Firefox Enterprise

Yep, we know how much work we need to here (I work at Mozilla leading new products and this is in my portfolio). We're being very deliberate about how we go after the opportunity and are focusing right on enterprises (in Europe to start) that can take advantage of what we can offer now, while we move quickly to add new features and capabilities to address a broader audience. I think we can get there!

Agreed. This is a great move by Mozilla - great timing, great vision, great potential for revenue.

Managing browsers - portals to almost every use and risk - is a PITA and I don't trust Chrome for confidentiality of data or users. Access to actual Mozilla personnel (engineers?) would be a big differentiator. But I wonder about a couple of things:

1) What are Edge and Safari management like? Are they competition here? If IT wants to move off Chrome to a management-friendly browser, the first thought would be the platform's native browsers which might integrate easily with native management.

2) How well does Firefox's management solution work? One-off management solutions for single applications have a bad history: They are often buggy, poorly designed (how much is Mozilla investing in UI design for this small number of users), complicated to learn, deploy (is this some sort of client-server? require another app client-side?), operate (what about WAN users? intermittent connections?), have poor features (multiple profiles? per-user or per-device? multiple users per device and multiple devices per user? group management? integration with other directory services - or do they reinvent the wheel and I need to input every update in multiple applications? multiple platforms? mobile apps?), manage (the management app needs management), etc. Does it reliably autodeploy or do I need to manually do something for each of my 10,000 users? Again, how much will Mozilla invest in this small group of users, the IT admins? I already have Microsoft's / Apple's native platform management solutions and those are enough of a headache.

I'd advise Mozilla to make it a delight for IT admins - immediately remove their fears of an additional headache in their busy days - and they will jump right in. As long as it works, I don't think users would care. Everyone, users and admins, is too busy.

So much of what you list is about controlling employees, it's just depressing. I would imagine the market wants surveillance of employees too?

> If you care about an open web browser, you should care about it having a sustainable revenue model.

This sounds like what someone called a self-licking ice cream cone. Make the web so complicated and unstable that you need a stupendously expensive browser development project releasing constant updates/upgrades. The alternative left behind was having a stable and not too fancy set of web standards, say basically HTML3, and then you wouldn't need a gigantic expensive bureaucracy to write a browser.

> preventing access to sites that distract employees and have zero business value (pornography, gambling, etc.)...

This is simplistic and almost certainly leads to overblocking.

Blocking a gambling domain sounds innocent on the surface but what if the gambling company publishes an article in their corporate blog to share how they solved a specific scaling problem or what money data modelling lessons they've learned?

It has happened to me more than once that I tried to read an article that was immediately relevant to my work but was denied access due to naive domain overblocking.

Please stop normalizing this shit.

I don't disagree with any of what you said about the value of an enterprise browser, but if a company is going to implement that, they're also going to want endpoint security that is functionally equivalent to everything you can do with Intune/MDM. The browser is just one part of it.

Still wild to me that people would gamble or look at pornography on a company computer

remember, this can be done to you.

They're selling delegated responsibility as a service. Seriously?

For general-purpose use this may be true. For specialized Web-based tools, like access to medical or legal systems, not as much: the users are conditioned to work with a specific browser (many remember MSIE-only apps), and are used to the idea that their workstation has all kinds of Internet access limitations, along with a corporate policy that expressly forbids arbitrary browsing.

[Edited: typo]

I've found this to be one of those issues that just seems completely normal when you first hear it but when you dig into the actual users, the "why" starts to get lost.

My anec-data on the subject seems to imply it affects a very specific segment of people: The "I only use a (usually Windows) computer at work" folks. The odd part of that is that almost all of them seem to own iPhones or iPads (specifically not Android devices) and since they use these devices, exclusively, outside of work and one can assume they're probably opening Safari for browsing, why do they have such a strong association that Chrome must be "the browser." This segment, though, seems to make up a large majority of "knowledge workers" outside of IT.

Now, like probably a lot of us here, I'm the tech support for everyone who knows I "play with computers professionally." One of the first things I do is remove the Chrome and Edge icon from the task bar[0] and add Firefox with a small set of extensions that generally keep me from having to revisit them due to malware. I usually just tell them "The button you use to get on the Internet changed but it's the same." ... and Bob's your uncle. I return a year later, the same Firefox icon is in the same place, updated several versions and all is well. They all vaguely knew they were using something different before, some knew it was called Chrome or Edge, but "the icon changed" is all I've had to say for probably a decade since the two browsers' core functionality is close enough that they generally cover every site the older generation would be expected to visit.

It feels like a variation of "they've got enough knowledge to be dangerous."

[0] I don't think I've ever seen my parents, aunts/uncles, extended older family every try to find a program through that menu that pops up when you click the button that used to be called the "Start" button. :)

> people are going to try and install Chrome at all costs

Mozilla might have anticipated this when they wrote "Diversify your browser engine" as one of the selling points.

https://www.firefox.com/en-US/enterprise/firefox-enterprise/...

