I think it's just that some of the device policy restrictions the Org admin can choose to enable don't work in FF. So if they require them, no FF.