1891682 - Create a telemetry indicator for windows clients running inside managed enterprise environments

Status: NEW

(Firefox :: Shell Integration, enhancement, P3)

Description

[Romain Testard [:RT]]

As a product manager, I want to understand if the windows desktop is run inside an enterprise environment so that I can quantify use of Firefox inside managed enterprise set-ups.

Quantifying such clients will help us prioritize enterprise set-ups with more confidence.

Talking to David these may be path to investigate in order to identify enterprise flags (existing command line arguments or registry keys) that we could use:

• Enterprise SKU
• Domain joined
• SCCM / Intune managed
• Logged in with AD or AAD user

Acceptance criteria:

• A telemetry flag helping identify clients as running inside managed enterprise environments with a fair level of confidence

Comment 1

[Mike Kaply [:mkaply]]

I already do some basic is_enterprise stuff, we would want to add this to the existing checks.

I've looked in the past at doing some of this (domain joined), but it seemed complicated to discover this.

Comment 2

[Robin Steuber (she/her) [:bytesized]]

A point of consideration here is the expected quality of the data. I say this because (a) it's not clear how good of an indicator these metrics are for what we are ultimately trying to measure, and (b) it's very common for enterprises to turn off telemetry.

Given that, it's not entirely clear to me that this telemetry would be useful enough to justify the effort.

Comment 3

[Mike Kaply [:mkaply]]

So I have other ideas about what we could do with this information besides just telemetry and it would be useful

So anything we can do to be sure that someone is an enterprise user would be helpful long term

Comment 4

[[e-mail]]

To determine SKU, you can check this value:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\EditionID
The following should cover it on Win10 and Win11: Enterprise, Education, Pro Education, Enterprise N, Education N, and Pro Education N

To determine if domain joined you can check for the existence of this registry value:
HKLM\SYSTEM\CurrentControlSet\Services\Netlogon\Parameters\JoinDomain
If it exists, the device is domain joined

I'm less sure about how to reliably detect SCCM and Intune... my instinct says you can just get a list of all installed apps and see if they're in there?

I think you can "decode" an active directory or azure active directory user from the SID, and distinguish from a MSA. But I'm not sure of the exact heuristic. There may be APIs for this as well.

Comment 5

[Romain Testard [:RT]]

Thanks all, super useful.
Rather than adding to 'is_enterprise', how about having separate flags for the SKU or JoinDomain in the same way as we currently have OS and OS_version?
This would also potentially help us make better sense of Microsoft roll-outs since they may happen at different time for different SKUs and impact these users on different schedules. We can always use is_enterprise, windows_sku or is_domain_joined as separate flags which will give us higher confidence - In the back-end a master indicator leveraging these 3 signals can also be created which should give us more flexibility if we find odd things in practice?
I wonder if we should restrict this bug for creation of sku and domain joined flags since they feel actionable already.

Proposal:

• Windows SKU:
  ----New telemetry probe under system environment collects the value of HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\EditionID
  ----String type
• Domain joined
  ----New telemetry probe under system environment checks if HKLM\SYSTEM\CurrentControlSet\Services\Netlogon\Parameters\JoinDomain exists
  ----Boolean type

Comment 6

[Mike Kaply [:mkaply]]

What would we do with this data given that we know that a lot of enterprises turn off telemetry?

Comment 7

[Romain Testard [:RT]]

It is intended to identify this traffic in our own telemetry to help segment our audience:

• This will help make sense of large movements when we see large increases or decreases of DAU that are not explained
• Enterprises often generate large counts of new profiles that are short lived, this makes our retention measurements hard to understand for consumers and being capable of segmentation here would help gain confidence in our retention measurements

Comment 8

[Romain Testard [:RT]]

https://blogs.windows.com/windows-insider/2025/08/29/releasing-windows-11-version-25h2-to-the-release-preview-channel/ mentions: *We consider a device a commercial device if it is not running the Windows 11 Home edition AND is being managed by an IT administrator (whether via Microsoft Endpoint Manager or other management solution) or has a volume license key or commercial ID or is joined to a domain.