Diversification is a good idea, personally I use both Chrome and Firefox every day (and sometimes Lynx).

An earlier company I worked at had this same issue with Internet Explorer. It was after IE had been deprecated by microsoft as a browser but our IT department still had it as a downloadable application. Most of my team's on-call issues were from internal users using IE to access our site, even after we added an IE compatible popup that would tell them NOT to use IE.

Change the icon to look like Chrome?

In my workplace a lot of people used to like firefox because it was the only browser on which the pac proxy setting was not enforced by group policy so it allowed them to have their corporate apps to actually work regardless of the network they were connected to.

They lost fierefox a few months ago due to new compamy policy and with it lost access to some apps when working from home. We know it is related to the proxy config but company is so big and processes are such a mess nobody knows who should be contacted and by which email alias or service now ticket.

I'm so old I still feel like Chrome is new.

It's a very easy problem to solve if you do it right - tie Conditional Access policies to you using the correct browser.

This is what the Island browser does - you can't log into any company resource unless you do so from the authorized browser.

Firefox works with uBlock--maybe that alone is enough incentive

We used to install FF and Chrome on the local PCs at work to ensure this would not be an issue. The office workers just used Edge.

It's "The Internet Icon".

I tried for a year to use it before just switching to Brave and getting the best of both worlds.

Also, half the sites on the Internet don’t work properly on anything but chrome. At home, I’m an ardent and committed Firefox user, at work, I use Chrome like everyone else (and keep anything personal as far away from it as I can).

Is there a notable difference between Firefox Enterprise and standard Firefox with group policy management[0]?

[0]: https://support.mozilla.org/en-US/kb/customizing-firefox-usi...

There are already some controls in place available, but they are often platform-specific (GPOs on Windows, Configuration Profiles on macOS) than can be pushed through Active Directory, Intune, Ivanti, etc, but this does remove some friction and configuration gaps where you can centrally manage those policies in a single location.

You'll still likely need to push something like an enrollment token for Chrome (ex: https://support.google.com/chrome/a/answer/9301891 ), but then the rest is done through the Firefox Enterprise console.

The large business I work for cited low usage when they blocked it from being installed a couple of years back.

That's weird. I used to work in a very secure facility (think actual air-gapped supercomputers where network access is building-LAN only) and Firefox was the only approved browser.

Large companies' IT departments claim a lot of reasons for their policies. Often the underlying reason is unstated, and has more to do with convenience of governance or with sales relationships.

I'd rather not have Firefox installed, than Firefox preloaded with MitM certificates, disabled uBlock Origin, Proxy Switcher, added Adobe, Copilot, and a few more "useful" extensions and security add-ons that can't be disabled, and so on.

If company IT gets hold of Firefox, it's not better than just using Edge or Chrome that comes by default.

If my company would tell me what browser should I use for work, I would look away from it. Fortunately all the companies I worked for didn't care what browser I use (even most people used Firefox anyway).

Nobody needs 2 browsers to support on locked down computers. There's no increase in functionality apart from making between 0 and 1 extremely niche users slightly more happy (but not more capable).

Yeah, they have the brand name already. Can sell to large traditional orgs like hospitals, governments, and etc.

20 years later they are finally taking Enterprise seriously. I still remember how hard it was to push Mozilla just to support Windows Group Policy along with other enterprise requirements and they were simply not interested in enterprise. Even though later they did some bare minimum to support it.

Well, you read one of their goals and visions here. That part is ok.

The question is: how is that goal turning out once it meets reality?

Tons of great ideas failed for various reasons. Alan Kay keeps on pointing out how sad he is that Xerox PARC failed in many ways. Reality is a strong selector - and the evil Google empire will make competition really, really hard here.

Are those customers from Germany maybe? Germany has really high Firefox market share compared to basically any other country.

people who decide on policy tend not be the same people on the ground doing real work. Therefore management makes a policy, they think they are doing the correct thing, when in actual fact, they're not, but just don't hear or get the right type of feedback (including feedback they trust to be real and isn't just the workers complaining/whinging unnecessarily).

This type of dysfunction occurs quite frequently i find.

Non-Technical users are complaining to you about how they want to use Firefox? What?

as the family techie, I recommend tech and that's what sticks with them. Recently, it's Firefox.

I wouldn't be surprised if those people had some techie in their life advising similar! and/or, they just really want decent adblock tech.

> The company I work for is trying to phase out Firefox

Why?

Or that's how they got around your corporate IT browser blocks

> Basically, instead of doing DLP/URL filtering/risk management on a MITM box, they're pushing it to the browser. This helps remove the need for TLS decryption, and the need to funnel their browser traffic to any particular tunnel endpoint.

