policy-templates

Enterprise policy descriptions and templates for Thunderbird 78 (and older)

Policies can be specified using the Group Policy templates on Windows, Intune on Windows, configuration profiles on macOS, or by creating a file called policies.json.

On Windows, create a directory called distribution where the EXE is located and place the file there. On Mac, the file goes into Thunderbird.app/Contents/Resources/distribution. On Linux, the file goes into thunderbird/distribution, where thunderbird is the installation directory for Thunderbird, which varies by distribution or you can specify system-wide policy by placing the file in /etc/thunderbird/policies.


Policy Name Description
3rdparty Set policies that WebExtensions can access via chrome.storage.managed.
AppAutoUpdate Enable or disable automatic application update.
AppUpdateURL Change the URL for application update.
Authentication Configure sites that support integrated authentication.
BlockAboutAddons Block access to the Add-ons Manager (about:addons).
BlockAboutConfig Block access to about:config.
BlockAboutProfiles Block access to About Profiles (about:profiles).
BlockAboutSupport Block access to Troubleshooting Information (about:support).
CaptivePortal Enable or disable the detection of captive portals.
Certificates -> ImportEnterpriseRoots Trust certificates that have been added to the operating system certificate store by a user or administrator.
Certificates -> Install Install certificates into the Thunderbird certificate store.
Cookies Configure cookie preferences.
DefaultDownloadDirectory Set the default download directory.
DisableAppUpdate Turn off application updates.
DisabledCiphers Disable ciphers.
DisableDeveloperTools Remove access to all developer tools.
DisableMasterPasswordCreation Remove the master password functionality.
DisablePasswordReveal Do not allow passwords to be revealed in saved logins.
DisableSafeMode Disable safe mode within the browser.
DisableSecurityBypass Prevent the user from bypassing security in certain cases.
DisableSystemAddonUpdate Prevent system add-ons from being installed or update.
DisableTelemetry DisableTelemetry
DownloadDirectory Set and lock the download directory.
Extensions Control the installation, uninstallation and locking of extensions.
ExtensionSettings Manage all aspects of extensions.
ExtensionUpdate Control extension updates.
HardwareAcceleration Control hardware acceleration.
InstallAddonsPermission Configure the default extension install policy as well as origins for extension installs are allowed.
PasswordManagerEnabled Remove (some) access to the password manager.
Preferences Set and lock preferences.
PromptForDownloadLocation Ask where to save each file before downloading.
Proxy Configure proxy settings.
RequestedLocales Set the the list of requested locales for the application in order of preference.
SSLVersionMax Set and lock the maximum version of TLS.
SSLVersionMin Set and lock the minimum version of TLS.


3rdparty

Allow WebExtensions to configure policy. For more information, see Adding policy support to your extension.

Compatibility

Policy/Property Name supported since deprecated after
3rdparty
3rdparty_Extensions
3rdparty_Extensions_[name]		 78.0  


AppAutoUpdate

Enable or disable automatic application update.

If set to true, application updates are installed without user approval within Thunderbird. The operating system might still require approval.

If set to false, application updates are downloaded but the user can choose when to install the update.

If you have disabled updates via DisableAppUpdate, this policy has no effect.

CCK2 Equivalent: N/A
Preferences Affected: app.update.auto

Windows (GPO)

Software\Policies\Mozilla\Thunderbird\AppAutoUpdate = 0x1 | 0x0

Windows (Intune)

OMA-URI:

./Device/Vendor/MSFT/Policy/Config/Thunderbird~Policy~thunderbird/AppAutoUpdate

Value (string):

<enabled/> or <disabled/>

macOS

<dict>
  <key>AppAutoUpdate</key>
  <true/> | <false/>
</dict>

policies.json

{
  "policies": {
    "AppAutoUpdate": true | false
  }
}

Compatibility

Policy/Property Name supported since deprecated after
AppAutoUpdate 75.0  


AppUpdateURL

Change the URL for application update if you are providing Thunderbird updates from a custom update server.

CCK2 Equivalent: N/A
Preferences Affected: app.update.url

Windows (GPO)

Software\Policies\Mozilla\Thunderbird\AppUpdateURL = "https://yoursite.com"

Windows (Intune)

OMA-URI:

./Device/Vendor/MSFT/Policy/Config/Thunderbird~Policy~thunderbird/AppUpdateURL

Value (string):

<enabled/>
<data id="AppUpdateURL" value="https://yoursite.com"/>

macOS

<dict>
  <key>AppUpdateURL</key>
  <string>https://yoursite.com</string>
</dict>

policies.json

{
  "policies": {
    "AppUpdateURL": "https://yoursite.com"
  }
}

Compatibility

Policy/Property Name supported since deprecated after
AppUpdateURL 68.0  


Authentication

Configure sites that support integrated authentication.

See https://developer.mozilla.org/en-US/docs/Mozilla/Integrated_authentication for more information.

PrivateBrowsing enables integrated authentication in private browsing.

CCK2 Equivalent: N/A
Preferences Affected: network.negotiate-auth.trusted-uris,network.negotiate-auth.delegation-uris,network.automatic-ntlm-auth.trusted-uris,network.automatic-ntlm-auth.allow-non-fqdn,network.negotiate-auth.allow-non-fqdn,network.automatic-ntlm-auth.allow-proxies,network.negotiate-auth.allow-proxies,network.auth.private-browsing-sso

Windows (GPO)

Software\Policies\Mozilla\Thunderbird\Authentication\SPNEGO\1 = "mydomain.com"
Software\Policies\Mozilla\Thunderbird\Authentication\SPNEGO\2 = "https://myotherdomain.com"
Software\Policies\Mozilla\Thunderbird\Authentication\Delegated\1 = "mydomain.com"
Software\Policies\Mozilla\Thunderbird\Authentication\Delegated\2 = "https://myotherdomain.com"
Software\Policies\Mozilla\Thunderbird\Authentication\NTLM\1 = "mydomain.com"
Software\Policies\Mozilla\Thunderbird\Authentication\NTLM\2 = "https://myotherdomain.com"
Software\Policies\Mozilla\Thunderbird\Authentication\AllowNonFQDN\SPNEGO = 0x1 | 0x0
Software\Policies\Mozilla\Thunderbird\Authentication\AllowNonFQDN\NTLM = 0x1 | 0x0
Software\Policies\Mozilla\Thunderbird\Authentication\AllowProxies\SPNEGO = 0x1 | 0x0
Software\Policies\Mozilla\Thunderbird\Authentication\AllowProxies\NTLM = 0x1 | 0x0
Software\Policies\Mozilla\Thunderbird\Authentication\Locked = 0x1 | 0x0
Software\Policies\Mozilla\Thunderbird\Authentication\PrivateBrowsing = 0x1 | 0x0

Windows (Intune)

OMA-URI:

./Device/Vendor/MSFT/Policy/Config/Thunderbird~Policy~thunderbird~Authentication/Authentication_SPNEGO

Value (string):

<enabled/>
<data id="Authentication" value="1&#xF000;mydomain&#xF000;2&#xF000;https://myotherdomain.com"/>

OMA-URI:

./Device/Vendor/MSFT/Policy/Config/Thunderbird~Policy~thunderbird~Authentication/Authentication_Delegated

Value (string):

<enabled/>
<data id="Authentication" value="1&#xF000;mydomain&#xF000;2&#xF000;https://myotherdomain.com"/>

OMA-URI:

./Device/Vendor/MSFT/Policy/Config/Thunderbird~Policy~thunderbird~Authentication/Authentication_NTLM

Value (string):

<enabled/>
<data id="Authentication" value="1&#xF000;mydomain&#xF000;2&#xF000;https://myotherdomain.com"/>

OMA-URI:

./Device/Vendor/MSFT/Policy/Config/Thunderbird~Policy~thunderbird~Authentication/Authentication_AllowNonFQDN

Value (string):

<enabled/>
<data id="Authentication_AllowNonFQDN_NTLM" value="true | false"/>
<data id="Authentication_AllowNonFQDN_SPNEGO" value="true | false"/>

OMA-URI:

./Device/Vendor/MSFT/Policy/Config/Thunderbird~Policy~thunderbird~Authentication/Authentication_Locked

Value (string):

<enabled/> or <disabled/>

OMA-URI:

./Device/Vendor/MSFT/Policy/Config/Thunderbird~Policy~thunderbird~Authentication/Authentication_PrivateBrowsing

Value (string):

