How to Enable Windows SSO in Firefox Using Microsoft Intune

Firefox Windows SSO allows users to seamlessly authenticate to supported enterprise web applications using their existing Windows sign-in credentials. This helps simplify access to Microsoft and other supported work applications without repeatedly entering credentials.

In this guide, we’ll explore how Firefox Windows SSO works and how administrators can enable and configure it using enterprise policies through Microsoft Intune.

How Does Firefox Windows SSO Work?

• Firefox can use the Windows sign-in credentials for supported Microsoft, work, and school account authentication.
• Administrators can enable or disable the functionality through the Firefox WindowsSSO enterprise policy.
• The policy controls the browser setting and locks it against user modification.
• Successful authentication also depends on the Windows sign-in context and the authentication requirements of the target application.

Why Enable Firefox Windows SSO?

In managed enterprise environments, users often access multiple work applications through different browsers. Without SSO, they may need to enter their credentials repeatedly, creating unnecessary interruptions.

Enabling Firefox Windows SSO helps provide a more consistent sign-in experience for users who access supported enterprise applications. It also allows organizations to extend their existing Windows authentication configuration to Firefox.

Key Benefits

• Simplified sign-in: Reduces repeated credential entry for supported authentication scenarios.
• Consistent browser experience: Provides similar SSO capabilities across Firefox and other enterprise browsers.
• Improved productivity: Minimizes interruptions when accessing work applications.
• Reduced support overhead: Can help reduce helpdesk requests related to repeated sign-in prompts.
• Centralized management: Administrators can configure and enforce the setting using Firefox enterprise policies through Microsoft Intune.

Prerequisites

You need to ensure the following prerequisites are met before enabling Windows SSO in Firefox,

• Operating System: Windows 10 or Windows 11.
• Firefox Version: Version 91 or newer.
• Accounts: Microsoft, work, or school accounts linked to Windows.
• Administrative Rights: Required if deploying via Intune or Group Policy.

Enable Windows SSO Manually

You can manually configure SSO in Mozilla Firefox by following the steps below. This is useful when your organization has not configured SSO for Firefox, and you want to enable that. Please note that you will not be able to change this option if your organization has enabled or disabled Windows SSO for Firefox through Microsoft Intune or Group Policies.

• Open Firefox.
• Click the menu button (≡) located at the top-right corner of the browser window.
• Select Settings from the dropdown menu.
• Navigate to the Privacy & Security panel on the left sidebar.
• Scroll down to the Logins and Passwords section.
• Check the box next to Allow Windows single sign-on for Microsoft, work, and school accounts to enable the feature.
• Close the settings tab.
• Restart Firefox to apply the changes and ensure the SSO feature is active.

Deploy Firefox Windows SSO Using Microsoft Intune

Method 1: Imported ADMX Templates

Follow the steps below to configure Windows SSO in Firefox for managed devices using Microsoft Intune.

Step 1: Download and Import Firefox AMDX templates

Download the latest Firefox ADMX templates from the official Mozilla website. The Firefox policy template depends on both the Mozilla.admx and Windows.admx files, so make sure these required ADMX templates are also imported into Microsoft Intune before configuring Firefox policies. You can follow my other guide How to Import ADMX and ADML Templates into Microsoft Intune to know steps by steps instruction for ADMX import.

Step 2: Create Configuration Profile

• Open the Intune Admin Portal and navigate to Devices > Windows > Configuration profiles.
• Click Create profile and select Windows 10 and later as the platform.
• Choose Templates > Imported Administrative Templates (Preview) to create a new policy.
• Provide an appropriate name & description for the policy and click on Next to create the profile.

Step 3: Add Firefox Setting

• In the profile wizard, click Add settings.
• Search for Firefox (appears after ADMX import).
• Search for Windows SSO and select the policy Windows SSO from the results.
• Select Enabled and click on Ok to turn on the settings.
• Select Next.

Step 4: Assign the Profile

Assign the profile to the target All Devices, All users, Entra ID groups. You can also use Assignment filters for granular targeting of the deployment.

Monitor deployment status and troubleshoot any issues via Intune reporting tools.

Method 2: Custom OMA-URI

Step 1: Create a Configuration Profile

• Sign in to the Microsoft Intune admin center.
• Navigate to Devices > Manage devices > Configuration.
• Select Create > New policy.
• Configure the following settings:

Click Create.

Step 2: Configure the Custom OMA-URI Setting

• Enter a suitable profile name, such as Firefox Windows SSO Configuration.
• Optionally, provide a description.
• Under Configuration settings, click Add.
• Enter the following configuration:

OMA-URI configuration

NAME: Firefox Windows SSO

DESCRIPTION: Enables Windows Single Sign-On in Mozilla Firefox for Microsoft, work, and school accounts.

OMA-URI: ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox/WindowsSSO

DATA TYPE: String

VALUE: Enabled

• Click Save to add the configuration setting.

Step 3: Assign the Configuration Profile

• Navigate to the Assignments tab.
• Select Add groups under Included groups.
• Select the device or user group that should receive the policy.
• Review the assignment configuration.
• Click Next and then Create.

Verify Firefox Windows SSO Deployment

Once Windows SSO is enabled in Firefox:

• Users accessing Microsoft 365 services such as Outlook, Teams, and SharePoint will be automatically signed in using their Windows credentials.
• Users will no longer be prompted repeatedly for usernames and passwords, streamlining access.
• This seamless authentication improves productivity and reduces login friction in enterprise environments.

