Security

Security2026-10-16· By Franz Senn

Firefox Enterprise: what the console takes over and what the free Firefox already controls

Mozilla announced Firefox Enterprise on 12 October 2026, and the first version reached the channel on 13 October. Behind it stand the familiar Firefox and a management console the customer runs on their own network. We measured Mozilla's new policy reference against the open templates and our own visitor numbers. The finding: the controls everyone is talking about have sat in the free Firefox for years, and the convenient version of exactly those is now an Enterprise feature.

Sales of Firefox Enterprise start in France, Germany, Austria and Switzerland. As of 14 October 2026 you cannot pay for it yet, access runs through early access. (Quelle: Mozilla, product announcement of 12 October 2026)

What Mozilla promises

The announcement starts from dependency and calls the browser the layer missing from the sovereignty debate. Identity provider, SIEM and MDM stay, and only the management infrastructure for the browser moves to the customer. Mozilla gives about 200 million monthly Firefox users, a vendor figure with no independent source. Thunderbird Enterprise is announced, and the same console is meant to manage mail, calendar and contacts later.

The release notes for version 158.0 of 13 October describe what the console takes over. It manages users, sessions and organisational units, checks device posture and signs employees out when a device loses compliance. Remote settings, sync, telemetry, crash collection and browser updates come on top, all on the customer's infrastructure. Employees sign in with the company's single sign-on before they can browse. Mozilla names OpenID Connect including the provider's second factor.

There are also watermarks on sensitive pages, a lockdown mode with JIT compilation switched off and a separate container per site, encrypted profile data with the key from the console, an access connector acting as a proxy for internal sites without VPN, a minimum version for updates and a remote sign-out for lost laptops. Security events flow into your own console and are only active per category after enabling. These are vendor statements from the release notes too, and no independent test exists yet.

Ten policies exist only with the console

Mozilla recently maintains a separate administrator reference, last updated on 13 October 2026. A comparison on 14 October against the machine-readable templates in the open policy-templates repo, version 8.4 of 13 October, gives the difference. The reference lists 138 policies, the open schema contains 126 keys. Twelve keys appear only in the new reference, and ten of them are marked Not supported for normal Firefox and the ESR branch in the compatibility table and hang on the Enterprise channel:

Policy	First entry in the Enterprise channel	What it controls
AccessConnector	149	Internal sites and web apps without device VPN
AIChatbot	149	Chatbot panel and its provider
Sync	150	Sync engines for extensions, addresses and bookmarks
Watermark	154	Watermarks with address and time on defined sites
CrashReportsSubmit	154	Whether crash reports are uploaded at all
ContentAnalysisTelemetry	155	Report on the DLP agent
DataLossPrevention	155	Warn or block data actions per domain
DisableLocalPolicies	155	Console is the only policy source
SecurityLogging	156	Which security events are logged
SignOut	158	Sign-out when the browser closes or crashes

Two of the twelve keys are not Enterprise features. ClearOnShutdown works since Firefox 158 and in the Enterprise channel, and is missing in ESR. And EnterprisePoliciesEnabled, the master switch for policies at all, does not appear as a property in the JSON schema.

The DataLossPrevention key is the feature all the reports are about. It defines rules with the actions TextPaste, FileUpload, FileDownload and Print, plus domains, regular expressions for content, warn or block, and a message text of its own. If the engine cannot reach a verdict, FallbackResult applies and the default is block. The example in Mozilla's documentation warns when pasting into chatgpt.com and claude.ai. The catch in the comparison: for this policy normal Firefox and ESR say Not supported, so it comes with the channel and the console.

By the documentation's own note, DisableLocalPolicies cannot be set through policies.json, group policy or a macOS plist. Together that means the convenient domain rule and control over who sets policies at all both hang on the console.

One contradiction stands out. The release notes call version 158 the first release of Firefox Enterprise, while the compatibility tables of the same documentation list Enterprise features from 149 and 150. One of the two is a documentation error, and we attach no assessment to any number from it.

What the free Firefox has controlled for years

Data leaving through the browser is not a new problem. ContentAnalysis has been in normal Firefox since 125.0.1 and in ESR since 128 and talks to a DLP agent over the same protocol Google defined for Chrome. Intercepted by default are the clipboard, drag and drop, file uploads and printing. Download came later and is off there by default. If the connection to the agent fails, the default is rejection, the timeout is 300 seconds, and there is signature verification for the agent too. Without a running agent everything stays blocked when Enabled is set; anyone who does not want that sets DefaultResult to warn or allow.

AIControls, available since Firefox 149.0.2 and ESR 153, governs the browser's AI features: page translation, alt text in PDFs, tab group suggestions, bullet points in link previews, the chatbot panel and, since Firefox 150, window arrangement. Each key has available or blocked plus Locked against user changes. It covers Mozilla's own offering and does not reach the page of a third-party AI service. Anyone who wants to forbid ChatGPT and the like in the browser reaches for WebsiteFilter. It has existed since Firefox 60, works with match patterns and accepts at most 1000 entries per list.

All of these policies sit in the same open templates that also generate the ADMX file for group policy. Counting the file of 13 October gives 424 entries at 271 kilobytes, spread across policies.json, group policy, Intune OMA-URIs and the macOS plist. The free route is not poor, it is just manual work.