<enabled/> or <disabled/>

macOS

<dict>
  <key>Authentication</key>
  <dict>
    <key>SPNEGO</key>
    <array>
      <string>mydomain.com</string>
      <string>https://myotherdomain.com</string>
    </array>
    <key>Delegated</key>
    <array>
      <string>mydomain.com</string>
      <string>https://myotherdomain.com</string>
    </array>
    <key>NTLM</key>
    <array>
      <string>mydomain.com</string>
      <string>https://myotherdomain.com</string>
    </array>
    <key>AllowNonFQDN</key>
      <dict>
      <key>SPNEGO</key>
      <true/> | <false/>
      <key>NTLM</key>
      <true/> | <false/>
    </dict>
    <key>AllowProxies</key>
      <dict>
      <key>SPNEGO</key>
      <true/> | <false/>
      <key>NTLM</key>
      <true/> | <false/>
    </dict>
    <key>Locked</key>
    <true/> | <false/>
    <key>PrivateBrowsing</key>
    <true/> | <false/>
  </dict>
</dict>

policies.json

{
  "policies": {
    "Authentication": {
      "SPNEGO": ["mydomain.com", "https://myotherdomain.com"],
      "Delegated": ["mydomain.com", "https://myotherdomain.com"],
      "NTLM": ["mydomain.com", "https://myotherdomain.com"],
      "AllowNonFQDN": {
        "SPNEGO": true | false,
        "NTLM": true | false
      },
      "AllowProxies": {
        "SPNEGO": true | false,
        "NTLM": true | false
      },
      "Locked": true | false,
      "PrivateBrowsing": true | false
    }
  }
}

Compatibility

Policy/Property Name supported since deprecated after
Authentication
Authentication_SPNEGO
Authentication_Delegated
Authentication_NTLM
Authentication_AllowNonFQDN
Authentication_AllowNonFQDN_SPNEGO
Authentication_AllowNonFQDN_NTLM
Authentication_AllowProxies
Authentication_AllowProxies_SPNEGO
Authentication_AllowProxies_NTLM
Authentication_Locked
Authentication_PrivateBrowsing		 78.0  


BlockAboutAddons

Block access to the Add-ons Manager (about:addons).

CCK2 Equivalent: disableAddonsManager
Preferences Affected: N/A

Windows (GPO)

Software\Policies\Mozilla\Thunderbird\BlockAboutAddons = 0x1 | 0x0

Windows (Intune)

OMA-URI:

./Device/Vendor/MSFT/Policy/Config/Thunderbird~Policy~thunderbird/BlockAboutAddons

Value (string):

<enabled/> or <disabled/>

macOS

<dict>
  <key>BlockAboutAddons</key>
  <true/> | <false/>
</dict>

policies.json

{
  "policies": {
    "BlockAboutAddons": true | false
  }
}

Compatibility

Policy/Property Name supported since deprecated after
BlockAboutAddons 68.0  


BlockAboutConfig

Block access to about:config.

CCK2 Equivalent: disableAboutConfig
Preferences Affected: N/A

Windows (GPO)

Software\Policies\Mozilla\Thunderbird\BlockAboutConfig = 0x1 | 0x0

Windows (Intune)

OMA-URI:

./Device/Vendor/MSFT/Policy/Config/Thunderbird~Policy~thunderbird/BlockAboutConfig

Value (string):

<enabled/> or <disabled/>

macOS

<dict>
  <key>BlockAboutConfig</key>
  <true/> | <false/>
</dict>

policies.json

{
  "policies": {
    "BlockAboutConfig": true | false
  }
}

Compatibility

Policy/Property Name supported since deprecated after
BlockAboutConfig 68.0  


BlockAboutProfiles

Block access to About Profiles (about:profiles).

CCK2 Equivalent: disableAboutProfiles
Preferences Affected: N/A

Windows (GPO)

Software\Policies\Mozilla\Thunderbird\BlockAboutProfiles = 0x1 | 0x0

Windows (Intune)

OMA-URI:

./Device/Vendor/MSFT/Policy/Config/Thunderbird~Policy~thunderbird/BlockAboutProfiles

Value (string):

<enabled/> or <disabled/>

macOS

<dict>
  <key>BlockAboutProfiles</key>
  <true/> | <false/>
</dict>

policies.json

{
  "policies": {
    "BlockAboutProfiles": true | false
  }
}

Compatibility

Policy/Property Name supported since deprecated after
BlockAboutProfiles 68.0  


BlockAboutSupport

Block access to Troubleshooting Information (about:support).

CCK2 Equivalent: disableAboutSupport
Preferences Affected: N/A

Windows (GPO)

Software\Policies\Mozilla\Thunderbird\BlockAboutSupport = 0x1 | 0x0

Windows (Intune)

OMA-URI:

./Device/Vendor/MSFT/Policy/Config/Thunderbird~Policy~thunderbird/BlockAboutSupport

Value (string):

<enabled/> or <disabled/>

macOS

<dict>
  <key>BlockAboutSupport</key>
  <true/> | <false/>
</dict>

policies.json

{
  "policies": {
    "BlockAboutSupport": true | false
  }
}

Compatibility

Policy/Property Name supported since deprecated after
BlockAboutSupport 68.0  


CaptivePortal

Enable or disable the detection of captive portals.

CCK2 Equivalent: N/A
Preferences Affected: network.captive-portal-service.enabled

Windows (GPO)

Software\Policies\Mozilla\Thunderbird\CaptivePortal = 0x1 | 0x0

Windows (Intune)

OMA-URI:

./Device/Vendor/MSFT/Policy/Config/Thunderbird~Policy~thunderbird/CaptivePortal

Value (string):

<enabled/> or <disabled/>

macOS

<dict>
  <key>CaptivePortal</key>
  <true/> | <false/>
</dict>

policies.json

{
  "policies": {
    "CaptivePortal": true | false
  }
}

Compatibility

Policy/Property Name supported since deprecated after
CaptivePortal 78.0  


Certificates | ImportEnterpriseRoots

Trust certificates that have been added to the operating system certificate store by a user or administrator.

Note: This policy only works on Windows and macOS. For Linux discussion, see bug 1600509.

See https://support.mozilla.org/kb/setting-certificate-authorities-firefox for more detail.

CCK2 Equivalent: N/A
Preferences Affected: security.enterprise_roots.enabled

Windows (GPO)

Software\Policies\Mozilla\Thunderbird\Certificates\ImportEnterpriseRoots = 0x1 | 0x0

Windows (Intune)

OMA-URI:

./Device/Vendor/MSFT/Policy/Config/Thunderbird~Policy~thunderbird~Certificates/Certificates_ImportEnterpriseRoots

Value (string):

<enabled/> or <disabled/>

macOS

<dict>
  <key>Certificates</key>
  <dict>
    <key>ImportEnterpriseRoots</key>
    <true/> | <false/>
  </dict>
</dict>

policies.json

{
  "policies": {
    "Certificates": {
      "ImportEnterpriseRoots": true | false
    }
  }
}

Compatibility

Policy/Property Name supported since deprecated after
Certificates_ImportEnterpriseRoots 68.0  


Certificates | Install

Install certificates into the Thunderbird certificate store. If only a filename is specified, Thunderbird searches for the file in the following locations:

Starting with Thunderbird 65, Thunderbird 60.5 ESR, a fully qualified path can be used, including UNC paths. You should use the native path style for your operating system. We do not support using %USERPROFILE% or other environment variables on Windows.

If you are specifying the path in the policies.json file on Windows, you need to escape your backslashes (\\) which means that for UNC paths, you need to escape both (\\\\). If you use group policy, you only need one backslash.

Certificates are installed using the trust string CT,CT,.

Binary (DER) and ASCII (PEM) certificates are both supported.

CCK2 Equivalent: certs.ca
Preferences Affected: N/A

Windows (GPO)

Software\Policies\Mozilla\Thunderbird\Certificates\Install\1 = "cert1.der"
Software\Policies\Mozilla\Thunderbird\Certificates\Install\2 = "C:\Users\username\cert2.pem"

Windows (Intune)

OMA-URI:

./Device/Vendor/MSFT/Policy/Config/Thunderbird~Policy~thunderbird~Certificates/Certificates_Install

Value (string):

<enabled/>
<data id="Certificates_Install" value="1&#xF000;cert1.der&#xF000;2&#xF000;C:\Users\username\cert2.pem"/>

macOS

<dict>
  <key>Certificates</key>
  <dict>
    <key>Install</key>
    <array>
      <string>cert1.der</string>
      <string>/Users/username/cert2.pem</string>
    </array>
  </dict>
</dict>

policies.json

{
  "policies": {
    "Certificates": {
      "Install": ["cert1.der", "/home/username/cert2.pem"]
    }
  }
}

Compatibility

Policy/Property Name supported since deprecated after
Certificates_Install 68.0  


Cookies

Configure cookie preferences.

