Skip to main content

Managing the Firefox v153 device apps and services prompt

  • Updated

This article explains that starting with Firefox version 153, users must grant the Device apps and services permission once per device to allow the Beyond Identity Authenticator to communicate securely for seamless sign-ins.

This Article Applies To:

  • Devices running the Beyond Identity Authenticator
  • Users running Firefox version 153 (or later) on Windows, macOS and Linux, including Firefox ESR 153 (or later)
  • Users accessing the Beyond Identity Secure Work console

Overview

Starting with the release of Firefox version 153 on July 21, 2026, Firefox enables Local Network Access (LNA) restrictions by default for all Firefox desktop users. Firefox now asks for permission before a public website can connect to apps or services running on your computer, or to devices on your local network.

Unlike Chrome, Firefox splits this into two separate permissions:

  • Device apps and services – access to your own computer and the applications installed on it (localhost). This is the only permission Beyond Identity needs.
  • Local network devices – access to other hardware on your network, such as printers, routers or media servers. Beyond Identity never requests this permission.

When authenticating with Beyond Identity, Firefox will prompt you to grant permission for the sign-in page (app.byndid.com, or app-eu.byndid.com for EU tenants) to securely communicate with the Beyond Identity Authenticator on your device. This approval is required only once per device to ensure seamless sign-in going forward. Make sure you check Remember my choice for this site and click "Allow" at the prompt.

Firefox Browser Example: Device apps and services prompt

The prompt appears directly below the address bar:

Firefox prompt: app.byndid.com wants to access other apps and services on this device, with Remember my choice for this site checkbox and Block / Allow buttons

When the prompt appears:

  1. Check Remember my choice for this site.
  2. Click Allow.

Note: If you click Allow without checking Remember my choice for this site, Firefox grants access for the current visit only, and you will see the prompt again the next time you sign in. Checking the box saves the decision permanently for app.byndid.com.

Beyond Identity does not attempt to connect to other devices on your local network; communication is limited to the device where the Beyond Identity Authenticator is installed.

See Mozilla’s documentation: Control personal device and local network permissions in Firefox

Why is this happening?

When you sign in to Secure Workforce via the web, the Beyond Identity sign-in page needs to talk to the Beyond Identity Authenticator app running locally on your device.

As part of a new security measure, Firefox requires explicit user approval before a website can connect to a local service. The first time you sign in after upgrading to Firefox 153, you may see this one-time permission request. This is the same browser security change that Chrome introduced in version 141 (see Managing the Chrome v141 local network access prompt); Firefox simply presents it with different wording.

Key Takeaways

  • Privacy-Focused: This prompt is only for Beyond Identity authentication. Beyond Identity does not connect to or read information from other devices on your network, and will never trigger the separate Local network devices prompt.
  • One-Time Prompt: With Remember my choice for this site checked, you will only need to click Allow once per device. After approval, Firefox remembers your choice.
  • Desktop only: The prompt appears in Firefox for Windows, macOS and Linux. Firefox for iOS and Firefox for Android are not affected at the time of writing.

Important admin information

  • Admins should promptly notify their Beyond Identity users to accept the Device apps and services prompt that will appear from Firefox, and to check Remember my choice for this site before clicking Allow. It's important to communicate this change as soon as possible, as blocking the prompt will degrade their user experience and could potentially lead to failed authentications.
  • Admins should also provide instructions on how to re-enable the permission if a user has already blocked it (see the FAQ below).

Additional guidance from Mozilla

Mozilla provides the LocalNetworkAccess enterprise policy to give admins control over Local Network Access. Its SkipDomains setting exempts trusted domains from LNA checks entirely, so managed Firefox installations never show the prompt for the Beyond Identity sign-in pages. The policy is supported in Firefox 145 and later and in Firefox ESR 153 and later, so every Firefox release that shows the prompt also supports the policy.

Beyond Identity recommends that admins pre-configure managed Firefox installations to suppress this prompt for their users.

What you will need to configure

  • Exception list: LocalNetworkAccess > SkipDomains
    Add the requesting page origin(s), app.byndid.com and app-eu.byndid.com, so they may call localhost without a prompt.

    Note: You list the site making the request (the Beyond Identity sign-in page), not the local endpoint. Do not add localhost or 127.0.0.1 to the list, because that would exempt every website from the check.

  • Keep protections on: LocalNetworkAccess > Enabled = true
    Leaves LNA enforced for all other websites. Do not set Enabled to false to work around the prompt, as this disables the protection browser-wide.

Option 1 - Configure Firefox using policies.json (Windows, macOS, Linux)

This is the simplest method and works on every desktop platform, managed or unmanaged. Place a policies.json file in the distribution folder of the Firefox installation directory:

  • Windows: C:\Program Files\Mozilla Firefox\distribution\policies.json
  • macOS: /Applications/Firefox.app/Contents/Resources/distribution/policies.json
  • Linux: /etc/firefox/policies/policies.json (or <install dir>/distribution/policies.json)
{
  "policies": {
    "LocalNetworkAccess": {
      "Enabled": true,
      "SkipDomains": [
        "app.byndid.com",
        "app-eu.byndid.com"
      ]
    }
  }
}

Option 2 - Configure Firefox using MDM or Group Policy

You can use your Mobile Device Management (MDM) solution or Windows Group Policy to deploy the LocalNetworkAccess policy on managed devices. This prevents users from ever seeing the prompt. The configuration varies slightly by operating system.

Windows (via Group Policy)

  1. Install the latest Firefox ADMX policy templates.
  2. In the Group Policy editor, go to Computer Configuration > Policies > Administrative Templates > Mozilla > Firefox > Local Network Access.
  3. Enable Skip Domains and add app.byndid.com and app-eu.byndid.com to the list.
  4. Leave Enabled set to Enabled (or not configured).