This is where it should have been done in the first place instead of breaking TLS and creating enormous risks when that corporate MITM private key goes for a walk.

I think that these DLP/content inspection solutions should not be preferred as a first line or blanket solution because they are inherently risky and can easily be deployed wrong. Not to mention creating big privacy and security risks for users, such as when someone wants to check their bank balance from their work machine.

But in cases where there is a clear benefit when dealing with highly sensitive information, doing this inspection right in the browser is the least worst option from a security perspective when it is correctly integrated with the browser and not hacked on.

Native DLP is specifically listed as a feature FYI, also mentions compatibility with Broadcom and Trellix.

Edit: "website filtering" too

What do you specifically mean with "risk management"? Device posture?

I think we hit all the features you mention but not sure about the above.

Right?!? There's a lot of negative sentiment on the comments here on HN but probably from people that don't understand locked down corps and other higher-security work environments where these features are needed. Plus not relying on Microsoft/Google is always a good thing. I can definitely see this being useful in hospitals, government orgs, etc.

Not only revenue but enterprise users are valuable market share. Think of things like Slack calling which last I checked don't work in Firefox unless you spoof the user-agent. More enterprise users will force better Firefox support in a huge variety of websites which will benefit all Firefox users.

Yes, this is good move. I am not getting why are people being up in arms, if they are getting fund from this, it will help improving Firefox, and resolve pain points the complainers have.

All in all good thing, why are they so mad.

Well, just install the fucking extension in Firefox. There is nothing else that is as good as uBlock Origin. E.g. Reddit prevents you from reading unless you log in? There's a filter for that in an "annoyances" block-list that you can activate.

This feature ships in Firefox for a few years IIRC? https://support.mozilla.org/en-US/kb/enhanced-tracking-prote...

I agree with the other person though that you should install uBlock Origin in Firefox (which works better there than in Chromium based browsers) and never look back.

Firefox supports policies for enterprise deployment, the ability to install extensions (like uBO) has been available for a long time:

https://mozilla.github.io/policy-templates/#extensions

https://github.com/gorhill/uBlock/wiki/Deploying-uBlock-Orig...

Is this a real question?

It takes literally two seconds to install uBlock Origin.

You can even preload it by baking in the xpi file.

It doesn't ship with a blessed adblocker, but firefox + ubo is still the gold standard.

If you are unable / unwilling to install an extension, Librewolf includes and enables uBlock Origin by default.

https://librewolf.net/

It is a Firefox fork with sane, user-respecting defaults. Of course it breaks sites that do not respect their users' privacy / agency.

If its first concern why would you use a browser that has ben caught injecting affiliate codes?

Mozilla as an organisation is rotten and genuinely needs to die, so that Firefox can live. The only thing from Mozilla that people care about is Firefox, but Mozilla doesn’t care about Firefox to a quite stunning degree. As an example: four or five years ago they announced laying off a quarter of their 1,000 employees, and declared what they were going to be focusing on: none of it was related to Firefox in any way (and most of it they’ve since shut down). And it should go without saying that you don’t need 750 employees to make a browser, and probably can’t effectively use even a hundred.

I guess it's the age old "people want everything for nothing" anti-capitalism trope that never actually works out in their favor.

You can't think of an enterprise that doesn't want all of its web browsing metadata collected by third parties? Some enterprises are much more security-conscious than that. I have seen protected paper trash bins in a research lab and office buildings with X-ray scanners (mainly for electronic devices, not weapons).

There's already Island browser that competes in this space. Plenty of companies pay for browser control that goes beyond what the normal policies can provide.

Governments come to mind. European ones, especially.

You can already turn everything off under Settings -> AI Control. Personally I keep Translations on so I can translate locally instead of calling external services.

They list this as a feature in the submission page.

There are no such plans.

(Regardless of one's feelings about generative AI, I think some features like local translation or alt text are too nice to be labeled "LLM shit", but I admit I am biased)

No, why would you think that?

No. Are you thinking that was a feature intended to appeal to corporate use or something? I'm pretty sure it was all about AI backlash. It's still a popular setting to have available. (I have no idea how many people actually use it.)

Someone dropped the following link, which seems to have way more detail than the press releases: https://www.firefox.com/en-US/firefox/enterprise/158.0/relea...

It looks like they do actually offer that as a feature: "Employees can access internal company sites and web apps from personal devices without a device-level VPN"

Edit: To give proper credit, the link is from Heise.de

Hopefully they still can. Healthy Firefox == healthy browser market.

Firefox Enterprise does include similar functionality :-)

Here's an easier way to view the release history: https://support.mozilla.org/en-US/products/firefox-enterpris...

You can pretty much see Firefox Enterprise as the easy-to-use, supercharged version of this + optional on-premise deployment of sync etc.