Allow is a list of origins (not domains) where cookies are always allowed. You must include http or https.

AllowSession is a list of origins (not domains) where cookies are only allowed for the current session. You must include http or https.

Block is a list of origins (not domains) where cookies are always blocked. You must include http or https.

Default determines whether cookies are accepted at all.

AcceptThirdParty determines how third-party cookies are handled.

ExpireAtSessionEnd determines when cookies expire.

RejectTracker only rejects cookies for trackers.

Locked prevents the user from changing cookie preferences.

CCK2 Equivalent: N/A
Preferences Affected: network.cookie.cookieBehavior,network.cookie.lifetimePolicy

Windows (GPO)

Software\Policies\Mozilla\Thunderbird\Cookies\Allow\1 = "https://example.com"
Software\Policies\Mozilla\Thunderbird\Cookies\AllowSession\1 = "https://example.edu"
Software\Policies\Mozilla\Thunderbird\Cookies\Block\1 = "https://example.org"
Software\Policies\Mozilla\Thunderbird\Cookies\Default = 0x1 | 0x0
Software\Policies\Mozilla\Thunderbird\Cookies\AcceptThirdParty = "always" | "never" | "from-visited"
Software\Policies\Mozilla\Thunderbird\Cookies\ExpireAtSessionEnd = 0x1 | 0x0
Software\Policies\Mozilla\Thunderbird\Cookies\RejectTracker = 0x1 | 0x0
Software\Policies\Mozilla\Thunderbird\Cookies\Locked = 0x1 | 0x0

Windows (Intune)

OMA-URI:

./Device/Vendor/MSFT/Policy/Config/Thunderbird~Policy~thunderbird~Cookies/Cookies_Allow

Value (string):

<enabled/>
<data id="Cookies_Allow" value="1&#xF000;https://example.com"/>

OMA-URI:

./Device/Vendor/MSFT/Policy/Config/Thunderbird~Policy~thunderbird~Cookies/Cookies_AllowSession

Value (string):

<enabled/>
<data id="Cookies_Allow" value="1&#xF000;https://example.edu"/>

OMA-URI:

./Device/Vendor/MSFT/Policy/Config/Thunderbird~Policy~thunderbird~Cookies/Cookies_Block

Value (string):

<enabled/>
<data id="Cookies_Block" value="1&#xF000;https://example.org"/>

OMA-URI:

./Device/Vendor/MSFT/Policy/Config/Thunderbird~Policy~thunderbird~Cookies/Cookies_Default

Value (string):

<enabled/> or <disabled/>

OMA-URI:

./Device/Vendor/MSFT/Policy/Config/Thunderbird~Policy~thunderbird~Cookies/Cookies_AcceptThirdParty

Value (string):

<enabled/>
<data id="Cookies_AcceptThirdParty" value="always | never | from-visited"/>

OMA-URI:

./Device/Vendor/MSFT/Policy/Config/Thunderbird~Policy~thunderbird~Cookies/Cookies_ExpireAtSessionEnd

Value (string):

<enabled/> or <disabled/>

OMA-URI:

./Device/Vendor/MSFT/Policy/Config/Thunderbird~Policy~thunderbird~Cookies/Cookies_RejectTracker

Value (string):

<enabled/> or <disabled/>

OMA-URI:

./Device/Vendor/MSFT/Policy/Config/Thunderbird~Policy~thunderbird~Cookies/Cookies_Locked

Value (string):

<enabled/> or <disabled/>

macOS

<dict>
  <key>Cookies</key>
  <dict>
    <key>Allow</key>
    <array>
      <string>http://example.com</string>
    </array>
    <key>AllowSession</key>
    <array>
      <string>http://example.edu</string>
    </array>
    <key>Block</key>
    <array>
      <string>http://example.org</string>
    </array>
    <key>Default</key>
    <true/> | <false/>
    <key>AcceptThirdParty</key>
    <string>always | never | from-visited</string>
    <key>ExpireAtSessionEnd</key>
    <true/> | <false/>
    <key>RejectTracker</key>
    <true/> | <false/>
    <key>Locked</key>
    <true/> | <false/>
  </dict>
</dict>

policies.json

{
  "policies": {
    "Cookies": {
      "Allow": ["http://example.org/"],
      "AllowSession": ["http://example.edu/"],
      "Block": ["http://example.edu/"],
      "Default": true | false,
      "AcceptThirdParty": "always" | "never" | "from-visited",
      "ExpireAtSessionEnd": true | false,
      "RejectTracker": true | false,
      "Locked": true | false
    }
  }
}

Compatibility

Policy/Property Name supported since deprecated after
Cookies
Cookies_Allow
Cookies_Block
Cookies_Default
Cookies_AcceptThirdParty
Cookies_ExpireAtSessionEnd
Cookies_Locked		 78.0  


DefaultDownloadDirectory

Set the default download directory.

You can use ${home} for the native home directory.

CCK2 Equivalent: N/A
Preferences Affected: browser.download.dir,browser.download.folderList

Windows (GPO)

Software\Policies\Mozilla\Thunderbird\DefaultDownloadDirectory = "${home}\Downloads"

Windows (Intune)

OMA-URI:

./Device/Vendor/MSFT/Policy/Config/Thunderbird~Policy~thunderbird/DefaultDownloadDirectory

Value (string):

<enabled/>
<data id="Preferences_String" value="${home}\Downloads"/>

macOS

<dict>
  <key>DefaultDownloadDirectory</key>
  <string>${home}/Downloads</string>
</dict>

policies.json (macOS and Linux)

{
  "policies": {
    "DefaultDownloadDirectory": "${home}/Downloads"
}

policies.json (Windows)

{
  "policies": {
    "DefaultDownloadDirectory": "${home}\\Downloads"
}

Compatibility

Policy/Property Name supported since deprecated after
DefaultDownloadDirectory 78.0  


DisableAppUpdate

Turn off application updates within Thunderbird.

CCK2 Equivalent: disableFirefoxUpdates
Preferences Affected: N/A

Windows (GPO)

Software\Policies\Mozilla\Thunderbird\DisableAppUpdate = 0x1 | 0x0

Windows (Intune)

OMA-URI:

./Device/Vendor/MSFT/Policy/Config/Thunderbird~Policy~thunderbird/DisableAppUpdate

Value (string):

<enabled/> or <disabled/>

macOS

<dict>
  <key>DisableAppUpdate</key>
  <true/> | <false/>
</dict>

policies.json

{
  "policies": {
    "DisableAppUpdate": true | false
  }
}

Compatibility

Policy/Property Name supported since deprecated after
DisableAppUpdate 68.0  


DisabledCiphers

Disable specific cryptographic ciphers.

Preferences Affected: security.ssl3.dhe_rsa_aes_128_sha, security.ssl3.dhe_rsa_aes_256_sha, security.ssl3.ecdhe_ecdsa_aes_128_gcm_sha256, security.ssl3.ecdhe_rsa_aes_128_gcm_sha256, security.ssl3.ecdhe_rsa_aes_128_sha, security.ssl3.ecdhe_rsa_aes_256_sha, security.ssl3.rsa_aes_128_gcm_sha256, security.ssl3.rsa_aes_128_sha, security.ssl3.rsa_aes_256_gcm_sha384, security.ssl3.rsa_aes_256_sha, security.ssl3.rsa_des_ede3_sha

Note:

This policy was updated in Thunderbird 78 to allow enabling ciphers as well. Setting the value to true disables the cipher, setting the value to false enables the cipher. Previously setting the value to true or false disabled the cipher.

