Firefox Enterprise Is Here. How to Get Its AI Controls Free with policies.json

Posted on Oct 16 • Originally published at blog.authon.dev

If you run plain Firefox, at home or on a fleet of laptops managed with a policies.json file, Firefox Enterprise takes nothing away from you. Mozilla is charging for a self-hosted management console and the security features built around it. The browser stays free, and the AI lockdown Mozilla lists as an enterprise feature already works today through the free AIControls policy in policies.json. What Mozilla won't tell anyone yet is the price, which is a strange choice when Google prints $6 per user per month on its own product page and gives its basic console away for $0.

Mozilla announced Firefox Enterprise on October 12, 2026. I went through the announcement, the two product pages, Mozilla's policy docs and the Lobsters thread where people are already fighting about it. Below is what the paid product adds, what the free browser keeps, and how it compares with Chrome Enterprise and Edge for Business.

The announcement covers the Firefox browser, the Gecko engine it's built on, and a management console "organizations can run on their own infrastructure."

The Firefox Enterprise landing page lists what that console gets you:

The product detail page adds device-posture gating, corporate SSO integration, and a way for content analysis tools you already run, like Trellix and Broadcom, to extend into the browser. It also claims tiered access for managed and unmanaged devices "without MDM, VPN or EDR".

Sales start in France, Germany, Austria and Switzerland, with more markets to follow. Thunderbird Enterprise is in development. There's no public price for either: the product page says "a subscription model" and the only call to action is a "Request a Demo" form.

Nothing in the announcement or on the product pages says anything changes for the roughly 200 million people who use Firefox every month. The free enterprise tooling Firefox has had for years is still documented and shipping:

The policy engine is the part to watch. Whatever the console does to the browser presumably ends up as policy on the client, and today that client side is open, documented and free, with AI controls already built in.

If AI governance is what's pushing your security team toward a paid product, look at what the free policies already cover. The AIControls reference lists keys for Default, Translations, PDFAltText, SmartTabGroups, LinkPreviewKeyPoints, SidebarChatbot, SmartWindow and SpeechRecognition. Each takes a Value ( "available" or "blocked" ) and a Locked boolean. Blocking an on-device feature also deletes the models it already downloaded. It needs Firefox 149.0.2 or later.

On Linux, put this in /etc/firefox/policies/policies.json:

{ "policies": { "DisableTelemetry": true, "AIControls": { "Default": { "Value": "blocked", "Locked": true } } } } Enter fullscreen mode Exit fullscreen mode On Windows, the file goes in a distribution folder next to firefox.exe. On macOS it goes in Firefox.app/Contents/Resources/distribution. Restart Firefox, then open about:policies to check that it loaded.

One gotcha: the old policy-templates page now opens with a warning that it is "NOT current". Policy behavior and syntax have moved to the Firefox administrator reference. Read the entry there before you lock anything fleet-wide.

That covers the policy part of Firefox Enterprise for $0. What the free route doesn't give you is a central console, reporting, DLP, SIEM export or someone at Mozilla to call.

Mozilla looks weakest here, and not only on price.

Google gives away the kind of console Mozilla is charging for. Chrome Enterprise Core lets you set policies, force-install and pin extensions, and get version reporting from the cloud for nothing. Google only charges for DLP and zero-trust access, in Premium. Microsoft's Edge management service sits inside the Microsoft 365 admin center with no separate price listed, and covers policies, extensions and AI features.

Mozilla can't win on features per dollar, so the pitch is about where things run: the console sits on your hardware, its data stays inside your boundary, and the engine isn't Chromium. CEO Anthony Enzor-DeMeo puts it as "If all your options are built with the same technology underneath, 'choice' is a lie." For a German ministry working through NIS2 and DORA, both of which Mozilla lists on the enterprise page, that argument beats any feature checklist. For a 40-person startup on Google Workspace it's irrelevant.

The enterprise page says standard support "is included with Firefox Enterprise, and is available as a paid upgrade if you're using Firefox as your company's browser." That part isn't new. Heise reported in November 2025 on "Firefox Support for Organizations", which started in January 2026 with a private ticket channel, defined response times and discounted custom feature work, and Mozilla said then that public support would stay free.

I have no problem with a paid support desk. I'd have a problem if fixes for paying customers started landing faster than fixes for everyone else. Mozilla hasn't said that will happen and I've seen no evidence it will, but Mozilla has asked people to take things on trust before.

The Lobsters thread splits about how you'd expect. One commenter says their job "outlawed Firefox and made Chrome our exclusive browser precisely because Firefox didn't have an Enterprise offering," which is about the best case for this product existing. The top comment says Mozilla "need[s] a non-Google revenue stream", and that's fair: It's FOSS notes Mozilla "still depends on Google through its search partnerships", and enterprise sales won't replace that money soon.

The other side is about leadership: the CEO pay complaint, the IoT and AR/VR detours, and a pointed observation that Mozilla is a US company selling sovereignty to Europe. A Mozilla engineer in the thread says "most of the code is open source", which prompted the obvious follow-up about releasing the rest. It's FOSS makes the same point: "Self-hosted doesn't automatically mean open source." Nobody has confirmed whether the console source will be published. If Mozilla wants the Lobsters crowd on side, that's the cheapest win available.

My take: I'd rather Mozilla make money from IT departments than from ad tech experiments. The structure looks right, with the browser and policy engine free and a paid console and SLA for orgs that need one. What bothers me is how opaque it all is: there's no pricing, no console source, and no written promise that the free policy engine stays complete. If Mozilla published those, I think most of the suspicion would go away.

The same Mozilla engineer replied to the "we got banned" story with: "Would be cool if they told us what's missing." So I'll ask here. If your company dropped Firefox for Chrome or Edge, what was the actual blocker, and would a self-hosted console with no public price change that decision?