policies.json: así se configura Firefox en la empresa

Firefox Enterprise policies allow IT administrators to block extensions, disable password saving, and enforce updates across thousands of machines without touching a single device. Mozilla documents these policies as part of their Firefox Enterprise offering, designed for businesses needing to audit and control the browser organization-wide.

The key behind this promise is a file named policies.json that Firefox reads when it starts up. TL;DR policies.json is a configuration file that Firefox reads upon launch and applies before any browser windows appear. Windows uses ADMX templates via Group Policy or Intune; macOS and Linux read the same JSON from a system folder.

Blocked policies with Locked:true cannot be reverted from about:preferences or with local admin privileges. about:policies displays live which policies are active and if there were syntax errors loading the file. Mozilla's GitHub repository policy-templates documents every valid key, from updates to certificates. What are Firefox Enterprise policies?

Firefox Enterprise policies are a set of JSON directives Mozilla exposes for administrators to configure, block, or deploy browser settings across all organization machines, independent of each user's GUI interface. They are defined in a policies.json file or through ADMX and MDM templates. The interpreter is called the Enterprise Policy Engine and has been integrated into Firefox since version 60 (2018).

It's not a separate product to install. Any official Firefox desktop build reads this file, but Firefox for Android still doesn't support policies.json. The repository contains policy templates in ADMX/ADML for Windows, macOS profiles, and documentation of each valid JSON key with ready-to-copy examples. Firefox reads distribution/policies.json before opening any browser window.

Why does it matter? A company without browser control is at the mercy of its largest attack surface. Employees enter credentials, upload files to external services, and run third-party extensions with access to every open tab. Mozilla built its Enterprise proposal around concrete regulatory frameworks: DORA and NIS2 in the EU, GDPR for personal data, ISO 27001 and SOC 2 for operational security controls.

None of these frameworks require a specific browser, but all demand the ability to demonstrate existing controls and audit them. policies.json is, in practice, a direct way to generate that evidence, a version-controlled Git file that auditors can read line by line. There's also a technical independence argument Mozilla repeats on its site: unlike a Chromium-based browser, Firefox runs its own Gecko engine, so a vulnerability in Chrome's engine wouldn't automatically compromise a company's Firefox fleet.

Diversifying the browser engine reduces the risk that a single exploit could take down all devices at once. How does policies.json work under the hood? When Firefox launches, before loading any user profiles, it searches for the policies.json file in a fixed system path. If found and the JSON is valid, it applies each key as a directive: hiding a menu, forcing a value, or blocking a preference so the user can't change it, not even from about:config.

The path varies by OS: Windows in the distribution folder alongside the executable (C:\Program Files\Mozilla Firefox\distribution\policies.json), or via Group Policy ADMX templates imported into the domain. macOS at /Applications/Firefox.app/Contents/Resources/distribution/policies.json, or a MDM configuration profile. Linux varies by distribution (Debian/Ubuntu at /etc/firefox/policies/policies.json, others at /usr/lib/firefox/distribution/policies.json).

Any valid policies.json must have the root key "policies". Without it, Firefox ignores the file, just like a malformed JSON. Inside that root key are dozens of documented directives from trivial settings (Homepage, NewTabPage) to deep security controls (SSLVersionMin, DisableSafeMode). You don't need to declare the ones you don't care about; Firefox only applies the ones present and leaves the rest at their default values.