CCK2 Equivalent: N/A
Preferences Affected: N/A

Windows (GPO)

Software\Policies\Mozilla\Thunderbird\DisabledCiphers\TLS_DHE_RSA_WITH_AES_128_CBC_SHA = 0x1 | 0x0
Software\Policies\Mozilla\Thunderbird\DisabledCiphers\TLS_DHE_RSA_WITH_AES_256_CBC_SHA = 0x1 | 0x0
Software\Policies\Mozilla\Thunderbird\DisabledCiphers\TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA = 0x1 | 0x0
Software\Policies\Mozilla\Thunderbird\DisabledCiphers\TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA = 0x1 | 0x0
Software\Policies\Mozilla\Thunderbird\DisabledCiphers\TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 = 0x1 | 0x0
Software\Policies\Mozilla\Thunderbird\DisabledCiphers\TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256 = 0x1 | 0x0
Software\Policies\Mozilla\Thunderbird\DisabledCiphers\TLS_RSA_WITH_AES_128_CBC_SHA = 0x1 | 0x0
Software\Policies\Mozilla\Thunderbird\DisabledCiphers\TLS_RSA_WITH_AES_256_CBC_SHA = 0x1 | 0x0
Software\Policies\Mozilla\Thunderbird\DisabledCiphers\TLS_RSA_WITH_3DES_EDE_CBC_SHA = 0x1 | 0x0

Windows (Intune)

OMA-URI:

./Device/Vendor/MSFT/Policy/Config/Thunderbird~Policy~thunderbird~DisabledCiphers/DisabledCiphers_TLS_DHE_RSA_WITH_AES_128_CBC_SHA
./Device/Vendor/MSFT/Policy/Config/Thunderbird~Policy~thunderbird~DisabledCiphers/DisabledCiphers_TLS_DHE_RSA_WITH_AES_256_CBC_SHA
./Device/Vendor/MSFT/Policy/Config/Thunderbird~Policy~thunderbird~DisabledCiphers/DisabledCiphers_TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA
./Device/Vendor/MSFT/Policy/Config/Thunderbird~Policy~thunderbird~DisabledCiphers/DisabledCiphers_TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA
./Device/Vendor/MSFT/Policy/Config/Thunderbird~Policy~thunderbird~DisabledCiphers/DisabledCiphers_TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256
./Device/Vendor/MSFT/Policy/Config/Thunderbird~Policy~thunderbird~DisabledCiphers/DisabledCiphers_TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256
./Device/Vendor/MSFT/Policy/Config/Thunderbird~Policy~thunderbird~DisabledCiphers/DisabledCiphers_TLS_RSA_WITH_AES_128_CBC_SHA
./Device/Vendor/MSFT/Policy/Config/Thunderbird~Policy~thunderbird~DisabledCiphers/DisabledCiphers_TLS_RSA_WITH_AES_256_CBC_SHA
./Device/Vendor/MSFT/Policy/Config/Thunderbird~Policy~thunderbird~DisabledCiphers/DisabledCiphers_TLS_RSA_WITH_3DES_EDE_CBC_SHA

Value (string):

<enabled/> or <disabled/>

macOS

<dict>
  <key>DisabledCiphers</key>
    <dict>
      <key>TLS_DHE_RSA_WITH_AES_128_CBC_SHA</key>
      <true/> | <false/>
      <key>TLS_DHE_RSA_WITH_AES_256_CBC_SHA</key>
      <true/> | <false/>
      <key>TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA</key>
      <true/> | <false/>
      <key>TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA</key>
      <true/> | <false/>
      <key>TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256</key>
      <true/> | <false/>
      <key>TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256</key>
      <true/> | <false/>
      <key>TLS_RSA_WITH_AES_128_CBC_SHA</key>
      <true/> | <false/>
      <key>TLS_RSA_WITH_AES_256_CBC_SHA</key>
      <true/> | <false/>
      <key>TLS_RSA_WITH_3DES_EDE_CBC_SHA</key>
      <true/> | <false/>
    </dict>
</dict>

policies.json

{
  "policies": {
    "DisabledCiphers": {
      "TLS_DHE_RSA_WITH_AES_128_CBC_SHA": true | false,
      "TLS_DHE_RSA_WITH_AES_256_CBC_SHA": true | false,
      "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA": true | false,
      "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA": true | false,
      "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256": true | false,
      "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256": true | false,
      "TLS_RSA_WITH_AES_128_CBC_SHA": true | false,
      "TLS_RSA_WITH_AES_256_CBC_SHA": true | false,
      "TLS_RSA_WITH_3DES_EDE_CBC_SHA": true | false,
    }
  }
}

Compatibility

Policy/Property Name supported since deprecated after
DisabledCiphers
DisabledCiphers_TLS_DHE_RSA_WITH_AES_128_CBC_SHA
DisabledCiphers_TLS_DHE_RSA_WITH_AES_256_CBC_SHA
DisabledCiphers_TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA
DisabledCiphers_TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA
DisabledCiphers_TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256
DisabledCiphers_TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256
DisabledCiphers_TLS_RSA_WITH_AES_128_CBC_SHA
DisabledCiphers_TLS_RSA_WITH_AES_256_CBC_SHA
DisabledCiphers_TLS_RSA_WITH_3DES_EDE_CBC_SHA		 76.0  


DisableDeveloperTools

Remove access to all developer tools.

CCK2 Equivalent: removeDeveloperTools
Preferences Affected: devtools.policy.disabled

Windows (GPO)

Software\Policies\Mozilla\Thunderbird\DisableDeveloperTools = 0x1 | 0x0`

Windows (Intune)

OMA-URI:

./Device/Vendor/MSFT/Policy/Config/Thunderbird~Policy~thunderbird/DisableDeveloperTools

Value (string):

<enabled/> or <disabled/>

macOS

<dict>
  <key>DisableDeveloperTools</key>
  <true/> | <false/>
</dict>

policies.json

{
  "policies": {
    "DisableDeveloperTools": true | false
  }
}

Compatibility

Policy/Property Name supported since deprecated after
DisableDeveloperTools 68.0  


DisableMasterPasswordCreation

Remove the master password functionality.

If this value is true, it works the same as setting PrimaryPassword to false and removes the primary password functionality.

If both DisableMasterPasswordCreation and PrimaryPassword are used, DisableMasterPasswordCreation takes precedent.

CCK2 Equivalent: noMasterPassword
Preferences Affected: N/A

Windows (GPO)

Software\Policies\Mozilla\Thunderbird\DisableMasterPasswordCreation = 0x1 | 0x0

Windows (Intune)

OMA-URI:

./Device/Vendor/MSFT/Policy/Config/Thunderbird~Policy~thunderbird/DisableMasterPasswordCreation

Value (string):

<enabled/> or <disabled/>

macOS

<dict>
  <key>DisableMasterPasswordCreation</key>
  <true/> | <false/>
</dict>

policies.json

{
  "policies": {
    "DisableMasterPasswordCreation": true | false
  }
}

Compatibility

Policy/Property Name supported since deprecated after
DisableMasterPasswordCreation 68.0  


DisablePasswordReveal

Do not allow passwords to be shown in saved logins

CCK2 Equivalent: N/A Preferences Affected: N/A

Windows (GPO)

Software\Policies\Mozilla\Thunderbird\DisablePasswordReveal = 0x1 | 0x0

Windows (Intune)

OMA-URI:

./Device/Vendor/MSFT/Policy/Config/Thunderbird~Policy~thunderbird/DisablePasswordReveal

Value (string):

<enabled/> or <disabled/>

macOS

<dict>
  <key>DisablePasswordReveal</key>
  <true/> | <false/>
</dict>

policies.json

{
  "policies": {
    "DisablePasswordReveal": true | false
  }
}

Compatibility

Policy/Property Name supported since deprecated after
DisablePasswordReveal 78.0  


DisableSafeMode

Disable safe mode within the browser.

On Windows, this disables safe mode via the command line as well.

CCK2 Equivalent: disableSafeMode
Preferences Affected: N/A

Windows (GPO)

Software\Policies\Mozilla\Thunderbird\DisableSafeMode = 0x1 | 0x0

Windows (Intune)

OMA-URI:

./Device/Vendor/MSFT/Policy/Config/Thunderbird~Policy~thunderbird/DisableSafeMode

Value (string):

<enabled/> or <disabled/>

macOS

<dict>
  <key>DisableSafeMode</key>
  <true/> | <false/>
</dict>

policies.json

{
  "policies": {
    "DisableSafeMode": true | false
  }
}

Compatibility

Policy/Property Name supported since deprecated after
DisableSafeMode 78.0  


DisableSecurityBypass

Prevent the user from bypassing security in certain cases.

InvalidCertificate prevents adding an exception when an invalid certificate is shown.

SafeBrowsing prevents selecting “ignore the risk” and visiting a harmful site anyway.