Open Firefox on the device and follow the steps below to verify the policy.

• Open Firefox.
• Click the menu button (≡) located at the top-right corner of the browser window.
• Select Settings from the dropdown menu.
• Navigate to the Privacy & Security panel on the left sidebar.
• Scroll down to the Logins and Passwords section.
• Check the box next to Allow Windows single sign-on for Microsoft, work, and school accounts to enable the feature.

You can notice that the “Allow Windows Single Sign-on for Microsoft, work, and school accounts” option is now enabled and grayed out. The policy is now applied through Intune, and users won’t be able to change the settings.

Troubleshooting Firefox Windows SSO

If Firefox Windows SSO is not working as expected, follow the troubleshooting steps below to identify whether the issue is related to Firefox policy configuration, Windows account registration, or Microsoft Entra authentication.

1. Verify Firefox Windows SSO Policy

If Windows SSO is deployed through Microsoft Intune, first confirm that the policy has been successfully applied to the affected device.

Open Firefox and enter the following address:

about:policies

Under the Active tab, verify that the WindowsSSO policy is listed and does not report any errors.

You can also check the Windows Registry at:

HKLM\SOFTWARE\Policies\Mozilla\Firefox

Look for the WindowsSSO policy value.

If the policy is missing:

• Check whether the Intune configuration profile is assigned to the affected device or user.
• Review the deployment status in the Intune admin center.
• Initiate a manual policy sync from the affected Windows device.
• Restart Firefox after the policy is successfully applied.

2. Verify Windows Account Configuration

Firefox Windows SSO uses credentials stored in Windows to authenticate users to supported Microsoft, work, and school accounts.

To verify whether the required account is available:

1. Open Windows Settings.
2. Navigate to Accounts > Your Accounts.
3. Locate the Accounts used by other apps section.
4. Confirm that the expected Microsoft or work account is listed.

If the account is missing, verify that the user has added the appropriate work or school account to Windows.

After correcting the account configuration, restart Firefox and test the sign-in again.

3. Verify Primary Refresh Token (PRT) Status

For Microsoft Entra ID-based authentication, a valid Primary Refresh Token (PRT) is an important part of the Windows SSO process.

If the user is experiencing repeated authentication prompts, check the PRT status on the affected device.

Open Command Prompt in the affected user’s sign-in session and run:

dsregcmd /status

Under the SSO State section, locate:

AzureAdPrt : YES

If the value is YES, Windows has a Primary Refresh Token available for the user.

If the value is NO, investigate the Windows sign-in and Microsoft Entra device registration state before troubleshooting Firefox further.

Pay particular attention to the following sections in the command output:

• Device State: Check the device’s Microsoft Entra join status.
• User State: Review the user’s registration information.
• SSO State: Verify the Primary Refresh Token status.

If the PRT is unavailable, review the device registration, user authentication, and network connectivity.

4. Verify Firefox Windows SSO Preference

You can also check whether Firefox has the Windows SSO setting enabled.

Open Firefox and navigate to:

about:config

Search for the following preference:

network.http.windows-sso.enabled

The expected value is:

true

If the value is false, review the Firefox enterprise policy configuration and check about:policies to determine whether the setting is being controlled by an administrator.

If the setting is managed through Intune or Group Policy, correct the policy at its source rather than attempting to change the preference manually.

5. Test Authentication in a Normal Firefox Window

After verifying the Windows account and Firefox policy configuration, test authentication again.

• Close all Firefox windows.
• Reopen Firefox in a normal browsing window.
• Navigate to a supported Microsoft sign-in page, such as Outlook on the web.
• Check whether the user can authenticate using the existing Windows account without manually entering credentials.

Note: Windows SSO using the PRT-based browser authentication flow is not supported in Firefox Private Browsing sessions. Always test using a normal browsing window.

If the user is still prompted for credentials, check whether the target application supports the Windows SSO authentication flow and whether additional authentication requirements, such as MFA or Conditional Access, require user interaction.

Quick Troubleshooting Checklist

Before escalating the issue, verify the following:

• Firefox Windows SSO policy is successfully applied.
• WindowsSSO is listed under about:policies.
• The expected work or school account is available in Windows.
• AzureAdPrt shows YES for Microsoft Entra-based authentication.
• Firefox preference network.http.windows-sso.enabled is set to true.
• Authentication is tested in a normal Firefox browsing window.
• The target application supports the expected Windows SSO authentication flow.

If all these checks are successful but authentication still fails, investigate the target application’s authentication configuration and Microsoft Entra sign-in requirements.

Conclusion

Firefox Windows SSO helps simplify authentication for users accessing supported Microsoft, work, and school applications. By using existing Windows sign-in credentials, it can reduce repeated credential prompts and provide a smoother browsing experience in managed enterprise environments.

Administrators can enable the feature manually or deploy it centrally using Microsoft Intune and Firefox enterprise policies. With the appropriate configuration, organizations can extend their existing authentication setup to Firefox while maintaining a consistent sign-in experience across supported browsers.

Frequently Asked Questions (FAQs)

Related Posts

• How to Allow Copilot in Microsoft Edge Using Intune
• Configure Microsoft Edge Sleeping Tabs using Microsoft Intune
• Manage Microsoft Edge Favorites with Intune for Windows 10/11
• Enabling Azure Single Sign-On in Google Chrome with Intune

Official Documentation and References

• Mozilla Firefox WindowsSSO Policy Reference
• Mozilla Firefox ADMX OMA-URI Reference
• Microsoft Entra Seamless SSO Documentation