From f16d9c5df8fd41e733e3f94457bc7a77cff757ee Mon Sep 17 00:00:00 2001 From: Brian Smith Date: Tue, 1 Sep 2026 10:12:38 +0200 Subject: [PATCH] feat: add doc page for EnterpriseStorageEncryption --- .vscode/project-words.txt | 1 + .../policies/EnterpriseStorageEncryption.mdx | 41 +++++++++++++++++++ 2 files changed, 42 insertions(+) create mode 100644 src/content/docs/reference/policies/EnterpriseStorageEncryption.mdx diff --git a/.vscode/project-words.txt b/.vscode/project-words.txt index 535290d..6c32c5f 100644 --- a/.vscode/project-words.txt +++ b/.vscode/project-words.txt @@ -37,6 +37,7 @@ Jamf jnlp knowledgebase ksecdd +libsecret localfilelinks managedfirefox mathml diff --git a/src/content/docs/reference/policies/EnterpriseStorageEncryption.mdx b/src/content/docs/reference/policies/EnterpriseStorageEncryption.mdx new file mode 100644 index 0000000..38202db --- /dev/null +++ b/src/content/docs/reference/policies/EnterpriseStorageEncryption.mdx @@ -0,0 +1,41 @@ +--- +title: "EnterpriseStorageEncryption" +description: "Enable an enterprise-managed primary password so that stored credentials and other sensitive profile data are encrypted at rest." +category: "Password manager" +--- + +Enable an enterprise-managed primary password to encrypt stored credentials and other sensitive profile data at rest. + +When enabled, Firefox retrieves a primary secret at startup and uses it to unlock its internal security token. +The secret is managed for the profile rather than chosen or entered by the user. +Data protected by that token is encrypted at rest using the secret, including: + +- **Saved logins.** Both the username and the password of each entry in `logins.json`. +- **Private keys in `key4.db`.** Client certificate keys and any other key material held in the software security device. +- **Saved payment methods on some platforms.** Card data is encrypted with the operating system keystore, which is [Keychain](https://developer.apple.com/documentation/security/keychain-services) on macOS and [Credential Manager](https://support.microsoft.com/en-US/Windows/Security/credential-manager-in-windows) on Windows. + Neither is affected by this policy. + On Linux without `libsecret`, and on platforms with no OS keystore, Firefox falls back to the internal security token, so this policy covers card data there. + +:::caution[Limitation] +If the primary secret cannot be retrieved, or the security token cannot be unlocked with it, Firefox quits during startup rather than running against a profile it cannot decrypt. +::: + +This policy does not affect **browsing data** such as history, cookies, or form history. +That data lives in the profile's SQLite databases, which have their own encryption controlled by `security.storage.encryption.sqlite.enabled`. +The `security.storage.encryption.sqlite.enabled` preference is enabled by default in Firefox Enterprise and is not configurable by policy. +Setting `security.storage.encryption.sqlite.enabled` manually to `false` on a profile whose databases are already encrypted will corrupt them. + +## Compatibility + + + +**CCK2 Equivalent:** N/A\ +**Preferences Affected:** `security.storage.encryption.enabled` + +## Examples + + + +## See also + +- [`PrimaryPassword`](/reference/policies/primarypassword/) policy requires a primary password that the user sets themselves.