CCK2 Equivalent: N/A
Preferences Affected: security.certerror.hideAddException,browser.safebrowsing.allowOverride

Windows (GPO)

Software\Policies\Mozilla\Thunderbird\DisableSecurityBypass\InvalidCertificate = 0x1 | 0x0
Software\Policies\Mozilla\Thunderbird\DisableSecurityBypass\SafeBrowsing = 0x1 | 0x0

Windows (Intune)

OMA-URI:

./Device/Vendor/MSFT/Policy/Config/Thunderbird~Policy~thunderbird/P_DisableSecurityBypass_InvalidCertificate

Value (string):

<enabled/> or <disabled/>

OMA-URI:

./Device/Vendor/MSFT/Policy/Config/Thunderbird~Policy~thunderbird/P_DisableSecurityBypass_SafeBrowsing

Value (string):

<enabled/> or <disabled/>

macOS

<dict>
  <key>DisableSecurityBypass</key>
  <dict>
    <key>InvalidCertificate</key>
    <true/> | <false/>
    <key>SafeBrowsing</key>
    <true/> | <false/>
  </dict>
</dict>

policies.json

{
  "policies": {
    "DisableSecurityBypass": {
      "InvalidCertificate": true | false,
      "SafeBrowsing": true | false
    }
  }
}

Compatibility

Policy/Property Name supported since deprecated after
DisableSecurityBypass
DisableSecurityBypass_InvalidCertificate
DisableSecurityBypass_SafeBrowsing		 68.0  


DisableSystemAddonUpdate

Prevent system add-ons from being installed or update.

CCK2 Equivalent: N/A
Preferences Affected: N/A

Windows (GPO)

Software\Policies\Mozilla\Thunderbird\DisableSystemAddonUpdate = 0x1 | 0x0

Windows (Intune)

OMA-URI:

./Device/Vendor/MSFT/Policy/Config/Thunderbird~Policy~thunderbird/DisableSystemAddonUpdate

Value (string):

<enabled/> or <disabled/>

macOS

<dict>
  <key>DisableSystemAddonUpdate</key>
  <true/> | <false/>
</dict>

policies.json

{
  "policies": {
    "DisableSystemAddonUpdate": true | false
  }
}

Compatibility

Policy/Property Name supported since deprecated after
DisableSystemAddonUpdate 77.0  


DisableTelemetry

Prevent the upload of telemetry data.

As of Thunderbird 83 and Thunderbird ESR 78.5, local storage of telemetry data is disabled as well.

Mozilla recommends that you do not disable telemetry. Information collected through telemetry helps us build a better product for businesses like yours.

CCK2 Equivalent: disableTelemetry
Preferences Affected: datareporting.healthreport.uploadEnabled,datareporting.policy.dataSubmissionEnabled,toolkit.telemetry.archive.enabled

Windows (GPO)

Software\Policies\Mozilla\Thunderbird\DisableTelemetry = 0x1 | 0x0

Windows (Intune)

OMA-URI:

./Device/Vendor/MSFT/Policy/Config/Thunderbird~Policy~thunderbird/DisableTelemetry

Value (string):

<enabled/> or <disabled/>

macOS

<dict>
  <key>DisableTelemetry</key>
  <true/> | <false/>
</dict>

policies.json

{
  "policies": {
    "DisableTelemetry": true | false
  }
}

Compatibility

Policy/Property Name supported since deprecated after
DisableTelemetry 78.0  


DownloadDirectory

Set and lock the download directory.

You can use ${home} for the native home directory.

CCK2 Equivalent: N/A
Preferences Affected: browser.download.dir,browser.download.folderList,browser.download.useDownloadDir

Windows (GPO)

Software\Policies\Mozilla\Thunderbird\DownloadDirectory = "${home}\Downloads"

Windows (Intune)

OMA-URI:

./Device/Vendor/MSFT/Policy/Config/Thunderbird~Policy~thunderbird/DownloadDirectory

Value (string):

<enabled/>
<data id="Preferences_String" value="${home}\Downloads"/>

macOS

<dict>
  <key>DownloadDirectory</key>
  <string>${home}/Downloads</string>
</dict>

policies.json (macOS and Linux)

{
  "policies": {
    "DownloadDirectory": "${home}/Downloads"
}

policies.json (Windows)

{
  "policies": {
    "DownloadDirectory": "${home}\\Downloads"
}

Compatibility

Policy/Property Name supported since deprecated after
DownloadDirectory 78.0  


Extensions

Control the installation, uninstallation and locking of extensions.

While this policy is not technically deprecated, it is recommended that you use the ExtensionSettings policy. It has the same functionality and adds more. It does not support native paths, though, so you’ll have to use file:/// URLs.

Install is a list of URLs or native paths for extensions to be installed.

Uninstall is a list of extension IDs that should be uninstalled if found.

Locked is a list of extension IDs that the user cannot disable or uninstall.

CCK2 Equivalent: addons
Preferences Affected: N/A

Windows (GPO)

Software\Policies\Mozilla\Thunderbird\Extensions\Install\1 = "https://addons.thunderbird.net/thunderbird/downloads/somefile.xpi"
Software\Policies\Mozilla\Thunderbird\Extensions\Install\2 = "//path/to/xpi"
Software\Policies\Mozilla\Thunderbird\Extensions\Uninstall\1 = "bad_addon_id@mozilla.org"
Software\Policies\Mozilla\Thunderbird\Extensions\Locked\1 = "addon_id@mozilla.org"

Windows (Intune)

OMA-URI:

./Device/Vendor/MSFT/Policy/Config/Thunderbird~Policy~thunderbird~Extensions/Extensions_Install

Value (string):

<enabled/>
<data id="Extensions" value="1&#xF000;https://addons.thunderbird.net/thunderbird/downloads/somefile.xpi&#xF000;2&#xF000;//path/to/xpi"/>

OMA-URI:

./Device/Vendor/MSFT/Policy/Config/Thunderbird~Policy~thunderbird~Extensions/Extensions_Uninstall

Value (string):

<enabled/>
<data id="Extensions" value="1&#xF000;bad_addon_id@mozilla.org"/>

OMA-URI:

./Device/Vendor/MSFT/Policy/Config/Thunderbird~Policy~thunderbird~Extensions/Extensions_Locked

Value (string):

<enabled/>
<data id="Extensions" value="1&#xF000;addon_id@mozilla.org"/>

macOS

<dict>
  <key>Extensions</key>
  <dict>
    <key>Install</key>
    <array>
      <string>https://addons.thunderbird.net/thunderbird/downloads/somefile.xpi</string>
      <string>//path/to/xpi</string>
    </array>
    <key>Uninstall</key>
    <array>
      <string>bad_addon_id@mozilla.org</string>
    </array>
    <key>Locked</key>
    <array>
      <string>addon_id@mozilla.org</string>
    </array>
  </dict>
</dict>

policies.json

{
  "policies": {
    "Extensions": {
      "Install": ["https://addons.thunderbird.net/thunderbird/downloads/somefile.xpi", "//path/to/xpi"],
      "Uninstall": ["bad_addon_id@mozilla.org"],
      "Locked":  ["addon_id@mozilla.org"]
    }
  }
}

Compatibility

Policy/Property Name supported since deprecated after
Extensions
Extensions_Install
Extensions_Uninstall
Extensions_Locked		 68.0  


ExtensionSettings

Manage all aspects of extensions. This policy is based heavily on the Chrome policy of the same name.

This policy maps an extension ID to its configuration. With an extension ID, the configuration will be applied to the specified extension only. A default configuration can be set for the special ID “*”, which will apply to all extensions that don’t have a custom configuration set in this policy.

To obtain an extension ID, install the extension and go to about:support. You will see the ID in the Extensions section. I’ve also created an extension that makes it easy to find the ID of extensions on ATN. You can download it here.

The configuration for each extension is another dictionary that can contain the fields documented below.