The resulting registry values are:

HKLM\SOFTWARE\Policies\Mozilla\Firefox\LocalNetworkAccess\Enabled = 0x1 (DWORD)
HKLM\SOFTWARE\Policies\Mozilla\Firefox\LocalNetworkAccess\SkipDomains\1 = "app.byndid.com" (REG_SZ)
HKLM\SOFTWARE\Policies\Mozilla\Firefox\LocalNetworkAccess\SkipDomains\2 = "app-eu.byndid.com" (REG_SZ)

Windows (via Intune)

Firefox policies are deployed in Intune through ADMX ingestion. If you have not already done so, ingest the Firefox ADMX templates (firefox.admx and mozilla.admx) as described in Mozilla’s Managing Firefox with Intune guide. Then:

  1. In the Intune console, create a custom device configuration profile:
    • Navigate to: Devices > Configuration > Create profile
      1. Platform: Windows 10 and later
      2. Profile type: Templates
      3. Template name: Custom
  2. Add an OMA-URI row:
    • OMA-URI: ./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~LocalNetworkAccess/LocalNetworkAccess_SkipDomains
    • Data type: String
    • Value:
    <enabled/>
<data id="LocalNetworkAccess_SkipDomains" value="1&#xF000;app.byndid.com&#xF000;2&#xF000;app-eu.byndid.com"/>
  3. Assign the profile to the desired groups and proceed to test.

Note: &#xF000; is the Unicode separator Intune requires between list entries. Alternatively, you can deploy the policies.json file from Option 1 with a Win32 app or PowerShell script.

macOS

For macOS devices managed by an MDM, you'll deploy a configuration profile (.mobileconfig) with a custom payload for Firefox. The payload should contain the following keys and values in the org.mozilla.firefox preference domain.

Here is an example .plist snippet:

<key>EnterprisePoliciesEnabled</key>
<true/>
<key>LocalNetworkAccess</key>
<dict>
    <key>Enabled</key>
    <true/>
    <key>SkipDomains</key>
    <array>
        <string>app.byndid.com</string>
        <string>app-eu.byndid.com</string>
    </array>
</dict>

Note: EnterprisePoliciesEnabled must be true for Firefox on macOS to read any policy from the configuration profile. If you already deploy other Firefox policies, add only the LocalNetworkAccess key to your existing payload.

See Mozilla’s reference to learn more about the LocalNetworkAccess policy - link

Testing

  1. Open Firefox on a device where the policy has been assigned.
  2. Enter about:policies in the address bar and verify the policy has been applied to the browser.
    • Look for LocalNetworkAccess under Active and verify that app.byndid.com and app-eu.byndid.com are listed in SkipDomains. If the policy shows under Errors, check the syntax of your configuration.
  3. Sign in with Beyond Identity. No Device apps and services prompt should appear.

Frequently Asked Questions

Q: How many times will I see this prompt?

A: If you check Remember my choice for this site and click "Allow", you will only need to do it once per device. If you click "Allow" without checking the box, the permission applies to the current visit only, and Firefox will ask again next time.

Q: Will I also see the "Local network devices" prompt?

A: No. Beyond Identity only communicates with the Authenticator on your own device, so only the Device apps and services permission is requested.

Q: What if I'm on a mobile device?

A: At the time of writing, Mozilla has enabled Local Network Access restrictions in Firefox for desktop (Windows, macOS, Linux) only. Firefox for iOS uses Apple’s WebKit engine and does not show this prompt. If Mozilla extends the feature to Firefox for Android, the same guidance applies: check Remember my choice for this site and tap Allow.

Q: What if I use a Private Window?

A: Firefox does not remember permissions granted in a Private Window. You will be asked each time you sign in from a Private Window. Use a regular window to save the decision permanently.

Q: What if a user accidentally clicks "Block"?

A: If a user blocked the permission, sign-in will fail until it is reset. There are two ways to re-enable it.

Method 1 - From the address bar (recommended)

  1. While on the Beyond Identity sign-in page (app.byndid.com), click the permissions icon on the left side of the address bar, next to the shield icon.
  2. In the Permissions for app.byndid.com panel, find Access this device, which shows Blocked.
  3. Click the X next to it to clear the blocked permission.
  4. Reload the page. When the prompt appears again, check Remember my choice for this site and click Allow.

Method 2 - From Firefox Settings

  1. Open the Firefox menu (≡) and select Settings.
  2. Select Permissions and data on the left. (In some Firefox versions this section is under Privacy & Security > Permissions.)
  3. Under Permissions, click Device apps and services.

    Firefox Settings - Permissions and data, showing the Device apps and services and Local network devices entries
  4. Find https://app.byndid.com (or https://app-eu.byndid.com) in the list and change its Status from Block to Allow.
  5. Make sure Block new requests to access to apps and services on this device is unchecked. If it is checked, Firefox silently blocks every site that is not already on the list, and the prompt never appears.
  6. Click Save changes.

    Settings - Device apps and services dialog with https://app.byndid.com set to Allow
  7. Reload the Beyond Identity sign-in page. Beyond Identity authentication should now work correctly.

Q: Can I turn the check off completely in Firefox?

A: Advanced users can disable Local Network Access checks in about:config (network.lna.enabled), but Beyond Identity does not recommend this. Allowing only app.byndid.com, either at the prompt or through the SkipDomains policy, keeps the protection in place for all other websites.

Additional resources

Comments

0 comments

Please sign in to leave a comment.