How do you manage Firefox extensions with enterprise policy?

Firefox manages extensions through the ExtensionSettings policy. Each extension ID, or the * default, gets an installation_mode of allowed, blocked, force_installed or normal_installed. Blocked prevents installation and removes an installed copy, force_installed prevents removal, and normal_installed installs it but lets users disable it.

The four modes

Mozilla's admin documentation defines them like this:

For the two installed modes you need an install_url unless the add-on is hosted on addons.mozilla.org or has an update_url. The documentation notes that newer Firefox versions relax this for addons.mozilla.org extensions, so check which version your fleet runs.

Other fields worth knowing

• blocked_install_message adds text to Firefox's standard error when a user is blocked. Use it to point people at your request form or help desk.
• updates_disabled is a boolean that turns off automatic updates for one extension. Disabling updates keeps a version in place, but it also stops security fixes, so use it with an expiry in mind.
• default_area sets whether the icon appears in the toolbar or the menu panel by default.
• allowed_types is only set under * and limits add-on types to dictionary, extension, locale, sitepermission and theme.

A sensible first configuration

1. Start with the * entry. Choose allowed if you want a default-open posture, or blocked for default-deny.
2. Add a blocked_install_message to the default entry so a refusal leads somewhere useful.
3. Add the extensions your company needs as force_installed or normal_installed.
4. Add known bad extension IDs as blocked entries.
5. Test on one machine, then roll out through your normal change process.

An example shape, for illustration only:

{
  "policies": {
    "ExtensionSettings": {
      "*": {
        "installation_mode": "blocked",
        "blocked_install_message": "Request approval at the IT portal."
      }
    }
  }
}

How it compares to Chrome

The idea is the same: a per-extension setting plus a default. The details differ. Chrome uses an ID or an update URL as the key and has fields for blocked permissions and runtime host blocking. Firefox's documented fields focus on install source, updates and add-on types. Do not assume a Chrome control has a Firefox twin. Our cross-browser cheat sheet lays them side by side.

Who owns the extension list

Every forced extension should have a named owner and a review date, as described in the extension owner register. The same person should check the add-on page for ownership or permission changes.

Common mistakes

• Forgetting the default entry. Without a * entry the default is allowed, so anything you did not list can be installed.
• Forcing without a source. A forced extension that has no usable install source will not arrive. Test one machine first.
• Freezing updates and forgetting. Turning off updates for an extension keeps a known version, but you also stop receiving fixes. Put a review date next to every such entry.
• Mixing versions. Some fields carry version-specific notes in Mozilla's documentation, so check your oldest supported release.

Quick check

Sources

• Firefox Enterprise Admin docs: ExtensionSettings

Last reviewed: 19 October 2026.