Name Description
installation_mode Maps to a string indicating the installation mode for the extension. The valid strings are allowed,blocked,force_installed, and normal_installed.
        allowed Allows the extension to be installed by the user. This is the default behavior. There is no need for an install_url; it will automatically be allowed based on the ID.
        blocked Blocks installation of the extension and removes it from the device if already installed.
        force_installed The extension is automatically installed and can’t be removed by the user. This option is not valid for the default configuration and requires an install_url.
        normal_installed The extension is automatically installed but can be disabled by the user. This option is not valid for the default configuration and requires an install_url.
install_url Maps to a URL indicating where Thunderbird can download a force_installed or normal_installed extension. If installing from the local file system, use a file:/// URL. If installing from the addons.thunderbird.net, use the following URL (substituting SHORT_NAME from the URL on ATN), https://addons.thunderbird.net/thunderbird/downloads/latest/SHORT_NAME/latest.xpi. Languages packs are available from https://releases.mozilla.org/pub/thunderbird/releases/VERSION/PLATFORM/xpi/LANGUAGE.xpi. If you need to update the extension, you can change the name of the extension and it will be automatically updated. Extensions installed from file URLs will additional be updated when their internal version changes.
install_sources A list of sources from which installing extensions is allowed. This is unnecessary if you are only allowing the installation of certain extensions by ID. Each item in this list is an extension-style match pattern. Users will be able to easily install items from any URL that matches an item in this list. Both the location of the *.xpi file and the page where the download is started from (i.e. the referrer) must be allowed by these patterns. This setting can be used only for the default configuration.
allowed_types This setting whitelists the allowed types of extension/apps that can be installed in Thunderbird. The value is a list of strings, each of which should be one of the following: “extension”, “theme”, “dictionary”, “locale” This setting can be used only for the default configuration.
blocked_install_message This maps to a string specifying the error message to display to users if they’re blocked from installing an extension. This setting allows you to append text to the generic error message displayed when the extension is blocked. This could be be used to direct users to your help desk, explain why a particular extension is blocked, or something else. This setting can be used only for the default configuration.
restricted_domains An array of domains on which content scripts can’t be run. This setting can be used only for the default configuration.
updates_disabled (Thunderbird 89, Thunderbird ESR 78.11) Boolean that indicates whether or not to disable automatic updates for an individual extension.

CCK2 Equivalent: N/A
Preferences Affected: N/A

Windows (GPO)

Software\Policies\Mozilla\Thunderbird\ExtensionSettings (REG_MULTI_SZ) =

{
  "*": {
    "blocked_install_message": "Custom error message.",
    "install_sources": ["about:addons","https://addons.thunderbird.net/"],
    "installation_mode": "blocked",
    "allowed_types": ["extension"]
  },
  "uBlock0@raymondhill.net": {
    "installation_mode": "force_installed",
    "install_url": "https://addons.thunderbird.net/thunderbird/downloads/latest/ublock-origin/latest.xpi"
  },
  "https-everywhere@eff.org": {
    "installation_mode": "allowed"
  }
}

Windows (Intune)

OMA-URI:

./Device/Vendor/MSFT/Policy/Config/Thunderbird~Policy~thunderbird~Extensions/ExtensionSettings

Value (string):

<enabled/>
<data id="ExtensionSettings" value='
{
  "*": {
    "blocked_install_message": "Custom error message.",
    "install_sources": ["about:addons","https://addons.thunderbird.net/"],
    "installation_mode": "blocked",
    "allowed_types": ["extension"]
  },
  "uBlock0@raymondhill.net": {
    "installation_mode": "force_installed",
    "install_url": "https://addons.thunderbird.net/thunderbird/downloads/latest/ublock-origin/latest.xpi"
  },
    "https-everywhere@eff.org": {
    "installation_mode": "allowed"
  }
}'/>

macOS

<dict>
  <key>ExtensionSettings</key>
  <dict>
    <key>*</key>
    <dict>
      <key>blocked_install_message</key>
      <string>Custom error message.</string>
      <key>install_sources</key>
      <array>
        <string>about:addons</string>
        <string>https://addons.thunderbird.net/</string>
      </array>
      <key>installation_mode</key>
      <string>blocked</string>
      <key>allowed_types</key>
      <array>
        <string>extension</string>
      </array>
    </dict>
    <key>uBlock0@raymondhill.net</key>
    <dict>
      <key>installation_mode</key>
       <string>force_installed</string>
      <key>install_url</key>
      <string>https://addons.thunderbird.net/thunderbird/downloads/latest/ublock-origin/latest.xpi</string>
    </dict>
    <key>https-everywhere@eff.org</key>
    <dict>
      <key>installation_mode</key>
       <string>allowed</string>
    </dict>
  </dict>
</dict>

policies.json

{
  "policies": {
    "ExtensionSettings": {
      "*": {
        "blocked_install_message": "Custom error message.",
        "install_sources": ["about:addons","https://addons.thunderbird.net/"],
        "installation_mode": "blocked",
        "allowed_types": ["extension"]
      },
      "uBlock0@raymondhill.net": {
        "installation_mode": "force_installed",
        "install_url": "https://addons.thunderbird.net/thunderbird/downloads/latest/ublock-origin/latest.xpi"
      },
      "https-everywhere@eff.org": {
        "installation_mode": "allowed"
      }
    }
  }
}

Compatibility

Policy/Property Name supported since deprecated after
ExtensionSettings
ExtensionSettings_[name]
ExtensionSettings_[name]_blocked_install_message		 68.0  
ExtensionSettings_*
ExtensionSettings_*_installation_mode
ExtensionSettings_*_allowed_types
ExtensionSettings_*_blocked_install_message
ExtensionSettings_*_install_sources
ExtensionSettings_*_restricted_domains
ExtensionSettings_[name]_installation_mode
ExtensionSettings_[name]_install_url
ExtensionSettings_[name]_updates_disabled		 78.10.3  


ExtensionUpdate

Control extension updates.

CCK2 Equivalent: N/A
Preferences Affected: extensions.update.enabled

Windows (GPO)

Software\Policies\Mozilla\Thunderbird\ExtensionUpdate = 0x1 | 0x0

Windows (Intune)

OMA-URI:

./Device/Vendor/MSFT/Policy/Config/Thunderbird~Policy~thunderbird~Extensions/ExtensionUpdate

Value (string):

<enabled/> or <disabled/>

macOS

<dict>
  <key>ExtensionUpdate</key>
  <true/> | <false/>
</dict>

policies.json

{
  "policies": {
    "ExtensionUpdate": true | false
  }
}

Compatibility

Policy/Property Name supported since deprecated after
ExtensionUpdate 68.0  


HardwareAcceleration

Control hardware acceleration.

CCK2 Equivalent: N/A
Preferences Affected: layers.acceleration.disabled

Windows (GPO)

Software\Policies\Mozilla\Thunderbird\HardwareAcceleration = 0x1 | 0x0

Windows (Intune)

OMA-URI:

./Device/Vendor/MSFT/Policy/Config/Thunderbird~Policy~thunderbird/HardwareAcceleration

Value (string):

<enabled/> or <disabled/>

macOS

<dict>
  <key>HardwareAcceleration</key>
  <true/> | <false/>
</dict>

policies.json

{
  "policies": {
    "HardwareAcceleration": true | false
  }
}

Compatibility

Policy/Property Name supported since deprecated after
HardwareAcceleration 78.0  


InstallAddonsPermission

Configure the default extension install policy as well as origins for extension installs are allowed. This policy does not override turning off all extension installs.

Allow is a list of origins where extension installs are allowed.

Default determines whether or not extension installs are allowed by default.

CCK2 Equivalent: permissions.install
Preferences Affected: xpinstall.enabled

Windows (GPO)

Software\Policies\Mozilla\Thunderbird\InstallAddonsPermission\Allow\1 = "https://example.org"
Software\Policies\Mozilla\Thunderbird\InstallAddonsPermission\Allow\2 = "https://example.edu"
Software\Policies\Mozilla\Thunderbird\InstallAddonsPermission\Default = 0x1 | 0x0

Windows (Intune)

OMA-URI:

./Device/Vendor/MSFT/Policy/Config/Thunderbird~Policy~thunderbird~Addons/InstallAddonsPermission_Allow

Value (string):

<enabled/>
<data id="Permissions" value="1&#xF000;https://example.org&#xF000;2&#xF000;https://example.edu"/>

OMA-URI:

./Device/Vendor/MSFT/Policy/Config/Thunderbird~Policy~thunderbird~Addons/InstallAddonsPermission_Default

Value (string):

<enabled/>

macOS

<dict>
  <key>InstallAddonsPermission</key>
  <dict>
    <key>Allow</key>
    <array>
      <string>http://example.org</string>
      <string>http://example.edu</string>
    </array>
    <key>Default</key>
    <true/> | <false/>
  </dict>
</dict>

policies.json

{
  "policies": {
    "InstallAddonsPermission": {
      "Allow": ["http://example.org/",
                "http://example.edu/"],
      "Default": true | false
    }
  }
}

Compatibility

Policy/Property Name supported since deprecated after
InstallAddonsPermission
InstallAddonsPermission_Allow
InstallAddonsPermission_Default		 68.0  


PasswordManagerEnabled

Remove access to the password manager via preferences and blocks about:logins on Thunderbird 70.