I don't know. Like another comment here says, some companies have been blocking Firefox because it's difficult to bend it to their will. For them, a browser has always meant one thing: Chrome. With Firefox entering the mix now, it's going to be 'yet another browser when we already have one'. Most corporate admins, I'd think, will say 'no, thanks'.

I once had to work with group policy FF that prevented me from configuring the way FF started. I wanted it to keep the session, but instead it always started with a blank slate. Mind-blowingly stupid.

Yes. You have some control by including/excluding certain sites from the rules, i.e. you could exclude common shopping sites from the CC rules, and we imagine most folks trying to stop (accidental) exfil through AI chatbots are going to block most common providers there.

Warning (instead of blocking) is possible. Due to the security logging (plus, if wanted, SIEM integration) you get the flagging.

Can you run data through a local or corporately-situated LLM instructed to "Assess whether this looks potentially sensitive" via a given set of rules, and flag it to the user or a supervisor to proceed/abort?

Not in the first version, but this is an area we are working in.

what kind of hooks and feedback/UI interaction is available for third party integrations?

We support the standard SDK for this which is also used by Chromium based products:

https://hacks.mozilla.org/2025/03/improving-firefox-stabilit...

That's how Trellix and Broadcom integrate with it as well.

a) it's much easier to work with b) you have much more monitoring possibilities c) it adds a pile of features d) you can host all supporting services (sync, updates, telemetry, etc) on premise - if you want

The current policies are not very enterprise-friendly yet.

Some settings are flat out refused (for "security reasons"). And with each new update there are a few new popups / invitations to try this new feature / re-enabling the v2 of the thing of which the v1 was already opted out in the policy. And it seems like you cannot apply new policy while the browser is running - meaning it cannot be used to roll out hotfixes without interrupting the work of currently unaffected workstations.

And then there is the syncing. If you want to manage & sync history, bookmarks and the password managers content.. you are probably going to find that easier by overriding the builtin features with 3rd-party extensions, as the builtin sync feature is very much tailored to the needs of privately owned devices and one-device-at-a-time usage patterns.

The last paragraph says the exact opposite of the first.

The number of people using web browsers has gone up massively though over the past 15 years. 2%-3% right now isn't as bad as it would have been in the past

Its 5.3% on desktop the same as Safari. I wonder what this means in real numbers.. perhaps hundreds of millions? That's not bad.

What do ad/tracker extensions do to that stat tracker?

It's enterprise, so the cost is 500k unless you don't want to pay so much, then it's 50k.

That's how you know it's enterprise!

If you have to ask the question, you're probably not going to like the answer.

Look at what Chrome Enterprise can do: whitelist/blacklist extensions and add-ons, force-install extensions, centralized history logging, configurable data loss prevention (e.g., red alert when someone uploads "confidential-financials-2026Q4.xlsx" to Claude), SSO configuration, and endpoint verification just off the top of my head.

Having an offering in this space would be one of the most sensible decisions the Mozilla Foundation has made in recent history.

No such thing. Business, like history, goes in circles.

I'm working on a demanding project that has performance as a fundamental requirement. Unfortunately Firefox turned out to be disappointing: audio/video codecs not supported or supported badly, and decidedly poor performance. Chrome instead is decidedly on another level. My opinion is that firefox prefers the road of features, neglecting the care of performance, and maybe this also depends on the fact that Mozilla doesn't have a big company behind it like chrome has google. It's a big problem, because on this road I don't see a great future for firefox, and we would end up on a road of de facto monopoly, which is not good for anyone.

Haven't had any reason to not use firefox since quantum

There have been a ton of upgrades to Thunderbird in the past year or so. When did you last look into it?

It's a paid product aimed at the Enterprise market.

Are you using, or planning to use, the Enterprise version, and feel like this functionality is missing? Or is the complain about the regular release? I'm asking because I fail to see the link...

Part of the sales pitch of Firefox Enterprise is that the management console includes a sync server that you can run on premise.

They need to try. I also feeling like there’s likley growing demand globally; like they mentioned. A need for greater digital sovereignty.

> Once again Mozilla invents stuff noone wants.

https://connect.mozilla.org/t5/discussions/phasing-out-the-o...

It's income they don't really earn.

Like a rich kid living on daddy's money, they're somewhat disconnected from the reality that most people exist in.

Only browser with an independent engine? Everything else is a Chromium reskin these days.

That just sounds like generic marketing-speak to me. That stuff never did mean anything.

>Professional Support included — private triage and defined response times

This one sounds new to me.

What do you dislike about this announcement?

Pretty sure that's Firefox in contrast to the other alternatives in the Enterprise space.

No, they do not infact hate pancakes.

... That doesn't make any kind of sense whatsoever. Firefox puts customer privacy first, now that includes enterprise customers. Like how do you even possibly come to this conclusion. Mind boggling.

"control first" to the IT department instead of the user.