Two ways to stop the same action

Firefox Enterprise brings the built-in engine. The ContentAnalysis route is free and needs an agent on every device, or the outcome is rejection. (Quelle: Our own reading of the Mozilla policy documentation, as of 14 October 2026)

Both routes stop the same action, and the difference lies in operation. According to Mozilla the built-in engine computes on the device, so content crosses no network for the check. A third-party vendor with an agent of its own displaces it: if you set ContentAnalysis to Enabled, the browser ignores the DataLossPrevention rules. A company with grown DLP gains nothing new, it only gets one more place to maintain rules.

Our own count in the Umami database of senn-tech.com, 15 September to 14 October 2026, 1,738 sessions scaled to 1000. The Blink family includes Chrome, Chrome on iOS, both Edge branches, the WebView share and Yandex Browser. (Quelle: Our own measurement, Umami database senn-tech.com)

Engine diversity is Mozilla's second argument, and we can measure it. On our blog 92.6 percent of sessions run on the Blink engine, and Gecko reaches 4.7 percent. That is measured in the Umami database of senn-tech.com: one site, four weeks, with bot protection, and it says nothing about customer fleets. It does say something about the situation: anyone who wants browser diversity today does not buy a second product but sets up a second branch for the cases where a vulnerability in one engine hits the whole estate. A wholesale move from Edge or Chrome to Firefox is a training question for an SME with 30 workstations, not a licence question.

What stays open

Mozilla names no price. The support page distinguishes three tiers: Community without a contract, Standard as part of Firefox Enterprise with an email channel, portal and a shared contact person, and Premium at extra cost with a named technical contact and quarterly business reviews. The Dr. Windows report of 13 October also notes that concrete prices are missing.

The system requirements page of 14 October names only the client side: Windows 10 or later, macOS 10.15 or later, on Linux glibc 2.17 and GTK+ 3.14 or later, plus 2 GB RAM and 500 MB of space on Windows. What the console itself needs in servers, database, storage and upkeep is not publicly documented. For an SME calculation that leaves out the part that tips the decision, since the console also takes over sync, telemetry, crash collection and updates, as seen above.

On the AI governance page Mozilla cites four figures from the IBM Cost of a Data Breach Report 2026, among them 43 percent of companies with an incident caused by ungoverned AI use. IBM's page confirms the report and a record average damage figure, but we could not verify Mozilla's four individual numbers in that form at IBM. They remain a vendor quote.

The compliance labels DORA, GDPR, NIS2, ISO 27001 and SOC 2 on the trust centre page are a claim of suitability, not evidence. Mozilla links a document on shared responsibilities and a data flow description there, both last updated on 24 September 2026 and explicitly not legal advice. A NIS2 evidence list is not filled by that, and the duty to prove stays with the company.

What administrators and commenters say

The announcement ran on Hacker News with 776 points and 328 comments (thread on the product page) and with 28 points and 3 comments (thread on the Mozilla blog). We read the larger thread up to the start of the comment tree, roughly two thirds of the text, and give the positions in our own words. They are opinions of individual commenters.

Approval comes with the argument that an offering for companies is a sensible revenue path for Mozilla next to the search deals, and long overdue. Scepticism runs in three directions. Companies hardly pay for a browser while Chrome and Edge are available. Mozilla builds features nobody asked for. And ads and telemetry have damaged trust. From an operator's view one practical remark stands out: there is still no simple way to self-host the sync server without a Mozilla account, and no public price exists. A group of its own objects to the wording of the product page, which puts privacy, independence and control "first": that reads as if privacy were secondary in normal Firefox or sat behind a paywall. On the DLP feature itself and the licence we found no technical discussion in the part we read.

Independent reports come from heise online (in German), Dr. Windows (in German), Help Net Security, Linuxiac and It's FOSS. They carry Mozilla's statements, and none reports a test of the console of its own.

What you can set up this week

Anyone with Firefox in their estate can test the controls without buying anything. Add the ADMX files from version 8.4 to central policy management, enable EnterprisePoliciesEnabled and then make four decisions separately:

AIControls set to blocked with Locked for the browser's AI features nobody has approved.
WebsiteFilter with the AI sites unwanted in the house. Up to 1000 entries per list, exceptions as a second list.
Enable ContentAnalysis only together with an agent, otherwise the end state is blanket rejection and a standstill.
Fix the ESR branch and keep policies.json like any other configuration in a version repository.

A demo request makes sense once two things are published: a price and the requirements for the console. Until then the question of where employees' data flows when they paste into an AI service is answered, in our case, by the own AI stack, which needs no foreign site. Controls in the browser are the second stage, and most companies lack it, whichever browser they run.

How we measured

On 14 October 2026 we read the machine-readable schema file of the open policy-templates in version 8.4 (126 keys in the schema) and counted the ADMX file (424 entries, 271 kilobytes). Mozilla's reference lists 138 policies, and the difference is twelve keys. Ten of them carry the entry Not supported for normal Firefox and ESR in the compatibility tables. The browser split comes from the Umami database of senn-tech.com for 15 September to 14 October 2026 (1,738 sessions). We did not test the console's functions; there is no public trial.