CCK2 Equivalent: N/A
Preferences Affected: pref.privacy.disable_button.view_passwords

Windows (GPO)

Software\Policies\Mozilla\Thunderbird\PasswordManagerEnabled = 0x1 | 0x0

Windows (Intune)

OMA-URI:

./Device/Vendor/MSFT/Policy/Config/Thunderbird~Policy~thunderbird/PasswordManagerEnabled

Value (string):

<enabled/> or <disabled/>

macOS

<dict>
  <key>PasswordManagerEnabled</key>
  <true/> | <false/>
</dict>

policies.json

{
  "policies": {
    "PasswordManagerEnabled": true | false
  }
}

Compatibility

Policy/Property Name supported since deprecated after
PasswordManagerEnabled 78.0  


Preferences

Set and lock certain preferences.

CCK2 Equivalent: preferences
Preferences Affected: See below

| Preference | Type | Default | — | — | — | accessibility.force_disabled | integer | 0 |     If set to 1, platform accessibility is disabled. | browser.cache.disk.enable | boolean | true |     If false, don’t store cache on the hard drive. | ~browser.cache.disk.parent_directory~ | string | Profile temporary directory |     ~If set, changes the location of the disk cache.~ This policy doesn’t work. It’s being worked on. | browser.fixup.dns_first_for_single_words | boolean | false |     If true, single words are sent to DNS, not directly to search. | browser.safebrowsing.phishing.enabled | boolean | true |     If false, phishing protection is not enabled (Not recommended) | browser.safebrowsing.malware.enabled | boolean | true |     If false, malware protection is not enabled (Not recommended) | browser.search.update | boolean | true |     If false, updates for search engines are not checked. | browser.urlbar.suggest.bookmark | boolean | true |     If false, bookmarks aren’t suggested when typing in the URL bar. | browser.urlbar.suggest.history | boolean | true |     If false, history isn’t suggested when typing in the URL bar. | browser.urlbar.suggest.openpage | boolean | true |     If false, open tabs aren’t suggested when typing in the URL bar. | datareporting.policy.dataSubmissionPolicyBypassNotification | boolean | false |     If true, don’t show the privacy policy tab on first run. | dom.allow_scripts_to_close_windows | boolean | false |     If false, web page can close windows. | dom.disable_window_flip | boolean | true |     If false, web pages can focus and activate windows. | dom.disable_window_move_resize | boolean | false |     If true, web pages can’t move or resize windows. | dom.event.contextmenu.enabled | boolean | true |     If false, web pages can’t override context menus. | dom.keyboardevent.keypress.hack.dispatch_non_printable_keys.addl | string | N/A |     See https://support.mozilla.org/en-US/kb/dom-events-changes-introduced-firefox-66 | dom.keyboardevent.keypress.hack.use_legacy_keycode_and_charcode.addl | string | N/A |     See https://support.mozilla.org/en-US/kb/dom-events-changes-introduced-firefox-66 | extensions.blocklist.enabled | boolean | true |     If false, the extensions blocklist is not used (Not recommended) | geo.enabled | boolean | true |     If false, the geolocation API is disabled. | Language dependent | intl.accept_languages | string |     If set, preferred language for web pages. | network.dns.disableIPv6 | boolean | false |     If true, IPv6 DNS lokoups are disabled. | network.IDN_show_punycode | boolean | false |     If true, display the punycode version of internationalized domain names. | places.history.enabled | boolean | true |     If false, history is not enabled. | print.save_print_settings | boolean | true |     If false, print settings are not saved between jobs. | security.default_personal_cert | string | Ask Every Time |     If set to Select Automatically, Thunderbird automatically chooses the default personal certificate. | security.mixed_content.block_active_content | boolean | true |     If false, mixed active content (HTTP and HTTPS) is not blocked. | security.osclientcerts.autoload | boolean | false |     If true, client certificates are loaded from the operating system certificate store. | security.ssl.errorReporting.enabled | boolean | true |     If false, SSL errors cannot be sent to Mozilla. | security.tls.hello_downgrade_check | boolean | true |     If false, the TLS 1.3 downgrade check is disabled. | widget.content.gtk-theme-override | string | N/A |     If set, overrides the GTK theme for widgets.

Windows (GPO)

Software\Policies\Mozilla\Thunderbird\Preferences\boolean_preference_name = 0x1 | 0x0
Software\Policies\Mozilla\Thunderbird\Preferences\string_preference_name = "string_value"

Windows (Intune)

OMA-URI: (periods are replaced by underscores)

./Device/Vendor/MSFT/Policy/Config/Thunderbird~Policy~thunderbird~Preferences/boolean_preference_name

Value (string):

<enabled/> or <disabled/>

OMA-URI: (periods are replaced by underscores)

./Device/Vendor/MSFT/Policy/Config/Thunderbird~Policy~thunderbird~Preferences/string_preference_name

Value (string):

<enabled/>
<data id="Preferences_String" value="string_value"/>

macOS

<dict>
  <key>Preferences</key>
  <dict>
    <key>boolean_preference_name</key>
    <true/> | <false/>
    <key>string_preference_name</key>
    <string>string_value</string>
  </dict>
</dict>

policies.json

{
  "policies": {
    "Preferences": {
      "boolean_preference_name": true | false,
      "string_preference_name": "string_value"
    }
  }
}

Compatibility

Policy/Property Name supported since deprecated after
Preferences
Preferences_network.IDN_show_punycode
Preferences_browser.cache.disk.parent_directory		 68.0  
Preferences_browser.fixup.dns_first_for_single_words
Preferences_browser.urlbar.suggest.openpage
Preferences_browser.urlbar.suggest.history
Preferences_browser.urlbar.suggest.bookmark		 68.0 77.0
Preferences_accessibility.force_disabled
Preferences_browser.cache.disk.enable
Preferences_browser.safebrowsing.phishing.enabled
Preferences_browser.safebrowsing.malware.enabled
Preferences_browser.search.update
Preferences_datareporting.policy.dataSubmissionPolicyBypassNotification
Preferences_dom.allow_scripts_to_close_windows
Preferences_dom.disable_window_flip
Preferences_dom.disable_window_move_resize
Preferences_dom.event.contextmenu.enabled
Preferences_dom.keyboardevent.keypress.hack.dispatch_non_printable_keys.addl
Preferences_dom.keyboardevent.keypress.hack.use_legacy_keycode_and_charcode.addl
Preferences_extensions.blocklist.enabled
Preferences_geo.enabled
Preferences_intl.accept_languages
Preferences_network.dns.disableIPv6
Preferences_places.history.enabled
Preferences_print.save_print_settings
Preferences_security.default_personal_cert
Preferences_security.mixed_content.block_active_content
Preferences_security.osclientcerts.autoload
Preferences_security.ssl.errorReporting.enabled
Preferences_security.tls.hello_downgrade_check
Preferences_widget.content.gtk-theme-override		 78.0  


PromptForDownloadLocation

Ask where to save each file before downloading.

CCK2 Equivalent: N/A
Preferences Affected: browser.download.useDownloadDir

Windows (GPO)

Software\Policies\Mozilla\Thunderbird\PromptForDownloadLocation = 0x1 | 0x0

Windows (Intune)

OMA-URI:

./Device/Vendor/MSFT/Policy/Config/Thunderbird~Policy~thunderbird/PromptForDownloadLocation

Value (string):

<enabled/> or <disabled/>

macOS

<dict>
  <key>PromptForDownloadLocation</key>
  <true/> | <false/>
</dict>

policies.json

{
  "policies": {
    "PromptForDownloadLocation": true | false
  }
}

Compatibility

Policy/Property Name supported since deprecated after
PromptForDownloadLocation 78.0  


Proxy

Configure proxy settings. These settings correspond to the connection settings in Thunderbird preferences. To specify ports, append them to the hostnames with a colon (:).

Mode is the proxy method being used.

Locked is whether or not proxy settings can be changed.

HTTPProxy is the HTTP proxy server.

UseHTTPProxyForAllProtocols is whether or not the HTTP proxy should be used for all other proxies.

SSLProxy is the SSL proxy server.

FTPProxy is the FTP proxy server.

SOCKSProxy is the SOCKS proxy server

SOCKSVersion is the SOCKS version (4 or 5)

Passthrough is list of hostnames or IP addresses that will not be proxied. Use <local> to bypass proxying for all hostnames which do not contain periods.

