How do you restrict Firefox extensions with enterprise policy?

To restrict Firefox extensions, use the ExtensionSettings policy. Set the wildcard entry to installation_mode blocked, then add an entry for each approved extension ID with installation_mode allowed, force_installed or normal_installed. Firefox removes blocked extensions that are already installed.

How the policy is shaped

ExtensionSettings is a JSON object that maps an extension ID to its settings. The special key named asterisk sets defaults for any extension that has no entry of its own. Mozilla's administrator reference says that if an extension has its own entry, Firefox ignores the asterisk entry for that extension.

Inside the asterisk entry, installation_mode accepts only allowed or blocked. The force_installed and normal_installed values are not supported there. They belong on per-extension entries.

The four installation modes

For the two installed modes, Firefox needs to know where to get the file. The reference says an install_url is required unless the extension is hosted on addons.mozilla.org or has an update_url. Later Firefox versions relax this for extensions on addons.mozilla.org, so check the reference for the version you run.

A default deny example

{
  "policies": {
    "ExtensionSettings": {
      "*": {
        "installation_mode": "blocked",
        "blocked_install_message": "Ask IT to approve this add-on."
      },
      "approved-extension@example.com": {
        "installation_mode": "allowed"
      }
    }
  }
}

This goes in a policies.json file or the equivalent enterprise policy channel for your operating system. The extension ID shown is a placeholder, so replace it with the ID from the add-on you approved.

Things worth knowing before rollout

The blocked_install_message string is appended to Firefox's standard error text, which is useful for pointing people to a help desk. It is valid in the asterisk entry and in per-ID entries.

The allowed_types setting only works in the asterisk entry, and it only applies when installation is otherwise allowed. If the asterisk entry is blocked, allowed_types has no effect. We cover that setting in a separate post.

A per-extension entry also escapes the allowed_types limit. Extensions with their own allowed, force_installed or normal_installed entry are not restricted by it.

A practical sequence

1. Export a list of the add-ons people use today on a few developer laptops.
2. Pick the ones you will support and record an owner for each.
3. Write the policy with the wildcard blocked and one entry per approved ID.
4. Test on one machine, including a removal check for an add-on that is not on the list.
5. Roll out to a pilot group, then everyone.

Keep the policy file in version control so changes are reviewed like code.

Safeguard note

Safeguard ships a Firefox add-on alongside its Chrome and Edge extension and Safari extension. You can run a free scan at gold.safeguard.sh/scan. Your Firefox policy is configured in Firefox, not in Safeguard.

Quick check

Sources

• ExtensionSettings policy, Firefox administrator reference

Last reviewed: 19 October 2026.