExtensionSettings policy key to control add-on behavior. Within this key, you define rules for specific Extension IDs or use an asterisk (*) to define a global default rule for all extensions.

There are four primary installation_mode values you can use:

• allowed: Users can install and uninstall the extension freely (default).
• blocked: Users cannot install the extension. If it is already installed, it is disabled and removed.
• force_installed: The extension is silently installed and cannot be disabled or removed by the user.
• normal_installed: The extension is silently installed, and the user can choose to disable it, but cannot remove it.

4. Example policies.json Configuration

Below is a complete example of a policies.json file. It demonstrates how to force-install one extension, block a specific extension, and allow all other extensions by default.

{
  "policies": {
    "ExtensionSettings": {
      "*": {
        "installation_mode": "allowed"
      },
      "uBlock0@raymondhill.net": {
        "installation_mode": "force_installed",
        "install_url": "https://addons.mozilla.org/firefox/downloads/latest/ublock-origin/latest.xpi"
      },
      "unwanted-extension@example.com": {
        "installation_mode": "blocked",
        "blocked_install_message": "This extension is blocked by your IT department."
      }
    }
  }
}

5. Block All Extensions Except an Approved List (Allowlisting)

In high-security environments, you may want to block users from installing any extensions except the ones you explicitly approve or force-install. To do this, set the global * rule to blocked, and then define the exceptions.

{
  "policies": {
    "ExtensionSettings": {
      "*": {
        "installation_mode": "blocked",
        "blocked_install_message": "Installing unapproved extensions is restricted by the system administrator."
      },
      "uBlock0@raymondhill.net": {
        "installation_mode": "force_installed",
        "install_url": "https://addons.mozilla.org/firefox/downloads/latest/ublock-origin/latest.xpi"
      },
      "approved-optional-addon@example.com": {
        "installation_mode": "allowed"
      }
    }
  }
}

6. Verify the Configuration

After saving the policies.json file in the correct directory, restart Firefox to apply the changes.

To verify that the policies are active and free of syntax errors:

1. Open Firefox and type about:policies in the address bar.
2. Check the Active tab to confirm your ExtensionSettings rules are listed.
3. If the policy is not working, click the Errors tab to troubleshoot any JSON formatting mistakes or invalid parameters.