AutoConfigURL is a URL for proxy configuration (only used if Mode is autoConfig).

AutoLogin means do not prompt for authentication if password is saved.

UseProxyForDNS to use proxy DNS when using SOCKS v5.

CCK2 Equivalent: networkProxy*
Preferences Affected: network.proxy.type,network.proxy.autoconfig_url,network.proxy.socks_remote_dns,signon.autologin.proxy,network.proxy.socks_version,network.proxy.no_proxies_on,network.proxy.share_proxy_settings,network.proxy.http,network.proxy.http_port,network.proxy.ftp,network.proxy.ftp_port,network.proxy.ssl,network.proxy.ssl_port,network.proxy.socks,network.proxy.socks_port

Windows (GPO)

Software\Policies\Mozilla\Thunderbird\Proxy\Mode = "none" | "system" | "manual" | "autoDetect" | "autoConfig"
Software\Policies\Mozilla\Thunderbird\Proxy\Locked = 0x1 | 0x0
Software\Policies\Mozilla\Thunderbird\=Proxy\HTTPProxy = https://httpproxy.example.com
Software\Policies\Mozilla\Thunderbird\Proxy\UseHTTPProxyForAllProtocols = 0x1 | 0x0
Software\Policies\Mozilla\Thunderbird\Proxy\SSLProxy = https://sslproxy.example.com
Software\Policies\Mozilla\Thunderbird\Proxy\FTPProxy = https://ftpproxy.example.com
Software\Policies\Mozilla\Thunderbird\Proxy\SOCKSProxy = https://socksproxy.example.com
Software\Policies\Mozilla\Thunderbird\Proxy\SOCKSVersion = 0x4 | 0x5
Software\Policies\Mozilla\Thunderbird\Proxy\Passthrough = <local>
Software\Policies\Mozilla\Thunderbird\Proxy\AutoConfigURL = URL_TO_AUTOCONFIG
Software\Policies\Mozilla\Thunderbird\Proxy\AutoLogin = 0x1 | 0x0
Software\Policies\Mozilla\Thunderbird\Proxy\UseProxyForDNS = 0x1 | 0x0

Windows (Intune)

OMA-URI:

./Device/Vendor/MSFT/Policy/Config/Thunderbird~Policy~thunderbird/Proxy

Value (string):

<enabled/>
<data id="ProxyLocked" value="true | false"/>
<data id="ConnectionType" value="none | system | manual | autoDetect | autoConfig"/>
<data id="HTTPProxy" value="https://httpproxy.example.com"/>
<data id="UseHTTPProxyForAllProtocols" value="true | false"/>
<data id="SSLProxy" value="https://sslproxy.example.com"/>
<data id="FTPProxy" value="https://ftpproxy.example.com"/>
<data id="SOCKSProxy" value="https://socksproxy.example.com"/>
<data id="SOCKSVersion" value="4 | 5"/>
<data id="AutoConfigURL" value="URL_TO_AUTOCONFIG"/>
<data id="Passthrough" value="<local>"/>
<data id="AutoLogin" value="true | false"/>
<data id="UseProxyForDNS" value="true | false"/>

macOS

<dict>
  <key>Proxy</key>
  <dict>
    <key>Mode</key>
    <string>none | system | manual | autoDetect | autoConfig</string>
    <key>Locked</key>
    <true> | </false>
    <key>HTTPProxy</key>
    <string>https://httpproxy.example.com</string>
    <key>UseHTTPProxyForAllProtocols</key>
    <true> | </false>
    <key>SSLProxy</key>
    <string>https://sslproxy.example.com</string>
    <key>FTPProxy</key>
    <string>https://ftpproxy.example.com</string>
    <key>SOCKSProxy</key>
    <string>https://socksproxy.example.com</string>
    <key>SOCKSVersion</key>
    <string>4 | 5</string>
    <key>Passthrough</key>
    <string>&lt;local>&gt;</string>
    <key>AutoConfigURL</key>
    <string>URL_TO_AUTOCONFIG</string>
    <key>AutoLogin</key>
    <true> | </false>
    <key>UseProxyForDNS</key>
    <true> | </false>
  </dict>
</dict>

policies.json

{
  "policies": {
    "Proxy": {
      "Mode": "none" | "system" | "manual" | "autoDetect" | "autoConfig",
      "Locked": true | false,
      "HTTPProxy": "hostname",
      "UseHTTPProxyForAllProtocols": true | false,
      "SSLProxy": "hostname",
      "FTPProxy": "hostname",
      "SOCKSProxy": "hostname",
      "SOCKSVersion": 4 | 5,
      "Passthrough": "<local>",
      "AutoConfigURL": "URL_TO_AUTOCONFIG",
      "AutoLogin": true | false,
      "UseProxyForDNS": true | false
    }
  }
}

Compatibility

Policy/Property Name supported since deprecated after
Proxy
Proxy_Mode
Proxy_Locked
Proxy_AutoConfigURL
Proxy_FTPProxy
Proxy_HTTPProxy
Proxy_SSLProxy
Proxy_SOCKSProxy
Proxy_SOCKSVersion
Proxy_UseHTTPProxyForAllProtocols
Proxy_Passthrough
Proxy_UseProxyForDNS
Proxy_AutoLogin		 68.0  


RequestedLocales

Set the the list of requested locales for the application in order of preference. It will cause the corresponding language pack to become active.

Note: For Thunderbird 68, this can now be a string so that you can specify an empty value.

CCK2 Equivalent: N/A
Preferences Affected: N/A

Windows (GPO)

Software\Policies\Mozilla\Thunderbird\RequestedLocales\1 = "de"
Software\Policies\Mozilla\Thunderbird\RequestedLocales\2 = "en-US"

or

Software\Policies\Mozilla\Thunderbird\RequestedLocales = "de,en-US"

Windows (Intune)

OMA-URI:

./Device/Vendor/MSFT/Policy/Config/Thunderbird~Policy~thunderbird/RequestedLocalesString

Value (string):

<enabled/>
<data id="Preferences_String" value="de,en-US"/>

macOS

<dict>
  <key>RequestedLocales</key>
  <array>
    <string>de</string>
    <string>en-US</string>
  </array>
</dict>

or

<dict>
  <key>RequestedLocales</key>
  <string>de,en-US</string>
</dict>

policies.json

{
  "policies": {
    "RequestedLocales": ["de", "en-US"]
  }
}

or

{
  "policies": {
    "RequestedLocales": "de,en-US"
  }
}

Compatibility

Policy/Property Name supported since deprecated after
RequestedLocales 68.0  


SSLVersionMax

Set and lock the maximum version of TLS.

CCK2 Equivalent: N/A
Preferences Affected: security.tls.version.max

Windows (GPO)

Software\Policies\Mozilla\Thunderbird\SSLVersionMax = "tls1" | "tls1.1" | "tls1.2" | "tls1.3"

Windows (Intune)

OMA-URI:

./Device/Vendor/MSFT/Policy/Config/Thunderbird~Policy~thunderbird/SSLVersionMax

Value (string):

<enabled/>
<data id="SSLVersion" value="tls1 | tls1.2 | tls1.3"/>

macOS

<dict>
  <key>SSLVersionMax</key>
  <string>tls1 | tls1.1 | tls1.2 | tls1.3</string>
</dict>

policies.json

{
  "policies": {
    "SSLVersionMax": "tls1" | "tls1.1" | "tls1.2" | "tls1.3"
  }
}

Compatibility

Policy/Property Name supported since deprecated after
SSLVersionMax 68.0  


SSLVersionMin

Set and lock the minimum version of TLS.

CCK2 Equivalent: N/A
Preferences Affected: security.tls.version.min

Windows (GPO)

Software\Policies\Mozilla\Thunderbird\SSLVersionMin = "tls1" | "tls1.1" | "tls1.2" | "tls1.3"

Windows (Intune)

OMA-URI:

./Device/Vendor/MSFT/Policy/Config/Thunderbird~Policy~thunderbird/SSLVersionMin

Value (string):

<enabled/>
<data id="SSLVersion" value="tls1 | tls1.2 | tls1.3"/>

macOS

<dict>
  <key>SSLVersionMin</key>
  <string>tls1 | tls1.1 | tls1.2 | tls1.3</string>
</dict>

policies.json

{
  "policies": {
    "SSLVersionMin": "tls1" | "tls1.1" | "tls1.2" | "tls1.3"
  }
}

Compatibility

Policy/Property Name supported since deprecated after
SSLVersionMin 68.0  


This site is open source. Improve this page.