I recommend using Firefox's GPOs anyways: Not just to ensure users can't override disabling DoH, but also to turn off arbitrary extension install (a major malwa

I recommend using Firefox's GPOs anyways: Not just to ensure users can't override disabling DoH, but also to turn off arbitrary extension install (a major malware vector) and other protocols designed to circumvent security inspection like QUIC. If you operate any network security appliances of any kind, browsers are basically built-by-default now to circumvent them, so you need to be configuring them heavily via group policy. Firefox, Chrome, and Edge all offer ADMX templates to add support for their policies pretty much drop-in to Active Directory.